@kontextmind/kxm 0.7.167 → 0.7.169

package/plugins/kxm/src/kxm-update.ts

@@ -1,3 +1,4 @@
+import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
@@ -43,6 +44,21 @@ export function kxmReleaseAssetName(version: string): string {
   return `kxm-${version}.tgz`;
 }
 
+export function kxmReleaseDownloadUrl(version: string, name = kxmReleaseAssetName(version)): string {
+  return `https://github.com/kontextmind/kxm/releases/download/v${version}/${name}`;
+}
+
+/** `gh` is optional. Hosts without it download the same asset with curl and still verify the digest. */
+export function ghReleaseDownloadAvailable(env: NodeJS.ProcessEnv = process.env): boolean {
+  const result = spawnSync("gh", ["--version"], {
+    encoding: "utf8",
+    env,
+    windowsHide: true,
+    timeout: 15_000,
+  });
+  return !result.error && result.status === 0;
+}
+
 export function readInstalledKxmVersion(root: string): string {
   const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8")) as { version?: unknown };
   if (typeof pkg.version !== "string" || !parseSemver(pkg.version)) {
@@ -213,7 +229,7 @@ export async function fetchLatestKxmVersion(
 }
 
 export type KxmPackageUpdateStep =
-  | { kind: "download"; command: "gh"; args: string[] }
+  | { kind: "download"; command: "gh" | "curl"; args: string[] }
   | { kind: "verify"; path: string; sha256: string }
   | { kind: "install"; command: "npm"; args: string[] };
 
@@ -233,17 +249,24 @@ export function planKxmPackageUpdate(
   latest: string,
   releaseDir: string,
   asset?: KxmReleaseAsset,
+  downloader: "gh" | "curl" = "gh",
 ): KxmPackageUpdateStep[] {
   if (source === "npm") {
     return [{ kind: "install", command: "npm", args: ["install", "--global", "--omit=peer", `@kontextmind/kxm@${latest}`] }];
   }
   const name = asset?.name ?? kxmReleaseAssetName(latest);
   const steps: KxmPackageUpdateStep[] = [
-    {
-      kind: "download",
-      command: "gh",
-      args: ["release", "download", `v${latest}`, "--repo", "kontextmind/kxm", "--pattern", name, "--dir", releaseDir, "--clobber"],
-    },
+    downloader === "curl"
+      ? {
+        kind: "download",
+        command: "curl",
+        args: ["--fail", "--silent", "--show-error", "--location", "--output", join(releaseDir, name), kxmReleaseDownloadUrl(latest, name)],
+      }
+      : {
+        kind: "download",
+        command: "gh",
+        args: ["release", "download", `v${latest}`, "--repo", "kontextmind/kxm", "--pattern", name, "--dir", releaseDir, "--clobber"],
+      },
   ];
   if (asset?.sha256) {
     steps.push({ kind: "verify", path: join(releaseDir, name), sha256: asset.sha256 });

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.167";
+const VERSION = "0.7.169";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/plugins/kxm/src/project-config.ts

@@ -104,7 +104,40 @@ const RESOURCE_SCHEMA: Readonly<Record<KxmResourceKind, { identity: string; file
 const IDENTIFIER = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/;
 const WINDOWS_RESERVED = /^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³]|conin\$|conout\$|clock\$)$/i;
 const BUILTIN_EXECUTORS = ["local", "ssh", "exe-dev"];
-const BUILTIN_TOOL_PRESETS = ["coordinator", "read-only", "workspace-writer", "tests-writer"];
+/** Builtin preset to the harness one-shot profile. An agent preset may only narrow. */
+export const TOOL_PRESET_PROFILES = Object.freeze({
+  coordinator: "read-only",
+  "read-only": "read-only",
+  "workspace-writer": "edit",
+  "tests-writer": "edit",
+} as const);
+const BUILTIN_TOOL_PRESETS = Object.keys(TOOL_PRESET_PROFILES);
+
+export function toolPresetProfile(preset: string): "read-only" | "edit" | undefined {
+  if (!Object.hasOwn(TOOL_PRESET_PROFILES, preset)) return undefined;
+  return TOOL_PRESET_PROFILES[preset as keyof typeof TOOL_PRESET_PROFILES];
+}
+
+/**
+ * Set when `preset` is wider than the role permission, or wider than a
+ * registered role preset. Same text at load and at dispatch.
+ */
+export function toolPresetExceedsRoleMessage(
+  preset: string,
+  roleId: string,
+  rolePermission: "edit" | "read-only",
+  rolePreset: string | undefined,
+): string | undefined {
+  const profile = toolPresetProfile(preset);
+  if (profile !== "edit") return undefined;
+  if (rolePermission === "read-only") {
+    return `tools.preset ${preset} exceeds role ${roleId} permission read-only`;
+  }
+  if (rolePreset !== undefined && toolPresetProfile(rolePreset) === "read-only") {
+    return `tools.preset ${preset} exceeds role ${roleId} preset ${rolePreset}`;
+  }
+  return undefined;
+}
 const SECRET_VALUE_PATTERNS: readonly RegExp[] = [
   /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/,
   /\b(?:ghp|github_pat)_[A-Za-z0-9_]{20,}\b/,
@@ -583,6 +616,16 @@ function stringValue(value: JsonValue | undefined): string | undefined {
   return typeof value === "string" ? value : undefined;
 }
 
