npm - @kb-labs/host-agent-app - Versions diffs - 0.3.0 → 2.6.0 - Mend

@kb-labs/host-agent-app 0.3.0 → 2.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/README.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # TODO

package/dist/index.js CHANGED Viewed

@@ -15,6 +15,7 @@ var LocalPluginResolver = class {
   constructor(allowedPaths) {
     this.allowedPaths = allowedPaths;
   }
+  allowedPaths;
   cache = /* @__PURE__ */ new Map();
   scanned = false;
   /**
@@ -142,6 +143,7 @@ var ExecutionHandler = class {
     this.pluginResolver = new LocalPluginResolver(opts.allowedPaths);
     this.journalCleanupTimer = setInterval(() => this.cleanupJournal(), JOURNAL_TTL_MS);
   }
+  opts;
   pluginResolver;
   journal = /* @__PURE__ */ new Map();
   journalCleanupTimer;

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/handlers/local-plugin-resolver.ts","../src/handlers/execution-handler.ts","../src/daemon.ts","../src/index.ts"],"names":["join","readFile"],"mappings":";;;;;;;;;;;;;AAkCO,IAAM,sBAAN,MAA0B;AAAA,EAI/B,YAA6B,YAAA,EAAwB;AAAxB,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAAA,EAAyB;AAAA,EAH9C,KAAA,uBAAY,GAAA,EAA2B;AAAA,EACvC,OAAA,GAAU,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlB,MAAM,OAAA,CAAQ,QAAA,EAAkB,UAAA,EAA6C;AAC3E,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,KAAK,IAAA,EAAK;AAAA,IAClB;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,QAAQ,iBAAiB,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACpG;AAGA,IAAA,MAAM,UAAA,GAAa,UAAU,UAAU,CAAA;AACvC,IAAA,IAAI,UAAA,CAAW,WAAW,IAAI,CAAA,IAAK,WAAW,QAAA,CAAS,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA,EAAG;AAClE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,UAAU,CAAA,CAAE,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,KAAA,CAAM,IAAA,EAAM,UAAU,CAAA;AAGlD,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,WAAW,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,WAAW,CAAA,CAAE,CAAA;AAAA,IAC1D;AAIA,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAW,CAAA;AAC9C,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA;AAC1C,IAAA,IAAI,CAAC,WAAA,CAAY,UAAA,CAAW,WAAW,GAAG,CAAA,IAAK,gBAAgB,QAAA,EAAU;AACvE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,WAAW,CAAA,CAAE,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,EAAE,UAAA,EAAY,KAAA,CAAM,IAAA,EAAM,WAAA,EAAY;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,GAA+C;AACnD,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,KAAK,IAAA,EAAK;AAAA,IAClB;AACA,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,IAAI,CAAA,CAAA,MAAM;AAAA,MACxC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,MAAM,CAAA,CAAE;AAAA,KACV,CAAE,CAAA;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,MAAM,KAAK,IAAA,EAAK;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,IAAA,GAAsB;AAClC,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,YAAA,EAAc;AACxC,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,IACtC;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA,EAEA,MAAc,QAAQ,GAAA,EAA4B;AAEhD,IAAA,MAAM,IAAA,CAAK,gBAAgB,GAAG,CAAA;AAG9B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,QAAQ,GAAG,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,KAAU,cAAA,IAAkB,UAAU,MAAA,EAAQ;AACzE,QAAA;AAAA,MACF;AACA,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA;AAChC,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,QAAQ,CAAA;AAC7B,QAAA,IAAI,CAAA,CAAE,aAAY,EAAG;AACnB,UAAA,MAAM,IAAA,CAAK,gBAAgB,QAAQ,CAAA;AAGnC,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,EAAU,UAAU,CAAA;AACxC,UAAA,IAAI;AACF,YAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,MAAM,CAAA;AACvC,YAAA,KAAA,MAAW,OAAO,UAAA,EAAY;AAC5B,cAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AAAE,gBAAA;AAAA,cAAU;AACrC,cAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,EAAQ,GAAG,CAAA;AAChC,cAAA,MAAM,UAAU,MAAM,IAAA,CAAK,OAAO,CAAA,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACpD,cAAA,IAAI,OAAA,EAAS,aAAY,EAAG;AAC1B,gBAAA,MAAM,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,cACpC;AAAA,YACF;AAAA,UACF,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,gBAAgB,GAAA,EAA4B;AAExD,IAAA,KAAA,MAAW,YAAA,IAAgB,CAAC,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,eAAe,CAAA,EAAG,IAAA,CAAK,GAAA,EAAK,eAAe,CAAC,CAAA,EAAG;AAC3F,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,YAAA,EAAc,OAAO,CAAA;AAChD,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAE/B,QAAA,IAAI,QAAA,CAAS,EAAA,IAAM,QAAA,CAAS,OAAA,EAAS;AACnC,UAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI;AAAA,YAC1B,IAAI,QAAA,CAAS,EAAA;AAAA,YACb,SAAS,QAAA,CAAS,OAAA;AAAA,YAClB,IAAA,EAAM;AAAA,WACP,CAAA;AACD,UAAA;AAAA,QACF;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF,CAAA;;;ACjHA,IAAM,cAAA,GAAiB,IAAI,EAAA,GAAK,GAAA;AAIzB,IAAM,mBAAN,MAAuB;AAAA,EAK5B,YAA6B,IAAA,EAA+B;AAA/B,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAC3B,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAI,mBAAA,CAAoB,IAAA,CAAK,YAAY,CAAA;AAG/D,IAAA,IAAA,CAAK,sBAAsB,WAAA,CAAY,MAAM,IAAA,CAAK,cAAA,IAAkB,cAAc,CAAA;AAAA,EACpF;AAAA,EATQ,cAAA;AAAA,EACA,OAAA,uBAAc,GAAA,EAA0B;AAAA,EACxC,mBAAA;AAAA;AAAA,EAUR,IAAA,GAAa;AACX,IAAA,aAAA,CAAc,KAAK,mBAAmB,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,OAAO,IAAA,EAAwC;AACnD,IAAA,QAAQ,KAAK,MAAA;AAAQ,MACnB,KAAK,SAAA;AACH,QAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAqB,CAAA;AAAA,MACtD,KAAK,UAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAS;AAAA,MACvB;AACE,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA;AAC9D,EACF;AAAA;AAAA,EAGA,MAAc,QAAA,GAA4C;AACxD,IAAA,OAAO,IAAA,CAAK,eAAe,WAAA,EAAY;AAAA,EACzC;AAAA;AAAA,EAGA,MAAc,QAAQ,OAAA,EAA6C;AACjE,IAAA,MAAM,EAAE,WAAA,EAAa,QAAA,EAAU,YAAY,KAAA,EAAO,UAAA,EAAY,WAAU,GAAI,OAAA;AAG5E,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC7C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI,QAAA,CAAS,WAAW,WAAA,EAAa;AACnC,QAAA,IAAI,SAAS,KAAA,EAAO;AAClB,UAAA,MAAM,IAAI,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA;AAAA,QAChC;AACA,QAAA,OAAO,QAAA,CAAS,MAAA;AAAA,MAClB;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,WAAW,CAAA,oBAAA,CAAsB,CAAA;AAAA,IAChE;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAW,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAG1E,IAAA,IAAI,KAAK,IAAA,CAAK,cAAA,IAAkB,KAAK,IAAA,CAAK,cAAA,CAAe,SAAS,CAAA,EAAG;AACnE,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,QAAA,CAAS,QAAQ,CAAA,EAAG;AAChD,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,WAAW,CAAA;AAC/B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,QAAQ,CAAA,CAAE,CAAA;AAAA,MACnD;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,IAAc,CAAC,UAAA,CAAW,WAAA,EAAa;AACzC,MAAA,UAAA,CAAW,WAAA,GAAc;AAAA,QACvB,EAAA,EAAI,EAAE,IAAA,EAAM,CAAC,GAAG,CAAA,EAAG,KAAA,EAAO,CAAC,GAAG,CAAA,EAAE;AAAA,QAChC,OAAA,EAAS,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,QACrB,GAAA,EAAK,EAAE,IAAA,EAAM,EAAC,EAAE;AAAA,QAChB,QAAA,EAAU,EAAE,GAAA,EAAK,IAAA,EAAM,OAAO,IAAA;AAAK,OACrC;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,UAAU,UAAU,CAAA;AAGvE,IAAA,MAAM,aAAA,GAAgB,MAAM,mBAAA,CAAoB;AAAA,MAC9C,SAAA,EAAW,KAAK,IAAA,CAAK;AAAA,KACtB,CAAA;AAID,IAAA,MAAM,gBAAA,GAAmB,SAAA,IAAa,IAAA,CAAK,IAAA,CAAK,SAAA;AAChD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,gBAAgB,CAAA;AAEnE,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,aAAA,KAAkB,YAAA,GACvC,MAAM,IAAA,CAAK,mBAAA,CAAoB,QAAA,EAAU,UAAA,EAAY,KAAA,EAAO,aAAA,EAAe,kBAAkB,UAAA,CAAW,MAAM,CAAA,GAC9G,MAAM,IAAA,CAAK,gBAAA,CAAiB,UAAU,UAAA,EAAY,KAAA,EAAO,aAAA,EAAe,UAAA,CAAW,MAAM,CAAA;AAG7F,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,WAAA,EAAa;AAAA,QAC5B,MAAA,EAAQ,WAAA;AAAA,QACR,MAAA;AAAA,QACA,SAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,CAAG;AAAA,OAC3C,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,WAAA,EAAa;AAAA,QAC5B,MAAA,EAAQ,WAAA;AAAA,QACR,KAAA,EAAO,OAAA;AAAA,QACP,SAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,CAAG;AAAA,OAC3C,CAAA;AAED,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,gBAAA,CACZ,QAAA,EACA,UAAA,EACA,KAAA,EACA,eACA,MAAA,EACkB;AAClB,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa;AAAA,MAChC,UAAA;AAAA,MACA,QAAA,EAAU,aAAA;AAAA,MACV,EAAA,EAAI,MAAA;AAAA,MACJ,aAAa,QAAA,CAAS,WAAA;AAAA,MACtB,KAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAK,QAAA,CAAS;AAAA,KACf,CAAA;AACD,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAc,mBAAA,CACZ,QAAA,EACA,YACA,KAAA,EACA,aAAA,EACA,WACA,MAAA,EACkB;AAElB,IAAA,MAAM,aAAaA,IAAAA,CAAK,MAAA,IAAU,CAAA,YAAA,EAAe,UAAA,EAAY,CAAA,KAAA,CAAO,CAAA;AAGpE,IAAA,MAAM,eAAe,IAAI,gBAAA,CAAiB,aAAA,EAAe,EAAE,YAAY,CAAA;AACvE,IAAA,MAAM,aAAa,KAAA,EAAM;AAEzB,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB;AAAA,QACnC,UAAA;AAAA,QACA,UAAA;AAAA,QACA,aAAa,QAAA,CAAS,WAAA;AAAA,QACtB,KAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAK,QAAA,CAAS;AAAA,OACf,CAAA;AACD,MAAA,OAAO,MAAA,CAAO,IAAA;AAAA,IAChB,CAAA,SAAE;AACA,MAAA,MAAM,aAAa,KAAA,EAAM;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGQ,cAAA,GAAuB;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,OAAA,EAAS;AACtC,MAAA,IAAI,MAAM,MAAA,KAAW,WAAA,IAAe,GAAA,GAAM,KAAA,CAAM,YAAY,cAAA,EAAgB;AAC1E,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACF,CAAA;;;AC5OA,IAAM,iBAAA,GAAoBA,IAAAA,CAAK,OAAA,EAAQ,EAAG,OAAO,YAAY,CAAA;AAC7D,IAAM,aAAA,GAAgB,OAAA;AAEtB,eAAe,kBAAA,CAAmB,KAAe,OAAA,EAAqC;AACpF,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AAAE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,OAAA,EAAU,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EAAG;AAClE,EAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC9C,EAAA,IAAI,CAAC,EAAA,CAAG,QAAA,CAAS,kBAAkB,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,2BAAA,EAA8B,EAAE,CAAA,CAAE,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,IAAA,GAAgB,MAAM,GAAA,CAAI,IAAA,EAAK;AACrC,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,SAAA,CAAU,IAAI,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,OAAO,6BAA6B,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAEA,SAAS,eAAA,CAAgB,KAAa,OAAA,EAAuB;AAC3D,EAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,UAAA,CAAW,kBAAkB,CAAA,IAAK,CAAC,GAAA,CAAI,UAAA,CAAW,kBAAkB,CAAA,EAAG;AAC7G,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,mDAAA,EAAiD,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,EACnF;AACF;AAEA,eAAe,WAAA,CAAY,UAAA,EAAoB,QAAA,EAAkB,YAAA,EAA0C;AACzG,EAAA,eAAA,CAAgB,YAAY,aAAa,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,WAAA,CAAA,EAAe;AAAA,IAClD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,cAAc;AAAA,GAChD,CAAA;AACD,EAAA,OAAO,kBAAA,CAAmB,KAAK,aAAa,CAAA;AAC9C;AAEA,eAAe,aAAA,CAAc,YAAoB,YAAA,EAA0C;AACzF,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,aAAA,CAAA,EAAiB;AAAA,IACpD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,cAAc;AAAA,GACtC,CAAA;AACD,EAAA,OAAO,kBAAA,CAAmB,KAAK,eAAe,CAAA;AAChD;AAEA,eAAsB,WAAA,GAA6B;AAEjD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMC,QAAAA,CAAS,iBAAA,EAAmB,OAAO,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,iBAAiB,CAAA,gCAAA,CAAkC,CAAA;AAAA,EAClG;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,iBAAiB,CAAA,uBAAA,CAAyB,CAAA;AAAA,EAC/E;AACA,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,SAAA,CAAU,MAAM,CAAA;AACjD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,IAAA;AAGtB,EAAA,IAAI,WAAA,GAAmC,IAAA;AAEvC,EAAA,MAAM,YAAA,GAAe,IAAI,YAAA,CAAa;AAAA,IACpC,WAAA,EAAa,MAAM,WAAA,CAAY,MAAA,CAAO,YAAY,MAAA,CAAO,QAAA,EAAU,OAAO,YAAY,CAAA;AAAA,IACtF,eAAe,CAAC,EAAA,KAAO,aAAA,CAAc,MAAA,CAAO,YAAY,EAAE,CAAA;AAAA,IAC1D,aAAa,MAAM;AAEjB,MAAA,WAAA,IAAc;AAAA,IAChB,CAAA;AAAA,IACA,eAAA,EAAiB,CAAC,GAAA,KAAQ;AACxB,MAAA,OAAA,CAAQ,KAAA,CAAM,8DAAA,EAAgE,GAAA,CAAI,OAAO,CAAA;AACzF,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,GACD,CAAA;AAGD,EAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,EAAA,MAAM,aAAA,GAAgB,IAAI,aAAA,CAAc;AAAA,IACtC,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,YAAA,EAAc,aAAA;AAAA,IACd,YAAA,EAAc,CAAC,YAAA,EAAc,KAAA,EAAO,WAAW,CAAA;AAAA,IAC/C,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,cAAA,EAAgB,MAAM,YAAA,CAAa,WAAA;AAAA,IACnC,WAAA,EAAa,CAAC,MAAA,EAAQ,SAAA,KAAc;AAClC,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,oCAAA,EAAuC,MAAM,CAAA,SAAA,EAAY,SAAS,CAAA,CAAE,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,gBAAgB,MAAM;AACpB,MAAA,SAAA,GAAY,KAAA;AACZ,MAAA,OAAA,CAAQ,IAAI,iDAAiD,CAAA;AAAA,IAC/D,CAAA;AAAA,IACA,gBAAgB,YAAY;AAAA,IAE5B;AAAA,GACD,CAAA;AAED,EAAA,WAAA,GAAc,MAAM;AAClB,IAAA,aAAA,CAAc,IAAA,EAAK;AACnB,IAAA,KAAK,cAAc,OAAA,EAAQ;AAAA,EAC7B,CAAA;AAGA,EAAA,MAAM,SAAA,GAAY,IAAI,iBAAA,CAAkB;AAAA,IACtC,cAAc,MAAA,CAAO;AAAA,GACtB,CAAA;AACD,EAAA,aAAA,CAAc,gBAAgB,YAAA,EAAc,CAAC,SAAS,SAAA,CAAU,MAAA,CAAO,IAAI,CAAC,CAAA;AAE5E,EAAA,MAAM,gBAAgB,IAAI,aAAA,CAAc,EAAE,YAAA,EAAc,MAAA,CAAO,gBAAgB,CAAA;AAC/E,EAAA,aAAA,CAAc,gBAAgB,QAAA,EAAU,CAAC,SAAS,aAAA,CAAc,MAAA,CAAO,IAAI,CAAC,CAAA;AAE5E,EAAA,MAAM,eAAe,IAAI,YAAA,CAAa,EAAE,YAAA,EAAc,MAAA,CAAO,gBAAgB,CAAA;AAC7E,EAAA,aAAA,CAAc,gBAAgB,OAAA,EAAS,CAAC,SAAS,YAAA,CAAa,MAAA,CAAO,IAAI,CAAC,CAAA;AAG1E,EAAA,MAAM,gBAAA,GAAmB,IAAI,gBAAA,CAAiB,aAAA,EAAe;AAAA,IAC3D,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,QAAQ,MAAA,CAAO;AAAA,GAChB,CAAA;AAED,EAAA,MAAM,gBAAA,GAAmB,IAAI,gBAAA,CAAiB;AAAA,IAC5C,gBAAA;AAAA,IACA,cAAc,MAAA,CAAO,cAAA;AAAA,IACrB,aAAA,EAAe,OAAO,SAAA,CAAU,IAAA;AAAA,IAChC,SAAA,EAAW,OAAO,SAAA,CAAU,SAAA;AAAA,IAC5B,cAAA,EAAgB,OAAO,SAAA,CAAU;AAAA,GAClC,CAAA;AAED,EAAA,aAAA,CAAc,gBAAgB,WAAA,EAAa,CAAC,SAAS,gBAAA,CAAiB,MAAA,CAAO,IAAI,CAAC,CAAA;AAGlF,EAAA,MAAM,YAAA,GAAe,eAAA,CAAgB,EAAE,IAAA,EAAM,QAAQ,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAI,SAAA,CAAU;AAAA,IAC9B,SAAA,EAAW,YAAA;AAAA,IACX,WAAW,OAAO;AAAA,MAChB,SAAA;AAAA,MACA,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,cAAc,CAAC;AAAA,KACjB,CAAA;AAAA,IACA;AAAA,GACD,CAAA;AAGD,EAAA,MAAM,aAAa,KAAA,EAAM;AACzB,EAAA,OAAA,CAAQ,IAAI,kCAAkC,CAAA;AAE9C,EAAA,MAAM,cAAc,OAAA,EAAQ;AAC5B,EAAA,MAAM,UAAU,KAAA,EAAM;AACtB,EAAA,OAAA,CAAQ,IAAI,yCAAyC,CAAA;AAGrD,EAAA,MAAM,WAAW,MAAY;AAC3B,IAAA,OAAA,CAAQ,IAAI,oCAAoC,CAAA;AAChD,IAAA,gBAAA,CAAiB,IAAA,EAAK;AACtB,IAAA,YAAA,CAAa,IAAA,EAAK;AAClB,IAAA,aAAA,CAAc,IAAA,EAAK;AACnB,IAAA,SAAA,CAAU,IAAA,EAAK;AACf,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB,CAAA;AAEA,EAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAC9B,EAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC/B;;;ACzLA,WAAA,EAAY,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAC3B,EAAA,OAAA,CAAQ,KAAA,CAAM,6BAA6B,GAAG,CAAA;AAC9C,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB,CAAC,CAAA","file":"index.js","sourcesContent":["/*\n LocalPluginResolver — resolves pluginId → local handler path on Workspace Agent.\n \n Scans workspacePaths for plugin manifests, caches the mapping.\n * Workspace Agent owns path resolution — Platform sends pluginId, not paths.\n \n Security:\n * - Paths validated against allowedPaths\n * - No '..' or symlink escape\n * - handlerRef normalized and resolved relative to pluginRoot\n \n @see ADR-0017: Workspace Agent Architecture (INV-1: plugin executes where files are)\n /\n\nimport { resolve, normalize, join, sep } from 'node:path';\nimport { readdir, readFile, stat, realpath } from 'node:fs/promises';\n\nexport interface ResolvedPlugin {\n pluginRoot: string;\n handlerPath: string;\n}\n\nexport interface PluginInventoryEntry {\n id: string;\n version: string;\n root: string;\n}\n\ninterface ManifestEntry {\n id: string;\n version: string;\n root: string;\n}\n\nexport class LocalPluginResolver {\n private cache = new Map<string, ManifestEntry>();\n private scanned = false;\n\n constructor(private readonly allowedPaths: string[]) {}\n\n /\n Resolve pluginId + handlerRef → absolute paths.\n * Scans allowedPaths for manifests on first call (cached).\n /\n async resolve(pluginId: string, handlerRef: string): Promise<ResolvedPlugin> {\n if (!this.scanned) {\n await this.scan();\n }\n\n const entry = this.cache.get(pluginId);\n if (!entry) {\n throw new Error(`Plugin not found: ${pluginId}. Available: [${[...this.cache.keys()].join(', ')}]`);\n }\n\n // Validate handlerRef: no traversal\n const normalized = normalize(handlerRef);\n if (normalized.startsWith('..') \|\| normalized.includes(`..${sep}`)) {\n throw new Error(`Invalid handlerRef (path traversal): ${handlerRef}`);\n }\n\n const handlerPath = resolve(entry.root, normalized);\n\n // Verify file exists first\n try {\n await stat(handlerPath);\n } catch {\n throw new Error(`Handler file not found: ${handlerPath}`);\n }\n\n // Ensure resolved path is within pluginRoot (no symlink escape)\n // Use realpath to resolve symlinks on both sides before comparison\n const realHandler = await realpath(handlerPath);\n const realRoot = await realpath(entry.root);\n if (!realHandler.startsWith(realRoot + sep) && realHandler !== realRoot) {\n throw new Error(`Handler path escapes plugin root: ${handlerPath}`);\n }\n\n return { pluginRoot: entry.root, handlerPath };\n }\n\n /\n Return plugin inventory for hello message / discover capability.\n /\n async listPlugins(): Promise<PluginInventoryEntry[]> {\n if (!this.scanned) {\n await this.scan();\n }\n return [...this.cache.values()].map(e => ({\n id: e.id,\n version: e.version,\n root: e.root,\n }));\n }\n\n /\n Force rescan (e.g., after plugin install).