@leuduan/lagent 0.1.2 → 44.0.0

package/dist/{sandbox → plugins/sandbox}/absent.d.ts

@@ -7,22 +7,23 @@ export type SandboxAbsentConfig = z.input<typeof AbsentConfigSchema>;
 /**
  * For a host that records sandbox modes but started without the sandbox. A process with no launch
  * handler would run every command plain, so a conversation recorded as confined would run unconfined
- * silently after such a restart. This is the launch handler of core's `ctx.launches` for that host,
- * which is what makes the refusal cover every caller of the seam, `commands` and a host calling
- * `ctx.launches` directly alike: a launch for a conversation recorded as confined is refused with a
- * message for the model, and a launch for one recorded as unconfined, or with no mode at all, runs as
- * plain `/bin/sh -c` with provenance that says so (`unconfined`, under this plugin's own launcher),
+ * silently after such a restart. This is the confinement handler of core's `ctx.confinement` for that
+ * host, which is what makes the refusal cover every caller of the seam, `commands`, the search tools
+ * and a host calling `ctx.confinement` directly alike: an operation for a conversation recorded as
+ * confined is refused with a message for the model, and a launch for one recorded as unconfined, or
+ * with no mode at all, runs plain (`/bin/sh -c` for shell text, the argv itself otherwise) with
+ * provenance that says so (`unconfined`, under this plugin's own launcher),
  * which a host's display marks. The model is told through the sandbox's notice: the unavailable
  * guidance when confined, and the lift a restart may have left owed otherwise.
  *
- * The refusal happens when the launch is prepared, after any confirmation the tool call needed, so
+ * The refusal happens at the operation's first use, after any confirmation the tool call needed, so
  * a call a person approved can still be refused: rare, since the notice says so at the first step.
  * It does not cover what spawns outside the seam: MCP stdio servers and lagent's own spawns.
  *
- * The recorded mode is read once, when preparation starts, from the journal's fold, which needs the
- * thread's history loaded: a tool call has it, and a host launching directly must keep it so. A thread
- * the journal does not hold, a caller chain that does not reach its conversation root and a mode row
- * this build cannot read refuse the launch with that error, never allow it.
+ * The recorded mode is read once, at the operation's first use, from the journal's fold; core holds
+ * the histories it is decided from for the snapshot. A thread the journal does not hold, a caller
+ * chain that does not reach its conversation root and a mode row this build cannot read refuse the
+ * operation with that error, never allow it.
  *
  * Mount it unscoped, after `core` and before threads start, so a failed composition is refused before
  * recovery. It excludes `sandbox` in either mount order. Disposing it releases its handler, which

package/dist/{sandbox → plugins/sandbox}/index.d.ts

@@ -6,7 +6,7 @@ export { SandboxConfigSchema, type SandboxConfigInput, type SandboxHealth, type
 /**
  * An optional OS sandbox for `run_command` and `start_command`, through Anthropic's sandbox-runtime
  * (`@anthropic-ai/sandbox-runtime`, an optional peer dependency: only the worker module loads it).
- * Mounting `sandbox` registers it as the launch handler of core's `ctx.launches`, so everything
+ * Mounting `sandbox` registers it as the confinement handler of core's `ctx.confinement`, so everything
  * `commands` launches afterwards goes through it, and each confined launch is limited to writing its thread's working directory, the host's
  * extra roots and a per-thread temporary directory, and, in `allowlist` network mode, to reaching the
  * host's allowed domains (`unrestricted` leaves the network open: only the filesystem rules bind). A
@@ -37,7 +37,10 @@ export { SandboxConfigSchema, type SandboxConfigInput, type SandboxHealth, type
  * await root.plugin(commands, { environment })
  * ```
  *
- * Shell confinement only: the file tools and every other spawn are unchanged. macOS only for now.
+ * One filesystem policy per conversation, enforced two ways: srt confines the processes `commands` and
+ * the search tools launch, and the same policy is checked in process for the file tools and the readers
+ * of instruction files and skills, through the confinement operation's file facade. Other spawns are
+ * unchanged. macOS only for now.
  */
 export declare const sandbox: Plugin.Constructor<SandboxConfigInput>;
 /** The worker entry built beside this module, for a host that runs lagent from `dist`. */

package/dist/plugins/sandbox/index.js

@@ -0,0 +1,4 @@
+import{a as p}from"../../chunks/VYMT4TXD.js";import{b as D,c as R,d as B,e as te}from"../../chunks/6DRCKZ2C.js";import{d as ne}from"../../chunks/7LI64H5X.js";import"../../chunks/3UMZMPWW.js";import{a as ie,b as ae}from"../../chunks/DDZ7YF26.js";import{d as N}from"../../chunks/S34ZA2R6.js";import{b as re,c as oe,e as se}from"../../chunks/6FRNHMCV.js";import"../../chunks/CUK7CGC7.js";import"../../chunks/BPRCULZH.js";import{d as E}from"../../chunks/DDANMY45.js";import{c as v}from"../../chunks/BBCW2FZK.js";import"../../chunks/MMNNZCBO.js";import"../../chunks/G44LG6VL.js";import"../../chunks/D4PQP5MA.js";import{createRequire as bn}from"node:module";import{dirname as vn,join as En}from"node:path";import{randomUUID as dn}from"node:crypto";import{homedir as hn}from"node:os";import{isAbsolute as U}from"node:path";import{Service as Pe}from"@leuduan/cordis";import{z as d}from"zod";import{Worker as He}from"node:worker_threads";var O=class{worker;pending=new Map;nextId=1;ended=null;closing=!1;onDeath;constructor(e,n,o){this.onDeath=o,this.worker=new He(e,{env:n}),this.worker.on("message",r=>this.settle(r)),this.worker.on("error",r=>this.end(new Error(`The sandbox worker failed: ${r.message}`))),this.worker.on("exit",r=>this.end(new Error(`The sandbox worker exited with code ${r}`)))}get alive(){return this.ended===null&&!this.closing}request(e,n){if(this.ended!==null)return Promise.reject(this.ended);if(this.closing)return Promise.reject(new Error("The sandbox worker is shutting down"));let{signal:o}=n;if(o?.aborted)return Promise.reject(o.reason instanceof Error?o.reason:new Error("aborted"));let r=this.nextId++;return new Promise((s,i)=>{let a=m=>{this.pending.delete(r)&&(clearTimeout(c),l(),e.type==="wrap"&&this.send({type:"cancel",id:r}),i(m))},h=()=>a(o?.reason instanceof Error?o.reason:new Error("aborted")),c=setTimeout(()=>a(new Error(`The sandbox worker did not answer ${e.type} within ${n.timeoutMs} ms`)),n.timeoutMs),l=()=>o?.removeEventListener("abort",h);o?.addEventListener("abort",h,{once:!0}),this.pending.set(r,{resolve:s,reject:i,timer:c,cleanup:l}),this.send({...e,id:r})})}async terminate(){this.closing=!0,this.rejectAll(new Error("The sandbox worker is shutting down")),await this.worker.terminate()}unref(){this.worker.unref()}send(e){try{this.worker.postMessage(e)}catch(n){this.end(new Error(`The sandbox worker could not be reached: ${n instanceof Error?n.message:n}`))}}settle(e){let n=this.pending.get(e.id);n!==void 0&&(this.pending.delete(e.id),clearTimeout(n.timer),n.cleanup(),e.ok?n.resolve(e.value):n.reject(new Error(e.error)))}end(e){this.ended===null&&(this.ended=e,this.rejectAll(e),this.closing||this.onDeath(e))}rejectAll(e){let n=[...this.pending.values()];this.pending.clear();for(let o of n)clearTimeout(o.timer),o.cleanup(),o.reject(e)}};import{createHash as I,randomUUID as Ue}from"node:crypto";import{existsSync as We,linkSync as Be,lstatSync as de,mkdirSync as he,readdirSync as Ie,readFileSync as ce,unlinkSync as ue,writeFileSync as Fe}from"node:fs";import{join as T}from"node:path";var le=t=>T(t,".srt"),G=(t,e)=>T(t,"scratch",I("sha256").update(e).digest("hex"));function F(t){try{he(t,{mode:448})}catch(n){if(!E(n,"EEXIST"))throw n}let e=de(t);if(!e.isDirectory()||e.uid!==process.getuid?.())throw new Error(`${t} is not a directory owned by this user`)}function me(t){return he(t,{recursive:!0,mode:448}),F(le(t)),le(t)}function X(t,e){F(T(t,"scratch"));let n=G(t,e);return F(n),n}function fe(t){let e=[];for(let n of Ie(t)){let o=/^srt-mux-(\d+)-[0-9a-z]+\.sock$/.exec(n);if(!(o===null||Ge(Number(o[1]))))try{ue(T(t,n)),e.push(n)}catch{}}return e}function Ge(t){if(t===process.pid)return!0;try{return process.kill(t,0),!0}catch(e){return E(e,"EPERM")}}function pe(t,e){let n=ce(e),o=I("sha256").update(n).digest("hex"),r=T(t,`srt-proxy-agent-${o}.jar`);if(!We(r)){let i=T(t,`.publish-${Ue()}.tmp`);Fe(i,n,{flag:"wx",mode:292});try{Be(i,r)}catch(a){if(!E(a,"EEXIST"))throw a}finally{ue(i)}}if(!de(r).isFile()||I("sha256").update(ce(r)).digest("hex")!==o)throw new Error(`${r} exists and is not the Java agent it is named for`);return{path:r,sha256:o}}import{createHash as ge}from"node:crypto";import{existsSync as z,lstatSync as J,opendirSync as Xe,realpathSync as ye,statSync as Je}from"node:fs";import{basename as xe,dirname as A,isAbsolute as be,join as g,relative as ze,resolve as S,sep as Ve}from"node:path";var Ye=/^(LD_.*|DYLD_.*|BASH_ENV|ENV|SHELLOPTS|BASHOPTS|BASH_FUNC_.