@kafca/agentdock 0.1.58 → 0.1.62

package/dist-electron/services/local-ai-core/src/kernel/bootstrap.js

@@ -14,6 +14,8 @@ const local_core_runtime_state_js_1 = require("../runtime/local-core-runtime-sta
 const scheduled_job_application_service_js_1 = require("../scheduler/scheduled-job-application-service.js");
 const scheduler_service_js_1 = require("../scheduler/scheduler-service.js");
 const automation_monitor_service_js_1 = require("../automation/automation-monitor-service.js");
+const automation_action_executor_js_1 = require("../automation/automation-action-executor.js");
+const automation_service_js_1 = require("../automation/automation-service.js");
 function bootstrapLocalCoreKernel(options) {
     const capabilities = new capability_registry_js_1.LocalCoreCapabilityRegistry();
     const plugins = new plugin_registry_js_1.LocalCorePluginRegistry(options?.disabledPluginIds);
@@ -206,8 +208,20 @@ function bootstrapLocalCoreRuntime(options) {
         knowledgeAttachments,
         log: options.log,
     });
+    const automationActionExecutor = new automation_action_executor_js_1.AutomationActionExecutor({
+        store,
+        getWorkspaceRouter: () => workspaceRouter,
+        getChannelRuntime: (platform) => channelRuntimes.find((runtime) => runtime.platform === platform || platform.startsWith(`${runtime.platform}:`)),
+    });
+    const automations = new automation_service_js_1.AutomationService({
+        store,
+        actionExecutor: automationActionExecutor,
+        eventBus: kernel.context.bus,
+        log: options.log,
+    });
     const scheduler = new scheduler_service_js_1.SchedulerService({
         store,
+        automations,
         triggers: schedulerTriggers,
         executors: schedulerExecutors,
         eventBus: kernel.context.bus,
@@ -216,9 +230,12 @@ function bootstrapLocalCoreRuntime(options) {
     const scheduledJobs = new scheduled_job_application_service_js_1.ScheduledJobApplicationService({
         store,
         scheduler,
+        automations,
+        eventBus: kernel.context.bus,
     });
     const automationMonitors = new automation_monitor_service_js_1.AutomationMonitorService({
         store,
+        automations,
         providers: monitorProviders,
         getWorkspaceRouter: () => workspaceRouter,
         getChannelRuntime: (platform) => channelRuntimes.find((runtime) => runtime.platform === platform || platform.startsWith(`${runtime.platform}:`)),
@@ -246,13 +263,17 @@ function bootstrapLocalCoreRuntime(options) {
         scheduler,
         scheduledJobs,
         automationMonitors,
+        automationActionExecutor,
+        automations,
         async start() {
             await kernel.lifecycle.startAll();
+            await automations.start();
             await scheduler.start();
             await automationMonitors.start();
         },
         async stop() {
             await automationMonitors.stop();
+            await automations.stop();
             await scheduler.stop();
             await kernel.lifecycle.stopAll();
             workspaceRouter.close();

package/dist-electron/services/local-ai-core/src/runtime/deployment-diagnostics.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runDeploymentDiagnostics = runDeploymentDiagnostics;
+exports.automationSandboxDiagnosticChecks = automationSandboxDiagnosticChecks;
 const node_fs_1 = require("node:fs");
 const superai_contracts_1 = require("../../../../packages/contracts/src/index.js");
 const sandbox_config_js_1 = require("../sandbox/sandbox-config.js");
+const anthropic_sandbox_runner_js_1 = require("../automation/scripts/anthropic-sandbox-runner.js");
 async function runDeploymentDiagnostics(input) {
     const env = input.env || process.env;
     const checkedAt = new Date().toISOString();
@@ -31,6 +33,7 @@ async function runDeploymentDiagnostics(input) {
         workspacePathCheck(config, profile.id),
         allowlistCheck(config, env),
         sandboxImageCheck(config),
+        ...(await automationSandboxChecks()),
         await opensandboxHealthCheck(opensandboxUrl, sandboxProvider.api_key_env, env),
     ];
     return {
@@ -39,6 +42,79 @@ async function runDeploymentDiagnostics(input) {
         checks,
     };
 }
+async function automationSandboxChecks() {
+    try {
+        const capability = await new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner().probe();
+        return automationSandboxDiagnosticChecks(capability);
+    }
+    catch (error) {
+        return [{
+                id: 'automation.sandbox',
+                label: 'Automation Sandbox Runtime',
+                status: 'fail',
+                summary: error instanceof Error ? error.message : String(error),
+            }];
+    }
+}
+/**
+ * Convert the runner's stable capability identifiers into one doctor row per
+ * host prerequisite. Operators can then repair only the failed capability.
