@kin-tio/cli 0.6.2 → 0.7.1

package/dist/src/services/codex-app-server.js

@@ -207,10 +207,19 @@ export class CodexAppServer {
             this.#pending.delete(message.id);
             const rpcError = asRecord(message.error);
             if (rpcError) {
-                const error = new Error(`Codex app-server request failed: ${pending.method}`);
-                if (typeof rpcError.code === 'number' && Number.isSafeInteger(rpcError.code)) {
-                    error.code = rpcError.code;
-                }
+                const code = typeof rpcError.code === 'number' && Number.isSafeInteger(rpcError.code)
+                    ? rpcError.code
+                    : undefined;
+                const errorData = asRecord(rpcError.data);
+                const category = codexFailureLabel(errorData?.codexErrorInfo ?? rpcError.codexErrorInfo);
+                const diagnostic = [
+                    ...(code === undefined ? [] : [`code ${code}`]),
+                    ...(category ? [`category ${category}`] : []),
+                ];
+                const error = new Error(`Codex app-server request failed: ${pending.method}` +
+                    (diagnostic.length ? ` (${diagnostic.join('; ')})` : ''));
+                if (code !== undefined)
+                    error.code = code;
                 pending.reject(error);
             }
             else {
@@ -355,8 +364,10 @@ class CodexAppServerThread {
     #params() {
         return {
             cwd: this.#options.workingDirectory,
-            approvalPolicy: this.#options.approvalPolicy,
-            sandbox: 'read-only',
+            ...(this.#options.approvalPolicy
+                ? { approvalPolicy: this.#options.approvalPolicy }
+                : {}),
+            ...(this.#options.sandbox ? { sandbox: this.#options.sandbox } : {}),
             ...(this.#options.developerInstructions
                 ? { developerInstructions: this.#options.developerInstructions }
                 : {}),

package/dist/src/services/conversation-processor.js

@@ -103,6 +103,9 @@ export class ConversationProcessor {
     #conversationKey(record) {
         return `${record.channel}\0${record.accountKey}\0${record.peerId}`;
     }
+    #agentAccess(record) {
+        return this.#pipeline.agentAccess?.(record) === 'host' ? 'host' : 'restricted';
+    }
     #notifyQueued(record) {
         const key = this.#conversationKey(record);
         if (this.#queueNotified.has(key))
@@ -304,6 +307,7 @@ export class ConversationProcessor {
     }
     async #submit(record, input, options = {}) {
         const opaqueConversationId = conversationId(record);
+        const agentAccess = this.#agentAccess(record);
         const activePrimary = options.wait
             ? undefined
             : this.#pipeline.agent.activePrimary(opaqueConversationId);
@@ -324,6 +328,7 @@ export class ConversationProcessor {
             try {
                 const submission = await this.#pipeline.agent.submit({
                     ...input,
+                    agentAccess,
                     channel: record.channel,
                     mode: 'steer',
                     conversationId: opaqueConversationId,
@@ -359,7 +364,7 @@ export class ConversationProcessor {
         });
         const boundaryMessageKey = options.boundaryMessageKey || record.messageKey;
         const conversationBefore = this.#store.getConversation(record.channel, record.accountKey, record.peerId);
-        const ensuredThreadId = await this.#pipeline.agent.ensureThread(opaqueConversationId, conversationBefore?.threadId || '');
+        const ensuredThreadId = await this.#pipeline.agent.ensureThread(opaqueConversationId, conversationBefore?.threadId || '', agentAccess);
         const pendingMemoryThreadId = this.#pipeline.agent.takePendingMemoryThread?.(opaqueConversationId) || '';
         if (!conversationBefore || ensuredThreadId !== conversationBefore.threadId) {
             this.#store.setConversationThread({
@@ -389,6 +394,7 @@ export class ConversationProcessor {
         try {
             submission = await this.#pipeline.agent.submit({
                 ...input,
+                agentAccess,
                 channel: record.channel,
                 ...(artifactCatalog.length ? { artifactCatalog } : {}),
                 mode: 'start',
@@ -668,7 +674,7 @@ export class ConversationProcessor {
         const latestId = ids.at(-1) || primary.clientInputId;
         const steering = validGroup.filter((item) => item.status === 'steering');
         const inspection = conversation?.threadId && this.#pipeline.agent.inspectHistory
-            ? await this.#pipeline.agent.inspectHistory(conversation.threadId, ids, latestId)
+            ? await this.#pipeline.agent.inspectHistory(conversation.threadId, ids, latestId, this.#agentAccess(primary))
             : undefined;
         const missingInput = steering.some((record) => {
             const clientId = record.clientInputId || record.messageKey;