*)$/;function ve(t){let e=Object.keys(t).filter(n=>Ye.test(n));if(e.length>0)throw new Error(`The command sandbox refuses an environment that sets ${e.join(", ")}: they run code before the sandbox holds`)}var V=128*1024;function k(t){let e=S(t),n=[];for(;!z(e)&&A(e)!==e;)n.unshift(xe(e)),e=A(e);return g(ye.native(e),...n)}var Ee=t=>({path:t,literal:!0}),Ze=/[*?[\]]/,Ke=["__GLOBSTAR_SLASH__","__GLOBSTAR__"];function Te(t){if(!be(t))throw new Error(`The command sandbox needs an absolute root, not ${t}`);let e=k(t);if(Ze.test(e)||Ke.some(n=>e.includes(n)))throw new Error(`The command sandbox refuses ${e} as a root: its name holds glob characters, which sandbox-runtime would read as a pattern`);return e}var Qe=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json",".vscode",".idea",".claude/commands",".claude/agents",".git/hooks",".git/config"];function qe(t,e){let n=[];for(let o of e)n.push(Ee(g(t,o)),`${t}/**/${o}`,`${t}/**/${o}/**`);return n}var en=["env","which","log","/bin/sh","/usr/bin/sandbox-exec"];function Ae(t){let e=t.split(":"),n=en.flatMap(o=>(o.startsWith("/")?[o]:e.map(r=>g(r,o))).filter(r=>z(r)).map(r=>ye.native(r)));return[...e,...n]}function Y(t,e,n){let o=(r,s)=>p(r,s)||p(s,r);for(let r of t){let s=e.find(i=>o(i,r));if(s!==void 0)throw new Error(`The command sandbox refuses to let commands write ${r}: it overlaps ${s}, which the sandbox runs before confinement`);if(o(n,r))throw new Error(`The command sandbox refuses to let commands write ${r}: it overlaps the temporary root`)}}var Z=(t,e)=>({spelling:t,canonical:e,foldsCase:tn(e)}),f=t=>Z(t,k(t)),nn=t=>t.replace(/[a-zA-Z]/g,e=>e===e.toLowerCase()?e.toUpperCase():e.toLowerCase());function tn(t,e=n=>J(n).dev){let n=S(t);for(;!z(n)&&A(n)!==n;)n=A(n);let o;try{Je(n).isDirectory()||(n=A(n)),o=e(n)}catch{return null}let r=(s,i)=>{let a=nn(i);if(a===i)return null;try{if(e(g(s,i))!==o)return null;let h=J(g(s,i)),c;try{c=J(g(s,a))}catch(l){return E(l,"ENOENT")?!1:null}return e(g(s,a))===o?h.ino===c.ino:null}catch{return null}};for(let s=n;;){let i=[];try{let c=Xe(s);try{for(let l=c.readSync();l!==null&&i.length<64;l=c.readSync())i.push(l.name)}finally{c.closeSync()}}catch{}for(let c of i){let l=r(s,c);if(l!==null)return l}let a=A(s);if(a===s)return null;try{if(e(a)!==o)return null}catch{return null}let h=r(a,xe(s));if(h!==null)return h;s=a}}function Se(t,e,n){return{writable:[e,...t.allowWrite,n],denyWrite:[...t.denyWrite,...t.conveniences,f("/tmp/claude"),f("/private/tmp/claude"),t.privateDirectory],denyRead:t.denyRead,protected:{root:e,suffixes:Qe}}}function ke(t){let e=n=>[...new Set(n.map(o=>o.canonical))].map(Ee);return{allowWrite:e(t.writable),denyWrite:[...e(t.denyWrite),...qe(t.protected.root.canonical,t.protected.suffixes)],denyRead:e(t.denyRead)}}var we={allowed:!0};function $e(t){let e=(r,s,i)=>{let a=s?r.normalize("NFC"):r;return i?a.toLowerCase():a},n=(r,s,i)=>{let a=i?s.foldsCase!==!1:s.foldsCase===!0,h=e(r,i,a);return p(h,e(S(s.spelling),i,a))||p(h,e(s.canonical,i,a))},o=r=>{let{root:s,suffixes:i}=t.protected,a=s.foldsCase!==!1;for(let h of[S(s.spelling),s.canonical]){let c={path:e(r,!0,a),base:e(h,!0,a)};if(!p(c.path,c.base))continue;let l=ze(c.base,c.path).split(Ve),m=i.find(x=>{let b=e(x,!0,a).split("/");return l.some((ee,w)=>b.every((_,u)=>l[w+u]===_))});if(m!==void 0)return m}return null};return{identity:ge("sha256").update(v(t.denyRead)).digest("hex"),check(r,s){if(!be(r))throw new Error(`The file policy judges absolute paths, not ${r}`);let i=S(r);if(s==="read"){let c=t.denyRead.find(l=>n(i,l,!0));return c===void 0?we:{allowed:!1,reason:`${r} is in ${c.spelling}, which this conversation may not read`}}if(!t.writable.some(c=>n(i,c,!1)))return{allowed:!1,reason:`${r} is outside the directories this conversation may write`};let a=t.denyWrite.find(c=>n(i,c,!0));if(a!==void 0)return{allowed:!1,reason:`${r} is in ${a.spelling}, which this conversation may not write`};let h=o(i);return h===null?we:{allowed:!1,reason:`${r} is protected (${h}) and cannot be written here`}}}}var K=['if [ -n "${LAGENT_SANDBOX_PATH+x}" ]; then PATH=$LAGENT_SANDBOX_PATH; export PATH; else unset PATH; fi',"TMPDIR=$LAGENT_SANDBOX_TMPDIR; export TMPDIR",'set -- "$LAGENT_SANDBOX_COMMAND"',"unset LAGENT_SANDBOX_PATH LAGENT_SANDBOX_TMPDIR LAGENT_SANDBOX_COMMAND",'exec /bin/sh -c "$1"'].join("; ");function _e(t){return"shell"in t?t.shell:`exec ${t.argv.map(e=>`'${e.replaceAll("'","'\\''")}'`).join(" ")}`}function De(t,e,n,o){let{PATH:r,...s}=t;return{...s,PATH:e,LAGENT_SANDBOX_TMPDIR:n,LAGENT_SANDBOX_COMMAND:o,...r===void 0?{}:{LAGENT_SANDBOX_PATH:r}}}var P="lagent-srt",rn="5",Re=t=>`${P}/${rn} sandbox-runtime/${t}`;function Ne(t){return`sha256:${ge("sha256").update(v({...t,bootstrap:K})).digest("hex")}`}function Oe(t){let e=t.filesystem.allowWrite.length===0?"":`, in ${t.filesystem.allowWrite.join(", ")}`,{network:n}=t,o=n.mode==="unrestricted"?"They have unrestricted network access.":n.allowedDomains.length===0?"They have no network access.":`They reach the network only through a proxy, and only these hosts: ${n.allowedDomains.join(", ")}; any other host is refused with HTTP 403. Tools that ignore HTTP_PROXY cannot connect. Refused requests are usually, not always, listed after the command's output.`;return[`run_command and start_command run in an OS sandbox. The file tools (read_file, list_dir, edit_files, rg_search, rg_files) are checked against the same rules, and name the rule when they refuse a path. Commands and edits can write only inside the conversation's working directory${e}, and in $TMPDIR. A command's refused write fails with "Operation not permitted", which is all it reports. Inside the working directory, git hooks, .git/config, shell startup files and editor settings cannot be written, by a command or by an edit.`,o,"A refusal is the sandbox, not a fault to work around: say what you needed instead."].join(" ")}import{z as Q}from"zod";var y=ae({name:"lagent:sandbox",authority:"conversation",initial:"confined",modes:["confined","unconfined"]});function C(t,e){if(t.journal.summary(e)===void 0)throw new Error(`Unknown thread: ${e}`);return y.recorded(t.journal,y.authorityOf(t,e))}var on=(t,e)=>y.recorded(t,e),sn=Q.strictObject({mode:Q.enum(["confined","unconfined"]),guidance:Q.string().nullable()}),an=re({plugin:"lagent:sandbox",kind:"notice",version:1,schema:sn}),cn="The sandbox is off: commands you start from now on run with the user's full permissions and network, and the file tools are no longer limited; commands already preparing or running keep the confinement they started with.",ln="Commands you start from now on are sandboxed, and the file tools follow the same rules; commands already preparing or running keep how they were launched.",q="The sandbox is unavailable on this host: commands, searches and file access are refused for this conversation.";function M(t,e){se(t,{event:an,agents:"all",rank:1,current:n=>{try{return e(n.threadId)}catch(o){if(o instanceof ie)return;throw o}},render:(n,o,{notices:r})=>{let s=oe(r)?.value??null;return n.mode==="unconfined"?(o??(s?.mode==="confined"?s:null))?.mode==="confined"?cn:null:n.guidance===null?null:n.guidance===q?n.guidance:`${ln} ${n.guidance}`}})}var j=new WeakMap;function L(t,e){let n=t.reflect.target,o=j.get(n);if(o!==void 0)throw new Error(`${e} cannot mount: ${o} already owns this application's sandbox, and the two exclude each other`);j.set(n,e),t.effect(()=>()=>{j.get(n)===e&&j.delete(n)})}var $=d.string().refine(U,{message:"Expected an absolute path"}),je=d.url({protocol:/^https?$/}).refine(t=>new URL(t).username===""&&new URL(t).password==="",{message:"A parent proxy URL carrying credentials is not supported"}),Me=d.strictObject({worker:d.union([d.instanceof(URL),d.string().min(1)]),searchPath:d.string().refine(t=>t.split(":").every(U),{message:"Every searchPath entry must be absolute"}),tmpRoot:$,javaAgentJar:$,unconfined:d.enum(["allowed","refused"]),filesystem:d.strictObject({allowWrite:d.array($),denyRead:d.array($),denyWrite:d.array($)}),network:d.discriminatedUnion("mode",[d.strictObject({mode:d.literal("allowlist"),allowedDomains:d.array(d.string().min(1)),deniedDomains:d.array(d.string().min(1)),parentProxy:d.union([d.literal("none"),d.strictObject({http:je.optional(),https:je.optional(),noProxy:d.string().optional()})])}),d.strictObject({mode:d.literal("unrestricted")})]),drainTimeoutMs:d.number().int().positive().default(2e4)});function un(t){if(t.mode==="unrestricted")return{deniedDomains:[]};let{parentProxy:e}=t;return{allowedDomains:t.allowedDomains,deniedDomains:t.deniedDomains,...e==="none"?{}:{parentProxy:e}}}function mn(t,e,n){return t==="allowlist"?e.isCopy?[]:[`sandbox-runtime does not advertise the Java agent copy ${n}`]:e.flags===0?[]:["sandbox-runtime advertises a Java agent although the network is unrestricted"]}var H=3e4,fn=15e3,pn=5e3,Ce=!1,W=class extends Pe{static inject=["confinement","journal","threads"];guidance;config;state="new";failure=null;admitting=!0;client=null;host=null;handle;releasing=null;constructor(e,n){super(e,"sandbox"),N(e,"sandbox"),this.config=Me.parse(n),this.guidance=Oe(this.config),L(e,"sandbox"),M(e,o=>{let r=this.mode(o);return{mode:r,guidance:r==="confined"?this.guidance:null}}),this.handle=e.confinement.handle(this),e.fiber.beforeUnload(()=>this.closeAndRelease())}async[Pe.init](){try{await this.start()}catch(e){this.state="failed",this.admitting=!1;let n=this.releaseHandle();throw this.announceFailure(),await n,await this.client?.terminate(),this.client=null,e}return()=>this.release()}get unconfined(){return this.config.unconfined}get health(){return this.state==="ready"&&this.admitting?"ready":"failed"}mode(e){return this.config.unconfined==="refused"?"confined":y.of(this.ctx,e)}async setMode(e,n){this.refuseGated(n);let o=this.ctx.journal.summary(e);if(o===void 0)throw new Error(`Unknown thread: ${e}`);if(o.origin!