@geminixiang/mikan 1.0.0-beta.32 → 1.0.0-beta.34

package/dist/agent.js

@@ -2,21 +2,23 @@
  * Agent runner: prompt construction, path translation, run lifecycle, and createRunner.
  * Single module — do not split helpers that only this file uses.
  */
+import { officeDirName } from "./office-address.js";
 import { DEFAULT_EVENT_BUDGET, formatSkillsForPrompt, loadExtensions, loadSkillsFromDir, MikanAgentSession, MikanModels, parseCommandInput, } from "./harness/index.js";
 import { runSubagent } from "./harness/subagent-runner.js";
 import { loadSubagentProfiles } from "./harness/subagent-profiles.js";
 import { mergeSubagentProgress, parseSubagentProgressSnapshot, renderSubagentDashboard, settleSubagentProgress, } from "./subagent-progress.js";
 import { createHash } from "crypto";
-import { existsSync } from "fs";
+import { existsSync, lstatSync, readdirSync } from "fs";
 import { chmod, mkdtemp, mkdir, readFile, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
 import { basename, isAbsolute, join, posix, relative, resolve, sep } from "path";
 import { resolveConversationSettings } from "./config.js";
+import { resolveWorkspaceProjection } from "./workspace-projection/index.js";
 import { effectiveStateDir } from "./cli/arg-grammar.js";
 import { packageSkillRuntimeDir, resolveConversationPackages } from "./packages/index.js";
 import { ActorExecutionResolver } from "./execution-resolver.js";
 import * as log from "./log.js";
-import { createExecutor, getUnresolvedSandboxPathContext, } from "./sandbox/index.js";
+import { assertSandboxSupportsWorkspacePolicy, createExecutor, getUnresolvedSandboxPathContext, } from "./sandbox/index.js";
 import { addLifecycleBreadcrumb, metricAttributes, reportUserFacingError, updateActiveSpanAttribution, } from "./observability/sentry.js";
 import { ChatHistorySync } from "./sessions/chat-history-sync.js";
 import { formatHistoryLine } from "./sessions/history-line.js";
@@ -149,11 +151,10 @@ export async function buildPromptPayload(message, workspacePath, pathContext, re
     }
     return { userMessage, imageAttachments };
 }
-async function getMemory(conversationDir) {
+async function getMemory(projection) {
     const parts = [];
-    // Read workspace-level memory (shared across all conversations)
-    const workspaceMemoryPath = join(conversationDir, "..", "MEMORY.md");
-    if (existsSync(workspaceMemoryPath)) {
+    const workspaceMemoryPath = projection.promptSources.globalMemoryPath;
+    if (workspaceMemoryPath && isRegularFile(workspaceMemoryPath)) {
         try {
             const content = (await readFile(workspaceMemoryPath, "utf-8")).trim();
             if (content) {
@@ -164,9 +165,8 @@ async function getMemory(conversationDir) {
             log.logWarning("Failed to read workspace memory", `${workspaceMemoryPath}: ${error}`);
         }
     }
-    // Read conversation-specific memory
-    const conversationMemoryPath = join(conversationDir, "MEMORY.md");
-    if (existsSync(conversationMemoryPath)) {
+    const conversationMemoryPath = projection.promptSources.conversationMemoryPath;
+    if (isRegularFile(conversationMemoryPath)) {
         try {
             const content = (await readFile(conversationMemoryPath, "utf-8")).trim();
             if (content) {
@@ -182,7 +182,16 @@ async function getMemory(conversationDir) {
     }
     return parts.join("\n\n");
 }
-function loadMikanSkills(conversationDir, workspacePath) {
+function isRegularFile(path) {
+    try {
+        const stats = lstatSync(path);
+        return stats.isFile() && !stats.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function loadMikanSkills(address, conversationDir, workspacePath, projection) {
     const skillMap = new Map();
     // conversationDir is the host path (e.g., /Users/.../data/C0A34FL8PMH)
     // hostWorkspacePath is the parent directory on host
@@ -206,7 +215,7 @@ function loadMikanSkills(conversationDir, workspacePath) {
     // skill ships alongside its SKILL.md, which inlining could never carry.
     const mounted = workspacePath !== hostWorkspacePath;
     for (const { slug, dir } of resolveConversationPackages({
-        conversationId: basename(conversationDir),
+        address,
         stateDir: effectiveStateDir(),
         conversationDir,
     }).skillDirs) {
@@ -221,26 +230,70 @@ function loadMikanSkills(conversationDir, workspacePath) {
             skillMap.set(skill.name, skill);
         }
     }
-    // Load workspace-level skills (global)
-    const workspaceSkillsDir = join(hostWorkspacePath, "skills");
-    for (const skill of loadSkillsFromDir({ dir: workspaceSkillsDir, source: "workspace" }).skills) {
-        // Translate paths to container paths for system prompt
-        skill.filePath = translatePath(skill.filePath);
-        skill.baseDir = translatePath(skill.baseDir);
-        skillMap.set(skill.name, skill);
+    // Load workspace-level skills only when the office projection authorizes it.
+    const workspaceSkillsDir = projection.promptSources.globalSkillsDir;
+    if (workspaceSkillsDir) {
+        for (const skill of loadSkillsFromDir({ dir: workspaceSkillsDir, source: "workspace" })
+            .skills) {
+            skill.filePath = translatePath(skill.filePath);
+            skill.baseDir = translatePath(skill.baseDir);
