@geminixiang/mikan 1.0.0-beta.39 → 1.0.0-beta.40

package/dist/vault/injection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../src/vault/injection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAOnE,MAAM,UAAU,qBAAqB,CAAC,OAMrC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,sCAAsC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;gBAChE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,gBAAgB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW;oBACX,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;iBACzB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GACP,YAAY,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC","sourcesContent":["import { existsSync } from \"fs\";\nimport { reportUserFacingError } from \"../observability/sentry.js\";\nimport type { SandboxConfig, SandboxCredentialCapabilities } from \"../sandbox/types.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport type { ResolvedVault, ResolvedVaultMount, VaultInjection } from \"./types.js\";\n\nexport type { VaultInjection } from \"./types.js\";\n\nexport function resolveVaultInjection(options: {\n  vault: ResolvedVault | undefined;\n  capabilities: SandboxCredentialCapabilities;\n  sandboxType: SandboxConfig[\"type\"];\n  /** Diagnostic identity for error reports only; no injection decision reads it. */\n  address: OfficeAddress;\n}): VaultInjection {\n  const { vault, capabilities, sandboxType, address } = options;\n  if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {\n    throw new Error(`Sandbox type \"${sandboxType}\" does not support vault file mounts`);\n  }\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const mount of vault?.mounts ?? []) {\n    if (!existsSync(mount.source)) {\n      reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n        domain: \"sandbox\",\n        surface: \"vault_injection\",\n        operation: \"resolve_mounts\",\n        severity: \"warning\",\n        context: {\n          sandboxType,\n          conversationId: address.conversationId,\n          target: mount.target,\n          hasVault: Boolean(vault),\n        },\n      });\n      continue;\n    }\n    mounts.push({ source: mount.source, target: mount.target });\n  }\n\n  const env =\n    capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n  return { ...(env ? { env } : {}), mounts };\n}\n"]}

package/dist/vault/policy.d.ts

@@ -1,20 +0,0 @@
-import type { PlatformTrustModel } from "../types.js";
-import type { SandboxConfig } from "../sandbox/index.js";
-/**
- * Decide whether a new conversation vault may inherit `sandbox.defaultSharedVault`.
- *
- * Ambient copy is a membership-trust convenience: only appropriate when the
- * people who can drive the agent are already gated by platform membership
- * (Slack/Discord/Telegram). Open-trigger surfaces (GitHub issue/PR comments)
- * must not inherit ambient credentials — host-side platform identity or an
- * explicitly provisioned vault only.
- *
- * Topology: only isolated sandboxes (`image` / `cloudflare`) auto-provision
- * per-conversation vaults that receive the copy. `host` / `container` /
- * `firecracker` do not use this ambient path.
- */
-export declare function allowsAmbientDefaultSharedVault(options: {
-    trustModel?: PlatformTrustModel;
-    sandboxType: SandboxConfig["type"];
-}): boolean;
-//# sourceMappingURL=policy.d.ts.map

package/dist/vault/policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,OAAO,CAIV"}

package/dist/vault/policy.js

@@ -1,20 +0,0 @@
-/**
- * Decide whether a new conversation vault may inherit `sandbox.defaultSharedVault`.
- *
- * Ambient copy is a membership-trust convenience: only appropriate when the
- * people who can drive the agent are already gated by platform membership
- * (Slack/Discord/Telegram). Open-trigger surfaces (GitHub issue/PR comments)
- * must not inherit ambient credentials — host-side platform identity or an
- * explicitly provisioned vault only.
- *
- * Topology: only isolated sandboxes (`image` / `cloudflare`) auto-provision
- * per-conversation vaults that receive the copy. `host` / `container` /
- * `firecracker` do not use this ambient path.
- */
-export function allowsAmbientDefaultSharedVault(options) {
-    const trustModel = options.trustModel ?? "membership";
-    if (trustModel === "open-trigger")
-        return false;
-    return options.sandboxType === "image" || options.sandboxType === "cloudflare";
-}
-//# sourceMappingURL=policy.js.map