==null)throw new Error(`Thread ${e} is in its conversation's sandbox mode`);await y.set(this.ctx,e,n),this.handle.changed()}opening(e){return this.refuseGated(e),y.opening(e)}refuseGated(e){if(e==="unconfined"&&this.config.unconfined==="refused")throw new Error("This host refuses unconfined conversations: commands, searches and file access stay confined")}async snapshot(e){this.requireOpen();let n=this.ctx.journal.summary(e);if(n===void 0)throw new Error(`The sandbox cannot serve unknown thread ${e}`);if(this.mode(e)==="unconfined")return{files:null,prepare:s=>this.prepare(null,s)};let r={cwd:n.environment.cwd,scratch:B(e),policy:this.policyFor(n.environment.cwd,B(e),!1)};return{files:$e(r.policy),prepare:s=>this.prepare(r,s)}}async prepare(e,n){if(this.requireOpen(),!U(n.workdir))throw new Error(`The command sandbox needs an absolute workdir, not ${n.workdir}`);if(e===null)return this.plain(n);if(n.root!==e.cwd||n.scratch!==e.scratch)throw new Error(`The command sandbox refuses a launch whose root and scratch key differ from its operation's (${e.cwd}, ${e.scratch}): one operation has one policy`);return this.build(n,!1,e.policy)}plain(e){let n=this.host;if(n===null)throw new Error("The sandbox is not running");return{argv:R(e.program),cwd:e.workdir,env:e.environment,provenance:{launcher:P,version:n.version,policy:D},violations:async()=>null}}async start(){if(process.platform!=="darwin")throw new Error(`The command sandbox supports macOS only; on ${process.platform}, sandbox-runtime's launches sharing a directory can remove each other's protective mount points`);let e=k(this.config.tmpRoot),n=this.config.filesystem.denyWrite.map(f),o=n.find(u=>p(e,u.canonical)||p(u.canonical,e));if(o!==void 0)throw new Error(`tmpRoot must be outside filesystem.denyWrite, which would keep commands from writing their scratch directories: ${o.spelling}`);if(Ce)throw new Error("The command sandbox starts once per process: sandbox-runtime keeps process-wide state and is never restarted, so restart the host");Ce=!0,this.state="starting";let{config:r}=this,s=r.searchPath.split(":").map(k).join(":"),i=Ae(s),a=r.filesystem.allowWrite.map(f);Y(a.map(u=>u.canonical),i,e);let h=r.filesystem.denyRead.map(f),c=hn(),l=me(e);fe(l);let m=pe(l,r.javaAgentJar),x=new O(r.worker,{PATH:s,HOME:c,TMPDIR:l,CLAUDE_CODE_TMPDIR:l},u=>this.onWorkerDeath(u));this.client=x;let b=u=>({path:u,literal:!0}),ee={network:un(r.network),filesystem:{denyRead:h.map(u=>b(u.canonical)),allowWrite:[],denyWrite:n.map(u=>b(u.canonical))},javaAgentJarPath:m.path},w=await x.request({type:"init",config:ee,expect:{tmpdir:l,home:c}},{timeoutMs:H}),_=[...w.supported?[]:["this platform is not supported"],...w.errors,...w.warnings,...mn(r.network.mode,w.javaAgent,m.path)];if(_.length>0)throw new Error(`The command sandbox cannot start here: ${_.join("; ")}`);if(this.host={tmpRoot:e,cwd:process.cwd(),home:c,searchPath:s,trusted:i,extraRoots:r.filesystem.allowWrite,facts:{allowWrite:a,denyWrite:n,denyRead:h,conveniences:w.conveniences.map(f),privateDirectory:f(l)},version:Re(w.version),javaAgentSha256:m.sha256},await this.selfCheck(e),!x.alive||this.failure!==null)throw new Error(`The command sandbox worker ended while it started${this.failure===null?"":`: ${this.failure.message}`}`);this.state="ready"}async selfCheck(e){let n=X(e,"self-check"),o=await this.build({program:{shell:"exit 0"},workdir:n,root:n,scratch:"self-check",environment:{},signal:AbortSignal.timeout(H)},!0),r=await ne({command:o.argv,cwd:o.cwd,env:o.env,signal:AbortSignal.timeout(H),timeoutMs:H});if(r.exitCode!==0){let s=r.exitSignal===null?`exit code ${r.exitCode}`:`signal ${r.exitSignal}`;throw new Error(`The command sandbox could not run a confined command: ${r.output.trim()||s}`)}}requireOpen(){if(this.state==="failed")throw new Error(`The sandbox failed${this.failure===null?"":`: ${this.failure.message}`}. Nothing runs unconfined; it stays failed until lagent restarts.`);if(this.state==="new"||this.state==="starting")throw new Error("The sandbox is still starting");if(this.state!=="ready"||!this.admitting)throw new Error("The sandbox is shutting down")}async build(e,n,o){let r=this.host,s=this.client;if(r===null||s===null)throw new Error("The sandbox is not running");if(ve(e.environment),!U(e.workdir))throw new Error(`The command sandbox needs an absolute workdir, not ${e.workdir}`);let i=_e(e.program);if(Buffer.byteLength(i)>V)throw new Error(`The command sandbox refuses a command longer than ${V} bytes`);if(process.cwd()!==r.cwd)throw new Error(`The host changed its working directory from ${r.cwd} to ${process.cwd()}: the command sandbox refuses to launch`);let a=this.policyFor(e.root,e.scratch,n);if(o!==void 0&&v(o)!==v(a))throw new Error("The command sandbox refuses to launch: a writable root or a link in it now leads somewhere other than where this operation selected its policy, so it could not enforce the same one. Start the operation again.");let h=o??a,c=X(r.tmpRoot,e.scratch),l=ke(h),m=dn();return{argv:["/bin/sh","-c",`exec ${await s.request({type:"wrap",command:K,commandId:m,commandText:i.slice(0,1e3),config:{filesystem:l}},{timeoutMs:fn,signal:e.signal})}`],cwd:e.workdir,env:De(e.environment,r.searchPath,c,i),provenance:{launcher:P,version:r.version,policy:Ne({filesystem:l,network:this.config.network,searchPath:r.searchPath,cwd:r.cwd,home:r.home,conveniences:r.facts.conveniences.map(b=>b.spelling),javaAgent:r.javaAgentSha256,version:r.version})},violations:()=>this.violationsOf(m)}}policyFor(e,n,o){let r=this.host;if(r===null)throw new Error("The sandbox is not running");let s=Z(e,Te(e)),i=r.extraRoots.map(f),a=i.map(h=>h.canonical);return Y(o?a:[s.canonical,...a],r.trusted,r.tmpRoot),Se({...r.facts,allowWrite:i},s,f(G(r.tmpRoot,n)))}async violationsOf(e){if(this.client===null)return null;let n=await this.client.request({type:"violations",commandId:e},{timeoutMs:te});return n.length===0?null:`<sandbox_violations>
+${n.join(`
+`)}
+</sandbox_violations>`}onWorkerDeath(e){this.failure??=e,this.state==="ready"&&(this.state="failed",this.admitting=!1,this.ctx.reportError(e),this.releaseHandle(),this.announceFailure())}announceFailure(){this.ctx.parallel("lagent/sandbox/health","failed").catch(e=>this.ctx.reportError(e))}async closeAndRelease(){this.admitting=!1,this.state==="ready"&&(this.state="stopping"),await this.releaseHandle()}releaseHandle(){return this.releasing??=this.handle.release(this.config.drainTimeoutMs).then(e=>(e||this.ctx.reportError(new Error(`A command could not be confirmed stopped within ${this.config.drainTimeoutMs} ms: a confined process may still run, so the sandbox worker is kept until the process exits`)),e)),this.releasing}async release(){let e=this.client;if(e!==null){if(!await this.releaseHandle()){e.unref();return}e.alive&&await e.request({type:"reset"},{timeoutMs:pn}).catch(()=>{}),await e.terminate(),this.client=null}}};import{z as Le}from"zod";var wn=Le.strictObject({drainTimeoutMs:Le.number().int().positive()}),gn="lagent-sandbox-absent",yn="1",xn={name:"lagent:sandbox-absent",inject:["journal","threads","confinement"],apply(t,e){N(t,"sandboxAbsent");let n=wn.parse(e);L(t,"sandboxAbsent");let o=t.confinement.handle({async snapshot(s){if(C(t,s)==="confined")throw new Error("This conversation is sandboxed, and the host started without a sandbox, so its commands, searches and file access are refused.");return{files:null,async prepare(i){return{argv:R(i.program),cwd:i.workdir,env:i.environment,provenance:{launcher:gn,version:yn,policy:D},violations:async()=>null}}}}}),r=null;t.fiber.beforeUnload(()=>(r??=o.release(n.drainTimeoutMs).then(s=>(s||t.reportError(new Error(`A command could not be confirmed stopped within ${n.drainTimeoutMs} ms`)),s)),r.then(()=>{}))),M(t,s=>C(t,s)==="confined"?{mode:"confined",guidance:q}:{mode:"unconfined",guidance:null})}};var dt=W,ht=new URL("./worker.js",import.meta.url);function ut(){let t=bn(import.meta.url).resolve("@anthropic-ai/sandbox-runtime/package.json");return En(vn(t),"vendor","java-proxy-agent","srt-proxy-agent.jar")}export{Me as SandboxConfigSchema,dt as sandbox,xn as sandboxAbsent,C as sandboxRecorded,on as sandboxRecordedOn,ht as sandboxWorker,ut as srtJavaAgentJar};

package/dist/{sandbox → plugins/sandbox}/mode.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from '@leuduan/cordis';
 import { z } from 'zod';
-import type { PluginJournal } from '../journal/index.js';
+import type { PluginJournal } from '../../journal/index.js';
 /**
  * Whether a conversation's shell commands run in the OS sandbox. One vocabulary from lagent to a
  * host's wire; "sandboxed" and "unsandboxed" are a display's words.
@@ -11,7 +11,7 @@ export type SandboxMode = 'confined' | 'unconfined';
  * mode, so a sub-agent is never in a mode its conversation is not. Private to this package: the
  * service is its only writer, and `sandboxRecorded` is how a host reads it.