+function roleById(roles: ReadonlyMap<string, KxmResource>, roleId: string): KxmResource | undefined {
+  const direct = roles.get(roleId);
+  if (direct) return direct;
+  const folded = roleId.toLocaleLowerCase("en-US");
+  for (const role of roles.values()) {
+    if ((role.id ?? "").toLocaleLowerCase("en-US") === folded) return role;
+  }
+  return undefined;
+}
+
 function numberValue(value: JsonValue | undefined, fallback: number): number {
   return typeof value === "number" ? value : fallback;
 }
@@ -1224,10 +1267,29 @@ function validateBundle(
     if (executor && !executors.has(executor)) issues.push(issue("reference", "executor_unknown", agent.logicalPath, `executor ${executor} is not registered`));
     const preset = stringValue(objectValue(agent.value.tools)?.preset);
     if (preset && !presets.has(preset)) issues.push(issue("reference", "tool_preset_unknown", agent.logicalPath, `tool preset ${preset} is not registered`));
+    const roleId = stringValue(agent.value.role);
+    const role = roleId ? roleById(roles, roleId) : undefined;
+    const rolePermission = stringValue(role?.value.permission);
+    if (preset && role && (rolePermission === "edit" || rolePermission === "read-only")) {
+      const message = toolPresetExceedsRoleMessage(
+        preset,
+        role.id ?? roleId ?? "role",
+        rolePermission,
+        stringValue(objectValue(role.value.tools)?.preset),
+      );
+      if (message) issues.push(issue("semantic", "tool_preset_exceeds_role", agent.logicalPath, message));
+    }
     for (const repositoryId of Object.keys(objectValue(agent.value.repositories) ?? {})) {
       if (!repositoryIds.has(repositoryId)) issues.push(issue("reference", "repository_unknown", agent.logicalPath, `references unknown repository ${repositoryId}`));
     }
   }
+  for (const role of roles.values()) {
+    const permission = stringValue(role.value.permission);
+    const rolePreset = stringValue(objectValue(role.value.tools)?.preset);
+    if (permission === "read-only" && rolePreset && toolPresetProfile(rolePreset) === "edit") {
+      issues.push(issue("semantic", "tool_preset_exceeds_role", role.logicalPath, `tools.preset ${rolePreset} exceeds permission read-only`));
+    }
+  }
   validateModelReferences(models, issues);
 
   const defaultWorkflow = stringValue(project.value.defaultWorkflow) ?? "default";

package/plugins/kxm/src/runtime-supervisor.ts

@@ -31,7 +31,7 @@ import { createKxmOneShotProducer } from "./oneshot-producer.ts";
 import { KxmRunScheduler, createKxmSimulatedProducer, recordDriveReceipt, recoverKxmRun, kxmDrivePollProjection } from "./engine.ts";
 import { kxmDriveSession, kxmOpenDriveSessions } from "./runtime-owner.ts";
 import { RuntimeHubClient, HubHttpError, type SyncPushResponse } from "./client.ts";
-import { CloudTokenError, readHubBinding } from "./hub-binding.ts";
+import { CloudTokenError, HubBindingError, loadHubBinding } from "./hub-binding.ts";
 import { resolveClientHubAuthToken } from "./hub-env.ts";
 import { createLogger } from "./logger.ts";
 import type { KxmOutboxRow, KxmOutboxStatus } from "./runtime-store.ts";
@@ -572,8 +572,21 @@ export async function syncKxmOutbox(
 }
 
 /** Where this Runtime reports one project, or nothing when no hub is bound. */
-function runtimeHubClientFor(context: KxmRuntimeContext, env: NodeJS.ProcessEnv): RuntimeHubClient | undefined {
-  const serverUrl = env.KXM_SERVER_URL?.trim() || readHubBinding(env)?.url;
+function runtimeHubClientFor(
+  context: KxmRuntimeContext,
+  env: NodeJS.ProcessEnv,
+  onBindingWarning?: (message: string) => void,
+): RuntimeHubClient | undefined {
+  let recordUrl: string | undefined;
+  try {
+    const loaded = loadHubBinding(env);
+    if (loaded.warning) onBindingWarning?.(loaded.warning);
+    recordUrl = loaded.record?.url;
+  } catch (error) {
+    if (!(error instanceof HubBindingError)) throw error;
+    onBindingWarning?.(`${error.message}; falling back to the local hub so sync can continue`);
+  }
+  const serverUrl = env.KXM_SERVER_URL?.trim() || recordUrl;
   if (!serverUrl) return undefined;
   // Use the context's actual projectId — the same identity sync events carry — so the
   // ops snapshot can join runs to their home Runtime. The npm package name (what an
@@ -1271,6 +1284,7 @@ async function startKxmRuntimeSupervisorInner(
   };
 
