@dynamicagents/plugins 0.13.0 → 0.15.0

package/dist/computer/sandbox.js

@@ -0,0 +1,236 @@
+import { RUN_DIR } from "../sandbox/constants.js";
+import { sandboxNameFromRuntime } from "../sandbox/name.js";
+import { routedWorkspace } from "./proxy.js";
+/** After `timeout`'s TERM, how long before its KILL. */
+const KILL_AFTER_S = 5;
+/** `timeout`'s exits for a command it ended: TERM taken, or KILL after it was not. */
+const TIMED_OUT = new Set([124, 137]);
+/**
+ * A command's processes carry a marker, for `kill` to find them by — through
+ * the launch and after it, since `exec` keeps it in every command line.
+ * `timeout` ends the command where it runs at its limit, which a Worker-side
+ * signal cannot.
+ */
+const MARKER = "da-exec-";
+const CANCELLED = `${RUN_DIR}/cancelled`;
+/**
+ * The launch and `kill` are a handshake, because a command can still be on its
+ * way in — starting the container — when it is cancelled: `kill` marks the
+ * command cancelled before it signals, and the launch checks the mark before
+ * it starts. Either the command never starts, or it is running when `kill`
+ * signals it.
+ */
+const LAUNCH = [
+    `[ -e "${CANCELLED}/$0" ] && exit 130`,
+    `exec timeout --kill-after=${KILL_AFTER_S} "$2" sh -c "$1" "$0"`
+].join("\n");
+/** The marker arrives in two halves, so this script's own command line is not one `pkill` matches. */
+const CANCEL = [
+    'm="$1$2"',
+    `mkdir -p ${CANCELLED} && : > "${CANCELLED}/$m"`,
+    'pkill -TERM -f "$m"',
+    "exit 0"
+].join("\n");
+/** What one `find` or `grep` returns at most, with no `limit` of its own. */
+const MAX_FOUND = 10_000;
+export function computerWorkspace(config, runtime) {
+    const host = (name) => config.binding.getByName(name);
+    return routedWorkspace({
+        name: () => sandboxNameFromRuntime(runtime?.()) ?? config.sandboxName(),
+        open: async (name) => sandboxClient(host(name)),
+        advisories: (name) => host(name).advisories()
+    }, config.cwd ?? "/workspace");
+}
+function missing(path) {
+    return Object.assign(new Error(`ENOENT: no such file or directory, ${path}`), { code: "ENOENT" });
+}
+/** The computer tools' client over one sandbox. */
+export function sandboxClient(host) {
+    const readFile = async (path, encoding) => {
+        const bytes = await host.readFile(path);
+        if (bytes === null)
+            throw missing(path);
+        return encoding === "utf8"
+            ? new TextDecoder().decode(bytes)
+            : new Blob([bytes]).stream();
+    };
+    const fs = {
+        readFile: readFile,
+        async stat(path) {
+            const stat = await host.stat(path);
+            if (!stat)
+                throw missing(path);
+            return {
+                size: stat.size,
+                mtime: stat.modifiedAt,
+                isFile: stat.type === "file",
+                isDirectory: stat.type === "directory",
+                isSymbolicLink: stat.type === "symlink"
+            };
+        },
+        async readdir(path, options = {}) {
+            const from = options.offset ?? 0;
+            return (await host.readDir(path))
+                .slice(from, options.limit === undefined ? undefined : from + options.limit)
+                .map((entry) => ({
+                name: entry.name,
+                isFile: entry.type === "file",
+                isDirectory: entry.type === "directory"
+            }));
+        },
+        find: (directory, pattern, options = {}) => find(host, directory, pattern, options),
+        grep: (pattern, path, options = {}) => grep(host, pattern, path, options),
+        writeFile: (path, content) => host.writeFile(path, content),
+        mkdir: (path) => host.mkdir(path),
+        rm: (path, options = {}) => host.rm(path, options.recursive ? { recursive: true } : {})
+    };
+    return {
+        fs,
+        runtime: {
+            async exec(command, options) {
+                const id = crypto.randomUUID();
+                const marker = `${MARKER}${id}`;
+                const startedAt = Date.now();
+                let killed = false;
+                const running = host.exec([
+                    "sh",
+                    "-c",
+                    LAUNCH,
+                    marker,
+                    command,
+                    // At least a second: `timeout 0` is no limit at all.
+                    String(Math.max(1, Math.ceil(options.timeoutMs / 1000)))
+                ], {
+                    cwd: options.cwd,
+                    ...(options.env ? { env: options.env } : {}),
+                    timeoutMs: options.timeoutMs + (KILL_AFTER_S + 5) * 1000
+                });
+                running.catch(() => undefined);
+                return {
+                    async result() {