\n /\n async rescan(): Promise<void> {\n this.cache.clear();\n this.scanned = false;\n await this.scan();\n }\n\n /\n Scan allowedPaths for plugin manifests.\n * Looks for dist/manifest.json or manifest.json in directories.\n /\n private async scan(): Promise<void> {\n for (const basePath of this.allowedPaths) {\n await this.scanDir(resolve(basePath));\n }\n this.scanned = true;\n }\n\n private async scanDir(dir: string): Promise<void> {\n // Check if dir itself has a manifest\n await this.tryLoadManifest(dir);\n\n // Scan subdirectories (one level deep — workspace packages)\n let entries: string[];\n try {\n entries = await readdir(dir);\n } catch {\n return;\n }\n\n for (const entry of entries) {\n if (entry.startsWith('.') \|\| entry === 'node_modules' \|\| entry === 'dist') {\n continue;\n }\n const fullPath = join(dir, entry);\n try {\n const s = await stat(fullPath);\n if (s.isDirectory()) {\n await this.tryLoadManifest(fullPath);\n\n // Also check packages/ subdirectory (monorepo layout)\n const pkgDir = join(fullPath, 'packages');\n try {\n const pkgEntries = await readdir(pkgDir);\n for (const pkg of pkgEntries) {\n if (pkg.startsWith('.')) { continue; }\n const pkgPath = join(pkgDir, pkg);\n const pkgStat = await stat(pkgPath).catch(() => null);\n if (pkgStat?.isDirectory()) {\n await this.tryLoadManifest(pkgPath);\n }\n }\n } catch {\n // no packages/ dir — skip\n }\n }\n } catch {\n continue;\n }\n }\n }\n\n private async tryLoadManifest(dir: string): Promise<void> {\n // Try dist/manifest.json first (built), then manifest.json (source)\n for (const manifestPath of [join(dir, 'dist', 'manifest.json'), join(dir, 'manifest.json')]) {\n try {\n const raw = await readFile(manifestPath, 'utf-8');\n const manifest = JSON.parse(raw) as { id?: string; version?: string; schema?: string };\n\n if (manifest.id && manifest.version) {\n this.cache.set(manifest.id, {\n id: manifest.id,\n version: manifest.version,\n root: dir,\n });\n return;\n }\n } catch {\n // no manifest here — continue\n }\n }\n }\n}\n","/\n ExecutionHandler — capability handler for plugin execution on Workspace Agent.\n \n Receives ExecutionRequest from Platform (via Gateway WS call),\n * executes plugin handler locally using plugin-runtime with proxy platform.\n \n Flow:\n * Platform → Gateway → WS call(adapter:'execution', method:'execute')\n * → ExecutionHandler.handle()\n * → LocalPluginResolver.resolve(pluginId) → local path\n * → createProxyPlatform(GatewayTransport) → proxy LLM/cache/etc\n * → runInProcess(descriptor, proxyPlatform, handlerPath, input)\n * → plugin handler executes (npm packages work natively)\n * → result → WS response → Gateway → Platform\n \n Security:\n * - Paths validated via LocalPluginResolver (no traversal, no escape)\n * - Plugin allowlist enforcement\n * - Execution journal for idempotency (at-most-once)\n * - Timeout via AbortSignal\n \n @see ADR-0017: Workspace Agent Architecture\n * @see ADR-0053: Delivery Semantics\n /\n\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path';\nimport { tmpdir } from 'node:os';\nimport type { CapabilityCall } from '@kb-labs/host-agent-contracts';\nimport type { GatewayTransport } from '@kb-labs/host-agent-core';\nimport { createProxyPlatform, UnixSocketServer } from '@kb-labs/core-runtime';\nimport { runInProcess, runInSubprocess } from '@kb-labs/plugin-runtime';\nimport { noopUI } from '@kb-labs/plugin-contracts';\nimport type { PluginContextDescriptor } from '@kb-labs/plugin-contracts';\nimport { LocalPluginResolver, type PluginInventoryEntry } from './local-plugin-resolver.js';\n\n// ── Types ──\n\ninterface ExecutionRequest {\n executionId: string;\n pluginId: string;\n handlerRef: string;\n exportName?: string;\n input: unknown;\n descriptor: PluginContextDescriptor;\n timeoutMs?: number;\n}\n\ninterface JournalEntry {\n status: 'started' \| 'completed';\n result?: unknown;\n error?: string;\n startedAt: number;\n}\n\nexport interface ExecutionHandlerOptions {\n gatewayTransport: GatewayTransport;\n allowedPaths: string[];\n executionMode: 'in-process' \| 'subprocess';\n timeoutMs: number;\n allowedPlugins?: string[];\n}\n\n// ── Constants ──\n\nconst JOURNAL_TTL_MS = 5 60 * 1000; // 5 minutes\n\n// ── Handler ──\n\nexport class ExecutionHandler {\n private pluginResolver: LocalPluginResolver;\n private journal = new Map<string, JournalEntry>();\n private journalCleanupTimer: ReturnType<typeof setInterval>;\n\n constructor(private readonly opts: ExecutionHandlerOptions) {\n this.pluginResolver = new LocalPluginResolver(opts.allowedPaths);\n\n // Periodic journal cleanup\n this.journalCleanupTimer = setInterval(() => this.cleanupJournal(), JOURNAL_TTL_MS);\n }\n\n /** Stop background tasks /\n stop(): void {\n clearInterval(this.journalCleanupTimer);\n }\n\n /* Capability call dispatcher /\n async handle(call: CapabilityCall): Promise<unknown> {\n switch (call.method) {\n case 'execute':\n return this.execute(call.args[0] as ExecutionRequest);\n case 'discover':\n return this.discover();\n default:\n throw new Error(`Unknown execution method: ${call.method}`);\n }\n }\n\n /* Return plugin inventory /\n private async discover(): Promise<PluginInventoryEntry[]> {\n return this.pluginResolver.listPlugins();\n }\n\n /* Execute a plugin handler locally /\n private async execute(request: ExecutionRequest): Promise<unknown> {\n const { executionId, pluginId, handlerRef, input, descriptor, timeoutMs } = request;\n\n // 1. Idempotency check (at-most-once for mutating, ADR-0053)\n const existing = this.journal.get(executionId);\n if (existing) {\n if (existing.status === 'completed') {\n if (existing.error) {\n throw new Error(existing.error);\n }\n return existing.result;\n }\n throw new Error(`Execution ${executionId} already in progress`);\n }\n this.journal.set(executionId, { status: 'started', startedAt: Date.now() });\n\n // 2. Plugin allowlist check\n if (this.opts.allowedPlugins && this.opts.allowedPlugins.length > 0) {\n if (!this.opts.allowedPlugins.includes(pluginId)) {\n this.journal.delete(executionId);\n throw new Error(`Plugin not allowed: ${pluginId}`);\n }\n }\n\n // 3. Default permissions if not provided (CLI dispatch may omit them)\n if (descriptor && !descriptor.permissions) {\n descriptor.permissions = {\n fs: { read: ['.'], write: ['.'] },\n network: { fetch: [] },\n env: { read: [] },\n platform: { llm: true, cache: true },\n };\n }\n\n // 4. Resolve plugin locally (Workspace Agent owns path resolution)\n const resolved = await this.pluginResolver.resolve(pluginId, handlerRef);\n\n // 5. Create proxy platform (LLM/Cache/etc → GatewayTransport → Platform)\n const proxyPlatform = await createProxyPlatform({\n transport: this.opts.gatewayTransport as any,\n });\n\n\n // 6. Setup timeout\n const effectiveTimeout = timeoutMs ?? this.opts.timeoutMs;\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), effectiveTimeout);\n\n try {\n // 7. Execute plugin handler — mode determines isolation level\n const result = this.opts.executionMode === 'subprocess'\n ? await this.executeInSubprocess(resolved, descriptor, input, proxyPlatform, effectiveTimeout, controller.signal)\n : await this.executeInProcess(resolved, descriptor, input, proxyPlatform, controller.signal);\n\n // 8. Record success in journal\n this.journal.set(executionId, {\n status: 'completed',\n result: result,\n startedAt: this.journal.get(executionId)!.startedAt,\n });\n\n return result;\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n\n // Record error in journal\n this.journal.set(executionId, {\n status: 'completed',\n error: message,\n startedAt: this.journal.get(executionId)!.startedAt,\n });\n\n throw err;\n } finally {\n clearTimeout(timer);\n }\n }\n\n /\n In-process execution (trust mode) — fast, no isolation.\n * Plugin runs in same process as Workspace Agent daemon.\n /\n private async executeInProcess(\n resolved: { pluginRoot: string; handlerPath: string },\n descriptor: PluginContextDescriptor,\n input: unknown,\n proxyPlatform: any,\n signal: AbortSignal,\n ): Promise<unknown> {\n const result = await runInProcess({\n descriptor,\n platform: proxyPlatform,\n ui: noopUI,\n handlerPath: resolved.handlerPath,\n input,\n signal,\n cwd: resolved.pluginRoot,\n });\n return result.data;\n }\n\n /\n Subprocess execution (balanced mode) — sandboxed, separate process.