@geminixiang/mikan 1.0.0-beta.7 → 1.0.0-beta.71

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { execFile } from \"child_process\";\nimport { promisify } from \"util\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\n// ── adapter ───────────────────────────────────────────────────────────────────\n\nexport type ConversationKind = \"direct\" | \"shared\";\n\nexport type PlatformName = \"slack\" | \"discord\" | \"telegram\";\n\nexport interface ConversationMessage {\n  id: string;\n  sessionKey: string;\n  conversationKind: ConversationKind;\n  userId: string;\n  userName?: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  threadTs?: string;\n}\n\nexport interface ChatToolResult {\n  toolName: string;\n  label?: string;\n  args?: Record<string, unknown>;\n  result: string;\n  isError: boolean;\n  durationMs: number;\n}\n\nexport interface ConversationResponder {\n  respond(text: string): Promise<void>;\n  appendResponseDelta?(delta: string): Promise<void>;\n  finishResponse?(finalText?: string): Promise<void>;\n  replaceResponse(text: string, options?: { createOverflowLink?: () => string }): Promise<void>;\n  respondDiagnostic(text: string, options?: { style?: \"muted\" | \"error\" }): Promise<void>;\n  respondToolResult(result: ChatToolResult): Promise<void>;\n  setTyping(isTyping: boolean): Promise<void>;\n  setWorking(working: boolean): Promise<void>;\n  uploadFile(filePath: string, title?: string): Promise<void>;\n  /**\n   * React to the message that triggered this run with an emoji short name\n   * (no colons). Optional: platforms/contexts without reaction support omit\n   * it, and callers must handle its absence.\n   */\n  react?(emoji: string): Promise<void>;\n  deleteResponse(): Promise<void>;\n}\n\nexport interface MessagingInfo {\n  name: string;\n  formattingGuide: string;\n  channels: { id: string; name: string }[];\n  users: { id: string; userName: string; displayName: string }[];\n  diagnostics?: {\n    showUsageSummary?: boolean;\n  };\n}\n\nexport interface ChatAdapter {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n  getMessagingInfo(): MessagingInfo;\n}\n\nexport type AgentEventPayload =\n  | { kind: \"sessionStart\" }\n  | { kind: \"responseDelta\"; delta: string }\n  | { kind: \"responseFinal\"; text: string }\n  | { kind: \"diagnostic\"; text: string }\n  | { kind: \"toolStart\"; toolId: string; toolName: string; input?: unknown }\n  | { kind: \"toolEnd\"; toolId: string }\n  | { kind: \"turnEnd\"; awaitingInput?: boolean }\n  | { kind: \"sessionEnd\"; reason?: string };\n\nexport interface AgentEventEnvelope {\n  source: \"mikan\";\n  sessionId: string;\n  actorName: string;\n  event: AgentEventPayload;\n}\n\n/**\n * A platform-agnostic event (message/mention) that triggers the agent.\n */\nexport interface ConversationEvent {\n  type: string;\n  /** Platform-specific raw conversation/channel/chat identifier */\n  conversationId: string;\n  /** Optional alternate conversation identity used for vault routing. */\n  vaultConversationId?: string;\n  /** Cross-platform conversation shape: direct message vs shared space */\n  conversationKind: ConversationKind;\n  /** Message timestamp or ID as string */\n  ts: string;\n  /** Parent message ID for threaded replies (optional) */\n  thread_ts?: string;\n  /** User ID */\n  user: string;\n  /** Message text (already stripped of bot mentions) */\n  text: string;\n  /** Downloaded attachments */\n  attachments?: { name: string; localPath: string }[];\n  /** Platform-computed session key; overrides default conversationId:thread_ts computation */\n  sessionKey?: string;\n}\n\n/**\n * Minimum interface that every platform bot must implement,\n * used by the central handler in main.ts and by EventsWatcher.\n */\nexport interface MessagingBot {\n  start(): Promise<void>;\n  postMessage(channel: string, text: string): Promise<string>;\n  updateMessage(channel: string, ts: string, text: string): Promise<void>;\n  /**\n   * Add an emoji reaction to a message. `emoji` is a platform-agnostic short\n   * name without colons (e.g. \"eyes\", \"white_check_mark\"). Optional so\n   * adapters adopt it incrementally; callers must handle its absence.\n   */\n  addReaction?(channel: string, messageTs: string, emoji: string): Promise<void>;\n  enqueueEvent(event: ConversationEvent): boolean;\n  getMessagingInfo(): MessagingInfo;\n  postPrivate?(conversationId: string, userId: string, text: string): Promise<void>;\n  postPrivateDiagnostic?(\n    conversationId: string,\n    userId: string,\n    text: string,\n    options?: { style?: \"muted\" | \"error\" },\n  ): Promise<void>;\n}\n\n/**\n * Post a plain message to a conversation without triggering an agent run.\n * Backs extension `api.notify`; implemented in main.ts over the platform bots.\n * `platform` is required only when more than one platform is running.\n */\nexport type PlatformNotifier = (\n  conversationId: string,\n  text: string,\n  platform?: string,\n) => Promise<void>;\n\n/**\n * Add an emoji reaction to a message without triggering an agent run. Backs\n * extension `api.react`; implemented in main.ts over the platform bots.\n */\nexport type PlatformReactor = (\n  conversationId: string,\n  messageTs: string,\n  emoji: string,\n  platform?: string,\n) => Promise<void>;\n\n/** Normalized platform data and reply hook for one event. */\nexport interface ConversationContext {\n  message: ConversationMessage;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n}\n\nexport interface RunningSession {\n  sessionKey: string;\n  startedAt: number;\n  lastActivityAt?: number;\n  currentTool?: string;\n}\n\nexport interface MessagingEventHandler {\n  isRunning(sessionKey: string): boolean;\n  getRunningSessions(): RunningSession[];\n  handleEvent(\n    event: ConversationEvent,\n    bot: MessagingBot,\n    context: ConversationContext,\n  ): Promise<void>;\n  handleStop(sessionKey: string, conversationId: string, bot: MessagingBot): Promise<void>;\n  forceStop(sessionKey: string): void;\n  handleNewCommand(sessionKey: string, conversationId: string, bot: MessagingBot): Promise<void>;\n}\n\n// ── agent ─────────────────────────────────────────────────────────────────────\n\nexport interface PiAgentWrapper {\n  