@leuduan/lagent 0.0.0-stage → 44.0.0

package/dist/plugins/sandbox/protocol.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The messages between the sandbox service on the host's main thread and its worker thread
+ * (`worker.ts`), which holds sandbox-runtime. Types only, so the worker, which runs from the sources
+ * under Node's type stripping as from `dist`, imports nothing of lagent.
+ */
+/** A path as sandbox-runtime takes it: a pattern when it reads as one, or a name marked literal. */
+export type PathEntry = string | {
+    readonly path: string;
+    readonly literal: true;
+};
+export type ParentProxy = {
+    readonly http?: string;
+    readonly https?: string;
+    readonly noProxy?: string;
+};
+/** The configuration sandbox-runtime is initialized with, once, for the worker's life. */
+export type SrtConfig = {
+    readonly network: {
+        readonly allowedDomains: readonly string[];
+        readonly deniedDomains: readonly string[];
+        /** Absent without a configured proxy: sandbox-runtime then reads its environment, which carries none. */
+        readonly parentProxy?: ParentProxy;
+    }
+    /** No `allowedDomains`: sandbox-runtime restricts the network only when it is defined. */
+     | {
+        readonly allowedDomains?: never;
+        readonly deniedDomains: readonly [];
+        readonly parentProxy?: never;
+    };
+    readonly filesystem: {
+        readonly denyRead: readonly PathEntry[];
+        readonly allowWrite: readonly PathEntry[];
+        readonly denyWrite: readonly PathEntry[];
+    };
+    /** The private copy of its JVM proxy agent: an existing explicit path ends sandbox-runtime's own search. */
+    readonly javaAgentJarPath: string;
+};
+/** A command's filesystem policy: complete lists, which replace the initialized ones for the call. */
+export type CallConfig = {
+    readonly filesystem: {
+        readonly allowWrite: readonly PathEntry[];
+        readonly denyWrite: readonly PathEntry[];
+        readonly denyRead: readonly PathEntry[];
+    };
+};
+/** What the worker found when it started sandbox-runtime. */
+export type InitReport = {
+    readonly version: string;
+    readonly supported: boolean;
+    readonly errors: readonly string[];
+    readonly warnings: readonly string[];
+    /** The paths under the home directory that sandbox-runtime keeps writable for its own uses. */
+    readonly conveniences: readonly string[];
+    /** How many JVM agent flags a wrapped command carries, and whether the one is the private copy. */
+    readonly javaAgent: {
+        readonly flags: number;
+        readonly isCopy: boolean;
+    };
+};
+export type WorkerRequest = {
+    readonly type: 'init';
+    readonly id: number;
+    readonly config: SrtConfig;
+    /** What the worker's own environment must say: its private temporary directory and its home. */
+    readonly expect: {
+        readonly tmpdir: string;
+        readonly home: string;
+    };
+} | {
+    readonly type: 'wrap';
+    readonly id: number;
+    readonly command: string;
+    readonly commandId: string;
+    /** The command the wrap stands for, bounded, for sandbox-runtime's reports. */
+    readonly commandText: string;
+    readonly config: CallConfig;
+}
+/** Abandons the wrap sent with the same id; handled on arrival, not behind queued wraps. */
+ | {
+    readonly type: 'cancel';
+    readonly id: number;
+} | {
+    readonly type: 'violations';
+    readonly id: number;
+    readonly commandId: string;
+} | {
+    readonly type: 'reset';
+    readonly id: number;
+};
+/** A request as a caller writes it: the client assigns the id. */
+export type WorkerMessage = WorkerRequest extends infer R ? (R extends WorkerRequest ? Omit<R, 'id'> : never) : never;
+/** What each request's reply carries. */
+export type WorkerValues = {
+    init: InitReport;
+    wrap: string;
+    violations: readonly string[];
+    reset: null;
+};
+export type WorkerReply = {
+    readonly id: number;
+} & ({
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly error: string;
+});

package/dist/plugins/sandbox/service.d.ts

@@ -0,0 +1,153 @@
+import { Service, type Context } from '@leuduan/cordis';
+import { z } from 'zod';
+import type { WriteRows } from '../../state/index.js';
+import { type ConfinementHandler, type ConfinementSnapshot } from '../../services/confinement/service.js';