\n \n Flow:\n * 1. Start UnixSocketServer with proxyPlatform as backend\n * 2. Fork subprocess via runInSubprocess()\n * 3. Subprocess connects to Unix socket → adapter calls proxied:\n * subprocess → UnixSocket → UnixSocketServer(proxyPlatform) → GatewayTransport → WS → Platform\n * 4. Subprocess applies sandbox patches (harden.ts)\n * 5. Result returned via IPC\n * 6. Cleanup Unix socket server\n /\n private async executeInSubprocess(\n resolved: { pluginRoot: string; handlerPath: string },\n descriptor: PluginContextDescriptor,\n input: unknown,\n proxyPlatform: any,\n timeoutMs: number,\n signal: AbortSignal,\n ): Promise<unknown> {\n // Unique socket path per execution to avoid collisions\n const socketPath = join(tmpdir(), `kb-ws-agent-${randomUUID()}.sock`);\n\n // UnixSocketServer bridges subprocess IPC → proxyPlatform → GatewayTransport → Platform\n const socketServer = new UnixSocketServer(proxyPlatform, { socketPath });\n await socketServer.start();\n\n try {\n const result = await runInSubprocess({\n descriptor,\n socketPath,\n handlerPath: resolved.handlerPath,\n input,\n timeoutMs,\n signal,\n cwd: resolved.pluginRoot,\n });\n return result.data;\n } finally {\n await socketServer.close();\n }\n }\n\n /* Remove expired journal entries /\n private cleanupJournal(): void {\n const now = Date.now();\n for (const [id, entry] of this.journal) {\n if (entry.status === 'completed' && now - entry.startedAt > JOURNAL_TTL_MS) {\n this.journal.delete(id);\n }\n }\n }\n}\n","/\n Daemon — main runtime loop.\n \n Lifecycle:\n * 1. Load ~/.kb/agent.json\n * 2. TokenManager.start() → fetch initial token pair from Gateway\n * 3. GatewayClient.connect() → WSS handshake\n * 4. Register capability handlers (filesystem, git)\n * 5. IpcServer.start() → Unix socket for CLI/Studio\n * 6. Wait for SIGTERM/SIGINT → graceful shutdown\n */\n\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { readFile } from 'node:fs/promises';\nimport { GatewayClient, GatewayTransport, IpcServer, TokenManager, type TokenPair } from '@kb-labs/host-agent-core';\nimport { FilesystemHandler, SearchHandler, ShellHandler } from '@kb-labs/host-agent-fs';\nimport { AgentConfigSchema, TokenPairSchema } from '@kb-labs/host-agent-contracts';\nimport { createTransport } from '@kb-labs/host-agent-transport';\nimport { ExecutionHandler } from './handlers/execution-handler.js';\n\nconst AGENT_CONFIG_PATH = join(homedir(), '.kb', 'agent.json');\nconst AGENT_VERSION = '0.1.0';\n\nasync function parseTokenResponse(res: Response, context: string): Promise<TokenPair> {\n if (!res.ok) { throw new Error(`${context}: HTTP ${res.status}`); }\n const ct = res.headers.get('content-type') ?? '';\n if (!ct.includes('application/json')) {\n throw new Error(`${context}: unexpected content-type: ${ct}`);\n }\n const body: unknown = await res.json();\n const parsed = TokenPairSchema.safeParse(body);\n if (!parsed.success) {\n throw new Error(`${context}: invalid token response: ${parsed.error.message}`);\n }\n return parsed.data;\n}\n\nfunction assertSecureUrl(url: string, context: string): void {\n if (!url.startsWith('https://') && !url.startsWith('http://localhost') && !url.startsWith('http://127.0.0.1')) {\n throw new Error(`${context}: insecure URL rejected — must use HTTPS (got ${url})`);\n }\n}\n\nasync function fetchTokens(gatewayUrl: string, clientId: string, clientSecret: string): Promise<TokenPair> {\n assertSecureUrl(gatewayUrl, 'fetchTokens');\n const res = await fetch(`${gatewayUrl}/auth/token`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ clientId, clientSecret }),\n });\n return parseTokenResponse(res, 'fetchTokens');\n}\n\nasync function refreshTokens(gatewayUrl: string, refreshToken: string): Promise<TokenPair> {\n const res = await fetch(`${gatewayUrl}/auth/refresh`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ refreshToken }),\n });\n return parseTokenResponse(res, 'refreshTokens');\n}\n\nexport async function startDaemon(): Promise<void> {\n // 1. Load config\n let raw: string;\n try {\n raw = await readFile(AGENT_CONFIG_PATH, 'utf-8');\n } catch {\n throw new Error(`Agent config not found at ${AGENT_CONFIG_PATH}. Run 'kb agent register' first.`);\n }\n let parsed: unknown;\n try {\n parsed = JSON.parse(raw);\n } catch {\n throw new Error(`Agent config at ${AGENT_CONFIG_PATH} contains invalid JSON.`);\n }\n const result = AgentConfigSchema.safeParse(parsed);\n if (!result.success) {\n throw new Error(`Agent config validation failed: ${result.error.message}`);\n }\n const config = result.data;\n\n // 2. Token manager\n let wsReconnect: (() => void) \| null = null;\n\n const tokenManager = new TokenManager({\n fetchTokens: () => fetchTokens(config.gatewayUrl, config.clientId, config.clientSecret),\n refreshTokens: (rt) => refreshTokens(config.gatewayUrl, rt),\n onRefreshed: () => {\n // Token rotated — trigger WS reconnect so new token is used\n wsReconnect?.();\n },\n onRefreshFailed: (err) => {\n console.error('[workspace-agent] Token refresh permanently failed, exiting:', err.message);\n process.exit(1);\n },\n });\n\n // 3. Gateway WS client\n let connected = false;\n\n const gatewayClient = new GatewayClient({\n gatewayUrl: config.gatewayUrl,\n agentVersion: AGENT_VERSION,\n capabilities: ['filesystem', 'git', 'execution'],\n hostType: config.hostType,\n getAccessToken: () => tokenManager.accessToken,\n onConnected: (hostId, sessionId) => {\n connected = true;\n console.log(`[workspace-agent] Connected: hostId=${hostId} session=${sessionId}`);\n },\n onDisconnected: () => {\n connected = false;\n console.log('[workspace-agent] Disconnected, reconnecting...');\n },\n onTokenExpired: async () => {\n // Will be handled by TokenManager — no action needed\n },\n });\n\n wsReconnect = () => {\n gatewayClient.stop();\n void gatewayClient.connect();\n };\n\n // 4. Register capability handlers (restricted to declared workspacePaths only)\n const fsHandler = new FilesystemHandler({\n allowedPaths: config.workspacePaths,\n });\n gatewayClient.registerHandler('filesystem', (call) => fsHandler.handle(call));\n\n const searchHandler = new SearchHandler({ allowedPaths: config.workspacePaths });\n gatewayClient.registerHandler('search', (call) => searchHandler.handle(call));\n\n const shellHandler = new ShellHandler({ allowedPaths: config.workspacePaths });\n gatewayClient.registerHandler('shell', (call) => shellHandler.handle(call));\n\n // 5. Execution capability — Workspace Agent can execute plugins locally\n const gatewayTransport = new GatewayTransport(gatewayClient, {\n namespaceId: config.namespaceId,\n hostId: config.hostId,\n });\n\n const executionHandler = new ExecutionHandler({\n gatewayTransport,\n allowedPaths: config.workspacePaths,\n executionMode: config.execution.mode,\n timeoutMs: config.execution.timeoutMs,\n allowedPlugins: config.execution.allowedPlugins,\n });\n\n gatewayClient.registerHandler('execution', (call) => executionHandler.handle(call));\n\n // 6. IPC server — transport auto-selects unix socket / named pipe / tcp by platform\n const ipcTransport = createTransport({ mode: 'auto' });\n const ipcServer = new IpcServer({\n transport: ipcTransport,\n getStatus: () => ({\n connected,\n hostId: config.hostId,\n gatewayUrl: config.gatewayUrl,\n reconnecting: !connected,\n }),\n gatewayClient,\n });\n\n // Start everything\n await tokenManager.start();\n console.log('[workspace-agent] Token acquired');\n\n await gatewayClient.connect();\n await ipcServer.start();\n console.log('[workspace-agent] IPC transport started');\n\n // 6. Graceful shutdown\n const shutdown = (): void => {\n console.log('[workspace-agent] Shutting down...');\n executionHandler.stop();\n tokenManager.stop();\n gatewayClient.stop();\n ipcServer.stop();\n process.exit(0);\n };\n\n process.on('SIGTERM', shutdown);\n process.on('SIGINT', shutdown);\n}\n","import { startDaemon } from './daemon.js';\n\nstartDaemon().catch((err) => {\n console.error('[host-agent] Fatal error:', err);\n process.exit(1);\n});\n"]}