syncChatHistory(currentMessageId?: string): void;\n  run(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string }>;\n  abort(): void;\n  getCurrentStep(): { toolName?: string; label?: string } | undefined;\n}\n\n// ── config ────────────────────────────────────────────────────────────────────\n\nexport interface AgentConfig {\n  provider: string;\n  model: string;\n  thinkingLevel: ThinkingLevel;\n  sentryDsn?: string;\n  sandboxCpus?: string;\n  sandboxMemory?: string;\n  sandboxBoostCpus?: string;\n  sandboxBoostMemory?: string;\n  sandboxImageWorkspaceMount?: \"private\" | \"full\";\n  defaultSharedVault?: string;\n  slack?: {\n    replyMode?: \"top-level\" | \"thread\";\n  };\n}\n\n/**\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport interface AutoReplyConfig {\n  enabled: boolean;\n  rules: string[];\n}\n\nexport interface JudgeModelConfig {\n  provider: string;\n  model: string;\n}\n\n// ── context ───────────────────────────────────────────────────────────────────\n\n/**\n * Platform conversation history entry from log.jsonl.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isMessagingBot?: boolean;\n}\n\n// ── events ────────────────────────────────────────────────────────────────────\n\nexport interface ImmediateEvent {\n  type: \"immediate\";\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  userId?: string;\n  text: string;\n}\n\nexport interface OneShotEvent {\n  type: \"one-shot\";\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  userId?: string;\n  text: string;\n  at: string;\n}\n\nexport interface PeriodicEvent {\n  type: \"periodic\";\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  userId?: string;\n  text: string;\n  schedule: string;\n  timezone: string;\n}\n\nexport type MikanEvent = ImmediateEvent | OneShotEvent | PeriodicEvent;\n\nexport interface PeriodicEventInfo {\n  filename: string;\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  text: string;\n  schedule: string;\n  timezone: string;\n  nextRun: string | null;\n}\n\n// ── execution-resolver ────────────────────────────────────────────────────────\n\nexport interface ActorContext {\n  platform: string;\n  userId: string;\n  conversationId: string;\n}\n\nexport type ImageWorkspaceMountMode = \"private\" | \"full\";\n\n// ── log ───────────────────────────────────────────────────────────────────────\n\nexport interface LogContext {\n  conversationId: string;\n  userName?: string;\n  conversationName?: string;\n  sessionId?: string;\n}\n\n// ── portal-shell ──────────────────────────────────────────────────────────────\n\ntype PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  extraStyles?: string;\n  inlineScript?: string;\n  extraHead?: string;\n  bodyAttributes?: Record<string, string>;\n}\n\n// ── provisioner ───────────────────────────────────────────────────────────────\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: ExecFileAsync;\n}\n\n// ── store ─────────────────────────────────────────────────────────────────────\n\nexport interface Attachment {\n  original: string;\n  localPath: string;\n}\n\nexport interface LoggedMessage {\n  date: string;\n  ts: string;\n  user: string;\n  userName?: string;\n  displayName?: string;\n  text: string;\n  attachments: Attachment[];\n  isMessagingBot: boolean;\n  threadTs?: string;\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string;\n}\n\n// ── trigger ───────────────────────────────────────────────────────────────────\n\nexport type TriggerIntent = \"mention\" | \"direct\" | \"thread-continuation\" | \"auto-reply-candidate\";\n\nexport type TriggerResult = { trigger: true; reason: string } | { trigger: false; reason: string };\n\n/**\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport type AutoReplyJudge = (input: {\n  event: ConversationEvent;\n  rules: string[];\n  conversationDir: string;\n}) => Promise<boolean>;\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAatC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport type { SubagentRunStatus } from \"./harness/types.js\";\nimport type { SessionViewTokenStoreLike } from \"./adapters/commands/types.js\";\nimport type { MikanModels } from \"./harness/models.js\";\nimport type { McpServerConfig } from \"./harness/types.js\";\nimport type { EventScheduleSink } from \"./events/index.js\";\nimport type { Office } from \"./office/types.js\";\nimport type { DockerContainerManager } from \"./sandbox/provisioner.js\";\nimport type { SandboxConfig } from \"./sandbox/types.js\";\nimport type { ResolvedSessionScope } from \"./sessions/types.js\";\nimport type { PlatformToolPackFactory } from \"./harness/tools/types.js\";\nimport type { VaultManager } from \"./vault/types.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\n// ── adapter ───────────────────────────────────────────────────────────────────\n\nexport type ConversationKind = \"direct\" | \"shared\";\n\nexport type PlatformName = \"slack\" | \"discord\" | \"telegram\" | \"github\";\n\n/** Canonical platform-plus-raw identifier for one conversation office. */\nexport interface OfficeAddress {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n}\n\n/** Stable, filesystem-safe identity derived from an OfficeAddress. */\nexport type OfficeKey = string & { readonly __brand: \"OfficeKey\" };\n\nexport type OfficeMigrationStatus = \"needs-owner\" | \"prepared\" | \"moving\" | \"committed\" | \"failed\";\n\nexport interface OfficeMigrationRecord {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n  readonly targetDir?: string;\n  readonly status: OfficeMigrationStatus;\n  readonly error?: string;\n  readonly updatedAt: string;\n}\n\n/**\n * Directory entry for one conversation office. The workspace dir name stops\n * carrying the raw platform id once the ADR 0005 layout migration lands, so\n * the registry is the durable raw-id ↔ office mapping used for enumeration.\n */\nexport interface OfficeRecord {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n  readonly recordedAt: string;\n}\n\nexport interface OfficeRegistryState {\n  readonly version: 1;\n  readonly enabledPlatforms: readonly PlatformName[];\n  readonly offices: readonly OfficeRecord[];\n  readonly migrations: readonly OfficeMigrationRecord[];\n}\n\nexport interface OfficeMigrationPreparation {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n}\n\n/**\n * Who can drive conversations on a platform — gates ambient credential policy.