+import { type SandboxMode } from './mode.js';
+export declare const SandboxConfigSchema: z.ZodObject<{
+    worker: z.ZodUnion<readonly [z.ZodCustom<import("url").URL, import("url").URL>, z.ZodString]>;
+    searchPath: z.ZodString;
+    tmpRoot: z.ZodString;
+    javaAgentJar: z.ZodString;
+    unconfined: z.ZodEnum<{
+        refused: "refused";
+        allowed: "allowed";
+    }>;
+    filesystem: z.ZodObject<{
+        allowWrite: z.ZodArray<z.ZodString>;
+        denyRead: z.ZodArray<z.ZodString>;
+        denyWrite: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    network: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"allowlist">;
+        allowedDomains: z.ZodArray<z.ZodString>;
+        deniedDomains: z.ZodArray<z.ZodString>;
+        parentProxy: z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodObject<{
+            http: z.ZodOptional<z.ZodURL>;
+            https: z.ZodOptional<z.ZodURL>;
+            noProxy: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"unrestricted">;
+    }, z.core.$strict>], "mode">;
+    drainTimeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type SandboxConfigInput = z.input<typeof SandboxConfigSchema>;
+/** Whether the sandbox can confine a launch now: `failed` once its worker died or its start failed, for good. */
+export type SandboxHealth = 'ready' | 'failed';
+declare module '@leuduan/cordis' {
+    interface Context {
+        /** The OS sandbox for shell commands, the confinement handler of `ctx.confinement` (optional plugin, `@leuduan/lagent/plugins/sandbox`). */
+        sandbox: SandboxService;
+    }
+    interface Events {
+        /**
+         * The sandbox can no longer confine a launch, so it refuses every one, confined or not: its
+         * worker died or it failed to start. For a host that shows conversations' sandbox state.
+         */
+        'lagent/sandbox/health'(health: SandboxHealth): void;
+    }
+}
+/**
+ * The OS sandbox for shell commands, as a service and as the one confinement handler of `ctx.confinement`.
+ * sandbox-runtime runs on a worker thread of this process (`./worker.ts`), started once, and this
+ * service owns it: the policy built for each command, the worker's messages and deadlines, and the
+ * order of teardown.
+ *
+ * Each conversation is confined or unconfined, as its durable mode says (`mode`, `setMode`, `opening`),
+ * unless the host's `unconfined: 'refused'` confines them all. The mode is read once, in the snapshot
+ * an operation takes at its first use: a switch applies to operations not yet used, and one already
+ * used keeps the policy it selected, its file access and launches included. An unconfined launch is
+ * still the sandbox's handler's, so it stops with it and a failed sandbox refuses it too. The model is
+ * told the mode as a notice, never in the prompt.
+ *
+ * The handler is registered before the worker starts and refuses every launch until the self-check
+ * passed, so a sandbox that fails to start never leaves a window in which launches run plain.
+ * Teardown releases the handle first, so what it confined ends before its proxy does. sandbox-runtime
+ * starts at most once per process, so a failed or disposed service is never restarted. The teardown
+ * order and its failure cases are in `docs/records/sandbox.md`.
+ */
+export declare class SandboxService extends Service<SandboxConfigInput> implements ConfinementHandler {
+    static inject: string[];
+    /** What the model is told about confined commands: part of the notice's fact, so a changed one is told again. */
+    private readonly guidance;
+    private readonly config;
+    private state;
+    private failure;
+    private admitting;
+    private client;
+    private host;
+    private readonly handle;
+    private releasing;
+    constructor(ctx: Context, config: SandboxConfigInput);
+    [Service.init](): Promise<() => Promise<void>>;
+    /** The host's gate: whether any conversation may run its commands unconfined. */
+    get unconfined(): 'allowed' | 'refused';
+    /** Whether the sandbox can confine a launch now. */
+    get health(): SandboxHealth;
+    /**
+     * The mode `threadId` runs its commands in: its conversation's recorded mode, `confined` before
+     * one is recorded, and `confined` whatever was recorded when the host refuses unconfined. The one
+     * value preparation, the notice and a host's display read.
