@kitman-sh/sdk 0.6.0 → 0.7.1

package/types/packages/core/src/workspace.d.ts

@@ -43,7 +43,53 @@ export declare const WorkspaceList: Schema.Struct<{
         readonly updatedAt: Schema.String;
     }>>;
 }>;
+/** What a Workspace has set up, each part read from the rows that exist; nothing about onboarding is stored. */
+export declare const WorkspaceSetup: Schema.Struct<{
+    readonly codeHostConnected: Schema.Boolean;
+    /** The first repository bound in the Workspace; a first Research Run reads it. */
+    readonly firstRepoBinding: Schema.NullOr<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly projectId: Schema.String;
+        readonly owner: Schema.String;
+        readonly name: Schema.String;
+    }>>;
+    readonly verificationsApproved: Schema.Boolean;
+    /** The caller's own Runner heartbeating now, the Harnesses it offers, and what each other Harness lacks. */
+    readonly machine: Schema.Struct<{
+        readonly ready: Schema.Boolean;
+        readonly harnesses: Schema.$Array<Schema.String>;
+        readonly missing: Schema.$Array<Schema.String>;
+    }>;
+    readonly teammatesInvited: Schema.Boolean;
+    readonly firstRun: Schema.Boolean;
+    /** The code hosts this deployment connects in one click. */
+    readonly oneClickConnect: Schema.Struct<{
+        readonly github: Schema.Boolean;
+        readonly gitlab: Schema.Boolean;
+    }>;
+}>;
+/** A minted Pairing Code and the one command that pairs a machine with it. */
+export declare const PairingCode: Schema.Struct<{
+    readonly code: Schema.String;
+    readonly expiresAt: Schema.String;
+    readonly command: Schema.String;
+}>;
+export declare const PairingRedeem: Schema.Struct<{
+    readonly code: Schema.String;
+}>;
+/** The credentials `kitman login` stores, for the person and Workspace the code was minted for. */
+export declare const PairingCredentials: Schema.Struct<{
+    readonly accessToken: Schema.String;
+    readonly refreshToken: Schema.optional<Schema.String>;
+    readonly expiresIn: Schema.optional<Schema.Finite>;
+    readonly workspaceId: Schema.String;
+    readonly userId: Schema.String;
+}>;
 export type Workspace = (typeof Workspace)['Type'];
+export type PairingCode = (typeof PairingCode)['Type'];
+export type PairingRedeem = (typeof PairingRedeem)['Type'];
+export type PairingCredentials = (typeof PairingCredentials)['Type'];
+export type WorkspaceSetup = (typeof WorkspaceSetup)['Type'];
 export type WorkspaceNotificationPreferences = (typeof WorkspaceNotificationPreferences)['Type'];
 export type WorkspaceCreate = (typeof WorkspaceCreate)['Type'];
 export type WorkspaceUpdate = (typeof WorkspaceUpdate)['Type'];

package/types/packages/live/src/rpc/runner-client.d.ts

@@ -2,7 +2,10 @@ import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import { RpcClient } from 'effect/rpc';
 import { type RunnerSignal } from './runner-group';
-export declare const runnerWebSocketProtocol: (url: string) => Layer.Layer<RpcClient.Protocol>;
+/** The Runner RPC over a WebSocket; `proxy` is the HTTP proxy it connects through, as a sandbox's egress proxy. */
+export declare const runnerWebSocketProtocol: (url: string, options?: {
+    readonly proxy?: string;
+}) => Layer.Layer<RpcClient.Protocol>;
 export declare function runnerRpcUrl(apiUrl: string): string;
 /**
  * A Runner's control connection, open for the caller's scope. `bearer` mints the AgentCredential token sent with
@@ -50,6 +53,9 @@ export declare const makeRunnerRpcClient: (options: {
                     readonly [x: string]: unknown;
                 };
             };
+            readonly network?: "open" | {
+                readonly hosts: readonly string[];
+            };
             readonly program: {
                 readonly loopId: string;
                 readonly credential: string;
@@ -179,6 +185,9 @@ export declare const makeRunnerRpcClient: (options: {
                     readonly [x: string]: unknown;
                 };
             };
+            readonly network?: "open" | {
+                readonly hosts: readonly string[];
+            };
             readonly program: {
                 readonly loopId: string;
                 readonly credential: string;