+                        const result = await running;
+                        const timedOut = TIMED_OUT.has(result.exitCode) &&
+                            Date.now() - startedAt >= options.timeoutMs;
+                        return {
+                            ...result,
+                            status: killed || timedOut
+                                ? "cancelled"
+                                : "completed"
+                        };
+                    },
+                    async kill() {
+                        killed = true;
+                        await host.exec(["sh", "-c", CANCEL, "da-cancel", MARKER, id]);
+                    },
+                    [Symbol.dispose]() { }
+                };
+            }
+        },
+        [Symbol.dispose]() { }
+    };
+}
+/**
+ * `rg` over `target`, from where its globs anchor: a directory's own, with
+ * `include` applied, or a file's parent. The script prints that directory
+ * first, then `rg`'s output cut at `lines`, so a search of a whole checkout
+ * returns what the tool can show rather than everything.
+ */
+const RG_SCRIPT = [
+    't="$1"; include="$2"; lines="$3"; shift 3',
+    '[ -e "$t" ] || { echo "ENOENT" >&2; exit 2; }',
+    'if [ -d "$t" ]; then cd "$t" || exit 2; a=.',
+    '  if [ -n "$include" ]; then set -- -g "/$include" "$@"; fi',
+    'else cd "$(dirname "$t")" || exit 2; a="./$(basename "$t")"; fi',
+    "pwd",
+    'rg "$@" -- "$a" < /dev/null | head -n "$lines"'
+].join("\n");
+async function rg(host, target, include, args, lines) {
+    const run = await host.exec([
+        "sh",
+        "-c",
+        RG_SCRIPT,
+        "rg",
+        target,
+        (include ?? "").replace(/^\/+/, ""),
+        String(lines),
+        ...args
+    ]);
+    if (run.exitCode === 2 && /ENOENT/.test(run.stderr))
+        throw missing(target);
+    const [cwd = target, ...out] = run.stdout.split("\n");
+    if (out.every((line) => line === "") && run.stderr.trim() !== "")
+        throw new Error(run.stderr.trim());
+    return { cwd, out: out.filter(Boolean) };
+}
+function absolute(cwd, printed) {
+    const rest = printed.replace(/^\.\//, "");
+    return cwd === "/" ? `/${rest}` : `${cwd}/${rest}`;
+}
+/** Hidden and ignored files too, as the old walk read them; `exclude` pruned. */
+function scope(exclude) {
+    return [
+        "--hidden",
+        "--no-ignore",
+        "--sort",
+        "path",
+        ...(exclude ?? []).flatMap((glob) => ["-g", `!${glob}`])
+    ];
+}
+async function find(host, directory, pattern, options) {
+    const from = options.offset ?? 0;
+    const take = options.limit ?? MAX_FOUND;
+    const { cwd, out } = await rg(host, directory, pattern, ["--files", ...scope(options.exclude)], Math.min(from + take, MAX_FOUND));
+    // Files only: `rg --files` lists no directories.
+    return out
+        .slice(from, from + take)
+        .map((path) => ({ path: absolute(cwd, path), type: "file" }));
+}
+async function grep(host, pattern, path, options) {
+    const around = options.context ?? 0;
+    const from = options.offset ?? 0;
+    const take = options.limit ?? MAX_FOUND;
+    const { cwd, out } = await rg(host, path, options.include, [
+        "--json",
+        ...scope(options.exclude),
+        ...(options.regex ? [] : ["--fixed-strings"]),
+        ...(options.ignoreCase ? ["--ignore-case"] : []),
+        ...(around > 0 ? ["--context", String(around)] : []),
+        "-e",
+        pattern
+    ], 
+    // Enough for every match it can return to arrive whole: each brings at
+    // most its context, and opens and closes a file.
+    (from + take) * (2 * around + 3) + 16);
+    // Per file, every line rg printed, so each match takes its context from them.
+    const files = new Map();
+    const order = [];
+    for (const raw of out) {
+        let entry;
+        try {
+            entry = JSON.parse(raw);
+        }
+        catch {
+            continue;
+        }
+        if (entry.type !== "match" && entry.type !== "context")
+            continue;
+        const file = absolute(cwd, entry.data?.path?.text ?? "");
+        const line = entry.data?.line_number ?? 0;
+        const text = (entry.data?.lines?.text ?? "").replace(/\r?\n$/, "");
+        const lines = files.get(file) ?? [];
+        lines.push({ line, text, isMatch: entry.type === "match" });
+        files.set(file, lines);
+        if (entry.type === "match")
+            order.push({ file, line, text });
+    }
+    return order.slice(from, from + take).map(({ file, line, text }) => ({
+        path: file,
+        line,
+        text,
+        ...(around > 0
+            ? {
+                context: (files.get(file) ?? []).filter((other) => Math.abs(other.line - line) <= around)
+            }
+            : {})
+    }));
+}