+     */
+    mode(threadId: string): SandboxMode;
+    /**
+     * Records `mode` for `threadId`'s conversation, when it changes it. Refuses a mode the host's gate
+     * refuses, a thread the journal does not hold, and a thread with an origin, which is in its
+     * conversation's mode: switch the conversation.
+     */
+    setMode(threadId: string, mode: SandboxMode): Promise<void>;
+    /**
+     * The rows that record `mode` in the write that creates or forks a conversation (`Opening.rows`),
+     * always one, so an opening leaves evidence of the choice. The mode and the host's gate are judged
+     * here, before anything is written; a thread with an origin is refused inside the write.
+     */
+    opening(mode: SandboxMode): WriteRows;
+    private refuseGated;
+    /**
+     * Admits one operation for `threadId` and reads its mode, once: the operation's launches and its
+     * file policy keep the mode selected here, whatever switch lands while they prepare or run.
+     */
+    snapshot(threadId: string): Promise<ConfinementSnapshot>;
+    private prepare;
+    /**
+     * An unconfined launch: what core would have run with no handler, with the provenance that says so.
+     * None of the confined machinery runs: no scratch directory, policy, digest, worker request or
+     * violation lookup.
+     */
+    private plain;
+    private start;
+    /** Runs a fixed command through the path every command takes, so a sandbox that cannot confine never serves. */
+    private selfCheck;
+    private requireOpen;
+    /**
+     * A confined launch from its geometry alone, never a thread, so the self-check builds one with none.
+     * `trusted` skips the root checks, for the one launch whose root lies in the temporary root.
+     */
+    private build;
+    /**
+     * The filesystem policy for a root and a scratch key, the one value both a launch's confinement
+     * and the file tools' policy are rendered from. `trusted` skips the root's own checks, for the
+     * one launch whose root lies in the temporary root.
+     */
+    private policyFor;
+    /** What sandbox-runtime recorded against one command: best-effort, from its global tail of recent events. */
+    private violationsOf;
+    private onWorkerDeath;
+    /** Tells the host's listeners the sandbox failed; a listener that throws is reported and never interrupts the caller. */
+    private announceFailure;
+    /** The unload guard: closes admission at once, then releases what the handler confined. */
+    private closeAndRelease;
+    /**
+     * Releases the handle once, whoever asks: core stops admitting through the handler, aborts what it
+     * prepared and waits for the groups. `false`, with the error reported, when a group could not be
+     * confirmed stopped, or one still ran at the bound: a confined process may still run, so the worker
+     * stays.
+     */
+    private releaseHandle;
+    /**
+     * Resets sandbox-runtime and ends the worker, once the handle was released: freeing its proxy port
+     * while a confined process may still run would hand the port to a listener without the
+     * allowlist, which that process's profile still permits.
+     */
+    private release;
+}

package/dist/plugins/sandbox/worker.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The sandbox worker: a message interface over Anthropic's sandbox-runtime (`SandboxManager`) on a
+ * worker thread of the host, and nothing else. It is the one module that loads sandbox-runtime, so
+ * the library's process-wide state, its proxies and its signal handlers live here: signals are not
+ * delivered to worker threads, and the proxy runs on an event loop that does nothing else.
+ *
+ * The service (`./service.ts`) starts it with an explicit environment, sends `init` once, then
+ * `wrap` for each command, and `reset` last. Self-contained: it imports sandbox-runtime and Node
+ * only (types aside), so it runs from the sources under Node's type stripping as from `dist`, and
+ * bundles into a single-file executable as an extra entry point.