\n *\n * - `membership`: only invited workspace/server members (Slack/Discord/Telegram).\n *   Safe to copy `sandbox.defaultSharedVault` into new conversation vaults.\n * - `open-trigger`: broader trigger surface (e.g. GitHub repo writers on public\n *   issues/PRs). Ambient shared vault must not apply; use host-side platform\n *   identity or an explicitly provisioned vault.\n */\nexport type PlatformTrustModel = \"membership\" | \"open-trigger\";\n\nexport interface ConversationMessage {\n  id: string;\n  /** Canonical identity of the conversation office. */\n  address: OfficeAddress;\n  /** @deprecated Use address.conversationId except at platform I/O seams. */\n  conversationId?: string;\n  sessionKey: string;\n  conversationKind: ConversationKind;\n  userId: string;\n  userName?: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  threadTs?: string;\n}\n\nexport interface ChatToolResult {\n  toolName: string;\n  label?: string;\n  args?: Record<string, unknown>;\n  result: string;\n  isError: boolean;\n  durationMs: number;\n}\n\n/**\n * Derived from the run status rather than restated, so a new terminal status\n * in the harness reaches the dashboard instead of silently rendering as a\n * status the marker tables never learned about.\n */\nexport type SubagentProgressStatus = SubagentRunStatus | \"pending\" | \"running\" | \"skipped\";\n\nexport interface SubagentProgressNode {\n  id: string;\n  label: string;\n  status: SubagentProgressStatus;\n  /** Profile the node ran under; the first thing to check when a run is ungrounded. */\n  profile?: string;\n  turns?: number;\n  toolCalls?: number;\n  toolCallCounts?: Record<string, number>;\n  tokens?: number;\n  costUsd?: number;\n  durationMs?: number;\n  /**\n   * What the node is doing right now, for running nodes only.\n   *\n   * Without it a node reports nothing between \"started\" and \"finished\", so a\n   * step that legitimately takes minutes is indistinguishable from a hang —\n   * and when it does finish, there is no record of how it got there.\n   */\n  activity?: string;\n  reason?: string;\n  cleanupPending?: boolean;\n}\n\nexport interface SubagentProgressSnapshot {\n  mode: \"single\" | \"parallel\" | \"dag\";\n  nodes: SubagentProgressNode[];\n}\n\nexport interface TaskStatus {\n  sessionKey: string;\n  threadTs: string;\n  acknowledgement: string;\n  status:\n    | \"running\"\n    | \"stopping\"\n    | \"completed\"\n    | \"aborted\"\n    | \"failed\"\n    | \"declined\"\n    | \"queued\"\n    | \"unknown\";\n  currentTool?: string;\n  observedAt: string;\n  endedAt?: string;\n}\n\nexport interface ConversationResponder {\n  /** Admit independent work; returns its platform session reference, never waits for completion. */\n  startTask?(message: string, task: string): Promise<string>;\n  /** Post a fresh delivery notification after the final task response. */\n  notifyCompletion?(): Promise<void>;\n  /** Read-only task observations, scoped to the current conversation. */\n  getTaskStatus?(sessionKey?: string): Promise<TaskStatus[]>;\n  respond(text: string): Promise<void>;\n  appendResponseDelta?(delta: string): Promise<void>;\n  finishResponse?(finalText?: string): Promise<void>;\n  replaceResponse(text: string, options?: { createOverflowLink?: () => string }): Promise<void>;\n  /**\n   * Override only to convert the subagent dashboard for a pipeline that is\n   * not response-source Markdown (Telegram HTML). Absent, the harness composes\n   * the Markdown dashboard — optionally followed by the final answer — through\n   * `replaceResponse`.\n   */\n  replaceSubagentProgress?(progress: SubagentProgressSnapshot, finalText?: string): Promise<void>;\n  /**\n   * Spike: post the final answer as a fresh message under the identity of the\n   * subagent profile that produced it, instead of appending it to the\n   * in-progress message. Absent, or when the run does not resolve to exactly\n   * one completed subagent profile, the harness keeps the single-message path.\n   */\n  respondAsRole?(profile: string, text: string): Promise<void>;\n  respondDiagnostic(text: string, options?: { style?: \"muted\" | \"error\" }): Promise<void>;\n  respondToolResult(result: ChatToolResult): Promise<void>;\n  setTyping(isTyping: boolean): Promise<void>;\n  setWorking(working: boolean): Promise<void>;\n  uploadFile(filePath: string, title?: string): Promise<void>;\n  /**\n   * React to the message that triggered this run with an emoji short name\n   * (no colons). Optional: platforms/contexts without reaction support omit\n   * it, and callers must handle its absence.\n   */\n  react?(emoji: string): Promise<void>;\n  deleteResponse(): Promise<void>;\n}\n\nexport interface MessagingInfo {\n  name: string;\n  /** Stable platform workspace/team identity when the adapter has one. */\n  workspaceId?: string;\n  formattingGuide: string;\n  channels: { id: string; name: string }[];\n  users: { id: string; userName: string; displayName: string }[];\n  /**\n   * Trust boundary for ambient credentials and host-side MCP capabilities.\n   * Built-in product paths normalize omission to `membership`; open-trigger\n   * platforms set this explicitly so policy does not key off platform names.\n   */\n  trustModel?: PlatformTrustModel;\n  diagnostics?: {\n    showUsageSummary?: boolean;\n  };\n}\n\n/**\n * A platform-agnostic event (message/mention) that triggers the agent.\n */\nexport interface ConversationEvent {\n  type: string;\n  /** Canonical identity created by the platform adapter at intake. */\n  address: OfficeAddress;\n  /** @deprecated Raw platform identifier; valid only at adapter I/O seams. */\n  conversationId: string;\n  /** Optional alternate conversation identity used for vault routing. */\n  vaultConversationId?: string;\n  /** Cross-platform conversation shape: direct message vs shared space */\n  conversationKind: ConversationKind;\n  /** Message timestamp or ID as string */\n  ts: string;\n  /** Parent message ID for threaded replies (optional) */\n  thread_ts?: string;\n  /** User ID */\n  user: string;\n  /** Message text (already stripped of bot mentions) */\n  text: string;\n  /** Downloaded attachments */\n  attachments?: { name: string; localPath: string }[];\n  /** Platform-computed session key; overrides default conversationId:thread_ts computation */\n  sessionKey?: string;\n}\n\n/**\n * Minimum interface that every platform bot must implement,\n * used by the central handler in main.ts and by EventsWatcher.