package/dist/computer/shell.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Run a command under {@link file://./index.ts ComputerToolsConfig.shell} with its
+ * two output streams merged into one transcript, in the order they were
+ * written, or hand it back untouched when no shell is configured.
+ *
+ * `bash`'s consumer is **a model reading output**. A project's check is a chain
+ * — `wrangler types && prettier && eslint && tsc` — and *which tool spoke last*
+ * is how you know which one failed. A stdout block and a separate stderr block
+ * destroy that ordering, and a model that wants it back re-runs the whole gate
+ * as `npm run check > /tmp/out 2>&1; cat /tmp/out`. This is that workaround,
+ * done once, for free.
+ *
+ * One quoted argument, not string concatenation: the command is model-authored
+ * and routinely contains quotes of its own (`git commit -m "…"`), so anything
+ * less than `shellQuote` re-parses the model's quoting and mangles it. The
+ * redirect binds to the wrapper process, so it applies to everything the
+ * command writes however deeply nested.
+ *
+ * ## Why `-o pipefail`
+ *
+ * Without it a pipeline's exit status is its **last** stage's, so
+ * `npm run check | tail -100` reports `exit 0` for a gate that failed outright —
+ * and models pipe into `tail` constantly. A tool that reports success for a
+ * failed build is worse than one that reports nothing.
+ *
+ * The trade is worth stating. `pipefail` surfaces SIGPIPE too, so
+ * `ls big-dir | head -1` reports 141 rather than 0 — noisy, but *visible*. The
+ * tool description tells the model not to pipe into `head`/`tail` at all, since
+ * output is already truncated with both ends kept. It needs a shell that
+ * implements it — `bash`, `zsh`, `ksh`, not `sh`/dash.
+ *
+ * With no shell configured the two streams arrive separate, and
+ * {@link file://./render.ts renderResult} renders them as a labelled
+ * `--- stderr ---` block.
+ */
+export declare function withShellTranscript(command: string, shell: string | undefined): string;

package/dist/computer/shell.js

@@ -0,0 +1,41 @@
+import { shellQuote } from "../sandbox/agent-exec.js";
+/**
+ * Run a command under {@link file://./index.ts ComputerToolsConfig.shell} with its
+ * two output streams merged into one transcript, in the order they were
+ * written, or hand it back untouched when no shell is configured.
+ *
+ * `bash`'s consumer is **a model reading output**. A project's check is a chain
+ * — `wrangler types && prettier && eslint && tsc` — and *which tool spoke last*
+ * is how you know which one failed. A stdout block and a separate stderr block
+ * destroy that ordering, and a model that wants it back re-runs the whole gate
+ * as `npm run check > /tmp/out 2>&1; cat /tmp/out`. This is that workaround,
+ * done once, for free.
+ *
+ * One quoted argument, not string concatenation: the command is model-authored
+ * and routinely contains quotes of its own (`git commit -m "…"`), so anything
+ * less than `shellQuote` re-parses the model's quoting and mangles it. The
+ * redirect binds to the wrapper process, so it applies to everything the
+ * command writes however deeply nested.
+ *
+ * ## Why `-o pipefail`
+ *
+ * Without it a pipeline's exit status is its **last** stage's, so
+ * `npm run check | tail -100` reports `exit 0` for a gate that failed outright —
+ * and models pipe into `tail` constantly. A tool that reports success for a
+ * failed build is worse than one that reports nothing.
+ *
+ * The trade is worth stating. `pipefail` surfaces SIGPIPE too, so
+ * `ls big-dir | head -1` reports 141 rather than 0 — noisy, but *visible*. The
+ * tool description tells the model not to pipe into `head`/`tail` at all, since
+ * output is already truncated with both ends kept. It needs a shell that
+ * implements it — `bash`, `zsh`, `ksh`, not `sh`/dash.
+ *
+ * With no shell configured the two streams arrive separate, and
+ * {@link file://./render.ts renderResult} renders them as a labelled
+ * `--- stderr ---` block.
+ */
+export function withShellTranscript(command, shell) {
+    return shell
+        ? `${shell} -o pipefail -c ${shellQuote(command)} 2>&1`
+        : command;
+}