+ */
+export {};

package/dist/plugins/sandbox/worker.js

@@ -0,0 +1 @@
+import{homedir as c,tmpdir as y}from"node:os";import{sep as u}from"node:path";import{parentPort as P}from"node:worker_threads";import{getDefaultWritePaths as S,NetworkConfigSchema as _,SandboxManager as n}from"@anthropic-ai/sandbox-runtime";import b from"@anthropic-ai/sandbox-runtime/package.json"with{type:"json"};var A=20,E=500,T=2e3,j=["HTTP_PROXY","HTTPS_PROXY","NO_PROXY","http_proxy","https_proxy","no_proxy"],a=P;if(a===null)throw new Error("lagent sandbox worker: started outside a worker thread");var d=new Map;a.on("message",e=>{I(e)});async function I(e){try{switch(e.type){case"init":return i(e.id,await O(e));case"wrap":{let o=new AbortController;d.set(e.id,o);try{let t=await n.wrapWithSandbox(e.command,"/bin/sh",e.config,o.signal,{commandId:e.commandId,commandText:e.commandText});return i(e.id,t)}finally{d.delete(e.id)}}case"cancel":d.get(e.id)?.abort();return;case"violations":{let o=n.getSandboxViolationStore().getViolationsForCommand(e.commandId);return i(e.id,o.slice(-A).map(t=>t.line.slice(0,E)))}case"reset":{let o;return await Promise.race([n.reset().catch(()=>{}),new Promise(t=>{o=setTimeout(t,T)})]),clearTimeout(o),i(e.id,null)}}}catch(o){let t={id:e.id,ok:!1,error:o instanceof Error?o.message:String(o)};a.postMessage(t)}}function i(e,o){let t={id:e,ok:!0,value:o};a.postMessage(t)}async function O(e){let{config:o,expect:t}=e;if(o.network.allowedDomains!==void 0){let r=_.safeParse(o.network);if(!r.success){let v=r.error.issues.map(g=>`${g.path.join(".")}: ${g.message}`);throw new Error(`sandbox-runtime rejects the network configuration: ${v.join("; ")}`)}}if(y()!==t.tmpdir)throw new Error(`the worker's temporary directory is ${y()}, not the private directory ${t.tmpdir}`);if(c()!==t.home)throw new Error(`the worker's home directory is ${c()}, not ${t.home}`);let m=o.network.parentProxy===void 0?j.filter(r=>r in process.env):[];if(m.length>0)throw new Error(`the worker's environment sets ${m.join(", ")} but no parent proxy is configured`);let p=n.isSupportedPlatform(),{errors:l,warnings:x}=n.checkDependencies(),h={version:b.version,supported:p,errors:l,warnings:x,conveniences:[],javaAgent:{flags:0,isCopy:!1}};if(!p||l.length>0)return h;await n.initialize(o);let s=c(),k=S({denyRead:o.filesystem.denyRead}).filter(r=>r.startsWith(s.endsWith(u)?s:s+u)),w=await n.wrapWithSandbox("true","/bin/sh"),f=w.split("-javaagent:").length-1;return{...h,conveniences:k,javaAgent:{flags:f,isCopy:f===1&&w.includes(`-javaagent:${o.javaAgentJarPath}`)}}}

package/dist/plugins/schedules/index.d.ts

@@ -0,0 +1,21 @@
+import type { Plugin } from '@leuduan/cordis';
+import { type SchedulesConfig } from './service.js';
+/**
+ * Scheduled wakes of root threads: `schedule_wake`, `list_wakes` and `cancel_wake`, registered for
+ * a grant, and `ctx.schedules` for the host (`list`, `create`, `cancel`, and `cancelRows` for a
+ * thread `cancel` that should stop them too). A wake fires once, after `in_seconds` or `at` a time,
+ * and is created only in a person's turn or by the host; it delivers its prompt as sourced user
+ * input waiting for a turn of its own, under a `fresh` cause.
+ *
+ * Its configuration is required: the `clock`, the `timeZone` a local `at` is read in, and the
+ * bounds `maxDelayMs` and `maxPendingPerThread`.
+ *
+ * Root-only. Mounted before `ctx.threads.start`, the wakes that fell due while the process was down
+ * fire inside its barrier, judged by its startup policy; mounted after, they are new causes.