\n */\nexport interface MessagingBot {\n  start(): Promise<void>;\n  /** Stop accepting new platform events and wait for intake already in flight. */\n  stop(): Promise<void>;\n  postMessage(channel: string, text: string): Promise<string>;\n  updateMessage(channel: string, ts: string, text: string): Promise<void>;\n  /**\n   * Add an emoji reaction to a message. `emoji` is a platform-agnostic short\n   * name without colons (e.g. \"eyes\", \"white_check_mark\"). Optional so\n   * adapters adopt it incrementally; callers must handle its absence.\n   */\n  addReaction?(channel: string, messageTs: string, emoji: string): Promise<void>;\n  /**\n   * Upload a host-side file into a conversation. Optional so adapters adopt\n   * it incrementally; callers must handle its absence. Existing adapter\n   * implementations (Slack/Discord/Telegram) already match this shape.\n   */\n  uploadFile?(channel: string, filePath: string, title?: string): Promise<void>;\n  /**\n   * Post into a platform thread. Optional so adapters adopt it incrementally;\n   * callers must handle its absence.\n   */\n  postInThread?(channel: string, threadTs: string, text: string): Promise<string>;\n  /**\n   * Open (or resolve) the direct-message conversation with a user, returning\n   * its conversation id — usable with `postMessage`. Optional capability.\n   */\n  openDirectConversation?(userId: string): Promise<string>;\n  /**\n   * Fetch recent messages from a conversation, oldest first. Optional\n   * capability; adapters may cap `limit` below what the caller asks for.\n   */\n  fetchHistory?(\n    channel: string,\n    options?: PlatformHistoryOptions,\n  ): Promise<PlatformHistoryMessage[]>;\n  /** List the platform workspace's active users. Optional capability. */\n  listUsers?(): Promise<PlatformUserInfo[]>;\n  enqueueEvent(event: ConversationEvent): boolean;\n  getMessagingInfo(): MessagingInfo;\n  postPrivate?(conversationId: string, userId: string, text: string): Promise<void>;\n  postPrivateDiagnostic?(\n    conversationId: string,\n    userId: string,\n    text: string,\n    options?: { style?: \"muted\" | \"error\" },\n  ): Promise<void>;\n}\n\n/** Filters for a platform conversation-history fetch. */\nexport interface PlatformHistoryOptions {\n  /** Only messages strictly newer than this platform message id/timestamp. */\n  oldest?: string;\n  /** Maximum number of messages to return (adapters may cap this lower). */\n  limit?: number;\n  /**\n   * Read the replies inside this thread instead of the conversation's\n   * top-level messages. The thread parent itself is not returned — the result\n   * is the replies to it. Adapters without threads ignore this.\n   */\n  threadTs?: string;\n}\n\n/** One platform message returned by a history fetch. */\nexport interface PlatformHistoryMessage {\n  ts: string;\n  threadTs?: string;\n  userId?: string;\n  userName?: string;\n  text: string;\n  isBot: boolean;\n}\n\n/** One platform user returned by a workspace user listing. */\nexport interface PlatformUserInfo {\n  id: string;\n  userName: string;\n  displayName: string;\n  isBot: boolean;\n}\n\n/** Normalized platform data and reply hook for one event. */\nexport interface ConversationContext {\n  /** Canonical identity for the office handling this turn. */\n  address: OfficeAddress;\n  message: ConversationMessage;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n}\n\nexport interface RunningSession {\n  /** The office this run belongs to; two platforms may share a raw id. */\n  address: OfficeAddress;\n  sessionKey: string;\n  startedAt: number;\n  lastActivityAt?: number;\n  currentTool?: string;\n  stopping?: boolean;\n}\n\nexport interface HandleNewCommandOptions {\n  sessionKey: string;\n  conversationId: string;\n  bot: MessagingBot;\n  message: ConversationMessage;\n}\n\n/**\n * Runtime state is addressed by an office plus that office's platform session\n * reference. The session key alone is a platform value and is not unique\n * across platforms, so every session-scoped call carries its `OfficeAddress`.\n */\nexport interface MessagingEventHandler {\n  isRunning(address: OfficeAddress, sessionKey: string): boolean;\n  getRunningSessions(): RunningSession[];\n  handleEvent(\n    event: ConversationEvent,\n    bot: MessagingBot,\n    context: ConversationContext,\n  ): Promise<void>;\n  handleStop(\n    address: OfficeAddress,\n    sessionKey: string,\n    bot: MessagingBot,\n    replyThreadTs?: string,\n  ): Promise<void>;\n  /** Returns false when idle; accepted controls bypass the normal run queue. */\n  steer?(message: ConversationMessage): Promise<boolean>;\n  forceStop(address: OfficeAddress, sessionKey: string): void;\n  handleNewCommand(options: HandleNewCommandOptions): Promise<void>;\n}\n\n// ── agent ─────────────────────────────────────────────────────────────────────\n\nexport interface PiAgentWrapper {\n  steer?(message: ConversationMessage): Promise<boolean>;\n  syncChatHistory(currentMessageId?: string): Promise<void>;\n  run(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string }>;\n  abort(): void;\n  getCurrentStep(): { toolName?: string; label?: string } | undefined;\n  dispose(): Promise<void>;\n}\n\n// ── config ────────────────────────────────────────────────────────────────────\n\n/**\n * Office visibility (ADR 0008): public offices may be read by every office and\n * write shared knowledge; private ones are visible only to themselves.\n */\nexport type WorkspaceVisibility = \"public\" | \"private\";\n\nexport interface SandboxSettings {\n  cpus?: string;\n  memory?: string;\n  boost?: { cpus?: string; memory?: string };\n  defaultSharedVault?: string;\n}\n\nexport interface AgentConfig {\n  provider: string;\n  model: string;\n  thinkingLevel: ThinkingLevel;\n  sentryDsn?: string;\n  sandbox?: SandboxSettings;\n  slack?: {\n    replyMode?: \"top-level\" | \"thread\";\n  };\n  /**\n   * MCP servers available to this scope, keyed by server name. Global and\n   * conversation entries merge per key (conversation wins); an entry with\n   * `disabled: true` turns off the inherited server. `open-connector` is\n   * filled in from the deployment default when undeclared. See `src/harness`.