package/dist/vault/policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAG/C;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC;AACjF,CAAC","sourcesContent":["import type { PlatformTrustModel } from \"../types.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\n\n/**\n * Decide whether a new conversation vault may inherit `sandbox.defaultSharedVault`.\n *\n * Ambient copy is a membership-trust convenience: only appropriate when the\n * people who can drive the agent are already gated by platform membership\n * (Slack/Discord/Telegram). Open-trigger surfaces (GitHub issue/PR comments)\n * must not inherit ambient credentials — host-side platform identity or an\n * explicitly provisioned vault only.\n *\n * Topology: only isolated sandboxes (`image` / `cloudflare`) auto-provision\n * per-conversation vaults that receive the copy. `host` / `container` /\n * `firecracker` do not use this ambient path.\n */\nexport function allowsAmbientDefaultSharedVault(options: {\n  trustModel?: PlatformTrustModel;\n  sandboxType: SandboxConfig[\"type\"];\n}): boolean {\n  const trustModel = options.trustModel ?? \"membership\";\n  if (trustModel === \"open-trigger\") return false;\n  return options.sandboxType === \"image\" || options.sandboxType === \"cloudflare\";\n}\n"]}

package/dist/web/agent-events/portal.d.ts

@@ -1,3 +0,0 @@
-import type { IncomingMessage, ServerResponse } from "http";
-export declare function handleAgentEventsRequest(req: IncomingMessage, res: ServerResponse, url: URL): boolean;
-//# sourceMappingURL=portal.d.ts.map

package/dist/web/agent-events/portal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/web/agent-events/portal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAI5D,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAiBT"}

package/dist/web/agent-events/portal.js

@@ -1,19 +0,0 @@
-import { addAgentEventStreamClient } from "../../agent-events.js";
-import { readEnv } from "../../utils/env.js";
-export function handleAgentEventsRequest(req, res, url) {
-    if (req.method !== "GET" || url.pathname !== "/api/agent-events/stream") {
-        return false;
-    }
-    const expectedToken = readEnv("AGENT_EVENTS_TOKEN");
-    const auth = req.headers.authorization ?? "";
-    const queryToken = url.searchParams.get("token") ?? "";
-    if (expectedToken && auth !== `Bearer ${expectedToken}` && queryToken !== expectedToken) {
-        res.writeHead(401, { "Content-Type": "text/plain; charset=utf-8" });
-        res.end("unauthorized");
-        return true;
-    }
-    const cleanup = addAgentEventStreamClient(res);
-    req.on("close", cleanup);
-    return true;
-}
-//# sourceMappingURL=portal.js.map

package/dist/web/agent-events/portal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"portal.js","sourceRoot":"","sources":["../../../src/web/agent-events/portal.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,GAAmB,EACnB,GAAQ;IAER,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,0BAA0B,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,aAAa,IAAI,IAAI,KAAK,UAAU,aAAa,EAAE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC/C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { addAgentEventStreamClient } from \"../../agent-events.js\";\nimport { readEnv } from \"../../utils/env.js\";\n\nexport function handleAgentEventsRequest(\n  req: IncomingMessage,\n  res: ServerResponse,\n  url: URL,\n): boolean {\n  if (req.method !== \"GET\" || url.pathname !== \"/api/agent-events/stream\") {\n    return false;\n  }\n\n  const expectedToken = readEnv(\"AGENT_EVENTS_TOKEN\");\n  const auth = req.headers.authorization ?? \"\";\n  const queryToken = url.searchParams.get(\"token\") ?? \"\";\n  if (expectedToken && auth !== `Bearer ${expectedToken}` && queryToken !== expectedToken) {\n    res.writeHead(401, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n    res.end(\"unauthorized\");\n    return true;\n  }\n\n  const cleanup = addAgentEventStreamClient(res);\n  req.on(\"close\", cleanup);\n  return true;\n}\n"]}