+ */
+function automationSandboxDiagnosticChecks(capability) {
+    if (capability.platform === 'windows') {
+        return [{
+                id: 'automation.sandbox',
+                label: 'Automation scripts on Windows',
+                status: 'fail',
+                summary: 'Condition-script execution is unsupported on Windows and remains fail-closed.',
+            }];
+    }
+    const missing = new Set(capability.missing);
+    const unverified = new Set(capability.unverified || []);
+    const check = (id, label, capabilityId) => ({
+        id,
+        label,
+        status: missing.has(capabilityId) ? 'fail' : 'pass',
+        summary: unverified.has(capabilityId)
+            ? `${label} is blocked and could not be behaviorally verified because an earlier prerequisite failed.`
+            : missing.has(capabilityId) ? `${label} is unavailable.` : `${label} is available.`,
+    });
+    const runtimeMissing = missing.has('sandbox_runtime') || missing.has('sandbox_unavailable');
+    const aggregate = {
+        id: 'automation.sandbox',
+        label: 'Automation script sandbox',
+        status: capability.available ? 'pass' : 'fail',
+        summary: capability.available
+            ? `Automation script sandbox is available on ${capability.platform}.`
+            : `Automation scripts are blocked on ${capability.platform}; missing ${capability.missing.join(', ')}.`,
+    };
+    const runtime = {
+        id: 'automation.runtime',
+        label: 'Anthropic Sandbox Runtime',
+        status: runtimeMissing ? 'fail' : 'pass',
+        summary: runtimeMissing
+            ? `Anthropic Sandbox Runtime is unavailable on ${capability.platform}.`
+            : `Anthropic Sandbox Runtime is available on ${capability.platform}.`,
+    };
+    if (capability.platform === 'linux') {
+        return [
+            aggregate,
+            runtime,
+            check('automation.linux.bwrap', 'Bubblewrap (bwrap)', 'bwrap'),
+            check('automation.linux.socat', 'socat proxy bridge', 'socat'),
+            check('automation.linux.rg', 'ripgrep (rg)', 'rg'),
+            check('automation.linux.userns-apparmor', 'user namespace / AppArmor permission', 'apparmor.userns'),
+            check('automation.linux.network-namespace', 'network namespace support', 'network.namespace'),
+            check('automation.linux.seccomp', 'seccomp support', 'seccomp'),
+        ];
+    }
+    return [
+        aggregate,
+        runtime,
+        check('automation.macos.sandbox-exec', 'macOS sandbox-exec', 'sandbox-exec'),
+        check('automation.macos.rg', 'ripgrep (rg)', 'rg'),
+    ];
+}
 function dockerSocketCheck(profileId) {
     if (profileId === 'docker-compose') {
         return {

package/dist-electron/services/local-ai-core/src/runtime/handlers/automations-handler.js

@@ -0,0 +1,322 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerUnifiedAutomationHandlers = registerUnifiedAutomationHandlers;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_process_1 = __importDefault(require("node:process"));
+const anthropic_sandbox_runner_js_1 = require("../../automation/scripts/anthropic-sandbox-runner.js");
+const server_helpers_js_1 = require("../server-helpers.js");
+const request_validation_js_1 = require("../request-validation.js");
+/**
+ * Unified automation endpoints deliberately accept writable contract fields only.
+ * Package locations, hashes, interpreter facts, approval state, evaluation state,
+ * and health are created and maintained by server-owned services.