\n   */\n  mcpServers?: Record<string, McpServerConfig>;\n}\n\n// ── context ───────────────────────────────────────────────────────────────────\n\n/**\n * Platform conversation history entry from log.jsonl.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isMessagingBot?: boolean;\n}\n\n// ── execution-resolver ────────────────────────────────────────────────────────\n\nexport interface ActorContext {\n  /** Canonical office identity used by vault and execution policy. */\n  address: OfficeAddress;\n  userId: string;\n  /** From MessagingInfo.trustModel; vault policy uses this, not platform name. */\n  trustModel?: PlatformTrustModel;\n}\n\n// ── log ───────────────────────────────────────────────────────────────────────\n\nexport interface LogContext {\n  conversationId: string;\n  userName?: string;\n  conversationName?: string;\n  sessionId?: string;\n}\n\n// ── portal shell (src/adapters/web/portal-shell.ts) ────────────────────────────────────\n\ntype PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  extraStyles?: string;\n  inlineScript?: string;\n  extraHead?: string;\n  bodyAttributes?: Record<string, string>;\n}\n\n// ── provisioner ───────────────────────────────────────────────────────────────\n\n/** Rewrites one Docker bind spec (`src:dst[:ro]`) during layout migration. */\nexport type ContainerBindTranslator = (bindSpec: string) => string;\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n  /**\n   * Mount without write access. Used for shared content an isolated runtime\n   * may read but must not modify. Absent means read-write.\n   */\n  readOnly?: boolean;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface SandboxResourceController {\n  boost(key: string): Promise<SandboxLimitStatus>;\n  setLimits(key: string, limits: ResourceLimits): Promise<SandboxLimitStatus>;\n  getLimitStatus(key: string): SandboxLimitStatus;\n  getDefaultLimits(): ResourceLimits | undefined;\n  getBoostLimits(): ResourceLimits | undefined;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: ExecFileAsync;\n}\n\nexport interface ExecutionPlan {\n  credentialKey: string;\n  resourceKey: string;\n  sandboxConfig: SandboxConfig;\n  env?: Record<string, string>;\n  mounts: ContainerMount[];\n}\n\n// ── store ─────────────────────────────────────────────────────────────────────\n\nexport interface Attachment {\n  original: string;\n  localPath: string;\n}\n\n// ── shared implementation contracts ─────────────────────────────────────────\n\ninterface EnvVarSpec {\n  name: string;\n  required?: boolean;\n  secret?: boolean;\n  deploy?: boolean;\n  doc: string;\n}\n\n/** The onboarding wizard's LLM answer, applied to the settings template. */\nexport interface OnboardLlmChoice {\n  provider: string;\n  model: string;\n}\n\nexport interface EnvGroup {\n  key: string;\n  title: string;\n  kind: \"platform\" | \"feature\";\n  vars: EnvVarSpec[];\n  anyOf?: readonly string[];\n  doc?: string;\n}\n\nexport interface RunnerCacheControl {\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  /** Clear the office's cached runner for a non-model settings change; false while busy. */\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n}\n\nexport interface GlobalRunnerCacheControl {\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport type SettingsApplyResult =\n  | { ok: true; runtimeSwitched: boolean | null }\n  | { ok: false; reason: \"busy\" };\n\nexport interface CreateRunnerOptions {\n  sandboxConfig: SandboxConfig;\n  sessionKey: string;\n  /** The Conversation office this runner serves; identity and layout derive from it. */\n  office: Office;\n  /**\n   * Fixed trust boundary for this office. It is not part of runner cache\n   * identity; changing it requires runner replacement, not another cache entry.\n   */\n  trustModel: PlatformTrustModel;\n  /** Platform workspace/team identity used by host-side integration provisioning. */\n  platformWorkspaceId?: string;\n  /** Deployment default for the `open-connector` MCP entry; settings may override it. */\n  openConnector?: McpServerConfig;\n  /** Scheduler notified by the office event store after each admitted mutation. */\n  eventScheduler?: EventScheduleSink;\n  sessionScope: ResolvedSessionScope;\n  /** Cancels construction during process shutdown; acquired resources still roll back before rejection. */\n  signal?: AbortSignal;\n  vaultManager?: VaultManager;\n  provisioner?: DockerContainerManager;\n  resourceController?: SandboxResourceController;\n  sessionView?: {\n    tokenStore: SessionViewTokenStoreLike;\n    portalBaseUrl?: string;\n  };\n  platformToolPackFactories?: readonly PlatformToolPackFactory[];\n  models?: MikanModels;\n}\n"]}

package/dist/vault/index.d.ts

@@ -1,4 +1,6 @@
-import type { SandboxConfig } from "../sandbox/index.js";
+import type { OfficeAddress } from "../types.js";
+import type { SandboxConfig, SandboxCredentialCapabilities } from "../sandbox/types.js";
+import type { PlatformTrustModel } from "../types.js";
 export declare function normalizeSharedVaultName(name: string): string | undefined;
 export declare function sharedVaultKey(name: string): string | undefined;
 export type { ResolvedVault, VaultManager } from "./types.js";
@@ -24,11 +26,59 @@ export declare class FileVaultManager implements VaultManager {
         envKeysCopied: number;
     };
     resolve(userId: string): ResolvedVault | undefined;
-    getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;
     list(): ResolvedVault[];
     upsertEnv(key: string, env: Record<string, string>): void;
+    deleteEnvKey(key: string, envKey: string): boolean;
     upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;
     private buildResolved;
 }
 export declare function defaultVaultTargetPath(relativePath: string): string;
+/**
+ * Rename legacy raw-id conversation vault directories to office keys, driven
+ * by the office registry's inventory (the only raw-id ↔ office authority).