+ */
+export declare const schedules: Plugin.Object<SchedulesConfig>;
+export { readScheduledWake } from './record.js';
+export type { ScheduledWake, ScheduleStatus } from './record.js';
+export { ScheduleRefusedError } from './service.js';
+export type { ScheduleInfo, ScheduleRequest, SchedulesConfig, SchedulesService } from './service.js';
+export { SCHEDULE_TOOLS } from './tools.js';

package/dist/plugins/schedules/index.js

@@ -0,0 +1,5 @@
+import{a as I}from"../../chunks/MNJ4SRF7.js";import{a as H,d as B}from"../../chunks/HK6ZSONF.js";import{a as Q}from"../../chunks/7VAPNE3L.js";import{b as z}from"../../chunks/EPYQ5M3B.js";import"../../chunks/5IRF47YB.js";import{b as y,c as G}from"../../chunks/JFX2MXBA.js";import{b as R,c as Z,d as L}from"../../chunks/S34ZA2R6.js";import{b as T}from"../../chunks/6FRNHMCV.js";import"../../chunks/CUK7CGC7.js";import{x as P}from"../../chunks/BPRCULZH.js";import"../../chunks/FJLU4UH3.js";import"../../chunks/DDANMY45.js";import"../../chunks/BBCW2FZK.js";import"../../chunks/MMNNZCBO.js";import"../../chunks/G44LG6VL.js";import"../../chunks/D4PQP5MA.js";import{Service as he}from"@leuduan/cordis";import{z as A}from"zod";import{z as c}from"zod";var x=c.number().int().nonnegative(),ae=c.discriminatedUnion("op",[c.strictObject({op:c.literal("created"),id:c.string().min(1),due_at:x,prompt:c.string().min(1),reason:c.string().min(1),time_zone:c.string().min(1),created_at:x,call_seq:c.number().int().positive().nullable()}),c.strictObject({op:c.literal("fired"),id:c.string().min(1),input_id:c.string().min(1)}),c.strictObject({op:c.literal("cancelled"),id:c.string().min(1),reason:c.string()})]),g=T({plugin:"lagent:schedules",kind:"schedule",version:1,schema:ae}),w=n=>n.cancelled?"cancelled":n.delivered===null?"pending":"fired",h=g.projection({key:"schedules",onFork:"reset",init:()=>new Map,apply(n,e){if(e.op==="created")return n.has(e.id)||n.set(e.id,{created:e,delivered:null,cancelled:!1}),n;let t=n.get(e.id);return t===void 0||n.set(e.id,e.op==="fired"?{...t,delivered:e.input_id}:{...t,cancelled:!0}),n}}),j=Q({key:"lagent:schedules",version:1,schema:c.strictObject({next_wake_at:x.nullable()}),applies:()=>!0,compute(n,e){let t=null;for(let r of n.state(h,e).values())w(r)==="pending"&&(t=t===null?r.created.due_at:Math.min(t,r.created.due_at));return{next_wake_at:t}}});function O(n,e){let t=j.read(n,e);return t.status==="available"?t.value.next_wake_at:null}var ce=c.strictObject({schedule_id:c.string().min(1),due_at:x,summary:c.string()}),$=T({plugin:"lagent:schedules",kind:"wake",version:1,schema:ce}),ue=n=>$.readSource(n);function J(n){try{return new Intl.DateTimeFormat("en-US",{timeZone:n}),!0}catch{return!1}}var Y=new Map;function le(n){let e=Y.get(n);return e===void 0&&(e=new Intl.DateTimeFormat("en-US",{timeZone:n,hourCycle:"h23",year:"numeric",month:"numeric",day:"numeric",hour:"numeric",minute:"numeric",second:"numeric"}),Y.set(n,e)),e}function M(n,e){let t={};for(let r of le(e).formatToParts(n))r.type!=="literal"&&(t[r.type]=Number(r.value));return{year:t.year,month:t.month,day:t.day,hour:t.hour,minute:t.minute,second:t.second}}function U(n,e){let t=M(n,e);return Date.UTC(t.year,t.month-1,t.day,t.hour,t.minute,t.second)-Math.floor(n/1e3)*1e3}var K=(n,e)=>n.year===e.year&&n.month===e.month&&n.day===e.day&&n.hour===e.hour&&n.minute===e.minute;function de(n,e){let t=Date.UTC(n.year,n.month-1,n.day,n.hour,n.minute),r=U(t-54e6,e),s=U(t+54e6,e),u=[...new Set([t-r,t-s])].sort((a,l)=>a-l);for(let a of u)if(K(M(a,e),n))return a;let o=Math.min(t-r,t-s),i=Math.max(t-r,t-s);for(;i-o>1e3;){let a=Math.floor((o+i)/2e3)*1e3;U(a,e)===s?i=a:o=a}return i}function V(n,e){let t=/^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:(Z)|([+-])(\d{2}):?