1	+ {"version":3,"sources":["../src/handlers/local-plugin-resolver.ts","../src/handlers/execution-handler.ts","../src/daemon.ts","../src/index.ts"],"names":["join","readFile"],"mappings":";;;;;;;;;;;;;AAkCO,IAAM,sBAAN,MAA0B;AAAA,EAI/B,YAA6B,YAAA,EAAwB;AAAxB,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAAA,EAAyB;AAAA,EAAzB,YAAA;AAAA,EAHrB,KAAA,uBAAY,GAAA,EAA2B;AAAA,EACvC,OAAA,GAAU,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlB,MAAM,OAAA,CAAQ,QAAA,EAAkB,UAAA,EAA6C;AAC3E,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,KAAK,IAAA,EAAK;AAAA,IAClB;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,QAAQ,iBAAiB,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACpG;AAGA,IAAA,MAAM,UAAA,GAAa,UAAU,UAAU,CAAA;AACvC,IAAA,IAAI,UAAA,CAAW,WAAW,IAAI,CAAA,IAAK,WAAW,QAAA,CAAS,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA,EAAG;AAClE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,UAAU,CAAA,CAAE,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,KAAA,CAAM,IAAA,EAAM,UAAU,CAAA;AAGlD,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,WAAW,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,WAAW,CAAA,CAAE,CAAA;AAAA,IAC1D;AAIA,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAW,CAAA;AAC9C,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA;AAC1C,IAAA,IAAI,CAAC,WAAA,CAAY,UAAA,CAAW,WAAW,GAAG,CAAA,IAAK,gBAAgB,QAAA,EAAU;AACvE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,WAAW,CAAA,CAAE,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,EAAE,UAAA,EAAY,KAAA,CAAM,IAAA,EAAM,WAAA,EAAY;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,GAA+C;AACnD,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,KAAK,IAAA,EAAK;AAAA,IAClB;AACA,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,IAAI,CAAA,CAAA,MAAM;AAAA,MACxC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,MAAM,CAAA,CAAE;AAAA,KACV,CAAE,CAAA;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,MAAM,KAAK,IAAA,EAAK;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,IAAA,GAAsB;AAClC,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,YAAA,EAAc;AACxC,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,IACtC;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA,EAEA,MAAc,QAAQ,GAAA,EAA4B;AAEhD,IAAA,MAAM,IAAA,CAAK,gBAAgB,GAAG,CAAA;AAG9B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,QAAQ,GAAG,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,KAAU,cAAA,IAAkB,UAAU,MAAA,EAAQ;AACzE,QAAA;AAAA,MACF;AACA,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA;AAChC,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,QAAQ,CAAA;AAC7B,QAAA,IAAI,CAAA,CAAE,aAAY,EAAG;AACnB,UAAA,MAAM,IAAA,CAAK,gBAAgB,QAAQ,CAAA;AAGnC,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,EAAU,UAAU,CAAA;AACxC,UAAA,IAAI;AACF,YAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,MAAM,CAAA;AACvC,YAAA,KAAA,MAAW,OAAO,UAAA,EAAY;AAC5B,cAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AAAE,gBAAA;AAAA,cAAU;AACrC,cAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,EAAQ,GAAG,CAAA;AAChC,cAAA,MAAM,UAAU,MAAM,IAAA,CAAK,OAAO,CAAA,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACpD,cAAA,IAAI,OAAA,EAAS,aAAY,EAAG;AAC1B,gBAAA,MAAM,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,cACpC;AAAA,YACF;AAAA,UACF,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,gBAAgB,GAAA,EAA4B;AAExD,IAAA,KAAA,MAAW,YAAA,IAAgB,CAAC,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,eAAe,CAAA,EAAG,IAAA,CAAK,GAAA,EAAK,eAAe,CAAC,CAAA,EAAG;AAC3F,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,YAAA,EAAc,OAAO,CAAA;AAChD,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAE/B,QAAA,IAAI,QAAA,CAAS,EAAA,IAAM,QAAA,CAAS,OAAA,EAAS;AACnC,UAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI;AAAA,YAC1B,IAAI,QAAA,CAAS,EAAA;AAAA,YACb,SAAS,QAAA,CAAS,OAAA;AAAA,YAClB,IAAA,EAAM;AAAA,WACP,CAAA;AACD,UAAA;AAAA,QACF;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF,CAAA;;;ACjHA,IAAM,cAAA,GAAiB,IAAI,EAAA,GAAK,GAAA;AAIzB,IAAM,mBAAN,MAAuB;AAAA,EAK5B,YAA6B,IAAA,EAA+B;AAA/B,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAC3B,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAI,mBAAA,CAAoB,IAAA,CAAK,YAAY,CAAA;AAG/D,IAAA,IAAA,CAAK,sBAAsB,WAAA,CAAY,MAAM,IAAA,CAAK,cAAA,IAAkB,cAAc,CAAA;AAAA,EACpF;AAAA,EAL6B,IAAA;AAAA,EAJrB,cAAA;AAAA,EACA,OAAA,uBAAc,GAAA,EAA0B;AAAA,EACxC,mBAAA;AAAA;AAAA,EAUR,IAAA,GAAa;AACX,IAAA,aAAA,CAAc,KAAK,mBAAmB,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,OAAO,IAAA,EAAwC;AACnD,IAAA,QAAQ,KAAK,MAAA;AAAQ,MACnB,KAAK,SAAA;AACH,QAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAqB,CAAA;AAAA,MACtD,KAAK,UAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAS;AAAA,MACvB;AACE,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA;AAC9D,EACF;AAAA;AAAA,EAGA,MAAc,QAAA,GAA4C;AACxD,IAAA,OAAO,IAAA,CAAK,eAAe,WAAA,EAAY;AAAA,EACzC;AAAA;AAAA,EAGA,MAAc,QAAQ,OAAA,EAA6C;AACjE,IAAA,MAAM,EAAE,WAAA,EAAa,QAAA,EAAU,YAAY,KAAA,EAAO,UAAA,EAAY,WAAU,GAAI,OAAA;AAG5E,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC7C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI,QAAA,CAAS,WAAW,WAAA,EAAa;AACnC,QAAA,IAAI,SAAS,KAAA,EAAO;AAClB,UAAA,MAAM,IAAI,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA;AAAA,QAChC;AACA,QAAA,OAAO,QAAA,CAAS,MAAA;AAAA,MAClB;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,WAAW,CAAA,oBAAA,CAAsB,CAAA;AAAA,IAChE;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAW,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAG1E,IAAA,IAAI,KAAK,IAAA,CAAK,cAAA,IAAkB,KAAK,IAAA,CAAK,cAAA,CAAe,SAAS,CAAA,EAAG;AACnE,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,QAAA,CAAS,QAAQ,CAAA,EAAG;AAChD,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,WAAW,CAAA;AAC/B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,QAAQ,CAAA,CAAE,CAAA;AAAA,MACnD;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,IAAc,CAAC,UAAA,CAAW,WAAA,EAAa;AACzC,MAAA,UAAA,CAAW,WAAA,GAAc;AAAA,QACvB,EAAA,EAAI,EAAE,IAAA,EAAM,CAAC,GAAG,CAAA,EAAG,KAAA,EAAO,CAAC,GAAG,CAAA,EAAE;AAAA,QAChC,OAAA,EAAS,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,QACrB,GAAA,EAAK,EAAE,IAAA,EAAM,EAAC,EAAE;AAAA,QAChB,QAAA,EAAU,EAAE,GAAA,EAAK,IAAA,EAAM,OAAO,IAAA;AAAK,OACrC;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,UAAU,UAAU,CAAA;AAGvE,IAAA,MAAM,aAAA,GAAgB,MAAM,mBAAA,CAAoB;AAAA,MAC9C,SAAA,EAAW,KAAK,IAAA,CAAK;AAAA,KACtB,CAAA;AAID,IAAA,MAAM,gBAAA,GAAmB,SAAA,IAAa,IAAA,CAAK,IAAA,CAAK,SAAA;AAChD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,gBAAgB,CAAA;AAEnE,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,aAAA,KAAkB,YAAA,GACvC,MAAM,IAAA,CAAK,mBAAA,CAAoB,QAAA,EAAU,UAAA,EAAY,KAAA,EAAO,aAAA,EAAe,kBAAkB,UAAA,CAAW,MAAM,CAAA,GAC9G,MAAM,IAAA,CAAK,gBAAA,CAAiB,UAAU,UAAA,EAAY,KAAA,EAAO,aAAA,EAAe,UAAA,CAAW,MAAM,CAAA;AAG7F,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,WAAA,EAAa;AAAA,QAC5B,MAAA,EAAQ,WAAA;AAAA,QACR,MAAA;AAAA,QACA,SAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,CAAG;AAAA,OAC3C,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,WAAA,EAAa;AAAA,QAC5B,MAAA,EAAQ,WAAA;AAAA,QACR,KAAA,EAAO,OAAA;AAAA,QACP,SAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,CAAG;AAAA,OAC3C,CAAA;AAED,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,gBAAA,CACZ,QAAA,EACA,UAAA,EACA,KAAA,EACA,eACA,MAAA,EACkB;AAClB,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa;AAAA,MAChC,UAAA;AAAA,MACA,QAAA,EAAU,aAAA;AAAA,MACV,EAAA,EAAI,MAAA;AAAA,MACJ,aAAa,QAAA,CAAS,WAAA;AAAA,MACtB,KAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAK,QAAA,CAAS;AAAA,KACf,CAAA;AACD,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAc,mBAAA,CACZ,QAAA,EACA,YACA,KAAA,EACA,aAAA,EACA,WACA,MAAA,EACkB;AAElB,IAAA,MAAM,aAAaA,IAAAA,CAAK,MAAA,IAAU,CAAA,YAAA,EAAe,UAAA,EAAY,CAAA,KAAA,CAAO,CAAA;AAGpE,IAAA,MAAM,eAAe,IAAI,gBAAA,CAAiB,aAAA,EAAe,EAAE,YAAY,CAAA;AACvE,IAAA,MAAM,aAAa,KAAA,EAAM;AAEzB,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB;AAAA,QACnC,UAAA;AAAA,QACA,UAAA;AAAA,QACA,aAAa,QAAA,CAAS,WAAA;AAAA,QACtB,KAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAK,QAAA,CAAS;AAAA,OACf,CAAA;AACD,MAAA,OAAO,MAAA,CAAO,IAAA;AAAA,IAChB,CAAA,SAAE;AACA,MAAA,MAAM,aAAa,KAAA,EAAM;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGQ,cAAA,GAAuB;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,OAAA,EAAS;AACtC,MAAA,IAAI,MAAM,MAAA,KAAW,WAAA,IAAe,GAAA,GAAM,KAAA,CAAM,YAAY,cAAA,EAAgB;AAC1E,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACF,CAAA;;;AC5OA,IAAM,iBAAA,GAAoBA,IAAAA,CAAK,OAAA,EAAQ,EAAG,OAAO,YAAY,CAAA;AAC7D,IAAM,aAAA,GAAgB,OAAA;AAEtB,eAAe,kBAAA,CAAmB,KAAe,OAAA,EAAqC;AACpF,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AAAE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,OAAA,EAAU,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EAAG;AAClE,EAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC9C,EAAA,IAAI,CAAC,EAAA,CAAG,QAAA,CAAS,kBAAkB,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,2BAAA,EAA8B,EAAE,CAAA,CAAE,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,IAAA,GAAgB,MAAM,GAAA,CAAI,IAAA,EAAK;AACrC,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,SAAA,CAAU,IAAI,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,OAAO,6BAA6B,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAEA,SAAS,eAAA,CAAgB,KAAa,OAAA,EAAuB;AAC3D,EAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,UAAA,CAAW,kBAAkB,CAAA,IAAK,CAAC,GAAA,CAAI,UAAA,CAAW,kBAAkB,CAAA,EAAG;AAC7G,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,mDAAA,EAAiD,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,EACnF;AACF;AAEA,eAAe,WAAA,CAAY,UAAA,EAAoB,QAAA,EAAkB,YAAA,EAA0C;AACzG,EAAA,eAAA,CAAgB,YAAY,aAAa,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,WAAA,CAAA,EAAe;AAAA,IAClD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,cAAc;AAAA,GAChD,CAAA;AACD,EAAA,OAAO,kBAAA,CAAmB,KAAK,aAAa,CAAA;AAC9C;AAEA,eAAe,aAAA,CAAc,YAAoB,YAAA,EAA0C;AACzF,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,aAAA,CAAA,EAAiB;AAAA,IACpD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,cAAc;AAAA,GACtC,CAAA;AACD,EAAA,OAAO,kBAAA,CAAmB,KAAK,eAAe,CAAA;AAChD;AAEA,eAAsB,WAAA,GAA6B;AAEjD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMC,QAAAA,CAAS,iBAAA,EAAmB,OAAO,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,iBAAiB,CAAA,gCAAA,CAAkC,CAAA;AAAA,EAClG;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,iBAAiB,CAAA,uBAAA,CAAyB,CAAA;AAAA,EAC/E;AACA,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,SAAA,CAAU,MAAM,CAAA;AACjD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,IAAA;AAGtB,EAAA,IAAI,WAAA,GAAmC,IAAA;AAEvC,EAAA,MAAM,YAAA,GAAe,IAAI,YAAA,CAAa;AAAA,IACpC,WAAA,EAAa,MAAM,WAAA,CAAY,MAAA,CAAO,YAAY,MAAA,CAAO,QAAA,EAAU,OAAO,YAAY,CAAA;AAAA,IACtF,eAAe,CAAC,EAAA,KAAO,aAAA,CAAc,MAAA,CAAO,YAAY,EAAE,CAAA;AAAA,IAC1D,aAAa,MAAM;AAEjB,MAAA,WAAA,IAAc;AAAA,IAChB,CAAA;AAAA,IACA,eAAA,EAAiB,CAAC,GAAA,KAAQ;AACxB,MAAA,OAAA,CAAQ,KAAA,CAAM,8DAAA,EAAgE,GAAA,CAAI,OAAO,CAAA;AACzF,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,GACD,CAAA;AAGD,EAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,EAAA,MAAM,aAAA,GAAgB,IAAI,aAAA,CAAc;AAAA,IACtC,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,YAAA,EAAc,aAAA;AAAA,IACd,YAAA,EAAc,CAAC,YAAA,EAAc,KAAA,EAAO,WAAW,CAAA;AAAA,IAC/C,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,cAAA,EAAgB,MAAM,YAAA,CAAa,WAAA;AAAA,IACnC,WAAA,EAAa,CAAC,MAAA,EAAQ,SAAA,KAAc;AAClC,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,oCAAA,EAAuC,MAAM,CAAA,SAAA,EAAY,SAAS,CAAA,CAAE,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,gBAAgB,MAAM;AACpB,MAAA,SAAA,GAAY,KAAA;AACZ,MAAA,OAAA,CAAQ,IAAI,iDAAiD,CAAA;AAAA,IAC/D,CAAA;AAAA,IACA,gBAAgB,YAAY;AAAA,IAE5B;AAAA,GACD,CAAA;AAED,EAAA,WAAA,GAAc,MAAM;AAClB,IAAA,aAAA,CAAc,IAAA,EAAK;AACnB,IAAA,KAAK,cAAc,OAAA,EAAQ;AAAA,EAC7B,CAAA;AAGA,EAAA,MAAM,SAAA,GAAY,IAAI,iBAAA,CAAkB;AAAA,IACtC,cAAc,MAAA,CAAO;AAAA,GACtB,CAAA;AACD,EAAA,aAAA,CAAc,gBAAgB,YAAA,EAAc,CAAC,SAAS,SAAA,CAAU,MAAA,CAAO,IAAI,CAAC,CAAA;AAE5E,EAAA,MAAM,gBAAgB,IAAI,aAAA,CAAc,EAAE,YAAA,EAAc,MAAA,CAAO,gBAAgB,CAAA;AAC/E,EAAA,aAAA,CAAc,gBAAgB,QAAA,EAAU,CAAC,SAAS,aAAA,CAAc,MAAA,CAAO,IAAI,CAAC,CAAA;AAE5E,EAAA,MAAM,eAAe,IAAI,YAAA,CAAa,EAAE,YAAA,EAAc,MAAA,CAAO,gBAAgB,CAAA;AAC7E,EAAA,aAAA,CAAc,gBAAgB,OAAA,EAAS,CAAC,SAAS,YAAA,CAAa,MAAA,CAAO,IAAI,CAAC,CAAA;AAG1E,EAAA,MAAM,gBAAA,GAAmB,IAAI,gBAAA,CAAiB,aAAA,EAAe;AAAA,IAC3D,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,QAAQ,MAAA,CAAO;AAAA,GAChB,CAAA;AAED,EAAA,MAAM,gBAAA,GAAmB,IAAI,gBAAA,CAAiB;AAAA,IAC5C,gBAAA;AAAA,IACA,cAAc,MAAA,CAAO,cAAA;AAAA,IACrB,aAAA,EAAe,OAAO,SAAA,CAAU,IAAA;AAAA,IAChC,SAAA,EAAW,OAAO,SAAA,CAAU,SAAA;AAAA,IAC5B,cAAA,EAAgB,OAAO,SAAA,CAAU;AAAA,GAClC,CAAA;AAED,EAAA,aAAA,CAAc,gBAAgB,WAAA,EAAa,CAAC,SAAS,gBAAA,CAAiB,MAAA,CAAO,IAAI,CAAC,CAAA;AAGlF,EAAA,MAAM,YAAA,GAAe,eAAA,CAAgB,EAAE,IAAA,EAAM,QAAQ,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAI,SAAA,CAAU;AAAA,IAC9B,SAAA,EAAW,YAAA;AAAA,IACX,WAAW,OAAO;AAAA,MAChB,SAAA;AAAA,MACA,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,cAAc,CAAC;AAAA,KACjB,CAAA;AAAA,IACA;AAAA,GACD,CAAA;AAGD,EAAA,MAAM,aAAa,KAAA,EAAM;AACzB,EAAA,OAAA,CAAQ,IAAI,kCAAkC,CAAA;AAE9C,EAAA,MAAM,cAAc,OAAA,EAAQ;AAC5B,EAAA,MAAM,UAAU,KAAA,EAAM;AACtB,EAAA,OAAA,CAAQ,IAAI,yCAAyC,CAAA;AAGrD,EAAA,MAAM,WAAW,MAAY;AAC3B,IAAA,OAAA,CAAQ,IAAI,oCAAoC,CAAA;AAChD,IAAA,gBAAA,CAAiB,IAAA,EAAK;AACtB,IAAA,YAAA,CAAa,IAAA,EAAK;AAClB,IAAA,aAAA,CAAc,IAAA,EAAK;AACnB,IAAA,SAAA,CAAU,IAAA,EAAK;AACf,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB,CAAA;AAEA,EAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAC9B,EAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC/B;;;ACzLA,WAAA,EAAY,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAC3B,EAAA,OAAA,CAAQ,KAAA,CAAM,6BAA6B,GAAG,CAAA;AAC9C,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB,CAAC,CAAA","file":"index.js","sourcesContent":["/*\n LocalPluginResolver — resolves pluginId → local handler path on Workspace Agent.\n \n Scans workspacePaths for plugin manifests, caches the mapping.\n * Workspace Agent owns path resolution — Platform sends pluginId, not paths.\n \n Security:\n * - Paths validated against allowedPaths\n * - No '..' or symlink escape\n * - handlerRef normalized and resolved relative to pluginRoot\n \n @see ADR-0017: Workspace Agent Architecture (INV-1: plugin executes where files are)\n /\n\nimport { resolve, normalize, join, sep } from 'node:path';\nimport { readdir, readFile, stat, realpath } from 'node:fs/promises';\n\nexport interface ResolvedPlugin {\n pluginRoot: string;\n handlerPath: string;\n}\n\nexport interface PluginInventoryEntry {\n id: string;\n version: string;\n root: string;\n}\n\ninterface ManifestEntry {\n id: string;\n version: string;\n root: string;\n}\n\nexport class LocalPluginResolver {\n private cache = new Map<string, ManifestEntry>();\n private scanned = false;\n\n constructor(private readonly allowedPaths: string[]) {}\n\n /\n Resolve pluginId + handlerRef → absolute paths.\n * Scans allowedPaths for manifests on first call (cached).\n /\n async resolve(pluginId: string, handlerRef: string): Promise<ResolvedPlugin> {\n if (!this.scanned) {\n await this.scan();\n }\n\n const entry = this.cache.get(pluginId);\n if (!entry) {\n throw new Error(`Plugin not found: ${pluginId}. Available: [${[...this.cache.keys()].join(', ')}]`);\n }\n\n // Validate handlerRef: no traversal\n const normalized = normalize(handlerRef);\n if (normalized.startsWith('..') \|\| normalized.includes(`..${sep}`)) {\n throw new Error(`Invalid handlerRef (path traversal): ${handlerRef}`);\n }\n\n const handlerPath = resolve(entry.root, normalized);\n\n // Verify file exists first\n try {\n await stat(handlerPath);\n } catch {\n throw new Error(`Handler file not found: ${handlerPath}`);\n }\n\n // Ensure resolved path is within pluginRoot (no symlink escape)\n // Use realpath to resolve symlinks on both sides before comparison\n const realHandler = await realpath(handlerPath);\n const realRoot = await realpath(entry.root);\n if (!realHandler.startsWith(realRoot + sep) && realHandler !== realRoot) {\n throw new Error(`Handler path escapes plugin root: ${handlerPath}`);\n }\n\n return { pluginRoot: entry.root, handlerPath };\n }\n\n /\n Return plugin inventory for hello message / discover capability.\n /\n async listPlugins(): Promise<PluginInventoryEntry[]> {\n if (!this.scanned) {\n await this.scan();\n }\n return [...this.cache.values()].map(e => ({\n id: e.id,\n version: e.version,\n root: e.root,\n }));\n }\n\n /\n Force rescan (e.g., after plugin install).\n /\n async rescan(): Promise<void> {\n this.cache.clear();\n this.scanned = false;\n await this.scan();\n }\n\n /\n Scan allowedPaths for plugin manifests.\n * Looks for dist/manifest.json or manifest.json in directories.\n /\n private async scan(): Promise<void> {\n for (const basePath of this.allowedPaths) {\n await this.scanDir(resolve(basePath));\n }\n this.scanned = true;\n }\n\n private async scanDir(dir: string): Promise<void> {\n // Check if dir itself has a manifest\n await this.tryLoadManifest(dir);\n\n // Scan subdirectories (one level deep — workspace packages)\n let entries: string[];\n try {\n entries = await readdir(dir);\n } catch {\n return;\n }\n\n for (const entry of entries) {\n if (entry.startsWith('.') \|\| entry === 'node_modules' \|\| entry === 'dist') {\n continue;\n }\n const fullPath = join(dir, entry);\n try {\n const s = await stat(fullPath);\n if (s.isDirectory()) {\n await this.tryLoadManifest(fullPath);\n\n // Also check packages/ subdirectory (monorepo layout)\n const pkgDir = join(fullPath, 'packages');\n try {\n const pkgEntries = await readdir(pkgDir);\n for (const pkg of pkgEntries) {\n if (pkg.startsWith('.')) { continue; }\n const pkgPath = join(pkgDir, pkg);\n const pkgStat = await stat(pkgPath).catch(() => null);\n if (pkgStat?.isDirectory()) {\n await this.tryLoadManifest(pkgPath);\n }\n }\n } catch {\n // no packages/ dir — skip\n }\n }\n } catch {\n continue;\n }\n }\n }\n\n private async tryLoadManifest(dir: string): Promise<void> {\n // Try dist/manifest.json first (built), then manifest.json (source)\n for (const manifestPath of [join(dir, 'dist', 'manifest.json'), join(dir, 'manifest.json')]) {\n try {\n const raw = await readFile(manifestPath, 'utf-8');\n const manifest = JSON.parse(raw) as { id?: string; version?: string; schema?: string };\n\n if (manifest.id && manifest.version) {\n this.cache.set(manifest.id, {\n id: manifest.id,\n version: manifest.version,\n root: dir,\n });\n return;\n }\n } catch {\n // no manifest here — continue\n }\n }\n }\n}\n","/\n ExecutionHandler — capability handler for plugin execution on Workspace Agent.