  */
-export declare const sandboxModes: import("../kit/modes.js").Modes<SandboxMode>;
+export declare const sandboxModes: import("../../services/modes.js").Modes<SandboxMode>;
 /**
  * The mode recorded for the conversation `threadId` belongs to, `null` only when none was ever
  * recorded: never the `confined` a thread without a row reads as. For a host deciding what the
@@ -37,10 +37,10 @@ declare const SandboxFactSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type SandboxFact = z.output<typeof SandboxFactSchema>;
 /**
- * What a confined conversation is told on a host started without a sandbox, where `run_command` and
- * `start_command` are refused for it.
+ * What a confined conversation is told on a host started without a sandbox, where its commands, searches
+ * and file access are refused.
  */
-export declare const ABSENT_GUIDANCE = "The sandbox is unavailable on this host: run_command and start_command are refused for this conversation.";
+export declare const ABSENT_GUIDANCE = "The sandbox is unavailable on this host: commands, searches and file access are refused for this conversation.";
 /**
  * Tells every agent's threads the fact `current` says at their model steps. The guidance is part of
  * the compared fact, so a changed sandbox file, or a host that lost its sandbox, is told again. A

package/dist/plugins/sandbox/policy.d.ts

@@ -0,0 +1,163 @@
+import type { FilePolicy, LaunchProgram } from '../../services/confinement/service.js';
+import type { SpawnEnvironment } from '../../sys/spawn.js';
+import type { CallConfig, PathEntry } from './protocol.js';
+export declare function refuseStartupInjection(environment: SpawnEnvironment): void;
+/** The most command text one launch carries, which travels in the environment of the process that starts it. */
+export declare const MAX_COMMAND_BYTES: number;
+/**
+ * `path` with every link in its existing part resolved, so containment is judged on real locations.
+ * The one rule for every path of a policy: a link that leads nowhere is not followed, it stays the
+ * name it is, so an entry that is a dangling link covers its own name and nothing it points at.
+ */
+export declare function canonical(path: string): string;
+/**
+ * The root a command's protected names are rebuilt for, canonical. sandbox-runtime substitutes the
+ * real prefix before it compiles a pattern, and cannot anchor one this module hands it, so a root
+ * whose real path holds glob characters or its compiler's placeholders would turn the patterns
+ * below into something else: it is refused, not escaped.
+ */
+export declare function canonicalRoot(root: string): string;
+/**
+ * The names sandbox-runtime protects below its working directory, which here is the host's, not the thread's:
+ * relative suffixes, matched at the root and at any depth below it, with everything beneath them.
+ */
+export declare const PROTECTED_SUFFIXES: readonly string[];
+/**
+ * sandbox-runtime's mandatory write denies, rebuilt for `root`: its own set anchors at the host's
+ * working directory and only ever adds denies there. Each of `suffixes` once as the path at the root and
+ * twice as patterns for the same name anywhere beneath it, itself and its descendants. `root` is
+ * canonical and holds no glob characters (`canonicalRoot`).
+ */
+export declare function mandatoryDenies(root: string, suffixes: readonly string[]): PathEntry[];
+/**
+ * The programs a launch runs before confinement, as the search path finds them: the directories
+ * searched, since a program dropped into an earlier one would win, and the real file of every
+ * candidate for each program, wherever its link leads.
+ */
+export declare function helperLocations(searchPath: string): string[];
+/**
+ * Refuses roots a command could use against the sandbox itself: one overlapping, either way, what
+ * a launch runs before confinement, or the temporary root, whose directories the host creates
+ * unconfined. `roots` are canonical.
+ */
+export declare function refuseUnsafeRoots(roots: readonly string[], trusted: readonly string[], tmpRoot: string): void;
+/**
+ * A path as the host configured it and as it really is, with whether its volume folds case
+ * (`null`: it could not be told). Both spellings are matched when a path is judged by name
+ * (`filePolicy`), so a workspace configured by its link path still matches a path spelled by its
+ * real one, and the other way round; the OS sees only the real one (`srtFilesystem`).
+ */
+export type Anchor = {
+    readonly spelling: string;
+    readonly canonical: string;
+    readonly foldsCase: boolean | null;
+};
+/** `spelling` with the real path it leads to, which the caller already has, and its volume's case rule. */
+export declare const anchorAt: (spelling: string, canonicalPath: string) => Anchor;
+/** `path` as configured, with where it really leads. */
+export declare const anchor: (path: string) => Anchor;
+/**
+ * Whether the volume that holds `path` treats names that differ only in case as one, or `null` when
+ * it cannot be told. `path` may not exist yet: the answer is the volume of its nearest existing
+ * directory, probed by looking one of its entries up in another case and comparing what the two
+ * lookups find (device and inode), never by assuming a platform's default. Only what lives on that
+ * directory's own volume is probed: an entry on another device (a mount), or the directory's own
+ * name in a parent on another device, would answer for another volume. A directory with no entry to
+ * probe is probed through its own name in its parent, and so up, on the same device. `deviceOf` is
+ * the device lookup, replaceable to simulate volumes in tests.
+ */
+export declare function foldsCase(path: string, deviceOf?: (path: string) => number): boolean | null;
+/**
+ * What the sandbox allows a thread's processes and file tools, as one value in a restricted
+ * language: literal subtrees, each a path and everything below it, and protected relative suffixes
+ * under one root. `srtFilesystem` renders it for the OS, `filePolicy` for the file tools in this process.
+ */
+export type FilesystemPolicy = {
+    /** Writable subtrees: the thread's root, the host's roots and the scratch directory. */
+    readonly writable: readonly Anchor[];
+    /** Unwritable even inside a writable subtree: what the host and the sandbox keep for themselves. */
+    readonly denyWrite: readonly Anchor[];
+    /** Unreadable subtrees: credentials. */
+    readonly denyRead: readonly Anchor[];
+    /** Names unwritable at `root` and at any depth below it, with everything beneath them. */
+    readonly protected: {
+        readonly root: Anchor;
+        readonly suffixes: readonly string[];
+    };
+};
+/** What a thread's filesystem policy is made of, besides its root and scratch directory. */
+export type HostFacts = {
+    readonly allowWrite: readonly Anchor[];
+    readonly denyWrite: readonly Anchor[];
+    readonly denyRead: readonly Anchor[];
+    /** The paths under the home directory sandbox-runtime keeps writable for itself, as its worker reported them. */
+    readonly conveniences: readonly Anchor[];
+    readonly privateDirectory: Anchor;
+};
+/**
+ * A thread's filesystem policy: writes only in the root, the host's roots and the scratch directory,
+ * and never in what the host or sandbox-runtime keeps for itself or in the root's protected names.
+ * `root` is the thread's working directory, `canonicalRoot`'s answer for its spelling.
+ */
+export declare function filesystemPolicy(facts: HostFacts, root: Anchor, scratchDirectory: Anchor): FilesystemPolicy;
+/** The OS's lists for the policy, which replace the initialized ones for the call: every path real and literal. */
+export declare function srtFilesystem(policy: FilesystemPolicy): CallConfig['filesystem'];
+/**
+ * The policy for file tools in this process: the same value the OS enforces on processes, judged by
+ * name. It reads no file system, so a link in a path is the caller's to resolve: it asks for the
+ * path as requested and for where it resolves, and both must pass. A path is in a subtree, or under
+ * the protected root, by either spelling of that entry.
+ *
+ * Names are compared as the entry's volume would see them, and doubt never widens what is allowed.
+ * A rule that refuses compares in Unicode normalization form NFC, since a volume such as APFS treats
+ * the composed and decomposed spellings of a name as one, and folds case where the volume does:
+ * `.SSH` is `.ssh` there, even when `.ssh` does not exist yet, and `.GITCONFIG` is another file on a
+ * volume that keeps case. Where that could not be told (`foldsCase: null`) it folds. A rule that
+ * allows compares the spellings as they are, folding case only where the volume is known to. So on
+ * a volume that tells normalizations apart a refusal can over-match, and on APFS a writable root
+ * typed in another normalization than it was configured in is refused, never allowed too widely.
+ */
+export declare function filePolicy(policy: FilesystemPolicy): FilePolicy;
+/**
+ * The script the sandbox runs: restores the command's `PATH`, sets its temporary directory and runs
+ * it with `/bin/sh -c`. Everything it needs arrives in variables, never spliced into the script.
+ */
+export declare const BOOTSTRAP: string;
+/**
+ * A program as the shell text the sandbox runs: shell text as it is, an argv as `exec` and every word
+ * single-quoted, so the shell splits it back into exactly those words and looks the program up as a
+ * plain spawn does, never as one of its builtins or functions.
+ */
+export declare function programText(program: LaunchProgram): string;
+/**
+ * The environment of the process that starts the sandbox: the command's own, but with the trusted
+ * `PATH` until the sandbox holds, since the wrapped line runs `env` and `sandbox-exec` before
+ * confinement. The bootstrap restores the rest.
+ */
+export declare function launchEnvironment(environment: SpawnEnvironment, searchPath: string, scratchDirectory: string, command: string): SpawnEnvironment;
+/** What the name and version say in a command's recorded launch. */
+export declare const LAUNCHER = "lagent-srt";
+export declare const versionOf: (runtime: string) => string;
+/** Everything enforcement depends on, digested: recorded with a launch as its policy. */
+export declare function policyDigest(facts: {
+    readonly filesystem: CallConfig['filesystem'];
+    readonly network: unknown;
+    readonly searchPath: string;
+    readonly cwd: string;
+    readonly home: string;
+    readonly conveniences: readonly string[];
+    readonly javaAgent: string;
+    readonly version: string;
+}): string;
+/** What the model is told about sandboxed commands. */
+export declare function instructionsFor(config: {
+    readonly filesystem: {
+        readonly allowWrite: readonly string[];
+    };
+    readonly network: {
+        readonly mode: 'allowlist';
+        readonly allowedDomains: readonly string[];
+    } | {
+        readonly mode: 'unrestricted';
+    };
+}): string;

package/dist/{sandbox → plugins/sandbox}/service.d.ts

@@ -1,7 +1,7 @@
 import { Service, type Context } from '@leuduan/cordis';
 import { z } from 'zod';
-import type { WriteRows } from '../loop/index.js';
-import { type LaunchHandler, type LaunchRequest, type PreparedLaunch } from '../services/launches.js';
+import type { WriteRows } from '../../state/index.js';
+import { type ConfinementHandler, type ConfinementSnapshot } from '../../services/confinement/service.js';
 import { type SandboxMode } from './mode.js';
 export declare const SandboxConfigSchema: z.ZodObject<{
     worker: z.ZodUnion<readonly [z.ZodCustom<import("url").URL, import("url").URL>, z.ZodString]>;
@@ -36,7 +36,7 @@ export type SandboxConfigInput = z.input<typeof SandboxConfigSchema>;
 export type SandboxHealth = 'ready' | 'failed';
 declare module '@leuduan/cordis' {
     interface Context {
-        /** The OS sandbox for shell commands, the launch handler of `ctx.launches` (optional plugin, `@leuduan/lagent/sandbox`). */
+        /** The OS sandbox for shell commands, the confinement handler of `ctx.confinement` (optional plugin, `@leuduan/lagent/plugins/sandbox`). */
         sandbox: SandboxService;
     }
     interface Events {
@@ -48,30 +48,29 @@ declare module '@leuduan/cordis' {
     }
 }
 /**
- * The OS sandbox for shell commands, as a service and as the one launch handler of `ctx.launches`.