+ */
+function registerUnifiedAutomationHandlers(map, options) {
+    const { automations, store } = options;
+    const activeTestClaims = new Set();
+    const stagedPackageUsers = new Map();
+    const emitVersion = (version) => options.emitScriptVersion?.(version);
+    map.set('automations.list', async (_route, _req, res, url) => {
+        const workspaceId = requiredWorkspace(url);
+        (0, server_helpers_js_1.json)(res, 200, { automations: automations.list(workspaceId) });
+    });
+    map.set('automations.create', async (_route, req, res) => {
+        const body = await strictBody(req, {
+            workspaceId: { kind: 'string', required: true }, title: { kind: 'string', required: true }, enabled: { kind: 'boolean', required: true },
+            activation: { kind: 'object', required: true }, condition: { kind: 'object', required: true },
+            action: { kind: 'object', required: true }, delivery: { kind: 'object', required: true }, policies: { kind: 'object', required: true },
+        });
+        (0, server_helpers_js_1.json)(res, 200, automations.create(body));
+    });
+    map.set('automation.get', async (route, _req, res, url) => {
+        (0, server_helpers_js_1.json)(res, 200, requireAutomation(automations, automationId(route), requiredWorkspace(url)));
+    });
+    map.set('automation.update', async (route, req, res, url) => {
+        requireAutomation(automations, automationId(route), requiredWorkspace(url));
+        const body = await strictBody(req, {
+            title: 'string', enabled: 'boolean', activation: 'object', condition: 'object', action: 'object', delivery: 'object', policies: 'object',
+        });
+        if (Object.keys(body).length === 0)
+            throw new request_validation_js_1.RequestValidationError('Request body must update at least one writable Automation field.');
+        (0, server_helpers_js_1.json)(res, 200, automations.update(automationId(route), body));
+    });
+    map.set('automation.delete', async (route, _req, res, url) => {
+        requireAutomation(automations, automationId(route), requiredWorkspace(url));
+        (0, server_helpers_js_1.json)(res, 200, automations.delete(automationId(route)));
+    });
+    map.set('automation.check', async (route, _req, res, url) => {
+        requireAutomation(automations, automationId(route), requiredWorkspace(url));
+        (0, server_helpers_js_1.json)(res, 200, await automations.checkNow(automationId(route)));
+    });
+    map.set('automation.evaluations', async (route, _req, res, url) => {
+        requireAutomation(automations, automationId(route), requiredWorkspace(url));
+        (0, server_helpers_js_1.json)(res, 200, { evaluations: automations.listEvaluations(automationId(route)) });
+    });
+    map.set('automation.runs', async (route, _req, res, url) => {
+        requireAutomation(automations, automationId(route), requiredWorkspace(url));
+        (0, server_helpers_js_1.json)(res, 200, { runs: automations.listRuns(automationId(route)) });
+    });
+    map.set('automation-scripts.list', async (_route, _req, res, url) => {
+        const workspaceId = requiredWorkspace(url);
+        (0, server_helpers_js_1.json)(res, 200, { scripts: store.listAutomationScripts(workspaceId) });
+    });
+    map.set('automation-scripts.create', async (_route, req, res) => {
+        const body = await strictBody(req, {
+            workspaceId: { kind: 'string', required: true }, title: { kind: 'string', required: true }, description: 'string',
+        });
+        (0, server_helpers_js_1.json)(res, 200, store.createAutomationScript(body));
+    });
+    map.set('automation-script.get', async (route, _req, res, url) => {
+        (0, server_helpers_js_1.json)(res, 200, requireScript(store, scriptId(route), requiredWorkspace(url)));
+    });
+    map.set('automation-script.update', async (route, req, res, url) => {
+        requireScript(store, scriptId(route), requiredWorkspace(url));
+        const body = await strictBody(req, { title: 'string', description: 'string' });
+        if (Object.keys(body).length === 0)
+            throw new request_validation_js_1.RequestValidationError('Request body must update at least one writable script field.');
+        (0, server_helpers_js_1.json)(res, 200, store.updateAutomationScript(scriptId(route), body));
+    });
+    map.set('automation-script.versions', async (route, _req, res, url) => {
+        requireScript(store, scriptId(route), requiredWorkspace(url));
+        (0, server_helpers_js_1.json)(res, 200, { versions: store.listAutomationScriptVersions(scriptId(route)) });
+    });
+    map.set('automation-script.version.submit', async (route, req, res, url) => {
+        const id = scriptId(route);
+        requireScript(store, id, requiredWorkspace(url));
+        const body = await strictBody(req, {
+            files: { kind: 'array', required: true, elementKind: 'object' },
+        }, MAX_SOURCE_UPLOAD_BODY_BYTES);
+        let staged;
+        let committed = false;
+        let version;
+        try {