   let syncing = false;
+  let bindingWarning: string | undefined;
   const syncTimer = setInterval(() => {
     if (syncing || stopping) return;
     syncing = true;
@@ -1292,7 +1306,11 @@ async function startKxmRuntimeSupervisorInner(
           consecutiveFailures: 0,
         };
         try {
-          const client = runtimeHubClientFor(context, env);
+          const client = runtimeHubClientFor(context, env, (message) => {
+            if (bindingWarning === message) return;
+            bindingWarning = message;
+            logger.warn({ event: "hub_binding_fallback", message });
+          });
           if (!client) {
             // Not a failure: a box with no bound hub simply keeps its rows.
             recordSyncStatus(context, { ...base, state: "no_hub" });

package/scripts/kxm-publish-npm.mjs

@@ -271,6 +271,36 @@ export async function runKxmNpmPublish(input) {
   };
 }
 
+/**
+ * npm can accept a publish minutes before `npm view <pkg>@<version>` answers.
+ * Callers that report success should wait until this returns visible.
+ */
+export function npmViewVersion(version, exec = execFile) {
+  return new Promise((resolve) => {
+    exec("npm", ["view", `@kontextmind/kxm@${version}`, "version"], { encoding: "utf8", timeout: 30_000 }, (error, stdout) => {
+      if (error) resolve("");
+      else resolve(String(stdout ?? "").trim());
+    });
+  });
+}
+
+export async function waitForNpmVersion(version, options = {}) {
+  const waitMs = Math.max(0, options.waitMs ?? 0);
+  const intervalMs = Math.max(250, options.intervalMs ?? 15_000);
+  const exec = options.npmView ?? ((value) => npmViewVersion(value));
+  const deadline = Date.now() + waitMs;
+  let last = "";
+  for (;;) {
+    const seen = String(await exec(version) ?? "").trim();
+    if (seen === version) return { visible: true, version };
+    last = seen || last;
+    if (Date.now() >= deadline) return { visible: false, version, detail: last };
+    const pause = Math.min(intervalMs, Math.max(0, deadline - Date.now()));
+    if (pause === 0) return { visible: false, version, detail: last };
+    await new Promise((resolve) => setTimeout(resolve, pause));
+  }
+}
+
 export async function main(env = process.env, stdout = process.stdout, stderr = process.stderr) {
   const token = env.GITHUB_TOKEN || env.GH_TOKEN;
   const npmToken = env.NODE_AUTH_TOKEN || env.NPM_TOKEN;
@@ -313,7 +343,23 @@ export async function main(env = process.env, stdout = process.stdout, stderr =
         stdout.write(`release ${tag} is currently a draft; waiting for publish (${sec}s remaining)...\n`);
       },
     });
-    stdout.write(`${JSON.stringify(result)}\n`);
+    const version = String(tag).replace(/^v/, "");
+    const visibleWaitRaw = env.KXM_NPM_VISIBLE_WAIT_MS;
+    const visibleWaitMs = visibleWaitRaw == null || visibleWaitRaw === ""
+      ? 20 * 60 * 1000
+      : Math.max(0, Number(visibleWaitRaw) || 0);
+    const intervalRaw = env.KXM_NPM_VISIBLE_INTERVAL_MS;
+    const intervalMs = intervalRaw == null || intervalRaw === "" ? 15_000 : Math.max(250, Number(intervalRaw) || 15_000);
+    if (visibleWaitMs > 0) {
+      stdout.write(`npm publish submitted for @kontextmind/kxm@${version}; waiting until npm view shows it\n`);
+      const visible = await waitForNpmVersion(version, { waitMs: visibleWaitMs, intervalMs });
+      if (!visible.visible) {
+        stderr.write(`npm_not_visible: npm view @kontextmind/kxm@${version} version did not appear within ${visibleWaitMs}ms\n`);
+        return 1;
+      }
+      stdout.write(`npm view @kontextmind/kxm@${version} version is visible\n`);
+    }
+    stdout.write(`${JSON.stringify({ ...result, npmVisible: visibleWaitMs > 0 })}\n`);
     return 0;
   } catch (error) {
     const code = error instanceof KxmPublishNpmError ? error.code : "publish_failed";