package/dist/src/state/sqlite-store.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { MAX_WECHAT_IMAGE_BYTES, detectImageFormat, } from '../lib/image-format.js';
 import { ensurePrivateDirectory } from '../lib/private-directory.js';
-const SCHEMA_VERSION = 22;
+const SCHEMA_VERSION = 24;
 const INBOUND_STATUSES = [
     'received',
     'processing',
@@ -327,8 +327,8 @@ export class SqliteStore {
         if (version !== 0 && version !== 11 && version !== 12 &&
             version !== 13 && version !== 14 && version !== 15 &&
             version !== 16 && version !== 17 && version !== 18 && version !== 19 &&
-            version !== 20 && version !== 21) {
-            throw new Error(`SQLite schema version ${version} is no longer supported; migrate to version 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, or 21 first`);
+            version !== 20 && version !== 21 && version !== 22 && version !== 23) {
+            throw new Error(`SQLite schema version ${version} is no longer supported; migrate to version 11 through 23 first`);
         }
         if (version === 11) {
             this.#database.exec(`
@@ -1384,6 +1384,131 @@ export class SqliteStore {
           PRAGMA foreign_keys = ON;
         `);
             }
+            version = 22;
+        }
+        if (version === 22) {
+            this.#database.exec('BEGIN IMMEDIATE');
+            try {
+                const accountColumns = this.#database.prepare('PRAGMA table_info(ilink_accounts)').all();
+                if (!accountColumns.some(({ name }) => name === 'agent_access')) {
+                    this.#database.exec(`
+            ALTER TABLE ilink_accounts ADD COLUMN agent_access TEXT NOT NULL
+              DEFAULT 'restricted'
+              CHECK (agent_access IN ('restricted', 'host'));
+          `);
+                }
+                this.#database.exec(`
+          DROP INDEX ilink_one_pending_offer_idx;
+          ALTER TABLE ilink_login_offers RENAME TO ilink_login_offers_v22;
+          CREATE TABLE ilink_login_offers (
+            offer_id TEXT PRIMARY KEY,
+            initiator_kind TEXT NOT NULL
+              CHECK (initiator_kind IN ('local_operator', 'remote_adapter')),
+            source_channel TEXT NOT NULL,
+            source_message_key TEXT NOT NULL,
+            source_account_id TEXT NOT NULL,
+            source_peer_id TEXT NOT NULL,
+            candidate_account_keys_json TEXT NOT NULL DEFAULT '[]'
+              CHECK (json_valid(candidate_account_keys_json)),
+            secret_generation INTEGER NOT NULL CHECK (secret_generation >= 0),
+            nonce TEXT NOT NULL,
+            ciphertext TEXT NOT NULL,
+            auth_tag TEXT NOT NULL,
+            api_base_url TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'waiting'
+              CHECK (status IN (
+                'waiting', 'scanned', 'confirmed', 'expired', 'failed', 'cancelled'
+              )),
+            expires_at INTEGER NOT NULL,
+            last_polled_at INTEGER NOT NULL DEFAULT 0,
+            error_code TEXT NOT NULL DEFAULT '',
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+          ) STRICT, WITHOUT ROWID;
+          INSERT INTO ilink_login_offers (
+            offer_id, initiator_kind, source_channel, source_message_key,
+            source_account_id, source_peer_id, secret_generation,
+            candidate_account_keys_json,
+            nonce, ciphertext, auth_tag, api_base_url, status,
+            expires_at, last_polled_at, error_code, created_at, updated_at
+          )
+          SELECT
+            offer_id, 'remote_adapter', 'wechat_kf', source_message_key,
+            source_open_kfid, source_external_userid, secret_generation,
+            '[]',
+            nonce, ciphertext, auth_tag, api_base_url, status,
+            expires_at, last_polled_at, error_code, created_at, updated_at
+          FROM ilink_login_offers_v22;
+          DROP TABLE ilink_login_offers_v22;
+          CREATE UNIQUE INDEX ilink_one_pending_offer_idx
+            ON ilink_login_offers(
+              source_channel, source_account_id, source_peer_id
+            )
+            WHERE status IN ('waiting', 'scanned');
+
+          ALTER TABLE ilink_enrollment_audit RENAME TO ilink_enrollment_audit_v22;
+          CREATE TABLE ilink_enrollment_audit (
+            offer_id TEXT PRIMARY KEY,
+            initiator_kind TEXT NOT NULL
+              CHECK (initiator_kind IN ('local_operator', 'remote_adapter')),
+            source_channel TEXT NOT NULL,
+            source_message_key TEXT NOT NULL,
+            source_account_id TEXT NOT NULL,
+            source_peer_id TEXT NOT NULL,
+            account_key TEXT NOT NULL DEFAULT '',
+            result TEXT NOT NULL CHECK (result IN (
+              'confirmed', 'expired', 'failed', 'cancelled',
+              'already_connected', 'verification_required'
+            )),
+            offered_at INTEGER NOT NULL,
+            completed_at INTEGER NOT NULL
+          ) STRICT, WITHOUT ROWID;
+          INSERT INTO ilink_enrollment_audit (
+            offer_id, initiator_kind, source_channel, source_message_key,
+            source_account_id, source_peer_id, account_key,
+            result, offered_at, completed_at
+          )
+          SELECT
+            offer_id, 'remote_adapter', 'wechat_kf', source_message_key,
+            source_open_kfid, source_external_userid, account_key,
+            result, offered_at, completed_at
+          FROM ilink_enrollment_audit_v22;
+          DROP TABLE ilink_enrollment_audit_v22;
+
+          PRAGMA user_version = 23;
+          COMMIT;
+        `);
+            }
+            catch (error) {
+                this.#database.exec('ROLLBACK');
+                throw error;
+            }
+            version = 23;
+        }
+        if (version === 23) {
+            this.#database.exec('BEGIN IMMEDIATE');
+            try {
+                const accountColumns = this.#database.prepare('PRAGMA table_info(ilink_accounts)').all();
+                if (!accountColumns.some(({ name }) => name === 'runtime_enabled')) {
+                    this.#database.exec(`
+            ALTER TABLE ilink_accounts ADD COLUMN runtime_enabled INTEGER NOT NULL
+              DEFAULT 0 CHECK (runtime_enabled IN (0, 1));
+          `);
+                }
+                this.#database.exec(`
+          UPDATE ilink_accounts
+          SET runtime_enabled = 1
+          WHERE status = 'active' AND (
+            SELECT COUNT(*) FROM ilink_accounts WHERE status = 'active'
+          ) = 1;
+          PRAGMA user_version = 24;
+          COMMIT;
+        `);
+            }
+            catch (error) {
+                this.#database.exec('ROLLBACK');
+                throw error;
+            }
             return;
         }
         this.#database.exec('BEGIN IMMEDIATE');
@@ -1425,6 +1550,10 @@ export class SqliteStore {
           generation INTEGER NOT NULL DEFAULT 1 CHECK (generation > 0),
           status TEXT NOT NULL DEFAULT 'active'
             CHECK (status IN ('active', 'paused', 'disabled', 'revoked')),
+          agent_access TEXT NOT NULL DEFAULT 'restricted'
+            CHECK (agent_access IN ('restricted', 'host')),
+          runtime_enabled INTEGER NOT NULL DEFAULT 0
+            CHECK (runtime_enabled IN (0, 1)),
           pause_until INTEGER NOT NULL DEFAULT 0,
           cursor TEXT NOT NULL DEFAULT '',
           cursor_updated_at INTEGER NOT NULL DEFAULT 0,
@@ -1448,9 +1577,14 @@ export class SqliteStore {
 
