@fungi.computer/oyster 0.7.0 → 0.8.0

package/dist/build/candidate-cli.mjs

@@ -19523,6 +19523,11 @@ var appBackendBindingKinds = {
         requires: ["workflow.run", "workflow.arm"],
         effect: "write"
       },
+      resumeSchedule: {
+        cap: "app.workflow.run",
+        requires: ["workflow.run", "workflow.arm"],
+        effect: "write"
+      },
       schedules: {
         cap: "app.workflow.read",
         requires: ["workflow.run"],
@@ -19675,6 +19680,11 @@ var appBackendBindingKinds = {
         requires: ["agent.manage"],
         effect: "write"
       },
+      resumeSchedule: {
+        cap: "agent.manage",
+        requires: ["agent.manage"],
+        effect: "write"
+      },
       deleteSchedule: {
         cap: "agent.manage",
         requires: ["agent.manage"],
@@ -22372,7 +22382,7 @@ var symbols = {
   // Oyster: the open shell that holds the Apps' pearl.
   oyster: (0, import_jsx_runtime4.jsxs)(import_jsx_runtime4.Fragment, { children: [(0, import_jsx_runtime4.jsx)("path", { fill: grape, d: "M35.5 6C33.7 6.3 32.3 7.6 31.4 9.4 30.9 10.3 30.4 10.3 29.5 10 25.5 9 20.6 11.6 19.6 15.9 19.4 16.6 19 17 18 17.1 14.5 17.6 12 20.6 12.1 24.2 12.2 25.4 12 25.9 11.5 26.5 7.5 30 10.5 34.5 17.5 34.4 15.3 32.6 16 31 19 29 26 24 37 19.5 43.5 19 46 19 46 22 43 25.5 46.5 23.5 51.5 18.5 53.5 15 55 11 50 7 45 9 43.8 9.4 43.3 9.2 42.5 8 40.7 6.3 38 5.6 35.5 6Z" }), (0, import_jsx_runtime4.jsx)("circle", { fill: cream, cx: "34.9", cy: "41.9", r: "11.3" }), (0, import_jsx_runtime4.jsxs)("g", { fill: ink, children: [(0, import_jsx_runtime4.jsx)("rect", { x: "29.9", y: "33.2", width: "3.2", height: "5.6", rx: "1.6" }), (0, import_jsx_runtime4.jsx)("rect", { x: "36.7", y: "33.2", width: "3.2", height: "5.6", rx: "1.6" })] }), (0, import_jsx_runtime4.jsx)("path", { fill: grape, d: "M49.5 39C47.9 39.3 46.5 40 46.1 41.6 45.8 43.2 45.5 43.5 44 43.5 38.5 43.5 35 48 39 49.5 40 50 39.5 50.5 38 51 35.5 52.5 32.5 52 30 51 29 50.5 28.5 50 29.5 50 33 47.5 30 43.5 24.5 43.5 23.3 43.5 22.9 43.3 22.5 43 20.5 40.5 19 40 17.5 39.5 13 39.5 13 44 17 47.5 18.3 48.4 18.6 48.7 19 49.5 20.5 53 23 55 26 55 26.8 55 27 55.3 27.5 56 31 58.5 36.5 58.5 40 56 40.8 55.2 41.2 55 42 55 45 55 47.5 53 49 49.5 49.6 48.5 50 48 50.5 47.5 56 43.5 55 38.5 49.5 39Z" }), (0, import_jsx_runtime4.jsx)("path", { fill: "none", stroke: yellow, strokeWidth: "3", strokeLinecap: "round", d: "M46.6 31.8 49.2 27.8 M49.4 35.5 52.8 33.7 M21.5 32.5 22.9 33.5 M19.3 37.5 21.1 38.1" })] }),
   // Tourtois: the desktop shell, a tortoise carrying window panes.
-  tourtois: (0, import_jsx_runtime4.jsxs)(import_jsx_runtime4.Fragment, { children: [(0, import_jsx_runtime4.jsx)("rect", { fill: cream, x: "11.07", y: "35.73", width: "26.8", height: "9.7", rx: "3.25", transform: "rotate(-5 24.47 40.58)" }), (0, import_jsx_runtime4.jsx)("path", { fill: yellow, d: "M14.8 16C19 14.6 23 13.5 26.5 12.6 28.4 12.1 29.6 13.4 30.1 15.3L31.6 21 17.4 37.6C13.8 38.2 10.6 37.8 10.1 35.4L9.2 27.8C9.1 26.1 10.1 24.7 11.6 24.1 11.4 22.4 11.4 20.6 11.8 19.1 12.3 17.4 13.3 16.5 14.8 16Z" }), (0, import_jsx_runtime4.jsx)("path", { fill: coral, d: "M14.0 24.1Q13.3 21.2 16.2 20.4L30.7 16.2Q33.6 15.4 34.6 18.2L36.0 22.7Q37.0 25.5 34.7 27.4L20.2 39.7Q17.9 41.6 17.2 38.7Z" }), (0, import_jsx_runtime4.jsx)("path", { fill: blue, d: "M21 23.4 35.5 20.6C37.3 20.2 38.6 21 38.9 22.6L40 34.5C40.1 36.2 39.1 37.3 37.5 37.7 32.6 39.9 26 41 21 