+            skillMap.set(skill.name, skill);
+        }
     }
-    // Load conversation-specific skills (override workspace skills on collision)
-    const conversationSkillsDir = join(conversationDir, "skills");
-    for (const skill of loadSkillsFromDir({ dir: conversationSkillsDir, source: "channel" }).skills) {
-        skill.filePath = translatePath(skill.filePath);
-        skill.baseDir = translatePath(skill.baseDir);
-        skillMap.set(skill.name, skill);
+    // Load conversation-specific skills (override workspace skills on collision).
+    // Host prompt construction must never follow an agent-created symlink out of
+    // the conversation office.
+    const conversationSkillsDir = projection.promptSources.conversationSkillsDir;
+    if (isSafePromptSkillTree(conversationSkillsDir, projection.promptSources.conversationDir)) {
+        for (const skill of loadSkillsFromDir({ dir: conversationSkillsDir, source: "channel" })
+            .skills) {
+            skill.filePath = translatePath(skill.filePath);
+            skill.baseDir = translatePath(skill.baseDir);
+            skillMap.set(skill.name, skill);
+        }
+    }
+    else if (existsSync(conversationSkillsDir)) {
+        log.logWarning("Ignoring unsafe conversation skill tree", conversationSkillsDir);
     }
     return Array.from(skillMap.values());
 }
-function buildRuntimePaths(runtimeWorkspaceRoot, conversationId) {
+export function isSafePromptSkillTree(dir, conversationDir) {
+    if (!existsSync(dir))
+        return true;
+    if (dir !== conversationDir && !dir.startsWith(`${conversationDir}${sep}`))
+        return false;
+    const stack = [dir];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        let stats;
+        try {
+            stats = lstatSync(current);
+        }
+        catch {
+            return false;
+        }
+        if (stats.isSymbolicLink())
+            return false;
+        if (!stats.isDirectory())
+            continue;
+        let entries;
+        try {
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            return false;
+        }
+        for (const entry of entries) {
+            if (entry.isSymbolicLink())
+                return false;
+            stack.push(join(current, entry.name));
+        }
+    }
+    return true;
+}
+function buildRuntimePaths(runtimeWorkspaceRoot, address) {
     const workspaceRoot = runtimeWorkspaceRoot.replace(/\/+$/, "") || "/";
-    const conversationPath = posix.join(workspaceRoot, conversationId);
+    const conversationPath = posix.join(workspaceRoot, officeDirName(address));
     return {
         workspaceRoot,
         conversationPath,
@@ -291,8 +344,8 @@ export function resolveTriggerAttribution(message) {
         return `@${message.userName}`;
     return undefined;
 }
-function buildSystemPrompt(workspacePath, conversationId, conversationKind, currentUserId, memory, sandboxConfig, platform, skills) {
-    const { workspaceRoot, conversationPath, scratchPath } = buildRuntimePaths(workspacePath, conversationId);
+function buildSystemPrompt(workspacePath, address, conversationKind, currentUserId, memory, sandboxConfig, platform, skills, projection) {
+    const { workspaceRoot, conversationPath, scratchPath } = buildRuntimePaths(workspacePath, address);
     const sandboxType = sandboxConfig.type;
     const isContainerLike = sandboxType === "container" || sandboxType === "image";
     const isFirecracker = sandboxType === "firecracker";
@@ -310,6 +363,20 @@ function buildSystemPrompt(workspacePath, conversationId, conversationKind, curr
     // system prompt stays byte-stable across a conversation's turns and keeps the
     // provider prompt cache warm (a changing system prefix invalidates the cache
     // for the whole request, including the far larger conversation history).
+    const workspaceLayout = projection.layout === "full"
+        ? `${workspaceRoot}/ contains the complete trusted workspace.`
+        : projection.layout === "shared-support"
+            ? `${workspaceRoot}/ contains shared MEMORY.md, skills/, events/, and this conversation's directory.`
+            : `${conversationPath}/ is the only conversation workspace mounted; global memory, skills, and events are not available.`;
+    const skillStorageGuidance = projection.doorPolicy === "trusted"
+        ? `Store shared skills in \`${workspaceRoot}/skills/<name>/\` or conversation-specific skills in \`${conversationPath}/skills/<name>/\`.`
+        : `Store skills in \`${conversationPath}/skills/<name>/\`; this office cannot access workspace-global skills.`;
+    const memoryGuidance = projection.doorPolicy === "trusted"
+        ? `Write important shared knowledge to \`${workspaceRoot}/MEMORY.md\` and conversation-specific knowledge to \`${conversationPath}/MEMORY.md\`.`
+        : `Write durable knowledge only to \`${conversationPath}/MEMORY.md\`; this office cannot access workspace-global memory.`;
+    const systemLogPath = projection.layout === "conversation"
+        ? `${conversationPath}/SYSTEM.md`
+        : `${workspaceRoot}/SYSTEM.md`;
     const slackBlockKitInstructions = platform.name === "slack"
         ? `
 ## Slack Rendering
@@ -344,10 +411,13 @@ ${envDescription}
 - Do not use host-only paths unless you are running in host mode and verified they exist.
 