package/types/packages/live/src/rpc/runner-group.d.ts

@@ -106,23 +106,7 @@ export declare const ProgramOutcome: Schema.Union<readonly [Schema.Struct<{
     readonly status: Schema.Literal<"failed">;
     readonly failureSummary: Schema.String;
 }>]>;
-declare const RunnerRpcs_base: RpcGroup.RpcGroup<Rpc.Rpc<"Signals", Schema.Struct<{
-    runnerReplicaId: Schema.String;
-}>, import("effect/rpc/RpcSchema").Stream<Schema.Union<readonly [Schema.TaggedStruct<"WorkAvailable", {}>, Schema.TaggedStruct<"LeaseRevoked", {
-    readonly workUnitId: Schema.String;
-}>, Schema.TaggedStruct<"Settled", {
-    readonly workUnitId: Schema.String;
-}>, Schema.TaggedStruct<"Canceled", {
-    readonly workUnitId: Schema.String;
-}>, Schema.TaggedStruct<"RunSettled", {
-    readonly runId: Schema.String;
-}>, Schema.TaggedStruct<"Steer", {
-    readonly workUnitId: Schema.String;
-    readonly messageId: Schema.String;
-    readonly text: Schema.String;
-}>, Schema.TaggedStruct<"SessionUpdated", {
-    readonly workUnitId: Schema.String;
-}>]>, typeof RunnerRpcError>, Schema.Never, typeof RunnerAuthentication, never> | Rpc.Rpc<"AdmitChild", Schema.Struct<{
+declare const RunnerRpcs_base: RpcGroup.RpcGroup<Rpc.Rpc<"AdmitChild", Schema.Struct<{
     lease: Schema.Struct<{
         readonly workUnitId: Schema.String;
         readonly leaseOwnerId: Schema.String;
@@ -187,6 +171,9 @@ declare const RunnerRpcs_base: RpcGroup.RpcGroup<Rpc.Rpc<"Signals", Schema.Struc
             readonly activities: Schema.$Record<Schema.String, Schema.Unknown>;
             readonly deferreds: Schema.$Record<Schema.String, Schema.Unknown>;
         }>;
+        readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+            readonly hosts: Schema.$Array<Schema.String>;
+        }>, Schema.Literal<"open">]>>;
         readonly program: Schema.Struct<{
             readonly loopId: Schema.String;
             readonly credential: Schema.String;
@@ -660,7 +647,23 @@ declare const RunnerRpcs_base: RpcGroup.RpcGroup<Rpc.Rpc<"Signals", Schema.Struc
     }>>;
 }>>, typeof RunnerRpcError, typeof RunnerAuthentication, never> | Rpc.Rpc<"SettledRuns", Schema.Struct<{
     runIds: Schema.$Array<Schema.String>;
-}>, Schema.$Array<Schema.String>, typeof RunnerRpcError, typeof RunnerAuthentication, never> | Rpc.Rpc<"StartAgentStep", Schema.Struct<{
+}>, Schema.$Array<Schema.String>, typeof RunnerRpcError, typeof RunnerAuthentication, never> | Rpc.Rpc<"Signals", Schema.Struct<{
+    runnerReplicaId: Schema.String;
+}>, import("effect/rpc/RpcSchema").Stream<Schema.Union<readonly [Schema.TaggedStruct<"WorkAvailable", {}>, Schema.TaggedStruct<"LeaseRevoked", {
+    readonly workUnitId: Schema.String;
+}>, Schema.TaggedStruct<"Settled", {
+    readonly workUnitId: Schema.String;
+}>, Schema.TaggedStruct<"Canceled", {
+    readonly workUnitId: Schema.String;
+}>, Schema.TaggedStruct<"RunSettled", {
+    readonly runId: Schema.String;
+}>, Schema.TaggedStruct<"Steer", {
+    readonly workUnitId: Schema.String;
+    readonly messageId: Schema.String;
+    readonly text: Schema.String;
+}>, Schema.TaggedStruct<"SessionUpdated", {
+    readonly workUnitId: Schema.String;
+}>]>, typeof RunnerRpcError>, Schema.Never, typeof RunnerAuthentication, never> | Rpc.Rpc<"StartAgentStep", Schema.Struct<{
     lease: Schema.Struct<{
         readonly workUnitId: Schema.String;
         readonly leaseOwnerId: Schema.String;

