@koda-sl/baker-bridge 0.123.0-dev.f9f855bf1 → 0.124.0-dev.7e3937022

package/dist/hono/bridge-job.js

@@ -13,13 +13,16 @@ import { AVATAR_CASTING_TOOL_NAME, normalizeAvatarCastingToolInput, } from "./av
 import { asksForAvatarFace, FACE_QUESTION_MESSAGE } from "./avatar-face-question.js";
 import { CONNECTION_INPUT_TOOL_NAME, CONNECTION_PLATFORMS, connectedButNotLoaded, normalizeConnectionInputToolInput, toolsConnected, } from "./connection-input.js";
 import { messageContextTokens, pickContextWindow, streamEventContextUsage, turnContextUsage, } from "./context-usage.js";
+import { CREDENTIAL_INPUT_TOOL_NAME, normalizeCredentialInputToolInput, } from "./credential-input.js";
+import { credentialScrubHooks } from "./credential-scrub.js";
 import { FLOW_INPUT_TOOL_NAME, nodeTargetRefusals, normalizeFlowInputToolInput, readRawFlowTree, sanitizeFlowRequests, } from "./flow-input.js";
 import { writesInventedLogo } from "./invented-logo.js";
+import { jevJudge } from "./jev.js";
 import { installedLatitudeHook, latitudeTelemetryFor } from "./latitude-telemetry.js";
 import { composioScopesToInvalidate, failedCustomServers, reportMcpInvalid, serversConnectedWithNoTools, } from "./mcp-servers.js";
 import { agentModelOverride, autoCompactWindowForModel, betasForModel, contextWindowForModel, } from "./model-capabilities.js";
 import { BEDROCK_SERVABLE_CAPABILITIES, buildAgentExtraBody, EXTRA_BODY_ENV, MODEL_CAPABILITIES_ENV, } from "./openrouter-session.js";
-import { currentReferenceReminder } from "./prompt-context.js";
+import { credentialReminder, currentReferenceReminder } from "./prompt-context.js";
 import { bridgeRuntimeFiles } from "./runtime-files.js";
 import { applyCurrentSenderAttribution, buildCleanBoundary, buildRehydratedPrompt, compactionRetryAttempt, emptyInProgressSession, isContextOverflowError, isResumeSessionError, observeInProgressSession, prepareSessionAttempt, stallContinuationAttempt, } from "./session-continuity.js";
 import { readSessionSkills } from "./session-skills.js";
@@ -220,6 +223,16 @@ export function reviewQueryOptions(job) {
         ? { outputFormat: { type: "json_schema", schema: job.review.outputSchema }, hooks: reviewOutputHooks() }
         : {};
 }
+/**
+ * Every job's tool results pass through the credential scrub, appended after
+ * any other PostToolUse hook so its rewrite is the one the SDK keeps.
+ */
+function withCredentialScrub(options) {
+    const scrub = credentialScrubHooks();
+    const hooks = { ...(options.hooks ?? {}) };
+    hooks.PostToolUse = [...(hooks.PostToolUse ?? []), ...(scrub.PostToolUse ?? [])];
+    return { ...options, hooks };
+}
 /**
  * The review runs on Baker's own OpenRouter credential and its own read-only
  * key, both replacing whatever the Runtime was started with — the client never
@@ -246,6 +259,12 @@ export const REVIEW_DEBUG_LOG = "/tmp/baker-review-cli.jsonl";
 // briefly; model activity cancels it (the CLI clearly isn't idle). Turns that
 // never ran a task skip the delay entirely.
 const DEFAULT_TURN_END_SETTLE_MS = 1_000;
+// When the last task settles after the clean result, the CLI wakes the model on
+// it and streams nothing until the woken turn's first token — seconds, and 30+
+// on a slow route. Ending input inside that silence strands the woken turn on a
+// closed channel, and the CLI's exit at its result kills anything it backgrounds
+// (dev, Oct 2026: a render). A settle that wakes nobody waits this long once.
+const DEFAULT_TURN_END_WAKE_MS = 45_000;
 // After input ends, a healthy idle CLI exits within seconds. If the stream is
 // still open past this window with no messages arriving, the CLI is wedged —
 // close the query so the turn can finish instead of hanging to the watchdog.
@@ -273,10 +292,10 @@ const UNATTENDED_PROMPT_MESSAGE = "This run is unattended — it was started by
  * asked for in a text prompt renders a question nobody can answer. In each case the user
  * is left waiting for something that was never going to come.
