@lunora/agent 1.0.0-alpha.2 → 1.0.0-alpha.4

package/dist/channels.d.mts

@@ -52,6 +52,14 @@ interface AgentChannelTarget {
 */
 type InboundChannelHandler = (request: Request, env: Record<string, unknown>) => Promise<Response>;
 /**
+* Whether a `workflow.create()` rejection is a duplicate-instance-id error — the
+* idempotency signal — as opposed to a transient/config failure (Workflows
+* service error, instance-creation quota, bad params). Only the former may be
+* acked; every other failure MUST surface so the handler returns non-2xx and the
+* provider redelivers, rather than silently dropping the event.
+*/
+declare const isDuplicateInstanceError: (error: unknown) => boolean;
+/**
 * Build an HTTP handler that starts a durable agent run from a verified inbound
 * webhook. The channel is detected from the signature headers; EACH eligible
 * target is verified against ITS OWN secret before its mapper is offered the
@@ -63,4 +71,4 @@ type InboundChannelHandler = (request: Request, env: Record<string, unknown>) =>
 * @experimental
 */
 declare const dispatchAgentChannel: (targets: ReadonlyArray<AgentChannelTarget>) => InboundChannelHandler;
-export { type AgentChannelTarget, type InboundChannelHandler, dispatchAgentChannel, verifyDiscord, verifyGithub, verifySlack };
+export { type AgentChannelTarget, type InboundChannelHandler, dispatchAgentChannel, isDuplicateInstanceError, verifyDiscord, verifyGithub, verifySlack };

package/dist/channels.d.ts

@@ -52,6 +52,14 @@ interface AgentChannelTarget {
 */
 type InboundChannelHandler = (request: Request, env: Record<string, unknown>) => Promise<Response>;
 /**
+* Whether a `workflow.create()` rejection is a duplicate-instance-id error — the
+* idempotency signal — as opposed to a transient/config failure (Workflows
+* service error, instance-creation quota, bad params). Only the former may be
+* acked; every other failure MUST surface so the handler returns non-2xx and the
+* provider redelivers, rather than silently dropping the event.
+*/
+declare const isDuplicateInstanceError: (error: unknown) => boolean;
+/**
 * Build an HTTP handler that starts a durable agent run from a verified inbound
 * webhook. The channel is detected from the signature headers; EACH eligible
 * target is verified against ITS OWN secret before its mapper is offered the
@@ -63,4 +71,4 @@ type InboundChannelHandler = (request: Request, env: Record<string, unknown>) =>
 * @experimental
 */
 declare const dispatchAgentChannel: (targets: ReadonlyArray<AgentChannelTarget>) => InboundChannelHandler;
-export { type AgentChannelTarget, type InboundChannelHandler, dispatchAgentChannel, verifyDiscord, verifyGithub, verifySlack };
+export { type AgentChannelTarget, type InboundChannelHandler, dispatchAgentChannel, isDuplicateInstanceError, verifyDiscord, verifyGithub, verifySlack };

package/dist/channels.mjs

@@ -178,4 +178,4 @@ const dispatchAgentChannel = (targets) => async (request, env) => {
   return verifiedAny ? new Response(void 0, { status: 204 }) : new Response("Invalid signature", { status: 401 });
 };
 
-export { dispatchAgentChannel, verifyDiscord, verifyGithub, verifySlack };
+export { dispatchAgentChannel, isDuplicateInstanceError, verifyDiscord, verifyGithub, verifySlack };

package/dist/component.mjs

@@ -1,8 +1,8 @@
 import { LunoraError } from '@lunora/errors';
 import { defineTable, initLunora, defineSchemaExtension } from '@lunora/server';
 import { v } from '@lunora/values';
-import { a as asInternal, A as AGENT_EXTENSION_KEY, g as graphTables, d as definedColumns, b as graphComponent } from './packem_shared/graph-component-aoUwO-f0.mjs';
-export { n as normalizeEntityName } from './packem_shared/graph-component-aoUwO-f0.mjs';
+import { a as asInternal, A as AGENT_EXTENSION_KEY, g as graphTables, d as definedColumns, b as graphComponent } from './packem_shared/graph-component-Bbaxxymp.mjs';
+export { n as normalizeEntityName } from './packem_shared/graph-component-Bbaxxymp.mjs';
 export { sandboxComponent } from './packem_shared/sandboxComponent-DR3pTwBL.mjs';
 