 ## Workspace Layout
-${workspaceRoot}/
+${workspaceLayout}
+${projection.layout === "conversation"
+        ? `${conversationPath}/           # This conversation`
+        : `${workspaceRoot}/
 ├── MEMORY.md                    # Global memory (all conversations)
 ├── skills/                      # Global CLI tools you create
-└── ${conversationId}/           # This conversation
+└── ${officeDirName(address)}/           # This conversation`}
     ├── MEMORY.md                # Conversation-specific memory
     ├── log.jsonl                # Human-readable message history (no tool results)
     ├── sessions/                # Structured session history used for context reconstruction
@@ -362,7 +432,7 @@ ${workspaceRoot}/
 You can create reusable CLI tools for recurring tasks (email, APIs, data processing, etc.).
 
 ### Creating Skills
-Store in \`${workspaceRoot}/skills/<name>/\` (global) or \`${conversationPath}/skills/<name>/\` (conversation-specific).
+${skillStorageGuidance}
 Each skill directory needs a \`SKILL.md\` with YAML frontmatter:
 
 \`\`\`markdown
@@ -394,16 +464,14 @@ When events trigger, messages are prefixed like \`[EVENT:filename:type:time]\`.
 For periodic events where there's nothing to report, respond with exactly \`[SILENT]\`. Debounce external triggers; prefer one summarized event over many.
 
 ## Memory
-Write to MEMORY.md files to persist context across conversations.
-- Global (${workspaceRoot}/MEMORY.md): skills, preferences, project info
-- Conversation (${conversationPath}/MEMORY.md): conversation-specific decisions, ongoing work
-Update when you learn something important or when asked to remember something.
+${memoryGuidance}
+Update it when you learn something important or when asked to remember something.
 