  */
-function refuseMalformedCall(toolName, input, userText, priorUserText) {
+async function refuseMalformedCall(toolName, input, judge, userText, priorUserText) {
     if (toolName === "Bash") {
         const command = typeof input?.command === "string" ? input.command : undefined;
-        return toolRunAsCommand(command) ?? accentContradictsUser(command, userText, priorUserText);
+        return toolRunAsCommand(command) ?? (await accentContradictsUser(command, userText, priorUserText, judge));
     }
     if (toolName === "Agent" || toolName === "Task") {
         return blockingToolDelegated(typeof input?.prompt === "string" ? input.prompt : undefined);
@@ -284,11 +303,18 @@ function refuseMalformedCall(toolName, input, userText, priorUserText) {
     if (toolName === "Write" || toolName === "Edit" || toolName === "MultiEdit") {
         return writesInventedLogo(typeof input?.file_path === "string" ? input.file_path : undefined);
     }
-    if (toolName === "AskUserQuestion" && asksForAvatarFace(input)) {
+    if (toolName === "AskUserQuestion" && (await asksForAvatarFace(input, judge))) {
         return FACE_QUESTION_MESSAGE;
     }
     return null;
 }
+/**
+ * Whether this Runtime has Credentials: the backend sets `BAKER_CREDENTIALS=1`
+ * alongside the credential broker's proxy env. Read per turn, not at import.
+ */
+function credentialsEnabled() {
+    return process.env.BAKER_CREDENTIALS === "1";
+}
 /** Blocking prompts: every tool that would leave a card the backend parks on. */
 function deniedUnattendedPrompt(toolName) {
     return (toolName === "AskUserQuestion" ||
@@ -296,6 +322,7 @@ function deniedUnattendedPrompt(toolName) {
         toolName === TAG_INPUT_TOOL_NAME ||
         toolName === FLOW_INPUT_TOOL_NAME ||
         toolName === CONNECTION_INPUT_TOOL_NAME ||
+        toolName === CREDENTIAL_INPUT_TOOL_NAME ||
         toolName === AVATAR_CASTING_TOOL_NAME);
 }
 export class StreamStallError extends Error {
@@ -817,7 +844,7 @@ beforeEndInput) {
         }, timings.exitGuardMs);
         exitGuard.unref?.();
     };
-    const scheduleEnd = () => {
+    const scheduleEnd = (delayMs = timings.settleMs) => {
         if (settleTimer) {
             return;
         }
@@ -829,7 +856,7 @@ beforeEndInput) {
             endInput();
             return;
         }
-        settleTimer = setTimeout(endInput, timings.settleMs);
+        settleTimer = setTimeout(endInput, delayMs);
         settleTimer.unref?.();
     };
     return {
@@ -895,7 +922,7 @@ beforeEndInput) {
             // second result) would strand the turn until the watchdog. An emptied
             // background_tasks_changed level counts as a settle the same way.
             if (lastWasTaskLifecycle && cleanResultSeen && !hasInFlightWork()) {
-                scheduleEnd();
+                scheduleEnd(timings.wakeMs);
             }
         },
         hasInFlightWork,
@@ -988,12 +1015,14 @@ export class BridgeJobExecutor {
     stallCheckIntervalMs;
     recordTurnEvent;
     turnEndSettleMs;
+    turnEndWakeMs;
     turnEndExitGuardMs;
     now;
     readUsageBaseline;
     stalledCliExitMs;
     readFlowTree;
     settleWorkspace;
+    judge;
     constructor(dependencies) {
         this.sdk = dependencies.sdk;
         this.relay = dependencies.relay;
@@ -1006,6 +1035,7 @@ export class BridgeJobExecutor {
         this.stallCheckIntervalMs = dependencies.stallCheckIntervalMs ?? DEFAULT_STALL_CHECK_INTERVAL_MS;
         this.recordTurnEvent = dependencies.recordTurnEvent ?? recordTurnEvent;
         this.turnEndSettleMs = dependencies.turnEndSettleMs ?? DEFAULT_TURN_END_SETTLE_MS;
+        this.turnEndWakeMs = dependencies.turnEndWakeMs ?? DEFAULT_TURN_END_WAKE_MS;
         this.turnEndExitGuardMs = dependencies.turnEndExitGuardMs ?? DEFAULT_TURN_END_EXIT_GUARD_MS;
         this.now = dependencies.now ?? Date.now;
         this.readUsageBaseline =
@@ -1015,6 +1045,7 @@ export class BridgeJobExecutor {
         this.settleWorkspace = dependencies.settleWorkspace ?? (() => settleWorkspaceAfterTasks());
         this.readFlowTree =
             dependencies.readFlowTree ?? ((flowSlug) => readRawFlowTree(bridgeRuntimeFiles.flowsDir(), flowSlug));
+        this.judge = dependencies.judge ?? jevJudge(process.env.OPENROUTER_API_KEY);
     }
     async execute(job, controls) {
         const state = createBridgeJobState();
@@ -1087,7 +1118,11 @@ export class BridgeJobExecutor {
         const verbatim = verbatimSlashCommand(job.prompt) ??