41 16 41 12.2 40.2 11 38.8 10.4 37.6 10.8 36.4 12.4 37L19.6 38.4 18.4 27C18.2 25.2 19.3 23.7 21 23.4Z" }), (0, import_jsx_runtime4.jsx)("path", { fill: cream, d: "M22.8 29.6 34.8 26.9C36.2 26.6 37 27.3 37.2 28.6L37.9 33C38.1 34.2 37.5 35 36.3 35.3L24.3 37.8C23 38.1 22.3 37.5 22.1 36.3L21.3 31.6C21.1 30.6 21.7 29.8 22.8 29.6Z" }), (0, import_jsx_runtime4.jsxs)("g", { fill: cream, children: [(0, import_jsx_runtime4.jsx)("circle", { cx: "14.7", cy: "18.45", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "17.6", cy: "17.65", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "20.5", cy: "16.85", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "17.9", cy: "22.2", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "21", cy: "21.5", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "24.1", cy: "20.75", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "28.2", cy: "25.3", r: "1" })] }), (0, import_jsx_runtime4.jsx)("circle", { fill: coral, cx: "21.7", cy: "26.6", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { fill: yellow, cx: "24.9", cy: "25.9", r: "1.05" }), (0, import_jsx_runtime4.jsxs)("g", { fill: mint, children: [(0, import_jsx_runtime4.jsx)("ellipse", { cx: "8.8", cy: "36.6", rx: "3.6", ry: "1.9", transform: "rotate(22 8.8 36.6)" }), (0, import_jsx_runtime4.jsx)("path", { d: "M12 41C10 41.5 7.5 44.5 7 46.5 7 48 8.5 49.5 10.5 50 12.5 50.5 13.5 50 15 48 15.5 47 16.5 47.5 19 50 22 49.5 22 46.5 22 45.5 20.5 45.5 17 45 16.5 44.5 16.5 44 16.5 42 13.5 40.5 12 41Z" }), (0, import_jsx_runtime4.jsx)("path", { d: "M40 33C39 38 36 42 34.5 41.5 32.5 40.5 29.5 42 28.5 44 26 49 27.5 51.5 32.5 51 36 51 37 50 36 46.5 36 45 37 44.5 38 44.5 38.5 45.5 40.5 49 43.5 50 46.5 47.5 47.5 46.5 46 43.5 44 42 43 41.5 43.5 40.5 44.5 39.5 46 38 47 37.5L47 33Z" })] }), (0, import_jsx_runtime4.jsx)("ellipse", { fill: mint, cx: "46.4", cy: "30.6", rx: "8.1", ry: "8.3" }), (0, import_jsx_runtime4.jsxs)("g", { fill: ink, children: [(0, import_jsx_runtime4.jsx)("rect", { x: "45.05", y: "26.95", width: "2.25", height: "4.6", rx: "1.1", transform: "rotate(-6 46.2 29.3)" }), (0, import_jsx_runtime4.jsx)("rect", { x: "49.25", y: "26.4", width: "2.25", height: "4.6", rx: "1.1", transform: "rotate(-6 50.4 28.7)" })] }), (0, import_jsx_runtime4.jsx)("path", { fill: coral, d: "M46.8 32.2H51C51 34.3 50 35.4 48.9 35.4S46.8 34.3 46.8 32.2Z", transform: "rotate(-8 48.9 33.5)" }), (0, import_jsx_runtime4.jsx)("path", { fill: "none", stroke: yellow, strokeWidth: "3", strokeLinecap: "round", d: "M50.9 17.7 50.5 19.7 M55.2 20.1 53.4 21.9 M56.5 24.5 55.7 24.7" })] }),
+  tourtois: (0, import_jsx_runtime4.jsxs)(import_jsx_runtime4.Fragment, { children: [(0, import_jsx_runtime4.jsx)("rect", { fill: cream, x: "11.07", y: "35.73", width: "26.8", height: "9.7", rx: "3.25", transform: "rotate(-5 24.47 40.58)" }), (0, import_jsx_runtime4.jsx)("path", { fill: yellow, d: "M14.8 16C19 14.6 23 13.5 26.5 12.6 28.4 12.1 29.6 13.4 30.1 15.3L31.6 21 17.4 37.6C13.8 38.2 10.6 37.8 10.1 35.4L9.2 27.8C9.1 26.1 10.1 24.7 11.6 24.1 11.4 22.4 11.4 20.6 11.8 19.1 12.3 17.4 13.3 16.5 14.8 16Z" }), (0, import_jsx_runtime4.jsx)("path", { fill: coral, d: "M14.0 24.1Q13.3 21.2 16.2 20.4L30.7 16.2Q33.6 15.4 34.6 18.2L36.0 22.7Q37.0 25.5 34.7 27.4L20.2 39.7Q17.9 41.6 17.2 38.7Z" }), (0, import_jsx_runtime4.jsx)("path", { fill: blue, d: "M21 23.4 35.5 20.6C37.3 20.2 38.6 21 38.9 22.6L40 34.5C40.1 36.2 39.1 37.3 37.5 