(\d{2}))?$/.exec(n.trim());if(t===null)return null;let[r,s,u,o,i,a]=t.slice(1,7).map(_=>Number(_??0)),l=new Date(Date.UTC(r,s-1,u));if(l.getUTCFullYear()!==r||l.getUTCMonth()!==s-1||l.getUTCDate()!==u||o>23||i>59||a>59)return null;let[,,,,,,,d,p,S,ie]=t;if(d!==void 0||p!==void 0){let _=Number(S??0),q=Number(ie??0);if(_>14||q>59)return null;let oe=(p==="-"?-1:1)*(_*60+q)*6e4;return Date.UTC(r,s-1,u,o,i,a)-oe}let C={year:r,month:s,day:u,hour:o,minute:i},b=de(C,e);return K(M(b,e),C)?b+a*1e3:b}var X=A.number().int().positive(),me=A.strictObject({clock:H,timeZone:A.string().refine(J,"timeZone must be an IANA time zone"),maxDelayMs:X,maxPendingPerThread:X}),m=class extends Error{constructor(e){super(e),this.name="ScheduleRefusedError"}},D="Scheduled wakes are for conversations a person talks to; an agent working for another agent cannot schedule one.",fe="A scheduled wake can be created only in a turn a person started, not from a wake or a notice. Tell the person what to schedule, or ask them.",pe=n=>`sch-${n}`,ee=n=>`wake_${n}`,W=n=>n.replaceAll("&","&amp;").replaceAll('"',"&quot;").replaceAll("<","&lt;"),k=n=>new Date(n).toISOString().replace(".000Z","Z"),te=(n,e)=>`A scheduled wake may be due at most ${Math.round(n/6e4)} minutes from now, by ${k(e+n)}.`;function E(n,e,t){let{created:r}=e,s=e.delivered!==null&&!e.cancelled&&t.input(e.delivered).state==="queued";return{id:r.id,threadId:n,dueAt:r.due_at,timeZone:r.time_zone,prompt:r.prompt,reason:r.reason,status:w(e),unread:s,createdAt:r.created_at}}var v=class extends he{static inject=["threads","journal"];config;queue;inFlight=new Set;refreshed=Promise.resolve([]);armed=!1;retries;closed=!1;constructor(e,t){super(e,"schedules"),this.config=me.parse(t),this.queue=B(this.config.clock,r=>e.reportError(r)),this.retries=I(this.config.clock,r=>e.reportError(r)),e.effect(()=>e.journal.register(h)),e.effect(()=>e.journal.subscribe(r=>{this.armed&&g.read(r)!==void 0&&this.arm(r.thread_id)})),this.refreshed=j.register(e).refreshed,e.effect(()=>{let r=e.threads.registerOwner({owner:"lagent:schedules",repair:()=>this.catchUp()});return()=>r.dispose()}),R(e,()=>this.shutdown())}list({threadId:e}){let t=this.ctx.threads.view(e);return[...this.ctx.journal.state(h,e).values()].map(r=>E(e,r,t))}async create(e,t,r={}){let s=this.thread(e),u=r.callSeq===void 0?P("sch"):pe(r.callSeq),o=await s.read(l=>{let d=this.ctx.journal.state(h,e).get(u);if(d!==void 0)return E(e,d,l);if(s.origin!=null)throw new m(D);if(r.requirePersonTurn===!0&&!this.ctx.threads.chain(e).personTurn)throw new m(fe)});if(o!==void 0)return o;let i=this.createdRow(u,t,r.callSeq??null),{value:a}=await this.ctx.journal.transact(e,()=>{let l=this.ctx.journal.state(h,e);if(l.has(u))return{rows:[],value:null};let d=[...l.values()].filter(S=>w(S)==="pending").length;if(d>=this.config.maxPendingPerThread)return{rows:[],value:`This conversation already has ${d} scheduled wakes waiting, the most it may; cancel one with cancel_wake first.`};let p=this.config.clock.now();return i.due_at<=p?{rows:[],value:`${k(i.due_at)} has already passed; it is now ${k(p)}.