             leadingSkillCommand(job.prompt, (await readSessionSkills(bridgeRuntimeFiles.projectRoot())) ?? []);
         let requestPrompt = verbatim ?? applyCurrentSenderAttribution(job.prompt, job.currentSender);
-        const reminder = verbatim === null ? currentReferenceReminder(job.currentReference) : undefined;
+        const reminders = [
+            verbatim === null ? currentReferenceReminder(job.currentReference) : undefined,
+            credentialReminder(job.credentials ?? [], credentialsEnabled()),
+        ].filter((text) => text !== undefined);
+        const reminder = reminders.length > 0 ? reminders.join("\n\n") : undefined;
         if (job.attachments && job.attachments.length > 0) {
             requestPrompt += await this.prepareAttachments(job.attachments, "message");
         }
@@ -1364,7 +1399,7 @@ export class BridgeJobExecutor {
             if (!servers) {
                 return notReady;
             }
-            const result = await settleWithin(query.setMcpServers({ ...servers, baker_ui: createBakerUiServer() }), MCP_RELOAD_TIMEOUT_MS);
+            const result = await settleWithin(query.setMcpServers({ ...servers, baker_ui: createBakerUiServer({ credentials: credentialsEnabled() }) }), MCP_RELOAD_TIMEOUT_MS);
             const failed = Object.keys(result?.errors ?? {});
             if (failed.length > 0) {
                 console.error(`[mcp] reload after a connection could not start ${failed.join(", ")}`);
@@ -1396,7 +1431,7 @@ export class BridgeJobExecutor {
      * handlers — except on an unattended turn, where there is nobody to answer and
      * every one of them is refused up front (see `UNATTENDED_PROMPT_MESSAGE`).
      */
-    routeToolUse(job, controls, toolName, input, opts) {
+    async routeToolUse(job, controls, toolName, input, opts) {
         const refusedShell = reviewShellRefusal(job, toolName, input);
         if (refusedShell) {
             return Promise.resolve({ behavior: "deny", message: refusedShell });
@@ -1412,9 +1447,9 @@ export class BridgeJobExecutor {
             });
             return Promise.resolve({ behavior: "deny", message: UNATTENDED_PROMPT_MESSAGE });
         }
-        const malformed = refuseMalformedCall(toolName, input, job.prompt, userTurnsBefore(job));
+        const malformed = await refuseMalformedCall(toolName, input, this.judge, job.prompt, userTurnsBefore(job));
         if (malformed)
-            return Promise.resolve({ behavior: "deny", message: malformed });
+            return { behavior: "deny", message: malformed };
         // Cast what is owed FIRST, whatever comes next — including another create. Checked
         // the other way round, a second create (the agent retrying after a rejected flag,
         // which is what happens in practice) would overwrite the handle and the first
@@ -1467,6 +1502,15 @@ export class BridgeJobExecutor {
         if (toolName === CONNECTION_INPUT_TOOL_NAME) {
             return this.handleConnectionInputRequest(job, controls, input, opts.toolUseID, opts.signal);
         }
+        if (toolName === CREDENTIAL_INPUT_TOOL_NAME) {
+            if (!credentialsEnabled()) {
+                return Promise.resolve({
+                    behavior: "deny",
+                    message: "Saved credentials are not available in this workspace. Ask the user to share what you need another way, and never ask them to paste a password or key into the chat.",
+                });
+            }
+            return this.handleCredentialInputRequest(job, controls, input, opts.toolUseID, opts.signal);
+        }
         if (toolName === AVATAR_CASTING_TOOL_NAME) {
             return this.handleAvatarCastingRequest(job, controls, input, opts.toolUseID, opts.signal);
         }
@@ -1537,7 +1581,7 @@ export class BridgeJobExecutor {
             settingSources: ["project"],
             // `baker_ui` hosts in-process interactive dashboard tools (secure tag
             // form). Always present; HTTP (Composio) servers merge alongside it.