package/types/packages/sdk/src/loop/define.d.ts

@@ -50,6 +50,13 @@ export type LoopDefinition<In, Out, E> = {
     readonly capabilities: readonly LoopCapability[];
     /** The Secrets the program reads with `Config.Redacted`, and `agentWork` may put into a Step's sandbox. */
     readonly secrets?: readonly string[];
+    /**
+     * The hosts the program calls besides Kitman, or `open` for any; a shared Runner refuses the rest. An `open` Loop
+     * runs only on a Runner with `docker`, or a personal Runner.
+     */
+    readonly network?: {
+        readonly hosts: readonly string[];
+    } | 'open';
     readonly run: (input: In) => Effect.Effect<Out, E, LoopServices>;
     /** Scripts a build runs twice, the second time from the journal; not part of the manifest. */
     readonly checks?: readonly LoopCheck[];

package/types/packages/sdk/src/program/host.d.ts

@@ -5,6 +5,7 @@ import * as Option from 'effect/Option';
 import * as Schema from 'effect/Schema';
 import type { PackageConfig } from '../loop/config';
 import { ManifestInvalid } from '../loop/define';
+import { type ProgramJournal } from './engine';
 /** Asks a bundle for its declarations and check results instead of running a program. */
 export declare const describeFlag = "--kitman-describe";
 export declare const Described: Schema.Union<readonly [Schema.TaggedStruct<"Described", {
@@ -28,6 +29,9 @@ export declare const Described: Schema.Union<readonly [Schema.TaggedStruct<"Desc
         }>>;
         readonly capabilities: Schema.$Array<Schema.Literals<readonly ["agent_work", "ask", "call", "verify", "change_request", "write_back", "post_comment", "create_tasks", "merge_change_request", "publish_release"]>>;
         readonly secrets: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+            readonly hosts: Schema.$Array<Schema.String>;
+        }>, Schema.Literal<"open">]>>;
     }>>;
     readonly agents: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly schedules: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
@@ -43,6 +47,24 @@ type SecretsRpc = Pick<Effect.Success<ReturnType<typeof makeRunnerRpcClient>>, '
 export declare const programSecrets: (rpc: SecretsRpc, lease: ProgramLease) => Effect.Effect<Option.Option<never> | Option.Option<{
     readonly [x: string]: string;
 }>, Error | import("effect/rpc/RpcClientError").RpcClientError | import("../../../live/src/rpc/runner-group").RunnerRpcError, never>;
+/** Kitman's API host and the Loop's declared hosts, comma-separated, as the Runner passes them; unset for `open`. */
+export declare const programHostsEnv = "KITMAN_PROGRAM_HOSTS";
+/** `fail` where the Runner sandboxes the program, `warn` where it runs on its owner's host. */
+export declare const undeclaredHostsEnv = "KITMAN_UNDECLARED_HOSTS";
+type Fetch = (resource: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/**
+ * `fetch` limited to `hosts`, redirect hops included. An undeclared host is refused, and fails the Run with its name
+ * whatever the program then reports; under `warn` it is let through, with one warning per host.
+ */
+export declare const networkGuard: (input: {
+    readonly hosts: readonly string[];
+    readonly undeclared: 'fail' | 'warn';
+    readonly fetch: Fetch;
+    readonly warn: (line: string) => void;
+}) => {
+    fetch: Fetch;
+    journal: <Journal extends Pick<ProgramJournal, 'suspend' | 'finish'>>(journal: Journal) => Journal;
+};
 /** The entry of every Package bundle. */
 export declare const runPackage: (config: PackageConfig) => void;
 export {};