`}:i.due_at>p+this.config.maxDelayMs?{rows:[],value:te(this.config.maxDelayMs,p)}:{rows:[g.entry({...i,created_at:p},{threadId:e})],value:null}});if(a!==null)throw new m(a);return s.read(l=>E(e,this.ctx.journal.state(h,e).get(u),l))}cancel(e,t,r="cancelled"){return this.track(async()=>{let s=this.thread(e);if(!await s.read(()=>this.ctx.journal.state(h,e).has(t)))throw new m(`No scheduled wake ${t} in this conversation.`);let o=await s.withdraw(ee(t),{rows:()=>this.ctx.journal.state(h,e).get(t).cancelled?[]:[g.entry({op:"cancelled",id:t,reason:r},{threadId:e})]});if(o.status==="refused")throw new Error(o.refusal.message);return{withdrawn:o.status==="withdrawn"}})}cancelRows(e,t="the conversation was stopped"){return[...this.ctx.journal.state(h,e).values()].filter(r=>w(r)==="pending").map(r=>g.entry({op:"cancelled",id:r.created.id,reason:t},{threadId:e}))}thread(e){let t=this.ctx.threads.get(e);if(t===void 0)throw new m(`No thread ${e}`);return t}createdRow(e,t,r){let{clock:s,timeZone:u,maxDelayMs:o}=this.config,i=s.now(),a=p=>{throw new m(p)};t.prompt.trim()===""&&a("A scheduled wake needs a prompt."),t.reason.trim()===""&&a("A scheduled wake needs a reason.");let{when:l}=t,d;return"in_seconds"in l?((!Number.isInteger(l.in_seconds)||l.in_seconds<1)&&a("in_seconds must be a whole number of at least 1."),d=i+l.in_seconds*1e3):(d=V(l.at,u)??a(`"${l.at}" is not a date and time such as 2026-10-11T14:30 or 2026-10-11T14:30+02:00.`),d<=i&&a(`${l.at} has already passed; it is now ${k(i)}.`)),d>i+o&&a(te(o,i)),{op:"created",id:e,due_at:d,prompt:t.prompt,reason:t.reason,time_zone:u,created_at:i,call_seq:r}}track(e){let t=e(),r=t.then(()=>{},()=>{});return this.inFlight.add(r),r.then(()=>this.inFlight.delete(r)),t}async catchUp(){try{await this.refreshed;let e=this.config.clock.now();await Promise.all(this.ctx.journal.summaries().filter(t=>{let r=O(this.ctx.journal,t.thread_id);return r!==null&&r<=e}).map(t=>this.check(t.thread_id)))}finally{this.armed=!0;for(let e of this.ctx.journal.summaries())this.arm(e.thread_id)}}arm(e){if(this.closed||this.retries.pending(e))return;let t=O(this.ctx.journal,e);t===null?this.queue.delete(e):this.queue.set(e,t,()=>{this.check(e)})}check(e){return this.track(()=>this.deliverDue(e))}async deliverDue(e){if(!this.closed)try{let t=this.ctx.threads.get(e);if(t===void 0)return;let r=this.config.clock.now(),s=await t.read(()=>[...this.ctx.journal.state(h,e).values()].filter(i=>w(i)==="pending"&&i.created.due_at<=r).map(i=>i.created.id)),o=(await Promise.allSettled(s.map(i=>this.fire(e,i)))).find(i=>i.status==="rejected");if(o!==void 0)throw o.reason;this.retries.succeeded(e),this.arm(e)}catch(t){if(this.ctx.reportError(t),this.closed)return;this.queue.delete(e),this.retries.failed(e,()=>{this.check(e)})}}async fire(e,t){if(this.closed)return;let r=this.thread(e),s=await r.read(()=>this.ctx.journal.state(h,e).get(t));if(s===void 0||w(s)!=="pending")return;let{created:u}=s,o=ee(t);await r.send({role:"user",content:we(u)},{id:o,source:$.record({schedule_id:t,due_at:u.due_at,summary:`${t} ${u.reason}`.slice(0,120)}),wake:{releases:!1,chain:"fresh"},target:"next-turn",rows:()=>{let i=this.ctx.journal.state(h,e).get(t);return i===void 0||w(i)!=="pending"?{refuse:{message:`Scheduled wake ${t} is no longer pending`}}:[g.entry({op:"fired",id:t,input_id:o},{threadId:e})]}})}async shutdown(){this.closed=!0,this.queue.dispose(),this.retries.dispose(),await Promise.allSettled([...this.inFlight])}};function we(n){return`<scheduled_wake ${[`schedule="${W(n.id)}"`,`due="${k(n.due_at)}"`,`time_zone="${W(n.time_zone)}"`,`reason="${W(n.reason)}"`].join(" ")}>