+            staged = store.stageAutomationScriptSource({ scriptId: id, files: validateSourceFiles(body.files) });
+            stagedPackageUsers.set(staged.packagePath, (stagedPackageUsers.get(staged.packagePath) || 0) + 1);
+            const interpreter = await resolveServerInterpreter(staged.shebang, staged.packagePath);
+            version = store.createAutomationScriptVersionFromStaged({
+                scriptId: id, staged, interpreterPath: interpreter.path, interpreterVersion: interpreter.version,
+            });
+            committed = true;
+        }
+        catch (error) {
+            throw error;
+        }
+        finally {
+            if (staged) {
+                const remaining = (stagedPackageUsers.get(staged.packagePath) || 1) - 1;
+                if (remaining <= 0) {
+                    stagedPackageUsers.delete(staged.packagePath);
+                    if (!committed)
+                        store.discardUnreferencedAutomationScriptPackage(id, staged);
+                }
+                else {
+                    stagedPackageUsers.set(staged.packagePath, remaining);
+                }
+            }
+        }
+        emitVersion(version);
+        (0, server_helpers_js_1.json)(res, 200, version);
+    });
+    map.set('automation-script-version.test-approval', async (route, req, res, url) => {
+        requireVersion(store, versionId(route), requiredWorkspace(url));
+        const { actor } = await strictBody(req, { actor: { kind: 'string', required: true } });
+        const approval = store.requestAutomationScriptTestApproval(versionId(route), actor);
+        emitVersion(store.getAutomationScriptVersion(versionId(route)));
+        (0, server_helpers_js_1.json)(res, 200, approval);
+    });
+    map.set('automation-script-version.test', async (route, req, res, url) => {
+        requireVersion(store, versionId(route), requiredWorkspace(url));
+        const { actor } = await strictBody(req, { actor: { kind: 'string', required: true } });
+        if (!options.executeScriptTest)
+            throw new Error('Automation script test executor is unavailable.');
+        if (activeTestClaims.has(versionId(route))) {
+            throw new request_validation_js_1.RequestValidationError('Automation script test is already executing.');
+        }
+        // Claim before awaiting the sandbox. A second request observes `testing` and
+        // cannot start a competing one-shot execution.
+        store.claimAutomationScriptTestExecution(versionId(route));
+        activeTestClaims.add(versionId(route));
+        try {
+            let report;
+            try {
+                report = await options.executeScriptTest(versionId(route), actor);
+            }
+            catch {
+                report = { status: 'failed', finishedAt: new Date().toISOString(), summary: 'Sandbox test execution failed.' };
+            }
+            try {
+                const version = store.recordAutomationScriptTestResult(versionId(route), report);
+                emitVersion(version);
+                (0, server_helpers_js_1.json)(res, 200, version);
+            }
+            catch (error) {
+                try {
+                    store.failClaimedAutomationScriptTestExecution(versionId(route));
+                }
+                catch { /* retry/lease recovery remains fail-closed */ }
+                throw error;
+            }
+        }
+        finally {
+            activeTestClaims.delete(versionId(route));
+        }
+    });
+    map.set('automation-script-version.enable-approval', async (route, req, res, url) => {
+        requireVersion(store, versionId(route), requiredWorkspace(url));
+        const { actor } = await strictBody(req, { actor: { kind: 'string', required: true } });
+        const approval = store.requestAutomationScriptEnableApproval(versionId(route), actor);
+        emitVersion(store.getAutomationScriptVersion(versionId(route)));
+        (0, server_helpers_js_1.json)(res, 200, approval);
+    });
+    for (const routeName of ['automation-script-version.approve', 'automation-script-version.reject']) {
+        map.set(routeName, async (route, req, res, url) => {
+            requireVersion(store, versionId(route), requiredWorkspace(url));
+            const { approvalId, actor } = await strictBody(req, {
+                approvalId: { kind: 'string', required: true }, actor: { kind: 'string', required: true },
+            });
+            const approval = store.getApprovalRequest(approvalId);
+            const expectedDecision = routeName === 'automation-script-version.approve' ? 'approved' : 'rejected';
+            if (!approval || approval.status !== expectedDecision) {
+                throw new request_validation_js_1.RequestValidationError(`Automation script ${routeName.endsWith('.approve') ? 'approve' : 'reject'} requires a ${expectedDecision} approval decision.`);
+            }
+            // Approval status is resolved by /approvals/:id/resolve. This route only
+            // applies the existing immutable approval decision to the matching version.