+ * The OS sandbox for shell commands, as a service and as the one confinement handler of `ctx.confinement`.
  * sandbox-runtime runs on a worker thread of this process (`./worker.ts`), started once, and this
  * service owns it: the policy built for each command, the worker's messages and deadlines, and the
  * order of teardown.
  *
  * Each conversation is confined or unconfined, as its durable mode says (`mode`, `setMode`, `opening`),
- * unless the host's `unconfined: 'refused'` confines them all. The mode is read once when a launch
- * starts preparing: a switch applies to launches that start preparing after it, and a launch already
- * preparing or running keeps the policy it selected. An unconfined launch is still the sandbox's
- * handler's, so it stops with it and a failed sandbox refuses it too. The model is told the mode as a
- * notice, never in the prompt.
+ * unless the host's `unconfined: 'refused'` confines them all. The mode is read once, in the snapshot
+ * an operation takes at its first use: a switch applies to operations not yet used, and one already
+ * used keeps the policy it selected, its file access and launches included. An unconfined launch is
+ * still the sandbox's handler's, so it stops with it and a failed sandbox refuses it too. The model is
+ * told the mode as a notice, never in the prompt.
  *
  * The handler is registered before the worker starts and refuses every launch until the self-check
  * passed, so a sandbox that fails to start never leaves a window in which launches run plain.
  * Teardown releases the handle first, so what it confined ends before its proxy does. sandbox-runtime
  * starts at most once per process, so a failed or disposed service is never restarted. The teardown
- * order and its failure cases are in `docs/sandbox.md`.
+ * order and its failure cases are in `docs/records/sandbox.md`.
  */
-export declare class SandboxService extends Service<SandboxConfigInput> implements LaunchHandler {
+export declare class SandboxService extends Service<SandboxConfigInput> implements ConfinementHandler {
     static inject: string[];
     /** What the model is told about confined commands: part of the notice's fact, so a changed one is told again. */
     private readonly guidance;
     private readonly config;
-    private readonly dataDir;
     private state;
     private failure;
     private admitting;
@@ -104,7 +103,12 @@ export declare class SandboxService extends Service<SandboxConfigInput> implemen
      */
     opening(mode: SandboxMode): WriteRows;
     private refuseGated;
-    prepare(request: LaunchRequest): Promise<PreparedLaunch>;
+    /**
+     * Admits one operation for `threadId` and reads its mode, once: the operation's launches and its
+     * file policy keep the mode selected here, whatever switch lands while they prepare or run.
+     */
+    snapshot(threadId: string): Promise<ConfinementSnapshot>;
+    private prepare;
     /**
      * An unconfined launch: what core would have run with no handler, with the provenance that says so.
      * None of the confined machinery runs: no scratch directory, policy, digest, worker request or
@@ -120,6 +124,12 @@ export declare class SandboxService extends Service<SandboxConfigInput> implemen
      * `trusted` skips the root checks, for the one launch whose root lies in the temporary root.
      */
     private build;
+    /**
+     * The filesystem policy for a root and a scratch key, the one value both a launch's confinement
+     * and the file tools' policy are rendered from. `trusted` skips the root's own checks, for the
+     * one launch whose root lies in the temporary root.
+     */
+    private policyFor;
     /** What sandbox-runtime recorded against one command: best-effort, from its global tail of recent events. */
     private violationsOf;
     private onWorkerDeath;

package/dist/plugins/schedules/index.js

@@ -1,5 +1,5 @@
-import{a as I}from"../../chunks/C5LYCXJG.js";import{a as H,d as B}from"../../chunks/J5S4URAW.js";import{a as Q}from"../../chunks/SL2YLB2F.js";import{b as Z}from"../../chunks/RK3VP2Q4.js";import"../../chunks/74HKUGRR.js";import{a as G}from"../../chunks/QMMLQJBS.js";import{a as L}from"../../chunks/YIR5MYGU.js";import{a as y,b as z}from"../../chunks/NAOUTU7A.js";import"../../chunks/UKXMCHHT.js";import{b as T}from"../../chunks/DRYAN665.js";import{d as R}from"../../chunks/2OSESBIL.js";import{G as P}from"../../chunks/YLNJXQ3Z.js";import"../../chunks/DDANMY45.js";import"../../chunks/37YOGDGY.js";import"../../chunks/KESCTXGO.js";import"../../chunks/TYTQRLTX.js";import"../../chunks/D7E6EWIE.js";import{Service as he}from"@leuduan/cordis";import{z as A}from"zod";import{z as c}from"zod";var v=c.number().int().nonnegative(),ae=c.discriminatedUnion("op",[c.strictObject({op:c.literal("created"),id:c.string().min(1),due_at:v,prompt:c.string().min(1),reason:c.string().min(1),time_zone:c.string().min(1),created_at:v,call_seq:c.number().int().positive().nullable()}),c.strictObject({op:c.literal("fired"),id:c.string().min(1),input_id:c.string().min(1)}),c.strictObject({op:c.literal("cancelled"),id:c.string().min(1),reason:c.string()})]),g=T({plugin:"lagent:schedules",kind:"schedule",version:1,schema:ae}),w=n=>n.cancelled?"cancelled":n.delivered===null?"pending":"fired",h=g.projection({key:"schedules",onFork:"reset",init:()=>new Map,apply(n,e){if(e.op==="created")return n.has(e.id)||n.set(e.id,{created:e,delivered:null,cancelled:!1}),n;let t=n.get(e.id);return t===void 0||n.set(e.id,e.op==="fired"?{...t,delivered:e.input_id}:{...t,cancelled:!0}),n}}),j=Q({key:"lagent:schedules",version:1,schema:c.strictObject({next_wake_at:v.nullable()}),applies:()=>!0,compute(n,e){let t=null;for(let r of n.state(h,e).values())w(r)==="pending"&&(t=t===null?r.created.due_at:Math.min(t,r.created.due_at));return{next_wake_at:t}}});function O(n,e){let t=j.read(n,e);return t.status==="available"?t.value.next_wake_at:null}var ce=c.strictObject({schedule_id:c.string().min(1),due_at:v,summary:c.string()}),$=T({plugin:"lagent:schedules",kind:"wake",version:1,schema:ce}),ue=n=>$.readSource(n);function J(n){try{return new Intl.DateTimeFormat("en-US",{timeZone:n}),!0}catch{return!1}}var Y=new Map;function le(n){let e=Y.get(n);return e===void 0&&(e=new Intl.DateTimeFormat("en-US",{timeZone:n,hourCycle:"h23",year:"numeric",month:"numeric",day:"numeric",hour:"numeric",minute:"numeric",second:"numeric"}),Y.set(n,e)),e}function M(n,e){let t={};for(let r of le(e).formatToParts(n))r.type!=="literal"&&(t[r.type]=Number(r.value));return{year:t.year,month:t.month,day:t.day,hour:t.hour,minute:t.minute,second:t.second}}function U(n,e){let t=M(n,e);return Date.UTC(t.year,t.month-1,t.day,t.hour,t.minute,t.second)-Math.floor(n/1e3)*1e3}var K=(n,e)=>n.year===e.year&&n.month===e.month&&n.day===e.day&&n.hour===e.hour&&n.minute===e.minute;function de(n,e){let t=Date.UTC(n.year,n.month-1,n.day,n.hour,n.minute),r=U(t-54e6,e),s=U(t+54e6,e),u=[...new Set([t-r,t-s])].sort((a,l)=>a-l);for(let a of u)if(K(M(a,e),n))return a;let o=Math.min(t-r,t-s),i=Math.max(t-r,t-s);for(;i-o>1e3;){let a=Math.floor((o+i)/2e3)*1e3;U(a,e)===s?i=a:o=a}return i}function V(n,e){let t=/^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:(Z)|([+-])(\d{2}):?(\d{2}))?$/.exec(n.trim());if(t===null)return null;let[r,s,u,o,i,a]=t.slice(1,7).map(_=>Number(_??0)),l=new Date(Date.UTC(r,s-1,u));if(l.getUTCFullYear()!==r||l.getUTCMonth()!==s-1||l.getUTCDate()!==u||o>23||i>59||a>59)return null;let[,,,,,,,d,p,S,ie]=t;if(d!==void 0||p!==void 0){let _=Number(S??0),q=Number(ie??0);if(_>14||q>59)return null;let oe=(p==="-"?-1:1)*(_*60+q)*6e4;return Date.UTC(r,s-1,u,o,i,a)-oe}let C={year:r,month:s,day:u,hour:o,minute:i},b=de(C,e);return K(M(b,e),C)?b+a*1e3:b}var X=A.number().int().positive(),me=A.strictObject({clock:H,timeZone:A.string().refine(J,"timeZone must be an IANA time zone"),maxDelayMs:X,maxPendingPerThread:X}),m=class extends Error{constructor(e){super(e),this.name="ScheduleRefusedError"}},D="Scheduled wakes are for conversations a person talks to; an agent working for another agent cannot schedule one.",fe="A scheduled wake can be created only in a turn a person started, not from a wake or a notice. Tell the person what to schedule, or ask them.",pe=n=>`sch-${n}`,ee=n=>`wake_${n}`,W=n=>n.replaceAll("&","&amp;").replaceAll('"',"&quot;").replaceAll("<","&lt;"),k=n=>new Date(n).toISOString().replace(".000Z","Z"),te=(n,e)=>`A scheduled wake may be due at most ${Math.round(n/6e4)} minutes from now, by ${k(e+n)}.`;function E(n,e,t){let{created:r}=e,s=e.delivered!==null&&!e.cancelled&&t.input(e.delivered).state==="queued";return{id:r.id,threadId:n,dueAt:r.due_at,timeZone:r.time_zone,prompt:r.prompt,reason:r.reason,status:w(e),unread:s,createdAt:r.created_at}}var x=class extends he{static inject=["threads","journal"];config;queue;inFlight=new Set;refreshed=Promise.resolve([]);armed=!1;retries;closed=!1;constructor(e,t){super(e,"schedules"),this.config=me.parse(t),this.queue=B(this.config.clock,r=>e.reportError(r)),this.retries=I(this.config.clock,r=>e.reportError(r)),e.effect(()=>e.journal.register(h)),e.effect(()=>e.journal.subscribe(r=>{this.armed&&g.read(r)!