package/dist/computer/tools-exec.js

@@ -54,8 +54,7 @@ import { tool } from "ai";
 import { z } from "zod";
 import { withAbort } from "@dynamicagents/core";
 import { renderResult } from "./render.js";
-import { execLostNote } from "./gate.js";
-import { withShellTranscript } from "../workspace/shell.js";
+import { withShellTranscript } from "./shell.js";
 /** Running one command in the container. */
 /**
  * Wait for a disposable resource without outliving `signal`.
@@ -96,7 +95,7 @@ export function execTools(ctx) {
              *
              * Two of these sentences are only true when a shell is configured, so the
              * description says whichever is. `withShellTranscript` is a no-op without
-             * {@link file://./index.ts ComputerConfig.shell}: no `2>&1`, so the
+             * {@link file://./index.ts ComputerToolsConfig.shell}: no `2>&1`, so the
              * streams arrive separate and {@link renderResult} labels them; no
              * `-o pipefail`, so `/bin/sh` reports a pipeline's *last* stage. Promising
              * a transcript and first-failure semantics there would be the lie
@@ -246,21 +245,16 @@ export function execTools(ctx) {
                 catch (err) {
                     if (abortSignal?.aborted)
                         return note(stopped(gateMsWaited, started));
-                    const lost = execLostNote(err);
                     console.warn("[computer] bash failed", {
                         command,
                         gateMs: gateMsWaited,
                         durationMs: Date.now() - startedAtMs - gateMsWaited,
                         timeoutMs,
-                        // Distinguished in the log for the same reason it is distinguished
-                        // for the model: a container replacement and a broken command want
-                        // different people looking at them.
-                        ...(lost ? { lost: true } : {}),
                         err: String(err)
                     });
                     // Returned, not thrown: a failed command is usually the model's to
                     // recover from, and it can only recover from what it is told.
-                    return note(lost ?? `error running command: ${String(err)}`);
+                    return note(`error running command: ${String(err)}`);
                 }
             }
         })

package/dist/computer/tools-file.d.ts

@@ -3,7 +3,7 @@ import type { ComputerContext } from "./context.js";
 /**
  * Editing a file in place — the one file tool this plugin keeps. Think's
  * `read`, `write` and `delete` reach the workspace through the agent's own
- * `this.workspace`, which is `computerWorkspace` (`./proxy.ts`).
+ * `this.workspace`, which is `computerWorkspace` (`./sandbox.ts`).
  *
  * Not Think's `edit`, because that one is two calls through the workspace — a
  * `readFile`, then a `writeFile` — and a lock inside the workspace cannot span

package/dist/computer/tools-file.js

@@ -5,7 +5,7 @@ import { withFileLock } from "./file-lock.js";
 /**
  * Editing a file in place — the one file tool this plugin keeps. Think's
  * `read`, `write` and `delete` reach the workspace through the agent's own
- * `this.workspace`, which is `computerWorkspace` (`./proxy.ts`).
+ * `this.workspace`, which is `computerWorkspace` (`./sandbox.ts`).
  *
  * Not Think's `edit`, because that one is two calls through the workspace — a
  * `readFile`, then a `writeFile` — and a lock inside the workspace cannot span

package/dist/{repo → repo-github}/checkout.d.ts

@@ -76,10 +76,9 @@ export declare function resolveDefaultBranch(plain: GitRunners["plain"], dir: st
  * It is the *nearest* answer, not the only one. `repo_commit` names the identity
  * on the commit itself, which is the one layer a stale config cannot outrank.
  * Underneath, a repository this plugin never cloned falls back to whatever the
- * shell's own git is configured with — which is an identity rather than nothing
- * only where `exec` is backed by `/workspace`, whose object writes one per
- * container; see {@link file://../workspace/git-identity.ts}. `exec` is an arbitrary
- * runner, so that is a property of a deployment, not of this plugin.
+ * shell's own git is configured with, or the environment a deployment gives
+ * its commands. `exec` is an arbitrary runner, so that is a property of a
+ * deployment, not of this plugin.
  *
  * Unchecked, like the config pins at the clone: git's identity is needed by the
  * first commit, and a failure to write it fails that commit with a sentence far