 ### Current Memory
 ${memory}
 
 ## System Configuration Log
-Maintain ${workspaceRoot}/SYSTEM.md to log all environment modifications:
+Maintain ${systemLogPath} to log all environment modifications:
 - Installed packages (apt install, npm install, uv pip install)
 - Environment variables set
 - Config files modified (~/.gitconfig, cron jobs, etc.)
@@ -920,7 +988,7 @@ function buildExtensionHostServices(params) {
     };
 }
 async function createConfiguredAgentSession(params) {
-    const { conversationId, workspaceDir, systemPrompt, model, thinkingLevel, tools, sessionStore, models, vaultManager, platformNotifier, platformReactor, platformUploader, platformBlockKit, } = params;
+    const { address, conversationId, conversationDir, workspaceDir, systemPrompt, model, thinkingLevel, tools, sessionStore, models, vaultManager, platformNotifier, platformReactor, platformUploader, platformBlockKit, } = params;
     // Host-only dirs under the state dir: extension code runs in the mikan
     // process, so it must never load from workspace paths — those are mounted
     // into sandbox containers and agent-writable (sandbox escape otherwise).
@@ -937,9 +1005,9 @@ async function createConfiguredAgentSession(params) {
     // they always agree on which profiles are launchable.
     let runnableSubagentProfiles = loadedProfiles.profiles;
     const resolvedPackages = resolveConversationPackages({
-        conversationId,
+        address,
         stateDir: effectiveStateDir(),
-        conversationDir: join(workspaceDir, conversationId),
+        conversationDir,
     });
     for (const error of resolvedPackages.errors) {
         log.logWarning(`Package unavailable: ${error.source}`, error.message);
@@ -947,7 +1015,7 @@ async function createConfiguredAgentSession(params) {
     const extensionsResult = await loadExtensions({
         dirs: resolvedPackages.extensionDirs,
         roots: resolvedPackages.extensionRoots,
-        context: { conversationId, workspaceDir, model, thinkingLevel },
+        context: { address, conversationId, workspaceDir, model, thinkingLevel },
         services: buildExtensionHostServices({
             workspaceDir,
             vaultManager,
@@ -1032,18 +1100,18 @@ async function prepareRunContext(params) {
     await mkdir(join(conversationDir, "scratch"), { recursive: true });
     if (executionResolver) {
         await resolveExecutorForRun({
-            platform: platform.name,
+            address: message.address,
             userId: message.userId,
-            conversationId,
             trustModel: platform.trustModel,
         });
         pathContext = getPathContext();
     }
     reloadSessionMessages(session, conversationId);
-    const memory = await getMemory(conversationDir);
-    const skills = mergeExtensionSkills(loadMikanSkills(conversationDir, pathContext.runtimeWorkspaceRoot), params.extensionSkills ?? []);
+    const projection = resolveWorkspaceProjection(join(conversationDir, ".."), message.address);
+    const memory = await getMemory(projection);
+    const skills = mergeExtensionSkills(loadMikanSkills(message.address, conversationDir, pathContext.runtimeWorkspaceRoot, projection), params.extensionSkills ?? []);
     const triggerAttribution = resolveTriggerAttribution(message);
-    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, conversationId, message.conversationKind, message.userId, memory, executor.getSandboxConfig(), platform, skills);
+    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, message.address, message.conversationKind, message.userId, memory, executor.getSandboxConfig(), platform, skills, projection);
     session.agent.state.systemPrompt = systemPrompt;
     // Cache diagnosis: a byte-stable system prompt is the precondition for
     // provider prompt caching. If this hash changes between turns of one
@@ -1459,8 +1527,10 @@ function attachSessionEventHandlers(params) {
  */
 export async function createRunner(options) {
     const { sandboxConfig, sessionKey, conversationId, conversationDir, workspaceDir, sessionScope, vaultManager, provisioner, resourceController, sessionView, platformNotifier, platformReactor, platformUploader, platformBlockKit, platformToolPackFactories, } = options;
-    const agentConfig = resolveConversationSettings(conversationDir);
+    const agentConfig = resolveConversationSettings({ address: options.address, conversationDir });
     const workspaceBase = join(conversationDir, "..");
+    const projection = resolveWorkspaceProjection(workspaceBase, options.address);
+    assertSandboxSupportsWorkspacePolicy(sandboxConfig, projection.doorPolicy);
     const { executionResolver, executor, getPathContext, resolveExecutorForRun } = createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, workspaceDir, workspaceBase);
     let pathContext = getUnresolvedSandboxPathContext(sandboxConfig, workspaceBase);
     const modelRegistry = options.models ?? MikanModels.create();
@@ -1474,8 +1544,8 @@ export async function createRunner(options) {
         getApiKey: () => modelRegistry.getApiKeyForProvider(model.provider),
     });
     // Initial system prompt (will be updated each run with fresh memory/channels/users/skills)
-    const memory = await getMemory(conversationDir);
-    const skills = loadMikanSkills(conversationDir, pathContext.runtimeWorkspaceRoot);
+    const memory = await getMemory(projection);
+    const skills = loadMikanSkills(options.address, conversationDir, pathContext.runtimeWorkspaceRoot, projection);
     const emptyPlatform = {
         name: "chat",
         formattingGuide: "",
@@ -1483,7 +1553,7 @@ export async function createRunner(options) {
         users: [],
         trustModel: "membership",
     };
-    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, conversationId, "shared", undefined, memory, sandboxConfig, emptyPlatform, skills);
+    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, options.address, "shared", undefined, memory, sandboxConfig, emptyPlatform, skills, projection);
     // Create session manager and settings manager. Top-level/private sessions
     // use the conversation's current pointer; scoped sessions use fixed files.
     // Platform-specific scope behavior is resolved before runner creation.
@@ -1497,7 +1567,9 @@ export async function createRunner(options) {
     const sessionUuid = extractSessionUuid(contextFile);
     const chatSessionManager = new ChatHistorySync();
     const { session, extensionSkills, extensionRegistry, disposeExtensions } = await createConfiguredAgentSession({
+        address: options.address,
         conversationId,
+        conversationDir,
         workspaceDir,
         systemPrompt,
         model,
@@ -1671,7 +1743,7 @@ export async function createRunner(options) {
             });
             pathContext = prepared.pathContext;
             try {
-                const conversationMemoryPath = posix.join(prepared.pathContext.runtimeWorkspaceRoot, conversationId, "MEMORY.md");
+                const conversationMemoryPath = posix.join(prepared.pathContext.runtimeWorkspaceRoot, officeDirName(message.address), "MEMORY.md");
                 const dreamTools = sessionDreamTools(session.agent.state.tools, conversationMemoryPath);
                 const outcome = await session.prompt(sessionDreamPrompt(conversationMemoryPath, dreamTools.map((tool) => tool.name)), {
                     origin: {