+ * Shared, user-keyed, and unrecognized directories are never touched. A
+ * conflict — both the legacy and the office-key directory exist — is reported
+ * for manual merge, never clobbered; callers treat it as fatal for boot so a
+ * conversation cannot silently run with half its credentials.
+ */
+export declare function migrateConversationVaultKeys(options: {
+    stateDir: string;
+    offices: readonly OfficeAddress[];
+}): {
+    migrated: string[];
+    conflicts: string[];
+};
+/**
+ * Decide whether a new conversation vault may inherit `sandbox.defaultSharedVault`.
+ *
+ * Ambient copy is a membership-trust convenience: only appropriate when the
+ * people who can drive the agent are already gated by platform membership
+ * (Slack/Discord/Telegram). Open-trigger surfaces (GitHub issue/PR comments)
+ * must not inherit ambient credentials — host-side platform identity or an
+ * explicitly provisioned vault only.
+ *
+ * Topology: only isolated sandboxes (`image` / `cloudflare`) auto-provision
+ * per-conversation vaults that receive the copy. `host` / `container` do
+ * not use this ambient path.
+ */
+export declare function allowsAmbientDefaultSharedVault(options: {
+    trustModel?: PlatformTrustModel;
+    sandboxType: SandboxConfig["type"];
+}): boolean;
+export type { VaultInjection } from "./types.js";
+import type { VaultInjection } from "./types.js";
+export declare function resolveVaultInjection(options: {
+    vault: ResolvedVault | undefined;
+    capabilities: SandboxCredentialCapabilities;
+    sandboxType: SandboxConfig["type"];
+    /** Diagnostic identity for error reports only; no injection decision reads it. */
+    address: OfficeAddress;
+}): VaultInjection;
+/**
+ * Inert VaultManager for embedders that run the conversation runtime without
+ * a credential vault. Read paths report an empty, disabled vault; write paths
+ * fail loudly so misconfiguration surfaces instead of silently dropping
+ * secrets.
+ */
+export declare const disabledVaultManager: VaultManager;
 //# sourceMappingURL=index.d.ts.map

package/dist/vault/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAazD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAWD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAC;AAIlF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BpE;AAID,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,QAAQ,EAAE,MAAM,EAE3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAUhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAQzE;IAED,IAAI,IAAI,aAAa,EAAE,CAOtB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAcxD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAcxF;IAID,OAAO,CAAC,aAAa;CA6BtB;AAuFD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAWtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAC;AAIlF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpE;AAwBD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,QAAQ,EAAE,MAAM,EAE3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAWhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAKjD;IAED,IAAI,IAAI,aAAa,EAAE,CAatB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAexD;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAejD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAexF;IAID,OAAO,CAAC,aAAa;CAetB;AA4GD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE;AAyBD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CACnC,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAkB9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,OAAO,CAIV;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8BjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,6BAA6B,CAAC;IAC5C,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,kFAAkF;IAClF,OAAO,EAAE,aAAa,CAAC;CACxB,GAAG,cAAc,CAWjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,YAiBlC,CAAC"}

package/dist/vault/index.js

@@ -1,14 +1,15 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "fs";
-import { dirname, isAbsolute, join, normalize, sep } from "path";
-import { readTextFileIfExists } from "../utils/file-guards.js";
-import { atomicWritePrivateFile } from "../utils/fs-atomic.js";
-import { reportUserFacingError } from "../observability/sentry.js";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, } from "node:fs";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { officeKey } from "../office/index.js";
+import { legacyConversationCredentialKey } from "../sandbox/identity.js";
+import { atomicWritePrivateFile, readTextFileIfExists } from "../file-guards.js";
+import { reportUserFacingError } from "../observability/index.js";
 const PRIVATE_DIR_MODE = 0o700;
 const SHARED_VAULT_DIR = "shared";
 /**
- * Top-level vault namespaces that are not user vaults: `shared/<name>` holds
- * shared login profiles, `extensions/<slug>` holds extension secrets (read
- * host-side via the harness `api.secrets`, never mounted into sandboxes).
+ * Top-level vault namespaces that are not user vaults. `extensions` remains
+ * reserved so data left by removed executable extensions is never mistaken
+ * for a user credential vault.
  */
 const RESERVED_VAULT_DIRS = new Set([SHARED_VAULT_DIR, "extensions"]);
 export function normalizeSharedVaultName(name) {
@@ -21,12 +22,6 @@ export function sharedVaultKey(name) {
     const normalized = normalizeSharedVaultName(name);
     return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;
 }
-function sanitizeCloudflareSandboxId(value) {
-    return (value
-        .toLowerCase()
-        .replace(/[^a-z0-9-]+/g, "-")
-        .replace(/^-+|-+$/g, "") || "unknown");
-}
 // ── parseEnvFile ───────────────────────────────────────────────────────────────
 /**
  * Parse a KEY=VALUE env file. Supports:
@@ -38,26 +33,33 @@ function sanitizeCloudflareSandboxId(value) {
  */
 export function parseEnvFile(content) {
     const env = {};
-    const lines = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
-    for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#"))
-            continue;
-        const eqIndex = trimmed.indexOf("=");
-        if (eqIndex === -1)
-            continue;
-        const key = trimmed.slice(0, eqIndex).trim();
-        if (!key)
-            continue;
-        let value = trimmed.slice(eqIndex + 1);
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        env[key] = value;
+    for (const line of content.split(/\r\n|\r|\n/)) {
+        const entry = parseEnvLine(line);
+        if (entry)
+            env[entry[0]] = entry[1];
     }
     return env;
 }
+/** One `KEY=VALUE` entry, or undefined for a blank line, comment or non-entry. */
+function parseEnvLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+        return undefined;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1)