==void 0&&this.arm(r.thread_id)})),this.refreshed=j.register(e).refreshed,e.effect(()=>{let r=e.threads.registerOwner({owner:"lagent:schedules",repair:()=>this.catchUp()});return()=>r.dispose()}),L(e,()=>this.shutdown())}list({threadId:e}){let t=this.ctx.threads.view(e);return[...this.ctx.journal.state(h,e).values()].map(r=>E(e,r,t))}async create(e,t,r={}){let s=this.thread(e),u=r.callSeq===void 0?P("sch"):pe(r.callSeq),o=await s.read(l=>{let d=this.ctx.journal.state(h,e).get(u);if(d!==void 0)return E(e,d,l);if(s.origin!=null)throw new m(D);if(r.requirePersonTurn===!0&&!this.ctx.threads.chain(e).personTurn)throw new m(fe)});if(o!==void 0)return o;let i=this.createdRow(u,t,r.callSeq??null),{value:a}=await this.ctx.journal.transact(e,()=>{let l=this.ctx.journal.state(h,e);if(l.has(u))return{rows:[],value:null};let d=[...l.values()].filter(S=>w(S)==="pending").length;if(d>=this.config.maxPendingPerThread)return{rows:[],value:`This conversation already has ${d} scheduled wakes waiting, the most it may; cancel one with cancel_wake first.`};let p=this.config.clock.now();return i.due_at<=p?{rows:[],value:`${k(i.due_at)} has already passed; it is now ${k(p)}.`}:i.due_at>p+this.config.maxDelayMs?{rows:[],value:te(this.config.maxDelayMs,p)}:{rows:[g.entry({...i,created_at:p},{threadId:e})],value:null}});if(a!==null)throw new m(a);return s.read(l=>E(e,this.ctx.journal.state(h,e).get(u),l))}cancel(e,t,r="cancelled"){return this.track(async()=>{let s=this.thread(e);if(!await s.read(()=>this.ctx.journal.state(h,e).has(t)))throw new m(`No scheduled wake ${t} in this conversation.`);let o=await s.withdraw(ee(t),{rows:()=>this.ctx.journal.state(h,e).get(t).cancelled?[]:[g.entry({op:"cancelled",id:t,reason:r},{threadId:e})]});if(o.status==="refused")throw new Error(o.refusal.message);return{withdrawn:o.status==="withdrawn"}})}cancelRows(e,t="the conversation was stopped"){return[...this.ctx.journal.state(h,e).values()].filter(r=>w(r)==="pending").map(r=>g.entry({op:"cancelled",id:r.created.id,reason:t},{threadId:e}))}thread(e){let t=this.ctx.threads.get(e);if(t===void 0)throw new m(`No thread ${e}`);return t}createdRow(e,t,r){let{clock:s,timeZone:u,maxDelayMs:o}=this.config,i=s.now(),a=p=>{throw new m(p)};t.prompt.trim()===""&&a("A scheduled wake needs a prompt."),t.reason.trim()===""&&a("A scheduled wake needs a reason.");let{when:l}=t,d;return"in_seconds"in l?((!Number.isInteger(l.in_seconds)||l.in_seconds<1)&&a("in_seconds must be a whole number of at least 1."),d=i+l.in_seconds*1e3):(d=V(l.at,u)??a(`"${l.at}" is not a date and time such as 2026-10-11T14:30 or 2026-10-11T14:30+02:00.`),d<=i&&a(`${l.at} has already passed; it is now ${k(i)}.`)),d>i+o&&a(te(o,i)),{op:"created",id:e,due_at:d,prompt:t.prompt,reason:t.reason,time_zone:u,created_at:i,call_seq:r}}track(e){let t=e(),r=t.then(()=>{},()=>{});return this.inFlight.add(r),r.then(()=>this.inFlight.delete(r)),t}async catchUp(){try{await this.refreshed;let e=this.config.clock.now();await Promise.all(this.ctx.journal.summaries().filter(t=>{let r=O(this.ctx.journal,t.thread_id);return r!==null&&r<=e}).map(t=>this.check(t.thread_id)))}finally{this.armed=!0;for(let e of this.ctx.journal.summaries())this.arm(e.thread_id)}}arm(e){if(this.closed||this.retries.pending(e))return;let t=O(this.ctx.journal,e);t===null?this.queue.delete(e):this.queue.set(e,t,()=>{this.check(e)})}check(e){return this.track(()=>this.deliverDue(e))}async deliverDue(e){if(!this.closed)try{let t=this.ctx.threads.get(e);if(t===void 0)return;let r=this.config.clock.now(),s=await t.read(()=>[...this.ctx.journal.state(h,e).values()].filter(i=>w(i)==="pending"&&i.created.due_at<=r).map(i=>i.created.id)),o=(await Promise.allSettled(s.map(i=>this.fire(e,i)))).find(i=>i.status==="rejected");if(o!==void 0)throw o.reason;this.retries.succeeded(e),this.arm(e)}catch(t){if(this.ctx.reportError(t),this.closed)return;this.queue.delete(e),this.retries.failed(e,()=>{this.check(e)})}}async fire(e,t){if(this.closed)return;let r=this.thread(e),s=await r.read(()=>this.ctx.journal.state(h,e).get(t));if(s===void 0||w(s)!=="pending")return;let{created:u}=s,o=ee(t);await r.send({role:"user",content:we(u)},{id:o,source:$.record({schedule_id:t,due_at:u.due_at,summary:`${t} ${u.reason}`.slice(0,120)}),wake:{releases:!1,chain:"fresh"},target:"next-turn",rows:()=>{let i=this.ctx.journal.state(h,e).get(t);return i===void 0||w(i)!=="pending"?{refuse:{message:`Scheduled wake ${t} is no longer pending`}}:[g.entry({op:"fired",id:t,input_id:o},{threadId:e})]}})}async shutdown(){this.closed=!0,this.queue.dispose(),this.retries.dispose(),await Promise.allSettled([...this.inFlight])}};function we(n){return`<scheduled_wake ${[`schedule="${W(n.id)}"`,`due="${k(n.due_at)}"`,`time_zone="${W(n.time_zone)}"`,`reason="${W(n.reason)}"`].join(" ")}>
+import{a as I}from"../../chunks/MNJ4SRF7.js";import{a as H,d as B}from"../../chunks/HK6ZSONF.js";import{a as Q}from"../../chunks/7VAPNE3L.js";import{b as z}from"../../chunks/EPYQ5M3B.js";import"../../chunks/5IRF47YB.js";import{b as y,c as G}from"../../chunks/JFX2MXBA.js";import{b as R,c as Z,d as L}from"../../chunks/S34ZA2R6.js";import{b as T}from"../../chunks/6FRNHMCV.js";import"../../chunks/CUK7CGC7.js";import{x as P}from"../../chunks/BPRCULZH.js";import"../../chunks/FJLU4UH3.js";import"../../chunks/DDANMY45.js";import"../../chunks/BBCW2FZK.js";import"../../chunks/MMNNZCBO.js";import"../../chunks/G44LG6VL.js";import"../../chunks/D4PQP5MA.js";import{Service as he}from"@leuduan/cordis";import{z as A}from"zod";import{z as c}from"zod";var x=c.number().int().nonnegative(),ae=c.discriminatedUnion("op",[c.strictObject({op:c.literal("created"),id:c.string().min(1),due_at:x,prompt:c.string().min(1),reason:c.string().min(1),time_zone:c.string().min(1),created_at:x,call_seq:c.number().int().positive().nullable()}),c.strictObject({op:c.literal("fired"),id:c.string().min(1),input_id:c.string().min(1)}),c.strictObject({op:c.literal("cancelled"),id:c.string().min(1),reason:c.string()})]),g=T({plugin:"lagent:schedules",kind:"schedule",version:1,schema:ae}),w=n=>n.cancelled?"cancelled":n.delivered===null?"pending":"fired",h=g.projection({key:"schedules",onFork:"reset",init:()=>new Map,apply(n,e){if(e.op==="created")return n.has(e.id)||n.set(e.id,{created:e,delivered:null,cancelled:!1}),n;let t=n.get(e.id);return t===void 0||n.set(e.id,e.op==="fired"?{...t,delivered:e.input_id}:{...t,cancelled:!0}),n}}),j=Q({key:"lagent:schedules",version:1,schema:c.strictObject({next_wake_at:x.nullable()}),applies:()=>!0,compute(n,e){let t=null;for(let r of n.state(h,e).values())w(r)==="pending"&&(t=t===null?r.created.due_at:Math.min(t,r.created.due_at));return{next_wake_at:t}}});function O(n,e){let t=j.read(n,e);return t.status==="available"?t.value.next_wake_at:null}var ce=c.strictObject({schedule_id:c.string().min(1),due_at:x,summary:c.string()}),$=T({plugin:"lagent:schedules",kind:"wake",version:1,schema:ce}),ue=n=>$.readSource(n);function J(n){try{return new Intl.DateTimeFormat("en-US",{timeZone:n}),!0}catch{return!1}}var Y=new Map;function le(n){let e=Y.get(n);return e===void 0&&(e=new Intl.DateTimeFormat("en-US",{timeZone:n,hourCycle:"h23",year:"numeric",month:"numeric",day:"numeric",hour:"numeric",minute:"numeric",second:"numeric"}),Y.set(n,e)),e}function M(n,e){let t={};for(let r of le(e).formatToParts(n))r.type!=="literal"&&(t[r.type]=Number(r.value));return{year:t.year,month:t.month,day:t.day,hour:t.hour,minute:t.minute,second:t.second}}function U(n,e){let t=M(n,e);return Date.UTC(t.year,t.month-1,t.day,t.hour,t.minute,t.second)-Math.floor(n/1e3)*1e3}var K=(n,e)=>n.year===e.year&&n.month===e.month&&n.day===e.day&&n.hour===e.hour&&n.minute===e.minute;function de(n,e){let t=Date.UTC(n.year,n.month-1,n.day,n.hour,n.minute),r=U(t-54e6,e),s=U(t+54e6,e),u=[...new Set([t-r,t-s])].sort((a,l)=>a-l);for(let a of u)if(K(M(a,e),n))return a;let o=Math.min(t-r,t-s),i=Math.max(t-r,t-s);for(;i-o>1e3;){let a=Math.floor((o+i)/2e3)*1e3;U(a,e)===s?i=a:o=a}return i}function V(n,e){let t=/^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:(Z)|([+-])(\d{2}):?(\d{2}))?$/.exec(n.trim());if(t===null)return null;let[r,s,u,o,i,a]=t.slice(1,7).map(_=>Number(_??0)),l=new Date(Date.UTC(r,s-1,u));if(l.getUTCFullYear()!==r||l.getUTCMonth()!==s-1||l.getUTCDate()!==u||o>23||i>59||a>59)return null;let[,,,,,,,d,p,S,ie]=t;if(d!==void 0||p!==void 0){let _=Number(S??0),q=Number(ie??0);if(_>14||q>59)return null;let oe=(p==="-"?-1:1)*(_*60+q)*6e4;return Date.UTC(r,s-1,u,o,i,a)-oe}let C={year:r,month:s,day:u,hour:o,minute:i},b=de(C,e);return K(M(b,e),C)?b+a*1e3:b}var X=A.number().int().positive(),me=A.strictObject({clock:H,timeZone:A.string().refine(J,"timeZone must be an IANA time zone"),maxDelayMs:X,maxPendingPerThread:X}),m=class extends Error{constructor(e){super(e),this.name="ScheduleRefusedError"}},D="Scheduled wakes are for conversations a person talks to; an agent working for another agent cannot schedule one.",fe="A scheduled wake can be created only in a turn a person started, not from a wake or a notice. Tell the person what to schedule, or ask them.",pe=n=>`sch-${n}`,ee=n=>`wake_${n}`,W=n=>n.replaceAll("&","&amp;").replaceAll('"',"&quot;").replaceAll("<","&lt;"),k=n=>new Date(n).toISOString().replace(".000Z","Z"),te=(n,e)=>`A scheduled wake may be due at most ${Math.round(n/6e4)} minutes from now, by ${k(e+n)}.