\n \n Receives ExecutionRequest from Platform (via Gateway WS call),\n * executes plugin handler locally using plugin-runtime with proxy platform.\n \n Flow:\n * Platform → Gateway → WS call(adapter:'execution', method:'execute')\n * → ExecutionHandler.handle()\n * → LocalPluginResolver.resolve(pluginId) → local path\n * → createProxyPlatform(GatewayTransport) → proxy LLM/cache/etc\n * → runInProcess(descriptor, proxyPlatform, handlerPath, input)\n * → plugin handler executes (npm packages work natively)\n * → result → WS response → Gateway → Platform\n \n Security:\n * - Paths validated via LocalPluginResolver (no traversal, no escape)\n * - Plugin allowlist enforcement\n * - Execution journal for idempotency (at-most-once)\n * - Timeout via AbortSignal\n \n @see ADR-0017: Workspace Agent Architecture\n * @see ADR-0053: Delivery Semantics\n /\n\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path';\nimport { tmpdir } from 'node:os';\nimport type { CapabilityCall } from '@kb-labs/host-agent-contracts';\nimport type { GatewayTransport } from '@kb-labs/host-agent-core';\nimport { createProxyPlatform, UnixSocketServer } from '@kb-labs/core-runtime';\nimport { runInProcess, runInSubprocess } from '@kb-labs/plugin-runtime';\nimport { noopUI } from '@kb-labs/plugin-contracts';\nimport type { PluginContextDescriptor } from '@kb-labs/plugin-contracts';\nimport { LocalPluginResolver, type PluginInventoryEntry } from './local-plugin-resolver.js';\n\n// ── Types ──\n\ninterface ExecutionRequest {\n executionId: string;\n pluginId: string;\n handlerRef: string;\n exportName?: string;\n input: unknown;\n descriptor: PluginContextDescriptor;\n timeoutMs?: number;\n}\n\ninterface JournalEntry {\n status: 'started' \| 'completed';\n result?: unknown;\n error?: string;\n startedAt: number;\n}\n\nexport interface ExecutionHandlerOptions {\n gatewayTransport: GatewayTransport;\n allowedPaths: string[];\n executionMode: 'in-process' \| 'subprocess';\n timeoutMs: number;\n allowedPlugins?: string[];\n}\n\n// ── Constants ──\n\nconst JOURNAL_TTL_MS = 5 60 * 1000; // 5 minutes\n\n// ── Handler ──\n\nexport class ExecutionHandler {\n private pluginResolver: LocalPluginResolver;\n private journal = new Map<string, JournalEntry>();\n private journalCleanupTimer: ReturnType<typeof setInterval>;\n\n constructor(private readonly opts: ExecutionHandlerOptions) {\n this.pluginResolver = new LocalPluginResolver(opts.allowedPaths);\n\n // Periodic journal cleanup\n this.journalCleanupTimer = setInterval(() => this.cleanupJournal(), JOURNAL_TTL_MS);\n }\n\n /** Stop background tasks /\n stop(): void {\n clearInterval(this.journalCleanupTimer);\n }\n\n /* Capability call dispatcher /\n async handle(call: CapabilityCall): Promise<unknown> {\n switch (call.method) {\n case 'execute':\n return this.execute(call.args[0] as ExecutionRequest);\n case 'discover':\n return this.discover();\n default:\n throw new Error(`Unknown execution method: ${call.method}`);\n }\n }\n\n /* Return plugin inventory /\n private async discover(): Promise<PluginInventoryEntry[]> {\n return this.pluginResolver.listPlugins();\n }\n\n /* Execute a plugin handler locally /\n private async execute(request: ExecutionRequest): Promise<unknown> {\n const { executionId, pluginId, handlerRef, input, descriptor, timeoutMs } = request;\n\n // 1. Idempotency check (at-most-once for mutating, ADR-0053)\n const existing = this.journal.get(executionId);\n if (existing) {\n if (existing.status === 'completed') {\n if (existing.error) {\n throw new Error(existing.error);\n }\n return existing.result;\n }\n throw new Error(`Execution ${executionId} already in progress`);\n }\n this.journal.set(executionId, { status: 'started', startedAt: Date.now() });\n\n // 2. Plugin allowlist check\n if (this.opts.allowedPlugins && this.opts.allowedPlugins.length > 0) {\n if (!this.opts.allowedPlugins.includes(pluginId)) {\n this.journal.delete(executionId);\n throw new Error(`Plugin not allowed: ${pluginId}`);\n }\n }\n\n // 3. Default permissions if not provided (CLI dispatch may omit them)\n if (descriptor && !descriptor.permissions) {\n descriptor.permissions = {\n fs: { read: ['.'], write: ['.'] },\n network: { fetch: [] },\n env: { read: [] },\n platform: { llm: true, cache: true },\n };\n }\n\n // 4. Resolve plugin locally (Workspace Agent owns path resolution)\n const resolved = await this.pluginResolver.resolve(pluginId, handlerRef);\n\n // 5. Create proxy platform (LLM/Cache/etc → GatewayTransport → Platform)\n const proxyPlatform = await createProxyPlatform({\n transport: this.opts.gatewayTransport as any,\n });\n\n\n // 6. Setup timeout\n const effectiveTimeout = timeoutMs ?? this.opts.timeoutMs;\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), effectiveTimeout);\n\n try {\n // 7. Execute plugin handler — mode determines isolation level\n const result = this.opts.executionMode === 'subprocess'\n ? await this.executeInSubprocess(resolved, descriptor, input, proxyPlatform, effectiveTimeout, controller.signal)\n : await this.executeInProcess(resolved, descriptor, input, proxyPlatform, controller.signal);\n\n // 8. Record success in journal\n this.journal.set(executionId, {\n status: 'completed',\n result: result,\n startedAt: this.journal.get(executionId)!.startedAt,\n });\n\n return result;\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n\n // Record error in journal\n this.journal.set(executionId, {\n status: 'completed',\n error: message,\n startedAt: this.journal.get(executionId)!.startedAt,\n });\n\n throw err;\n } finally {\n clearTimeout(timer);\n }\n }\n\n /\n In-process execution (trust mode) — fast, no isolation.\n * Plugin runs in same process as Workspace Agent daemon.\n /\n private async executeInProcess(\n resolved: { pluginRoot: string; handlerPath: string },\n descriptor: PluginContextDescriptor,\n input: unknown,\n proxyPlatform: any,\n signal: AbortSignal,\n ): Promise<unknown> {\n const result = await runInProcess({\n descriptor,\n platform: proxyPlatform,\n ui: noopUI,\n handlerPath: resolved.handlerPath,\n input,\n signal,\n cwd: resolved.pluginRoot,\n });\n return result.data;\n }\n\n /\n Subprocess execution (balanced mode) — sandboxed, separate process.\n \n Flow:\n * 1. Start UnixSocketServer with proxyPlatform as backend\n * 2. Fork subprocess via runInSubprocess()\n * 3. Subprocess connects to Unix socket → adapter calls proxied:\n * subprocess → UnixSocket → UnixSocketServer(proxyPlatform) → GatewayTransport → WS → Platform\n * 4. Subprocess applies sandbox patches (harden.ts)\n * 5. Result returned via IPC\n * 6. Cleanup Unix socket server\n /\n private async executeInSubprocess(\n resolved: { pluginRoot: string; handlerPath: string },\n descriptor: PluginContextDescriptor,\n input: unknown,\n proxyPlatform: any,\n timeoutMs: number,\n signal: AbortSignal,\n ): Promise<unknown> {\n // Unique socket path per execution to avoid collisions\n const socketPath = join(tmpdir(), `kb-ws-agent-${randomUUID()}.sock`);\n\n // UnixSocketServer bridges subprocess IPC → proxyPlatform → GatewayTransport → Platform\n const socketServer = new UnixSocketServer(proxyPlatform, { socketPath });\n await socketServer.start();\n\n try {\n const result = await runInSubprocess({\n descriptor,\n socketPath,\n handlerPath: resolved.handlerPath,\n input,\n timeoutMs,\n signal,\n cwd: resolved.pluginRoot,\n });\n return result.data;\n } finally {\n await socketServer.close();\n }\n }\n\n /* Remove expired journal entries /\n private cleanupJournal(): void {\n const now = Date.now();\n for (const [id, entry] of this.journal) {\n if (entry.status === 'completed' && now - entry.startedAt > JOURNAL_TTL_MS) {\n this.journal.delete(id);\n }\n }\n }\n}\n","/\n Daemon — main runtime loop.