+            const current = store.getAutomationScriptVersion(versionId(route));
+            const version = current.status === 'pending_test_approval'
+                ? store.authorizeAutomationScriptTest(versionId(route), approvalId, actor)
+                : current.status === 'pending_approval'
+                    ? store.approveAutomationScriptVersion(versionId(route), approvalId, actor)
+                    : (() => { throw new request_validation_js_1.RequestValidationError(`Automation script version cannot apply an approval from ${current.status}.`); })();
+            emitVersion(version);
+            (0, server_helpers_js_1.json)(res, 200, version);
+        });
+    }
+    map.set('automation-script-version.revoke', async (route, req, res, url) => {
+        requireVersion(store, versionId(route), requiredWorkspace(url));
+        const { actor } = await strictBody(req, { actor: { kind: 'string', required: true } });
+        const version = store.revokeAutomationScriptVersion(versionId(route), actor);
+        emitVersion(version);
+        (0, server_helpers_js_1.json)(res, 200, version);
+    });
+}
+function requiredWorkspace(url) {
+    const workspaceId = url.searchParams.get('workspace_id')?.trim();
+    if (!workspaceId)
+        throw new request_validation_js_1.RequestValidationError('workspace_id is required.');
+    return workspaceId;
+}
+function requireAutomation(automations, automationId, workspaceId) {
+    const automation = automations.get(automationId);
+    if (!automation || automation.workspaceId !== workspaceId)
+        throw new request_validation_js_1.RequestValidationError('Automation was not found in this workspace.');
+    return automation;
+}
+function requireScript(store, scriptId, workspaceId) {
+    const script = store.getAutomationScript(scriptId);
+    if (!script || script.workspaceId !== workspaceId)
+        throw new request_validation_js_1.RequestValidationError('Automation script was not found in this workspace.');
+    return script;
+}
+function requireVersion(store, versionId, workspaceId) {
+    const version = store.getAutomationScriptVersion(versionId);
+    if (!version)
+        throw new request_validation_js_1.RequestValidationError('Automation script version was not found in this workspace.');
+    requireScript(store, version.scriptId, workspaceId);
+    return version;
+}
+function automationId(route) {
+    return route.automationId;
+}
+function scriptId(route) {
+    return route.scriptId;
+}
+function versionId(route) {
+    return route.versionId;
+}
+function validateSourceFiles(value) {
+    if (!Array.isArray(value))
+        throw new request_validation_js_1.RequestValidationError('Request body.files must be an array.');
+    return value.map((file, index) => {
+        if (!file || typeof file !== 'object' || Array.isArray(file)) {
+            throw new request_validation_js_1.RequestValidationError(`Request body.files[${index}] must be an object.`);
+        }
+        const record = file;
+        for (const key of Object.keys(record)) {
+            if (key !== 'path' && key !== 'content')
+                throw new request_validation_js_1.RequestValidationError(`Request body.files[${index}].${key} is not writable.`);
+        }
+        if (typeof record.path !== 'string' || !record.path.trim() || typeof record.content !== 'string') {
+            throw new request_validation_js_1.RequestValidationError(`Request body.files[${index}] requires text path and content.`);
+        }
+        return { path: record.path, content: record.content };
+    });
+}
+/** Derives interpreter facts from a staged shebang; no client path or version is trusted. */
+async function resolveServerInterpreter(shebang, packagePath) {
+    const tokens = shebang.replace(/^#!\s*/, '').trim().split(/\s+/).filter(Boolean);
+    if (tokens.length !== 1 && !(tokens.length === 2 && tokens[0] === '/usr/bin/env')) {
+        throw new request_validation_js_1.RequestValidationError('Automation script shebang must name one interpreter (or /usr/bin/env NAME).');
+    }
+    const requested = tokens[0] === '/usr/bin/env' ? resolvePathInterpreter(tokens[1]) : tokens[0];