package/dist/{repo → repo-github}/checkout.js

@@ -33,10 +33,9 @@ export async function resolveDefaultBranch(plain, dir) {
  * It is the *nearest* answer, not the only one. `repo_commit` names the identity
  * on the commit itself, which is the one layer a stale config cannot outrank.
  * Underneath, a repository this plugin never cloned falls back to whatever the
- * shell's own git is configured with — which is an identity rather than nothing
- * only where `exec` is backed by `/workspace`, whose object writes one per
- * container; see {@link file://../workspace/git-identity.ts}. `exec` is an arbitrary
- * runner, so that is a property of a deployment, not of this plugin.
+ * shell's own git is configured with, or the environment a deployment gives
+ * its commands. `exec` is an arbitrary runner, so that is a property of a
+ * deployment, not of this plugin.
  *
  * Unchecked, like the config pins at the clone: git's identity is needed by the
  * first commit, and a failure to write it fails that commit with a sentence far

package/dist/{repo → repo-github}/context.d.ts

@@ -1,4 +1,5 @@
 import type { ActionContext } from "@cloudflare/think";
+import { type GithubMcpCall } from "./mcp.js";
 import type { RepoCheckout, RepoConfig, RepoExec, RepoGitResult } from "./index.js";
 /**
  * How many items one GitHub list call asks for. GitHub's maximum, and its default
@@ -11,39 +12,12 @@ import type { RepoCheckout, RepoConfig, RepoExec, RepoGitResult } from "./index.
  * the last page, and those are exactly the ones an agent was sent to act on.
  */
 export declare const GITHUB_PAGE_SIZE = 100;
-/**
- * Where GraphQL lives, given where REST does.
- *
- * On github.com they share an origin and `/graphql` hangs off it. On GitHub
- * Enterprise — which {@link RepoConfig.apiBase} exists for — REST is under
- * `/api/v3` and GraphQL is its **sibling** at `/api/graphql`, not a path beneath
- * it. Appending blindly yields `/api/v3/graphql`, which is a 404 on every
- * Enterprise install and no failure at all on the public API, so the mistake
- * survives every test written against github.com.
- */
-export declare function graphqlEndpoint(apiBase: string): string;
-/**
- * Middle-out truncation, so both the head of a diff and its tail survive.
- *
- * Deliberately a **copy** of `/workspace`'s function of the same name, not an
- * import. `npm run verify:exports` fails any subpath whose module graph
- * reaches a sibling's directory, and its own advice for a shared helper is to
- * duplicate it — installing `repo` must not drag `/workspace` (and therefore
- * `@cloudflare/computer`) into a consumer's bundle. Fifteen lines is a cheaper
- * price than that coupling, and it is the same reason `exec` is injected here
- * rather than imported.
- *
- * The `half < 1` guard is not padding: without it a small `max` makes `half`
- * zero or negative, and `slice(-0)` is `slice(0)` — the whole string — so the
- * function would return *more* than it was given.
- */
-export declare function truncateOutput(text: string, max: number): string;
 /**
  * What one container command produced — plus one bit the container did not.
  *
- * `exec` does not only *return* failures, it throws them: `@cloudflare/computer`
- * throws `EEXEC_LOST` when a container is replaced mid-command, and any call to a
- * Durable Object can fail outright. Both are caught at the seam
+ * `exec` does not only *return* failures, it throws them: any call to a Durable
+ * Object can fail outright, a container lost mid-command among them. That is
+ * caught at the seam
  * ({@link repoContext}'s `run`) and turned into a failed result, so every tool
  * answers in its own `!success` branch — "could not read the status of /w/r: …"
  * is a better sentence than any wrapper one level up could write, and a seventh
@@ -83,6 +57,16 @@ export interface RepoContext {
         };
         unreachable?: string;
     }>;
+    /**
+     * One call to GitHub's hosted MCP server — every read this plugin makes.
+     * See {@link file://./mcp.ts GithubMcpCall}.
+     */
+    mcp: GithubMcpCall;
+    /**
+     * One REST call, for what is left on it: opening a pull request and
+     * commenting. Both are writes, and both are `coding`'s rather than
+     * claude-coordinator's.
+     */
     github: (tool: string, path: string, init?: {
         method: string;
         body: unknown;
@@ -125,8 +109,6 @@ export declare const GITHUB_ACTION_TIMEOUT_MS = 120000;
  * version of that fault.
  */
 export declare function actionTask(ctx: ActionContext): string;
-/** A hex SHA-256, so a key names a body without carrying it. */
-export declare function sha256(text: string): Promise<string>;
 export declare function repoContext(config: RepoConfig, 
 /**
  * The running sub-agent's `runtime()`, read per command. Forwarded to every