`;function E(n,e,t){let{created:r}=e,s=e.delivered!==null&&!e.cancelled&&t.input(e.delivered).state==="queued";return{id:r.id,threadId:n,dueAt:r.due_at,timeZone:r.time_zone,prompt:r.prompt,reason:r.reason,status:w(e),unread:s,createdAt:r.created_at}}var v=class extends he{static inject=["threads","journal"];config;queue;inFlight=new Set;refreshed=Promise.resolve([]);armed=!1;retries;closed=!1;constructor(e,t){super(e,"schedules"),this.config=me.parse(t),this.queue=B(this.config.clock,r=>e.reportError(r)),this.retries=I(this.config.clock,r=>e.reportError(r)),e.effect(()=>e.journal.register(h)),e.effect(()=>e.journal.subscribe(r=>{this.armed&&g.read(r)!==void 0&&this.arm(r.thread_id)})),this.refreshed=j.register(e).refreshed,e.effect(()=>{let r=e.threads.registerOwner({owner:"lagent:schedules",repair:()=>this.catchUp()});return()=>r.dispose()}),R(e,()=>this.shutdown())}list({threadId:e}){let t=this.ctx.threads.view(e);return[...this.ctx.journal.state(h,e).values()].map(r=>E(e,r,t))}async create(e,t,r={}){let s=this.thread(e),u=r.callSeq===void 0?P("sch"):pe(r.callSeq),o=await s.read(l=>{let d=this.ctx.journal.state(h,e).get(u);if(d!==void 0)return E(e,d,l);if(s.origin!=null)throw new m(D);if(r.requirePersonTurn===!0&&!this.ctx.threads.chain(e).personTurn)throw new m(fe)});if(o!==void 0)return o;let i=this.createdRow(u,t,r.callSeq??null),{value:a}=await this.ctx.journal.transact(e,()=>{let l=this.ctx.journal.state(h,e);if(l.has(u))return{rows:[],value:null};let d=[...l.values()].filter(S=>w(S)==="pending").length;if(d>=this.config.maxPendingPerThread)return{rows:[],value:`This conversation already has ${d} scheduled wakes waiting, the most it may; cancel one with cancel_wake first.`};let p=this.config.clock.now();return i.due_at<=p?{rows:[],value:`${k(i.due_at)} has already passed; it is now ${k(p)}.`}:i.due_at>p+this.config.maxDelayMs?{rows:[],value:te(this.config.maxDelayMs,p)}:{rows:[g.entry({...i,created_at:p},{threadId:e})],value:null}});if(a!==null)throw new m(a);return s.read(l=>E(e,this.ctx.journal.state(h,e).get(u),l))}cancel(e,t,r="cancelled"){return this.track(async()=>{let s=this.thread(e);if(!await s.read(()=>this.ctx.journal.state(h,e).has(t)))throw new m(`No scheduled wake ${t} in this conversation.`);let o=await s.withdraw(ee(t),{rows:()=>this.ctx.journal.state(h,e).get(t).cancelled?[]:[g.entry({op:"cancelled",id:t,reason:r},{threadId:e})]});if(o.status==="refused")throw new Error(o.refusal.message);return{withdrawn:o.status==="withdrawn"}})}cancelRows(e,t="the conversation was stopped"){return[...this.ctx.journal.state(h,e).values()].filter(r=>w(r)==="pending").map(r=>g.entry({op:"cancelled",id:r.created.id,reason:t},{threadId:e}))}thread(e){let t=this.ctx.threads.get(e);if(t===void 0)throw new m(`No thread ${e}`);return t}createdRow(e,t,r){let{clock:s,timeZone:u,maxDelayMs:o}=this.config,i=s.now(),a=p=>{throw new m(p)};t.prompt.trim()===""&&a("A scheduled wake needs a prompt."),t.reason.trim()===""&&a("A scheduled wake needs a reason.");let{when:l}=t,d;return"in_seconds"in l?((!Number.isInteger(l.in_seconds)||l.in_seconds<1)&&a("in_seconds must be a whole number of at least 1."),d=i+l.in_seconds*1e3):(d=V(l.at,u)??a(`"${l.at}" is not a date and time such as 2026-10-11T14:30 or 2026-10-11T14:30+02:00.`),d<=i&&a(`${l.at} has already passed; it is now ${k(i)}.`)),d>i+o&&a(te(o,i)),{op:"created",id:e,due_at:d,prompt:t.prompt,reason:t.reason,time_zone:u,created_at:i,call_seq:r}}track(e){let t=e(),r=t.then(()=>{},()=>{});return this.inFlight.add(r),r.then(()=>this.inFlight.delete(r)),t}async catchUp(){try{await this.refreshed;let e=this.config.clock.now();await Promise.all(this.ctx.journal.summaries().filter(t=>{let r=O(this.ctx.journal,t.thread_id);return r!==null&&r<=e}).map(t=>this.check(t.thread_id)))}finally{this.armed=!0;for(let e of this.ctx.journal.summaries())this.arm(e.thread_id)}}arm(e){if(this.closed||this.retries.pending(e))return;let t=O(this.ctx.journal,e);t===null?this.queue.delete(e):this.queue.set(e,t,()=>{this.check(e)})}check(e){return this.track(()=>this.deliverDue(e))}async deliverDue(e){if(!this.closed)try{let t=this.ctx.threads.get(e);if(t===void 0)return;let r=this.config.clock.now(),s=await t.read(()=>[...this.ctx.journal.state(h,e).values()].filter(i=>w(i)==="pending"&&i.created.due_at<=r).map(i=>i.created.id)),o=(await Promise.allSettled(s.map(i=>this.fire(e,i)))).find(i=>i.status==="rejected");if(o!==void 0)throw o.reason;this.retries.succeeded(e),this.arm(e)}catch(t){if(this.ctx.reportError(t),this.closed)return;this.queue.delete(e),this.retries.failed(e,()=>{this.check(e)})}}async fire(e,t){if(this.closed)return;let r=this.thread(e),s=await r.read(()=>this.ctx.journal.state(h,e).get(t));if(s===void 0||w(s)!=="pending")return;let{created:u}=s,o=ee(t);await r.send({role:"user",content:we(u)},{id:o,source:$.record({schedule_id:t,due_at:u.due_at,summary:`${t} ${u.reason}`.slice(0,120)}),wake:{releases:!1,chain:"fresh"},target:"next-turn",rows:()=>{let i=this.ctx.journal.state(h,e).get(t);return i===void 0||w(i)!=="pending"?{refuse:{message:`Scheduled wake ${t} is no longer pending`}}:[g.entry({op:"fired",id:t,input_id:o},{threadId:e})]}})}async shutdown(){this.closed=!0,this.queue.dispose(),this.retries.dispose(),await Promise.allSettled([...this.inFlight])}};function we(n){return`<scheduled_wake ${[`schedule="${W(n.id)}"`,`due="${k(n.due_at)}"`,`time_zone="${W(n.time_zone)}"`,`reason="${W(n.reason)}"`].join(" ")}>
 ${n.prompt}
-</scheduled_wake>`}import{z as f}from"zod";function N(n,e){let t=G(n.ctx,"schedules",e);if(n.ctx.threads.get(n.threadId)?.origin!=null)throw new m(D);return t}var ne=n=>`${n.id}  ${n.unread?"delivered, not read yet":n.status}  due ${k(n.dueAt)} (${n.timeZone}): ${n.reason}`,ge=f.strictObject({when:f.union([f.strictObject({in_seconds:f.number().int().min(1).describe("Seconds from now.")}),f.strictObject({at:f.string().describe("A date and time, such as 2026-10-11T14:30 (in the conversation\u2019s time zone) or 2026-10-11T14:30+02:00.")})]).describe("When: after in_seconds, or at a time."),prompt:f.string().min(1).describe("What you will be told when it fires: write it for yourself, then."),reason:f.string().min(1).describe("One line for the person, saying why.")}),F=y({name:"schedule_wake",description:"Schedule one wake of this conversation, after a delay or at a time. When it fires, you get its prompt as a new turn, even if nobody is here.",parameters:ge,onInterrupted:"rerun",executionMode:"exclusive",async execute(n,e){let t=await N(e,"schedule_wake").create(e.threadId,n,{callSeq:e.callSeq,requirePersonTurn:!0});return{output:`Scheduled ${ne(t)}`,metadata:{id:t.id,due_at:t.dueAt}}}}),re=y({name:"list_wakes",description:"List the scheduled wakes of this conversation still waiting to fire, and those that fired but whose message you have not read yet.",parameters:f.strictObject({}),onInterrupted:"rerun",executionMode:"parallel",execute:async(n,e)=>{let t=N(e,"list_wakes").list({threadId:e.threadId}),r=t.filter(s=>s.status==="pending"||s.unread);return{output:r.map(ne).join(`
+</scheduled_wake>`}import{z as f}from"zod";function N(n,e){let t=Z(n.ctx,"schedules",e);if(n.ctx.threads.get(n.threadId)?.origin!=null)throw new m(D);return t}var ne=n=>`${n.id}  ${n.unread?"delivered, not read yet":n.status}  due ${k(n.dueAt)} (${n.timeZone}): ${n.reason}`,ge=f.strictObject({when:f.union([f.strictObject({in_seconds:f.number().int().min(1).describe("Seconds from now.")}),f.strictObject({at:f.string().describe("A date and time, such as 2026-10-11T14:30 (in the conversation\u2019s time zone) or 2026-10-11T14:30+02:00.")})]).describe("When: after in_seconds, or at a time."),prompt:f.string().min(1).describe("What you will be told when it fires: write it for yourself, then."),reason:f.string().min(1).describe("One line for the person, saying why.")}),F=y({name:"schedule_wake",description:"Schedule one wake of this conversation, after a delay or at a time. When it fires, you get its prompt as a new turn, even if nobody is here.",parameters:ge,onInterrupted:"rerun",executionMode:"exclusive",async execute(n,e){let t=await N(e,"schedule_wake").create(e.threadId,n,{callSeq:e.callSeq,requirePersonTurn:!0});return{output:`Scheduled ${ne(t)}`,metadata:{id:t.id,due_at:t.dueAt}}}}),re=y({name:"list_wakes",description:"List the scheduled wakes of this conversation still waiting to fire, and those that fired but whose message you have not read yet.",parameters:f.strictObject({}),onInterrupted:"rerun",executionMode:"parallel",execute:async(n,e)=>{let t=N(e,"list_wakes").list({threadId:e.threadId}),r=t.filter(s=>s.status==="pending"||s.unread);return{output:r.map(ne).join(`