+        return undefined;
+    const key = trimmed.slice(0, eqIndex).trim();
+    if (!key)
+        return undefined;
+    return [key, unquoteEnvValue(trimmed.slice(eqIndex + 1))];
+}
+/** Strip one matching pair of surrounding single or double quotes. */
+function unquoteEnvValue(value) {
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.endsWith(quote))
+        return value.slice(1, -1);
+    return value;
+}
 // ── FileVaultManager ───────────────────────────────────────────────────────────
 export class FileVaultManager {
     constructor(stateDir) {
@@ -67,6 +69,8 @@ export class FileVaultManager {
         return existsSync(this.vaultsDir);
     }
     hasEntry(key) {
+        if (!isSafeVaultKey(key))
+            return false;
         return existsSync(join(this.vaultsDir, key));
     }
     listSharedVaults() {
@@ -88,6 +92,8 @@ export class FileVaultManager {
         return existed;
     }
     copySharedVaultTo(name, targetKey) {
+        if (!isSafeVaultKey(targetKey))
+            throw new Error(`vault: invalid vault key: ${targetKey}`);
         const sourceKey = sharedVaultKey(name);
         if (!sourceKey)
             throw new Error(`vault: invalid shared login name: ${name}`);
@@ -100,31 +106,29 @@ export class FileVaultManager {
         return copyVaultDir(sourceDir, targetDir);
     }
     resolve(userId) {
+        if (!isSafeVaultKey(userId))
+            return undefined;
         const dir = join(this.vaultsDir, userId);
         if (!existsSync(dir))
             return undefined;
         return this.buildResolved(userId);
     }
-    getSandboxConfig(userId, baseConfig) {
-        if (baseConfig.type === "cloudflare") {
-            return {
-                type: "cloudflare",
-                sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,
-            };
-        }
-        return baseConfig;
-    }
     list() {
         if (!existsSync(this.vaultsDir))
             return [];
         const keys = new Set();
         for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {
-            if (entry.isDirectory() && !RESERVED_VAULT_DIRS.has(entry.name))
+            if (entry.isDirectory() &&
+                !RESERVED_VAULT_DIRS.has(entry.name) &&
+                isSafeVaultKey(entry.name)) {
                 keys.add(entry.name);
+            }
         }
         return Array.from(keys, (key) => this.buildResolved(key));
     }
     upsertEnv(key, env) {
+        if (!isSafeVaultKey(key))
+            throw new Error(`vault: invalid vault key: ${key}`);
         const dir = join(this.vaultsDir, key);
         const envPath = join(dir, "env");
         ensurePrivateDir(this.vaultsDir);
@@ -138,7 +142,27 @@ export class FileVaultManager {
             .join("\n") + "\n";
         atomicWritePrivateFile(envPath, content);
     }
+    deleteEnvKey(key, envKey) {
+        if (!isSafeVaultKey(key))
+            throw new Error(`vault: invalid vault key: ${key}`);
+        const envPath = join(this.vaultsDir, key, "env");
+        const existingContent = readTextFileIfExists(envPath);
+        if (existingContent === undefined)
+            return false;
+        const existing = parseEnvFile(existingContent);
+        if (!(envKey in existing))
+            return false;
+        delete existing[envKey];
+        const content = Object.entries(existing)
+            .toSorted(([left], [right]) => left.localeCompare(right))
+            .map(([name, value]) => `${name}=${value}`)
+            .join("\n") + "\n";
+        atomicWritePrivateFile(envPath, content);
+        return true;
+    }
     upsertFile(key, relativePath, content, targetPath) {
+        if (!isSafeVaultKey(key))
+            throw new Error(`vault: invalid vault key: ${key}`);
         const normalizedPath = normalizeVaultRelativePath(relativePath);
         if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {
             throw new Error(`vault: invalid relative secret file path for "${key}": ${relativePath}`);
@@ -156,23 +180,8 @@ export class FileVaultManager {
     buildResolved(key) {
         const dir = join(this.vaultsDir, key);
         const mounts = inferMountsFromDir(dir);
-        let env = {};
         const envContent = readTextFileIfExists(join(dir, "env"));
-        if (envContent !== undefined) {
-            try {
-                env = parseEnvFile(envContent);
-            }
-            catch (err) {
-                console.error(`vault: failed to parse env file for "${key}":`, err);
-                reportUserFacingError(err, {
-                    domain: "sandbox",
-                    surface: "vault_injection",
-                    operation: "parse_env",
-                    severity: "warning",
-                    context: { vaultKey: key, fatal: false },
-                });
-            }
-        }
+        const env = envContent === undefined ? {} : parseEnvFile(envContent);
         return {
             userId: key,
             displayName: key,
@@ -202,37 +211,57 @@ function ensurePrivateDir(path) {
     chmodSync(path, PRIVATE_DIR_MODE);
 }
 function copyVaultDir(sourceDir, targetDir) {
-    let filesCopied = 0;
-    let envKeysCopied = 0;
+    const total = { filesCopied: 0, envKeysCopied: 0 };
     for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
-        const sourcePath = join(sourceDir, entry.name);
-        const targetPath = join(targetDir, entry.name);
-        if (entry.name === "env" && entry.isFile()) {
-            const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? "");
-            const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? "");
-            const merged = { ...targetEnv, ...sourceEnv };
-            const content = Object.entries(merged)
-                .toSorted(([left], [right]) => left.localeCompare(right))
-                .map(([envKey, value]) => `${envKey}=${value}`)
-                .join("\n") + "\n";
-            atomicWritePrivateFile(targetPath, content);
-            envKeysCopied += Object.keys(sourceEnv).length;
-            continue;
-        }
-        if (entry.isDirectory()) {
-            ensurePrivateDir(targetPath);
-            const nested = copyVaultDir(sourcePath, targetPath);
-            filesCopied += nested.filesCopied;
-            envKeysCopied += nested.envKeysCopied;
-            continue;
-        }
-        if (!entry.isFile())
-            continue;
-        copyFileSync(sourcePath, targetPath);
-        chmodSync(targetPath, 0o600);
-        filesCopied++;
+        const counts = copyVaultEntry(sourceDir, targetDir, entry);