+${n.prompt}
+</scheduled_wake>`}import{z as f}from"zod";function N(n,e){let t=Z(n.ctx,"schedules",e);if(n.ctx.threads.get(n.threadId)?.origin!=null)throw new m(D);return t}var ne=n=>`${n.id}  ${n.unread?"delivered, not read yet":n.status}  due ${k(n.dueAt)} (${n.timeZone}): ${n.reason}`,ge=f.strictObject({when:f.union([f.strictObject({in_seconds:f.number().int().min(1).describe("Seconds from now.")}),f.strictObject({at:f.string().describe("A date and time, such as 2026-10-11T14:30 (in the conversation\u2019s time zone) or 2026-10-11T14:30+02:00.")})]).describe("When: after in_seconds, or at a time."),prompt:f.string().min(1).describe("What you will be told when it fires: write it for yourself, then."),reason:f.string().min(1).describe("One line for the person, saying why.")}),F=y({name:"schedule_wake",description:"Schedule one wake of this conversation, after a delay or at a time. When it fires, you get its prompt as a new turn, even if nobody is here.",parameters:ge,onInterrupted:"rerun",executionMode:"exclusive",async execute(n,e){let t=await N(e,"schedule_wake").create(e.threadId,n,{callSeq:e.callSeq,requirePersonTurn:!0});return{output:`Scheduled ${ne(t)}`,metadata:{id:t.id,due_at:t.dueAt}}}}),re=y({name:"list_wakes",description:"List the scheduled wakes of this conversation still waiting to fire, and those that fired but whose message you have not read yet.",parameters:f.strictObject({}),onInterrupted:"rerun",executionMode:"parallel",execute:async(n,e)=>{let t=N(e,"list_wakes").list({threadId:e.threadId}),r=t.filter(s=>s.status==="pending"||s.unread);return{output:r.map(ne).join(`
+`)||"No scheduled wakes waiting.",metadata:{pending:r.filter(s=>!s.unread).length,unread:r.filter(s=>s.unread).length,total:t.length}}}}),se=y({name:"cancel_wake",description:"Cancel a scheduled wake of this conversation, or its delivery still waiting to be read.",parameters:f.strictObject({id:f.string().min(1).describe("The id schedule_wake returned, such as sch-42.")}),onInterrupted:"rerun",executionMode:"exclusive",async execute({id:n},e){let{withdrawn:t}=await N(e,"cancel_wake").cancel(e.threadId,n,"cancel_wake");return{output:`Cancelled ${n}.${t?" Its waiting delivery was withdrawn.":""}`,metadata:{id:n,withdrawn:t}}}}),ke=["schedule_wake","list_wakes","cancel_wake"];var _e=["Use schedule_wake only when the person asks for something later, never to wait for what a notice will report, such as a sub-agent or a command started with notify.","A scheduled wake fires once, and can be created only in a turn the person started: never from a wake or a notice, so do not promise follow-ups you cannot schedule then.","When a wake fires you get its prompt as user input in a <scheduled_wake> frame naming its due time; compare it with the current date, since a wake waiting behind a stop is delivered late."].join(`
+`),Ge={name:"lagent:schedules",inject:["tools","prompts","threads","journal"],async apply(n,e){L(n,"schedules"),await n.plugin(v,e);let t=[F,re,se];for(let r of t)G(n,r);z(n,{tag:"schedules",slot:"instruction",agents:"all",render:({tools:r})=>r.some(s=>s.tool===F)?_e:null})}};export{ke as SCHEDULE_TOOLS,m as ScheduleRefusedError,ue as readScheduledWake,Ge as schedules};