37.7 32.6 39.9 26 41 21 41 16 41 12.2 40.2 11 38.8 10.4 37.6 10.8 36.4 12.4 37L19.6 38.4 18.4 27C18.2 25.2 19.3 23.7 21 23.4Z" }), (0, import_jsx_runtime4.jsx)("path", { fill: cream, d: "M22.8 29.6 34.8 26.9C36.2 26.6 37 27.3 37.2 28.6L37.9 33C38.1 34.2 37.5 35 36.3 35.3L24.3 37.8C23 38.1 22.3 37.5 22.1 36.3L21.3 31.6C21.1 30.6 21.7 29.8 22.8 29.6Z" }), (0, import_jsx_runtime4.jsxs)("g", { fill: cream, children: [(0, import_jsx_runtime4.jsx)("circle", { cx: "14.7", cy: "18.45", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "17.6", cy: "17.65", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "20.5", cy: "16.85", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "17.9", cy: "22.2", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "21", cy: "21.5", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "24.1", cy: "20.75", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { cx: "28.2", cy: "25.3", r: "1" })] }), (0, import_jsx_runtime4.jsx)("circle", { fill: coral, cx: "21.7", cy: "26.6", r: "1" }), (0, import_jsx_runtime4.jsx)("circle", { fill: yellow, cx: "24.9", cy: "25.9", r: "1.05" }), (0, import_jsx_runtime4.jsxs)("g", { fill: mint, children: [(0, import_jsx_runtime4.jsx)("ellipse", { cx: "8.8", cy: "36.6", rx: "3.6", ry: "1.9", transform: "rotate(22 8.8 36.6)" }), (0, import_jsx_runtime4.jsx)("path", { d: "M12 41C10 41.5 7.5 44.5 7 46.5 7 48 8.5 49.5 10.5 50 12.5 50.5 13.5 50 15 48 15.5 47 16.5 47.5 19 50 22 49.5 22 46.5 22 45.5 20.5 45.5 17 45 16.5 44.5 16.5 44 16.5 42 13.5 40.5L12 41Z" }), (0, import_jsx_runtime4.jsx)("path", { d: "M40 33C39 38 36 42 34.5 41.5 32.5 40.5 29.5 42 28.5 44 26 49 27.5 51.5 32.5 51 36 51 37 50 36 46.5 36 45 37 44.5 38 44.5 38.5 45.5 40.5 49 43.5 50 46.5 47.5 47.5 46.5 46 43.5 44 42 43 41.5 43.5 40.5 44.5 39.5 46 38 47 37.5L47 33Z" })] }), (0, import_jsx_runtime4.jsx)("ellipse", { fill: mint, cx: "46.4", cy: "30.6", rx: "8.1", ry: "8.3" }), (0, import_jsx_runtime4.jsxs)("g", { fill: ink, children: [(0, import_jsx_runtime4.jsx)("rect", { x: "45.05", y: "26.95", width: "2.25", height: "4.6", rx: "1.1", transform: "rotate(-6 46.2 29.3)" }), (0, import_jsx_runtime4.jsx)("rect", { x: "49.25", y: "26.4", width: "2.25", height: "4.6", rx: "1.1", transform: "rotate(-6 50.4 28.7)" })] }), (0, import_jsx_runtime4.jsx)("path", { fill: coral, d: "M46.8 32.2H51C51 34.3 50 35.4 48.9 35.4S46.8 34.3 46.8 32.2Z", transform: "rotate(-8 48.9 33.5)" }), (0, import_jsx_runtime4.jsx)("path", { fill: "none", stroke: yellow, strokeWidth: "3", strokeLinecap: "round", d: "M50.9 17.7 50.5 19.7 M55.2 20.1 53.4 21.9 M56.5 24.5 55.7 24.7" })] }),
   // The launcher's "All Apps": four App tiles, no install arrow.
   allApps: (0, import_jsx_runtime4.jsxs)(import_jsx_runtime4.Fragment, { children: [(0, import_jsx_runtime4.jsx)("rect", { fill: coral, x: "7", y: "7.25", width: "23.2", height: "22.7", rx: "4.6", transform: "rotate(-6.2 18.6 18.6)" }), (0, import_jsx_runtime4.jsx)("rect", { fill: blue, x: "33.9", y: "7.25", width: "23.2", height: "22.7", rx: "4.6", transform: "rotate(6.2 45.5 18.6)" }), (0, import_jsx_runtime4.jsx)("rect", { fill: mint, x: "7", y: "34.15", width: "23.2", height: "22.7", rx: "4.6", transform: "rotate(6.2 18.6 45.5)" }), (0, import_jsx_runtime4.jsx)("rect", { fill: yellow, x: "33.9", y: "34.15", width: "23.2", height: "22.7", rx: "4.6", transform: "rotate(-6.2 45.5 45.5)" })] }),
   // Search: a magnifying glass.