+    if (!(0, node_path_1.isAbsolute)(requested) || !(0, node_fs_1.existsSync)(requested)) {
+        throw new request_validation_js_1.RequestValidationError('Automation script shebang interpreter is unavailable on this server.');
+    }
+    let interpreterPath;
+    try {
+        (0, node_fs_1.accessSync)(requested, node_fs_1.constants.X_OK);
+        interpreterPath = (0, node_fs_1.realpathSync)(requested);
+    }
+    catch {
+        throw new request_validation_js_1.RequestValidationError('Automation script shebang interpreter is not executable on this server.');
+    }
+    const sandbox = (0, anthropic_sandbox_runner_js_1.createAnthropicSandboxRunner)();
+    const probe = await sandbox.probe();
+    if (!probe.available)
+        throw new Error(`sandbox_unavailable: ${probe.missing.join(', ') || probe.platform}`);
+    const result = await sandbox.run({
+        command: `${quoteShell(interpreterPath)} --version`,
+        interpreterPath,
+        cwd: packagePath,
+        packagePath,
+        network: 'none',
+        timeoutMs: 5_000,
+        stdoutBytes: 16_384,
+        stderrBytes: 16_384,
+    });
+    if (result.exitCode !== 0 || result.signal || result.outputLimitExceeded || !result.stdout.trim()) {
+        throw new request_validation_js_1.RequestValidationError('Automation script interpreter version probe failed in the sandbox.');
+    }
+    return { path: interpreterPath, version: result.stdout.trim() };
+}
+function resolvePathInterpreter(name) {
+    if (!/^[A-Za-z0-9._+-]+$/.test(name))
+        throw new request_validation_js_1.RequestValidationError('Automation script env shebang interpreter name is invalid.');
+    for (const directory of String(node_process_1.default.env.PATH || '').split(node_path_1.delimiter).filter(Boolean)) {
+        const candidate = (0, node_path_1.join)(directory, name);
+        try {
+            (0, node_fs_1.accessSync)(candidate, node_fs_1.constants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Only server PATH entries are considered for /usr/bin/env resolution.
+        }
+    }
+    throw new request_validation_js_1.RequestValidationError('Automation script env shebang interpreter is unavailable on this server.');
+}
+function quoteShell(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+const MAX_SOURCE_UPLOAD_BODY_BYTES = 1_200_000;
+async function strictBody(req, schema, maxBytes) {
+    const body = await (0, server_helpers_js_1.readJsonBody)(req, maxBytes);
+    const allowed = new Set(Object.keys(schema));
+    for (const field of Object.keys(body)) {
+        if (!allowed.has(field))
+            throw new request_validation_js_1.RequestValidationError(`Request body.${field} is not writable.`);
+    }
+    return (0, request_validation_js_1.validateBody)(body, schema);
+}

package/dist-electron/services/local-ai-core/src/runtime/local-core-controller.js

@@ -20,6 +20,8 @@ class LocalCoreController extends node_events_1.EventEmitter {
     externalService;
     scheduledJobs;
     automationMonitors;
+    automations;
+    automationActionExecutor;
     runtimeDetection;
     kernel;
     errorReporter;
@@ -58,6 +60,18 @@ class LocalCoreController extends node_events_1.EventEmitter {
             runMonitorNow: async () => { throw new Error('Automation monitor service is not available.'); },
             listRuns: () => [],
         };
+        this.automations = this.runtime.automations || {
+            list: () => [],
+            get: () => undefined,
+            create: () => { throw new Error('Automation service is not available.'); },
+            update: () => { throw new Error('Automation service is not available.'); },
+            delete: () => ({ deleted: false }),
+            checkNow: async () => { throw new Error('Automation service is not available.'); },
+            listEvaluations: () => [],
+            listRuns: () => [],
+            getRuntimeStatus: () => ({ status: 'stopped' }),
+        };
+        this.automationActionExecutor = this.runtime.automationActionExecutor;
         this.errorReporter = new local_core_errors_js_1.LocalCoreErrorReporter((message) => this.handleLog(message));
         this.runtimeDetection = new runtime_detection_service_js_1.RuntimeDetectionService({