\n \n Lifecycle:\n * 1. Load ~/.kb/agent.json\n * 2. TokenManager.start() → fetch initial token pair from Gateway\n * 3. GatewayClient.connect() → WSS handshake\n * 4. Register capability handlers (filesystem, git)\n * 5. IpcServer.start() → Unix socket for CLI/Studio\n * 6. Wait for SIGTERM/SIGINT → graceful shutdown\n */\n\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { readFile } from 'node:fs/promises';\nimport { GatewayClient, GatewayTransport, IpcServer, TokenManager, type TokenPair } from '@kb-labs/host-agent-core';\nimport { FilesystemHandler, SearchHandler, ShellHandler } from '@kb-labs/host-agent-fs';\nimport { AgentConfigSchema, TokenPairSchema } from '@kb-labs/host-agent-contracts';\nimport { createTransport } from '@kb-labs/host-agent-transport';\nimport { ExecutionHandler } from './handlers/execution-handler.js';\n\nconst AGENT_CONFIG_PATH = join(homedir(), '.kb', 'agent.json');\nconst AGENT_VERSION = '0.1.0';\n\nasync function parseTokenResponse(res: Response, context: string): Promise<TokenPair> {\n if (!res.ok) { throw new Error(`${context}: HTTP ${res.status}`); }\n const ct = res.headers.get('content-type') ?? '';\n if (!ct.includes('application/json')) {\n throw new Error(`${context}: unexpected content-type: ${ct}`);\n }\n const body: unknown = await res.json();\n const parsed = TokenPairSchema.safeParse(body);\n if (!parsed.success) {\n throw new Error(`${context}: invalid token response: ${parsed.error.message}`);\n }\n return parsed.data;\n}\n\nfunction assertSecureUrl(url: string, context: string): void {\n if (!url.startsWith('https://') && !url.startsWith('http://localhost') && !url.startsWith('http://127.0.0.1')) {\n throw new Error(`${context}: insecure URL rejected — must use HTTPS (got ${url})`);\n }\n}\n\nasync function fetchTokens(gatewayUrl: string, clientId: string, clientSecret: string): Promise<TokenPair> {\n assertSecureUrl(gatewayUrl, 'fetchTokens');\n const res = await fetch(`${gatewayUrl}/auth/token`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ clientId, clientSecret }),\n });\n return parseTokenResponse(res, 'fetchTokens');\n}\n\nasync function refreshTokens(gatewayUrl: string, refreshToken: string): Promise<TokenPair> {\n const res = await fetch(`${gatewayUrl}/auth/refresh`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ refreshToken }),\n });\n return parseTokenResponse(res, 'refreshTokens');\n}\n\nexport async function startDaemon(): Promise<void> {\n // 1. Load config\n let raw: string;\n try {\n raw = await readFile(AGENT_CONFIG_PATH, 'utf-8');\n } catch {\n throw new Error(`Agent config not found at ${AGENT_CONFIG_PATH}. Run 'kb agent register' first.`);\n }\n let parsed: unknown;\n try {\n parsed = JSON.parse(raw);\n } catch {\n throw new Error(`Agent config at ${AGENT_CONFIG_PATH} contains invalid JSON.`);\n }\n const result = AgentConfigSchema.safeParse(parsed);\n if (!result.success) {\n throw new Error(`Agent config validation failed: ${result.error.message}`);\n }\n const config = result.data;\n\n // 2. Token manager\n let wsReconnect: (() => void) \| null = null;\n\n const tokenManager = new TokenManager({\n fetchTokens: () => fetchTokens(config.gatewayUrl, config.clientId, config.clientSecret),\n refreshTokens: (rt) => refreshTokens(config.gatewayUrl, rt),\n onRefreshed: () => {\n // Token rotated — trigger WS reconnect so new token is used\n wsReconnect?.();\n },\n onRefreshFailed: (err) => {\n console.error('[workspace-agent] Token refresh permanently failed, exiting:', err.message);\n process.exit(1);\n },\n });\n\n // 3. Gateway WS client\n let connected = false;\n\n const gatewayClient = new GatewayClient({\n gatewayUrl: config.gatewayUrl,\n agentVersion: AGENT_VERSION,\n capabilities: ['filesystem', 'git', 'execution'],\n hostType: config.hostType,\n getAccessToken: () => tokenManager.accessToken,\n onConnected: (hostId, sessionId) => {\n connected = true;\n console.log(`[workspace-agent] Connected: hostId=${hostId} session=${sessionId}`);\n },\n onDisconnected: () => {\n connected = false;\n console.log('[workspace-agent] Disconnected, reconnecting...');\n },\n onTokenExpired: async () => {\n // Will be handled by TokenManager — no action needed\n },\n });\n\n wsReconnect = () => {\n gatewayClient.stop();\n void gatewayClient.connect();\n };\n\n // 4. Register capability handlers (restricted to declared workspacePaths only)\n const fsHandler = new FilesystemHandler({\n allowedPaths: config.workspacePaths,\n });\n gatewayClient.registerHandler('filesystem', (call) => fsHandler.handle(call));\n\n const searchHandler = new SearchHandler({ allowedPaths: config.workspacePaths });\n gatewayClient.registerHandler('search', (call) => searchHandler.handle(call));\n\n const shellHandler = new ShellHandler({ allowedPaths: config.workspacePaths });\n gatewayClient.registerHandler('shell', (call) => shellHandler.handle(call));\n\n // 5. Execution capability — Workspace Agent can execute plugins locally\n const gatewayTransport = new GatewayTransport(gatewayClient, {\n namespaceId: config.namespaceId,\n hostId: config.hostId,\n });\n\n const executionHandler = new ExecutionHandler({\n gatewayTransport,\n allowedPaths: config.workspacePaths,\n executionMode: config.execution.mode,\n timeoutMs: config.execution.timeoutMs,\n allowedPlugins: config.execution.allowedPlugins,\n });\n\n gatewayClient.registerHandler('execution', (call) => executionHandler.handle(call));\n\n // 6. IPC server — transport auto-selects unix socket / named pipe / tcp by platform\n const ipcTransport = createTransport({ mode: 'auto' });\n const ipcServer = new IpcServer({\n transport: ipcTransport,\n getStatus: () => ({\n connected,\n hostId: config.hostId,\n gatewayUrl: config.gatewayUrl,\n reconnecting: !connected,\n }),\n gatewayClient,\n });\n\n // Start everything\n await tokenManager.start();\n console.log('[workspace-agent] Token acquired');\n\n await gatewayClient.connect();\n await ipcServer.start();\n console.log('[workspace-agent] IPC transport started');\n\n // 6. Graceful shutdown\n const shutdown = (): void => {\n console.log('[workspace-agent] Shutting down...');\n executionHandler.stop();\n tokenManager.stop();\n gatewayClient.stop();\n ipcServer.stop();\n process.exit(0);\n };\n\n process.on('SIGTERM', shutdown);\n process.on('SIGINT', shutdown);\n}\n","import { startDaemon } from './daemon.js';\n\nstartDaemon().catch((err) => {\n console.error('[host-agent] Fatal error:', err);\n process.exit(1);\n});\n"]}

package/package.json CHANGED Viewed

@@ -1,40 +1,44 @@
 {
-  "name": "@kb-labs/host-agent-app",
-  "version": "0.3.0",
-  "type": "module",
   "bin": {
     "kb-host-agent": "./dist/index.js"
   },
-  "main": "./dist/index.js",
+  "dependencies": {
+    "@kb-labs/core-runtime": "^2.6.0",
+    "@kb-labs/host-agent-contracts": "^2.6.0",
+    "@kb-labs/host-agent-core": "^2.6.0",
+    "@kb-labs/host-agent-fs": "^2.6.0",
+    "@kb-labs/host-agent-transport": "^2.6.0",
+    "@kb-labs/plugin-contracts": "^2.6.0",
+    "@kb-labs/plugin-runtime": "^2.6.0"
+  },
+  "devDependencies": {
+    "@kb-labs/devkit": "workspace:*",
+    "@types/node": "^24.3.3",
+    "rimraf": "^6",
+    "tsup": "^8.5.0",
+    "typescript": "^5",
+    "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=20.0.0",
+    "pnpm": ">=9.0.0"
+  },
   "files": [
     "dist"
   ],
+  "main": "./dist/index.js",
+  "name": "@kb-labs/host-agent-app",
   "scripts": {
-    "clean": "rimraf dist",
     "build": "tsup",
+    "clean": "rimraf dist",
     "dev": "tsup --watch",
-    "type-check": "tsc --noEmit",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "start": "node dist/index.js",
     "test": "vitest run -c ../../vitest.config.ts",
-    "test:watch": "vitest -c ../../vitest.config.ts"
+    "test:watch": "vitest -c ../../vitest.config.ts",
+    "type-check": "tsc --noEmit"
   },
-  "dependencies": {
-    "@kb-labs/core-runtime": "^1.6.0",
-    "@kb-labs/host-agent-contracts": "^0.3.0",
-    "@kb-labs/host-agent-core": "^0.3.0",
-    "@kb-labs/host-agent-fs": "^0.3.0",
-    "@kb-labs/host-agent-transport": "^0.3.0",
-    "@kb-labs/plugin-contracts": "^1.4.0",
-    "@kb-labs/plugin-runtime": "^1.4.0"
-  },
-  "devDependencies": {
-    "@kb-labs/devkit": "link:../../../kb-labs-devkit",
-    "@types/node": "^24.3.3",
-    "rimraf": "^6",
-    "tsup": "^8.5.0",
-    "typescript": "^5",
-    "vitest": "^3.2.4"
-  }
+  "type": "module",
+  "version": "2.6.0"
 }