+        total.filesCopied += counts.filesCopied;
+        total.envKeysCopied += counts.envKeysCopied;
+    }
+    return total;
+}
+/** Copy one vault entry: merge `env`, recurse into directories, chmod files. */
+function copyVaultEntry(sourceDir, targetDir, entry) {
+    const sourcePath = join(sourceDir, entry.name);
+    const targetPath = join(targetDir, entry.name);
+    if (entry.name === "env" && entry.isFile()) {
+        return { filesCopied: 0, envKeysCopied: mergeVaultEnvFile(sourcePath, targetPath) };
+    }
+    if (entry.isDirectory()) {
+        ensurePrivateDir(targetPath);
+        return copyVaultDir(sourcePath, targetPath);
     }
-    return { filesCopied, envKeysCopied };
+    if (!entry.isFile())
+        return { filesCopied: 0, envKeysCopied: 0 };
+    copyFileSync(sourcePath, targetPath);
+    chmodSync(targetPath, 0o600);
+    return { filesCopied: 1, envKeysCopied: 0 };
+}
+/** Overlay the source env file onto the target's; returns the keys copied. */
+function mergeVaultEnvFile(sourcePath, targetPath) {
+    const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? "");
+    const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? "");
+    const merged = { ...targetEnv, ...sourceEnv };
+    const content = Object.entries(merged)
+        .toSorted(([left], [right]) => left.localeCompare(right))
+        .map(([envKey, value]) => `${envKey}=${value}`)
+        .join("\n") + "\n";
+    atomicWritePrivateFile(targetPath, content);
+    return Object.keys(sourceEnv).length;
+}
+function isSafeVaultKey(key) {
+    if (typeof key !== "string" || !key || isAbsolute(key))
+        return false;
+    if (/^[A-Za-z]:[\\/]/.test(key))
+        return false;
+    return key.split(/[\\/]/).every((segment) => {
+        return (segment !== "" && segment !== "." && segment !== ".." && !hasUnsafeControlCharacter(segment));
+    });
+}
+function hasUnsafeControlCharacter(value) {
+    return Array.from(value).some((character) => {
+        const code = character.codePointAt(0) ?? 0;
+        return (code >= 0 && code <= 31) || (code >= 127 && code <= 159);
+    });
 }
 function normalizeVaultRelativePath(relativePath) {
     const trimmed = relativePath.trim();
@@ -278,4 +307,107 @@ function inferredVaultTargetPath(relativePath) {
     }
     return defaultVaultTargetPath(normalized);
 }
+/**
+ * Rename legacy raw-id conversation vault directories to office keys, driven
+ * by the office registry's inventory (the only raw-id ↔ office authority).
+ * Shared, user-keyed, and unrecognized directories are never touched. A
+ * conflict — both the legacy and the office-key directory exist — is reported
+ * for manual merge, never clobbered; callers treat it as fatal for boot so a
+ * conversation cannot silently run with half its credentials.
+ */
+export function migrateConversationVaultKeys(options) {
+    const vaultsDir = join(options.stateDir, "vaults");
+    const migrated = [];
+    const conflicts = [];
+    if (!existsSync(vaultsDir))
+        return { migrated, conflicts };
+    for (const office of options.offices) {
+        const legacyDir = join(vaultsDir, legacyConversationCredentialKey(office.conversationId));
+        if (!existsSync(legacyDir))
+            continue;
+        const targetDir = join(vaultsDir, officeKey(office));
+        if (existsSync(targetDir)) {
+            conflicts.push(office.conversationId);
+            continue;
+        }
+        renameSync(legacyDir, targetDir);
+        migrated.push(office.conversationId);
+    }
+    return { migrated, conflicts };
+}
+/**
+ * Decide whether a new conversation vault may inherit `sandbox.defaultSharedVault`.
+ *
+ * Ambient copy is a membership-trust convenience: only appropriate when the
+ * people who can drive the agent are already gated by platform membership
+ * (Slack/Discord/Telegram). Open-trigger surfaces (GitHub issue/PR comments)
+ * must not inherit ambient credentials — host-side platform identity or an
+ * explicitly provisioned vault only.
+ *
+ * Topology: only isolated sandboxes (`image` / `cloudflare`) auto-provision
+ * per-conversation vaults that receive the copy. `host` / `container` do
+ * not use this ambient path.
+ */
+export function allowsAmbientDefaultSharedVault(options) {
+    const trustModel = options.trustModel ?? "membership";
+    if (trustModel === "open-trigger")
+        return false;
+    return options.sandboxType === "image" || options.sandboxType === "cloudflare";
+}
+/** Keep the mounts whose source still exists; a missing one is reported, not fatal. */
+function resolveExistingMounts(vault, sandboxType, address) {
+    const mounts = [];
+    for (const mount of vault?.mounts ?? []) {
+        if (!existsSync(mount.source)) {
+            reportUserFacingError(new Error("Vault mount source is missing"), {
+                domain: "sandbox",
+                surface: "vault_injection",
+                operation: "resolve_mounts",
+                severity: "warning",
+                context: {
+                    sandboxType,
+                    conversationId: address.conversationId,
+                    target: mount.target,
+                    hasVault: Boolean(vault),
+                },
+            });
+            continue;
+        }
+        mounts.push({ source: mount.source, target: mount.target });
+    }
+    return mounts;
+}
+export function resolveVaultInjection(options) {
+    const { vault, capabilities, sandboxType, address } = options;
+    if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {
+        throw new Error(`Sandbox type "${sandboxType}" does not support vault file mounts`);
+    }
+    const mounts = resolveExistingMounts(vault, sandboxType, address);
+    const env = capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
+    return { ...(env ? { env } : {}), mounts };
+}
+/**
+ * Inert VaultManager for embedders that run the conversation runtime without
+ * a credential vault. Read paths report an empty, disabled vault; write paths
+ * fail loudly so misconfiguration surfaces instead of silently dropping
+ * secrets.
+ */
+export const disabledVaultManager = {
+    isEnabled: () => false,
+    hasEntry: () => false,
+    resolve: () => undefined,
+    list: () => [],
+    listSharedVaults: () => [],
+    deleteSharedVault: () => false,
+    copySharedVaultTo: () => ({ filesCopied: 0, envKeysCopied: 0 }),
+    upsertEnv: () => {
+        throw new Error("Vault not configured");
+    },
+    deleteEnvKey: () => {
+        throw new Error("Vault not configured");
+    },
+    upsertFile: () => {
+        throw new Error("Vault not configured");
+    },
+};
 //# sourceMappingURL=index.js.map