         CREATE TABLE ilink_login_offers (
           offer_id TEXT PRIMARY KEY,
+          initiator_kind TEXT NOT NULL
+            CHECK (initiator_kind IN ('local_operator', 'remote_adapter')),
+          source_channel TEXT NOT NULL,
           source_message_key TEXT NOT NULL,
-          source_open_kfid TEXT NOT NULL,
-          source_external_userid TEXT NOT NULL,
+          source_account_id TEXT NOT NULL,
+          source_peer_id TEXT NOT NULL,
+          candidate_account_keys_json TEXT NOT NULL DEFAULT '[]'
+            CHECK (json_valid(candidate_account_keys_json)),
           secret_generation INTEGER NOT NULL CHECK (secret_generation >= 0),
           nonce TEXT NOT NULL,
           ciphertext TEXT NOT NULL,
@@ -1467,17 +1601,24 @@ export class SqliteStore {
           updated_at INTEGER NOT NULL
         ) STRICT, WITHOUT ROWID;
         CREATE UNIQUE INDEX ilink_one_pending_offer_idx
-          ON ilink_login_offers(source_open_kfid, source_external_userid)
+          ON ilink_login_offers(
+            source_channel, source_account_id, source_peer_id
+          )
           WHERE status IN ('waiting', 'scanned');
 
         CREATE TABLE ilink_enrollment_audit (
           offer_id TEXT PRIMARY KEY,
+          initiator_kind TEXT NOT NULL
+            CHECK (initiator_kind IN ('local_operator', 'remote_adapter')),
+          source_channel TEXT NOT NULL,
           source_message_key TEXT NOT NULL,
-          source_open_kfid TEXT NOT NULL,
-          source_external_userid TEXT NOT NULL,
+          source_account_id TEXT NOT NULL,
+          source_peer_id TEXT NOT NULL,
           account_key TEXT NOT NULL DEFAULT '',
-          result TEXT NOT NULL
-            CHECK (result IN ('confirmed', 'expired', 'failed', 'cancelled')),
+          result TEXT NOT NULL CHECK (result IN (
+            'confirmed', 'expired', 'failed', 'cancelled',
+            'already_connected', 'verification_required'
+          )),
           offered_at INTEGER NOT NULL,
           completed_at INTEGER NOT NULL
         ) STRICT, WITHOUT ROWID;

package/dist/src/version.js

@@ -1 +1 @@
-export const KINTIO_VERSION = '0.6.2';
+export const KINTIO_VERSION = '0.7.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kin-tio/cli",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "license": "Apache-2.0",
   "author": "XIE YU",
   "packageManager": "pnpm@10.34.5",