-            mcpServers: { ...(mcpServers ?? {}), baker_ui: createBakerUiServer() },
+            mcpServers: { ...(mcpServers ?? {}), baker_ui: createBakerUiServer({ credentials: credentialsEnabled() }) },
             // Only send the key when there is something in it: the SDK forwards
             // `settings` to the CLI whenever it is present, so an empty object still
             // becomes a `--settings {}` flag tier for the CLI to parse.
@@ -1550,7 +1594,7 @@ export class BridgeJobExecutor {
             // the workspace could not be read; omit rather than allowlist nothing.
             ...(skills ? { skills } : {}),
             disallowedTools: disallowedToolsFor(job),
-            ...reviewQueryOptions(job),
+            ...withCredentialScrub(reviewQueryOptions(job)),
             ...(job.planMode ? { permissionMode: "plan" } : {}),
             canUseTool: (toolName, input, opts) => this.routeToolUse(job, controls, toolName, input, opts),
             // No `fallbackModel`, and no server-side refusal `fallbacks` in the extra
@@ -1575,6 +1619,10 @@ export class BridgeJobExecutor {
                 // system-reminder repeatedly pushed the agent toward that ephemeral
                 // backlog instead of the product's own Tasks (`baker actions`).
                 CLAUDE_CODE_ENABLE_TASKS: "0",
+                // The CLI clamps any Bash timeout to 10 minutes unless told otherwise;
+                // the workspace's `inject-timeouts` hook gives a render up to 30, and at
+                // the clamp the render was moved to the background mid-repair.
+                BASH_MAX_TIMEOUT_MS: String(30 * 60_000),
                 // `citty` writes ANSI escapes into `baker --help` unconditionally —
                 // they are never TTY-gated, so every help read the agent does inside
                 // the sandbox pays ~5-10% of its tokens on colour codes it can't see.
@@ -1649,7 +1697,7 @@ export class BridgeJobExecutor {
         // A reading that answers after the query drained (past its timeout) belongs
         // to a query already folded into the turn — and a retry reuses `state`.
         let drained = false;
-        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent, async () => {
+        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, wakeMs: this.turnEndWakeMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent, async () => {
             const reading = await query.usage?.();
             if (reading && !drained) {
                 settledCostUsd = recordCumulativeUsage(state, reading);
@@ -1757,6 +1805,7 @@ export class BridgeJobExecutor {
                 controls.pendingTagInputs.size > 0 ||
                 controls.pendingFlowInputs.size > 0 ||
                 controls.pendingConnectionInputs.size > 0 ||
+                controls.pendingCredentialInputs.size > 0 ||
                 controls.pendingAvatarCastings.size > 0,
             onStall: () => {
                 console.error(`[BridgeJob] no stream data for ${this.stallTimeoutMs}ms while awaiting the model — closing query for retry (thread ${job.threadId})`);
@@ -2265,6 +2314,36 @@ export class BridgeJobExecutor {
             : decision.value;
         return { behavior: "allow", updatedInput: { connections, resolution } };
     }
+    async handleCredentialInputRequest(job, controls, input, toolUseId, signal) {
+        const target = { threadId: job.threadId, turnId: job.turnId };
+        const request = normalizeCredentialInputToolInput(input);
+        if (!request) {
+            return {
+                behavior: "deny",
+                message: "request_credential requires { label, reason, allowedHosts: [...] } (and optionally a lowercase `name`). Retry with that shape.",
+            };
+        }
+        const posted = await this.relay.credentialInputRequest(target, { toolUseId, ...request });
+        if (!posted) {
+            console.error(`[request_credential] failed to post credential-input-request for ${toolUseId} — denying`);
+            return {
+                behavior: "deny",
+                message: "The credential request could not be delivered to the dashboard — retry request_credential in a moment.",
+            };
+        }
+        const decision = await this.awaitPromptDecision({
+            label: "request_credential",
+            signal,
+            controls,
+            pending: controls.pendingCredentialInputs,
+            toolUseId,
+        });
+        if (decision.kind === "unanswered") {
+            return { behavior: "deny", message: PROMPT_UNANSWERED_MESSAGE };
+        }
+        void this.relay.credentialInputResolved(target);
+        return { behavior: "allow", updatedInput: { ...request, resolution: decision.value } };
+    }
     async handlePlanReview(job, controls, input, toolUseId, signal) {
         const target = { threadId: job.threadId, turnId: job.turnId };
         controls.markEvent?.();