             userDataPath,
@@ -78,6 +92,12 @@ class LocalCoreController extends node_events_1.EventEmitter {
             this.emit('automation-monitor', monitor);
         }), this.kernel.context.bus.on('automation.monitor.run.updated', (run) => {
             this.emit('automation-monitor-run', run);
+        }), this.kernel.context.bus.on('automation.definition.updated', (automation) => {
+            this.emit('automation-definition', automation);
+        }), this.kernel.context.bus.on('automation.evaluation.updated', (evaluation) => {
+            this.emit('automation-evaluation', evaluation);
+        }), this.kernel.context.bus.on('automation.run.updated', (run) => {
+            this.emit('automation-run', run);
         }), this.kernel.context.bus.on('runtime.state.changed', () => {
             void this.emitRuntime();
         }), this.kernel.context.bus.on('localcore.error', (event) => {

package/dist-electron/services/local-ai-core/src/runtime/managed-skill-catalog.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedSkillCatalog = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** Loads packaged skills by name without constructing instructions from user input. */
+class ManagedSkillCatalog {
+    rootDir;
+    constructor(options = {}) {
+        this.rootDir = (0, node_path_1.resolve)(options.rootDir || resolveManagedSkillsRoot());
+    }
+    get(id) {
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(id))
+            return undefined;
+        const path = (0, node_path_1.resolve)(this.rootDir, id, 'SKILL.md');
+        if (!path.startsWith(`${this.rootDir}/`) || !(0, node_fs_1.existsSync)(path))
+            return undefined;
+        return { id, content: (0, node_fs_1.readFileSync)(path, 'utf8') };
+    }
+    /** Resolves a packaged helper only when it belongs to the declared managed skill. */
+    getHelperPath(id, relativePath) {
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(id))
+            return undefined;
+        if (!/^(?:[a-z0-9][a-z0-9._-]*\/)*[a-z0-9][a-z0-9._-]*$/.test(relativePath))
+            return undefined;
+        const skillRoot = (0, node_path_1.resolve)(this.rootDir, id);
+        const path = (0, node_path_1.resolve)(skillRoot, relativePath);
+        if (!path.startsWith(`${skillRoot}/`) || !(0, node_fs_1.existsSync)(path))
+            return undefined;
+        return path;
+    }
+}
+exports.ManagedSkillCatalog = ManagedSkillCatalog;
+function resolveManagedSkillsRoot() {
+    const packaged = (0, node_path_1.resolve)(process.cwd(), 'dist-electron', 'electron', 'managed-skills');
+    return (0, node_fs_1.existsSync)(packaged) ? packaged : (0, node_path_1.resolve)(process.cwd(), 'electron', 'managed-skills');
+}

package/dist-electron/services/local-ai-core/src/runtime/server-helpers.js

@@ -40,8 +40,8 @@ function jsonError(res, statusCode, error) {
     res.setHeader('Content-Type', 'application/json; charset=utf-8');
     res.end(JSON.stringify((0, local_core_errors_js_1.errorInfoToHttpBody)(info)));
 }
-async function readJsonBody(req) {
-    const body = await readRawBody(req);
+async function readJsonBody(req, maxBytes) {
+    const body = await readRawBody(req, maxBytes);
     if (!body.length) {
         return {};
     }
@@ -55,10 +55,20 @@ async function readJsonBody(req) {
         throw new request_validation_js_1.RequestValidationError('Request body must contain valid JSON.');
     }
 }
-async function readRawBody(req) {
+async function readRawBody(req, maxBytes) {
+    const contentLength = Number(req.headers?.['content-length'] || '');
+    if (maxBytes !== undefined && Number.isFinite(contentLength) && contentLength > maxBytes) {
+        throw new request_validation_js_1.RequestValidationError(`Request body exceeds ${maxBytes} bytes.`);
+    }
     const chunks = [];
+    let total = 0;
     for await (const chunk of req) {
-        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.byteLength;
+        if (maxBytes !== undefined && total > maxBytes) {
+            throw new request_validation_js_1.RequestValidationError(`Request body exceeds ${maxBytes} bytes.`);
+        }
+        chunks.push(buffer);
     }
     return Buffer.concat(chunks);
 }