 `)||"No scheduled wakes waiting.",metadata:{pending:r.filter(s=>!s.unread).length,unread:r.filter(s=>s.unread).length,total:t.length}}}}),se=y({name:"cancel_wake",description:"Cancel a scheduled wake of this conversation, or its delivery still waiting to be read.",parameters:f.strictObject({id:f.string().min(1).describe("The id schedule_wake returned, such as sch-42.")}),onInterrupted:"rerun",executionMode:"exclusive",async execute({id:n},e){let{withdrawn:t}=await N(e,"cancel_wake").cancel(e.threadId,n,"cancel_wake");return{output:`Cancelled ${n}.${t?" Its waiting delivery was withdrawn.":""}`,metadata:{id:n,withdrawn:t}}}}),ke=["schedule_wake","list_wakes","cancel_wake"];var _e=["Use schedule_wake only when the person asks for something later, never to wait for what a notice will report, such as a sub-agent or a command started with notify.","A scheduled wake fires once, and can be created only in a turn the person started: never from a wake or a notice, so do not promise follow-ups you cannot schedule then.","When a wake fires you get its prompt as user input in a <scheduled_wake> frame naming its due time; compare it with the current date, since a wake waiting behind a stop is delivered late."].join(`
-`),Ge={name:"lagent:schedules",inject:["tools","prompts","threads","journal"],async apply(n,e){R(n,"schedules"),await n.plugin(x,e);let t=[F,re,se];for(let r of t)z(n,r);Z(n,{tag:"schedules",slot:"instruction",agents:"all",render:({tools:r})=>r.some(s=>s.tool===F)?_e:null})}};export{ke as SCHEDULE_TOOLS,m as ScheduleRefusedError,ue as readScheduledWake,Ge as schedules};
+`),Ge={name:"lagent:schedules",inject:["tools","prompts","threads","journal"],async apply(n,e){L(n,"schedules"),await n.plugin(v,e);let t=[F,re,se];for(let r of t)G(n,r);z(n,{tag:"schedules",slot:"instruction",agents:"all",render:({tools:r})=>r.some(s=>s.tool===F)?_e:null})}};export{ke as SCHEDULE_TOOLS,m as ScheduleRefusedError,ue as readScheduledWake,Ge as schedules};

package/dist/plugins/schedules/record.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import type { PluginJournal } from '../../journal/index.js';
-import type { ExtensionRecord } from '../../models/index.js';
+import type { ExtensionRecord } from '../../records/journal.js';
 import type { DeepReadonly } from '../../util/json.js';
 /**
  * What the journal keeps of a scheduled wake, on the thread it wakes, as `ext` rows of this plugin:
@@ -128,8 +128,8 @@ export declare const scheduleRow: {
         op: "cancelled";
         id: string;
         reason: string;
-    }, options: import("../../journal/journal.js").AppendOptions): Promise<import("../../models/index.js").JournalEvent<"ext">>;
-    read(event: import("../../models/index.js").JournalEvent): {
+    }, options: import("../../journal/journal.js").AppendOptions): Promise<import("../../records/journal.js").JournalEvent<"ext">>;
+    read(event: import("../../records/journal.js").JournalEvent): {
         op: "created";
         id: string;
         due_at: number;
@@ -148,7 +148,7 @@ export declare const scheduleRow: {
         reason: string;
     } | undefined;
     contribution(message: {
-        role?: import("../../models/index.js").InputRole;
+        role?: import("../../records/journal.js").InputRole;
         content: string | readonly import("../../llm/content.js").ContentPartInput[];
     }, value: {
         op: "created";
@@ -168,8 +168,8 @@ export declare const scheduleRow: {
         id: string;
         reason: string;
     }, options?: {
-        sourceSeqs?: readonly import("../../models/index.js").Seq[];
-    }): import("../../models/index.js").StepContribution;
+        sourceSeqs?: readonly import("../../records/journal.js").Seq[];
+    }): import("../../records/journal.js").StepContribution;
     matchesSource(record: DeepReadonly<ExtensionRecord>): boolean;
     rejection(reason: string, value: {
         op: "created";
@@ -193,7 +193,7 @@ export declare const scheduleRow: {
         reason: string;
         source: ExtensionRecord;
     };
-    readContribution: (event: import("../../models/index.js").JournalEvent) => {
+    readContribution: (event: import("../../records/journal.js").JournalEvent) => {
         op: "created";
         id: string;
         due_at: number;
@@ -229,7 +229,7 @@ export declare const scheduleRow: {
         id: string;
         reason: string;
     } | undefined;
-    told: import("../../journal/projection.js").PluginProjection<import("../../kit/extension.js").ToldNotices<{
+    told: import("../../journal/projection.js").PluginProjection<import("../../services/extensionEvents.js").ToldNotices<{
         op: "created";
         id: string;
         due_at: number;
@@ -267,7 +267,7 @@ export declare const scheduleRow: {
             op: "cancelled";
             id: string;
             reason: string;
-        }, event: import("../../models/index.js").JournalEvent<"ext">): State;
+        }, event: import("../../records/journal.js").JournalEvent<"ext">): State;
         onFork?: "inherit" | "reset";
     }): import("../../journal/projection.js").PluginProjection<State>;
 };
@@ -287,7 +287,7 @@ export declare const schedules: import("../../journal/projection.js").PluginProj
  * What a thread contributes to its catalog entry: the earliest due instant among its pending wakes,
  * `null` with none, so due work is found from the catalog without loading anything.
  */
-export declare const nextWake: import("../../services/contributions.js").ContributionDefinition<{
+export declare const nextWake: import("../../services/catalogContributions.js").ContributionDefinition<{
     next_wake_at: number | null;
 }>;
 /**
@@ -339,22 +339,22 @@ export declare const scheduledWake: {
         schedule_id: string;
         due_at: number;
         summary: string;
-    }, options: import("../../journal/journal.js").AppendOptions): Promise<import("../../models/index.js").JournalEvent<"ext">>;
-    read(event: import("../../models/index.js").JournalEvent): {
+    }, options: import("../../journal/journal.js").AppendOptions): Promise<import("../../records/journal.js").JournalEvent<"ext">>;
+    read(event: import("../../records/journal.js").JournalEvent): {
         schedule_id: string;
         due_at: number;
         summary: string;
     } | undefined;
     contribution(message: {
-        role?: import("../../models/index.js").InputRole;
+        role?: import("../../records/journal.js").InputRole;
         content: string | readonly import("../../llm/content.js").ContentPartInput[];
     }, value: {
         schedule_id: string;
         due_at: number;
         summary: string;
     }, options?: {
-        sourceSeqs?: readonly import("../../models/index.js").Seq[];
-    }): import("../../models/index.js").StepContribution;
+        sourceSeqs?: readonly import("../../records/journal.js").Seq[];
+    }): import("../../records/journal.js").StepContribution;
     matchesSource(record: DeepReadonly<ExtensionRecord>): boolean;
     rejection(reason: string, value: {
         schedule_id: string;
@@ -365,7 +365,7 @@ export declare const scheduledWake: {
         reason: string;
         source: ExtensionRecord;
     };
-    readContribution: (event: import("../../models/index.js").JournalEvent) => {
+    readContribution: (event: import("../../records/journal.js").JournalEvent) => {
         schedule_id: string;
         due_at: number;
         summary: string;
@@ -375,7 +375,7 @@ export declare const scheduledWake: {
         due_at: number;
         summary: string;
     } | undefined;
-    told: import("../../journal/projection.js").PluginProjection<import("../../kit/extension.js").ToldNotices<{
+    told: import("../../journal/projection.js").PluginProjection<import("../../services/extensionEvents.js").ToldNotices<{
         schedule_id: string;
         due_at: number;
         summary: string;
@@ -387,7 +387,7 @@ export declare const scheduledWake: {
             schedule_id: string;
             due_at: number;
             summary: string;
-        }, event: import("../../models/index.js").JournalEvent<"ext">): State;
+        }, event: import("../../records/journal.js").JournalEvent<"ext">): State;
         onFork?: "inherit" | "reset";
     }): import("../../journal/projection.js").PluginProjection<State>;
 };

package/dist/plugins/schedules/service.d.ts

@@ -9,7 +9,7 @@ declare module '@leuduan/cordis' {
     }
 }
 export declare const SchedulesConfigSchema: z.ZodObject<{
-    clock: z.ZodCustom<import("../../kit/timers.js").Clock, import("../../kit/timers.js").Clock>;
+    clock: z.ZodCustom<import("../../util/timers.js").Clock, import("../../util/timers.js").Clock>;
     timeZone: z.ZodString;
     maxDelayMs: z.ZodNumber;
     maxPendingPerThread: z.ZodNumber;
@@ -57,7 +57,7 @@ export declare const iso: (instant: number) => string;
  * a cancel each decide inside their own write, which the journal orders: a cancel that commits
  * first stops the delivery, and one that commits after it withdraws the delivery, keyed by the
  * wake, in the same write. Due work is found from the catalog (`next_wake_at`) and kept on one timer queue; at
- * startup it fires through a repair-only constraint registration. Reasons in `docs/schedules.md`.
+ * startup it fires through a repair-only constraint registration. Reasons in `docs/records/schedules.md`.
  */
 export declare class SchedulesService extends Service<SchedulesConfig> {
     static inject: string[];