package/dist/web/request.d.ts

@@ -1,3 +0,0 @@
-import type { IncomingMessage } from "http";
-export declare function requestBaseUrl(req: IncomingMessage): string;
-//# sourceMappingURL=request.d.ts.map

package/dist/web/request.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/web/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAG5C,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAW3D"}

package/dist/web/request.js

@@ -1,13 +0,0 @@
-import { resolveLinkBaseUrl } from "../config.js";
-export function requestBaseUrl(req) {
-    const configured = resolveLinkBaseUrl();
-    if (configured)
-        return configured;
-    const protoRaw = req.headers["x-forwarded-proto"]?.split(",")[0]?.trim();
-    const proto = protoRaw || "http";
-    const host = req.headers["x-forwarded-host"]?.split(",")[0]?.trim() ||
-        req.headers.host ||
-        "localhost";
-    return `${proto}://${host}`;
-}
-//# sourceMappingURL=request.js.map

package/dist/web/request.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/web/request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,UAAU,cAAc,CAAC,GAAoB;IACjD,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,QAAQ,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,IAAI,MAAM,CAAC;IACjC,MAAM,IAAI,GACP,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAwB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QAC9E,GAAG,CAAC,OAAO,CAAC,IAAI;QAChB,WAAW,CAAC;IACd,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import type { IncomingMessage } from \"http\";\nimport { resolveLinkBaseUrl } from \"../config.js\";\n\nexport function requestBaseUrl(req: IncomingMessage): string {\n  const configured = resolveLinkBaseUrl();\n  if (configured) return configured;\n\n  const protoRaw = (req.headers[\"x-forwarded-proto\"] as string | undefined)?.split(\",\")[0]?.trim();\n  const proto = protoRaw || \"http\";\n  const host =\n    (req.headers[\"x-forwarded-host\"] as string | undefined)?.split(\",\")[0]?.trim() ||\n    req.headers.host ||\n    \"localhost\";\n  return `${proto}://${host}`;\n}\n"]}

package/dist/web/session-view/command.d.ts

@@ -1,4 +0,0 @@
-export type { ParsedSessionViewCommand } from "./types.js";
-import type { ParsedSessionViewCommand } from "./types.js";
-export declare function parseSessionViewCommand(text: string): ParsedSessionViewCommand | null;
-//# sourceMappingURL=command.d.ts.map

package/dist/web/session-view/command.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../src/web/session-view/command.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAM3D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,GAAG,IAAI,CAGrF"}

package/dist/web/session-view/command.js

@@ -1,10 +0,0 @@
-import { commandForms } from "../../commands/manifest.js";
-import { matchCommand } from "../../commands/parse.js";
-// `session` is the only bare command (manifest `bare: true`), so its grammar
-// includes the slash-less spelling alongside the derived slash forms.
-const SESSION_VIEW_COMMANDS = commandForms("session");
-export function parseSessionViewCommand(text) {
-    const matched = matchCommand(text, SESSION_VIEW_COMMANDS);
-    return matched ? { command: matched.command } : null;
-}
-//# sourceMappingURL=command.js.map

package/dist/web/session-view/command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/web/session-view/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIvD,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAEtD,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC","sourcesContent":["import { commandForms } from \"../../commands/manifest.js\";\nimport { matchCommand } from \"../../commands/parse.js\";\nexport type { ParsedSessionViewCommand } from \"./types.js\";\nimport type { ParsedSessionViewCommand } from \"./types.js\";\n\n// `session` is the only bare command (manifest `bare: true`), so its grammar\n// includes the slash-less spelling alongside the derived slash forms.\nconst SESSION_VIEW_COMMANDS = commandForms(\"session\");\n\nexport function parseSessionViewCommand(text: string): ParsedSessionViewCommand | null {\n  const matched = matchCommand(text, SESSION_VIEW_COMMANDS);\n  return matched ? { command: matched.command } : null;\n}\n"]}