package/dist/build/local-build.d.ts

@@ -40,7 +40,13 @@ export declare function createFirstPartyAppSourceDistribution(options: {
     readonly source: CapturedSource;
     readonly entry: string;
 }): Effect.Effect<FirstPartyAppSourceDistribution, unknown>;
-/** How one build executor is composed; never part of a recipe or request. */
+/**
+ * How one build executor is composed; never part of a recipe or request.
+ * Build-log stdout/stderr are interleaved in arrival order and unlabelled.
+ * The job log is credential-bearing by design; it must never flow to
+ * diagnostics, Releases, agent surfaces, or support bundles without a
+ * recorded decision.
+ */
 export type LocalBuildExecutorOptions = Readonly<{
     packageStoreDirectory?: string;
     /** Host-hydrated metadata; supplied only for a cache-only pnpm install. */

package/dist/host.js

@@ -127,8 +127,8 @@ function methodResponse(reply) {
  * designated install authority.
  */
 async function admitInstallation(host, installationId, release, principal, intent, origin, requestId = installationCommandIds.request.generate()) {
-    // App-mediated installation needs installFree/designated-marketplace
-    // authority. A member's owner role is not that delegated App authority.
+    // App-mediated installation has no owner-confirmation flow here, so refuse
+    // it. A member's owner role is not delegated App install authority.
     if (origin !== "owner-direct" && origin !== "workflow")
         return refusal(403, "install_authority_unavailable");
     if (!oysterPrincipalIsOwner(principal))
@@ -869,7 +869,7 @@ export function oysterRouteTable(host) {
         // desktop chrome belongs to the shell.
         return new Response(config.workbench
             ? `${head}<style>html,body,#oyster-shell{margin:0;height:100%}body{font-family:var(--font-sans)}</style><div id="oyster-shell"></div>${tail}`
-            : `${head}<style>html,body{margin:0;height:100%}iframe{border:0;width:100%;height:100%;display:block}</style><iframe id="oyster-app" sandbox="${appSandbox}" src="${escapeHtml(config.uiUrl)}" title="${escapeHtml(installation.installationId)}"></iframe>${tail}`, {
+            : `${head}<style>html,body{margin:0;height:100%}iframe{border:0;width:100%;height:100%;display:block}</style><iframe id="oyster-app" sandbox="${appSandbox}" allowfullscreen src="${escapeHtml(config.uiUrl)}" title="${escapeHtml(installation.installationId)}"></iframe>${tail}`, {
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",

package/dist/installation-execution.js

@@ -33,6 +33,10 @@ export async function executeInstallation(host, input) {
         !("role" in principal) ||
         principal.role !== "owner")
         return refused(403, "install_authority_unavailable");
+    // A Workflow can publish a build and update an approved installation, but
+    // creating an installation always needs the owner's direct confirmation.
+    if (command.admission.origin !== "owner-direct" && command.baseline === null)
+        return refused(409, "needs_consent");
     if ((await host.installations.generation()) !== command.generation)
         return refused(409, "stale_authority");
     let verified;