 const EPISODES_TABLE = "agent_episodes";
@@ -179,7 +179,7 @@ const agentComponent = () => {
         throw new Error(`@lunora/agent: thread "${args.key}" belongs to another owner`);
       }
       const priorInstanceId = existing["instanceId"];
-      const isConcurrentRun = (existing["status"] === "running" || existing["status"] === "awaiting_input") && priorInstanceId !== void 0 && args.instanceId !== void 0 && priorInstanceId !== args.instanceId;
+      const isConcurrentRun = (existing["status"] === "running" || existing["status"] === "awaiting_input") && priorInstanceId !== void 0 && (args.instanceId === void 0 || args.instanceId !== priorInstanceId);
       if (isConcurrentRun) {
         const policy = args.onConcurrentRun ?? "reject";
         if (policy !== "replace") {
@@ -188,7 +188,12 @@ const agentComponent = () => {
             `@lunora/agent: thread "${args.key}" already has a run in flight (instance "${priorInstanceId}") — onConcurrentRun="${policy}"`
           );
         }
-        await context.db.patch(existing["_id"], { error: void 0, instanceId: args.instanceId, status: "running", updatedAt: now });
+        await context.db.patch(existing["_id"], {
+          error: void 0,
+          status: "running",
+          updatedAt: now,
+          ...args.instanceId === void 0 ? {} : { instanceId: args.instanceId }
+        });
         return { created: false, priorInstanceId, replaced: true };
       }
       await context.db.patch(existing["_id"], {
@@ -310,9 +315,11 @@ const agentComponent = () => {
     if (readableThread(thread, context.auth) === void 0) {
       return [];
     }
-    const rows = await context.db.query(MESSAGES_TABLE).withIndex("byThread", (q) => q.eq("threadKey", args.key)).collect();
-    const ordered = rows.toSorted((a, b) => a["seq"] - b["seq"]);
-    return args.limit === void 0 ? ordered : ordered.slice(Math.max(0, ordered.length - args.limit));
+    if (args.limit !== void 0) {
+      const tail = await context.db.query(MESSAGES_TABLE).withIndex("byThread", (q) => q.eq("threadKey", args.key)).order("desc").take(args.limit);
+      return tail.toReversed();
+    }
+    return context.db.query(MESSAGES_TABLE).withIndex("byThread", (q) => q.eq("threadKey", args.key)).collect();
   });
   const agentResolveApproval = mutation.input({
     decision: v.union(v.literal("approve"), v.literal("reject")),
@@ -326,6 +333,9 @@ const agentComponent = () => {
     if (readable === void 0) {
       throw new LunoraError("FORBIDDEN", `@lunora/agent: not allowed to resolve approvals on thread "${args.threadKey}"`);
     }
+    if (readable["instanceId"] !== args.instanceId) {
+      throw new LunoraError("FORBIDDEN", `@lunora/agent: instance "${args.instanceId}" does not own thread "${args.threadKey}"`);
+    }
     const agentName = readable["agent"];
     const { agents } = context;
     const handle = agents?.[agentName];
@@ -336,8 +346,9 @@ const agentComponent = () => {
       );
     }
     await handle.sendEvent(args.instanceId, {
-      payload: { decision: args.decision, ...args.note === void 0 ? {} : { note: args.note } },
-      type: "agent-approval"
+      payload: { decision: args.decision, toolCallId: args.toolCallId, ...args.note === void 0 ? {} : { note: args.note } },
+      // Scoped per tool call — see the doc comment above.
+      type: `agent-approval:${args.toolCallId}`
     });
     return { resolved: true };
   });

package/dist/index.mjs

@@ -1,10 +1,10 @@
-export { runAgentLoop, splitForCompaction } from './packem_shared/runAgentLoop-Dhg4ZNvw.mjs';
+export { runAgentLoop, splitForCompaction } from './packem_shared/runAgentLoop-B3Q2o-Uz.mjs';
 export { collectAgenticMemoryTools, toSearchResults } from './packem_shared/collectAgenticMemoryTools-QrzpV-WX.mjs';
-export { agentAsTool } from './packem_shared/agentAsTool-Dt8NlU6k.mjs';
+export { agentAsTool } from './packem_shared/agentAsTool-CUHlWsmt.mjs';
 export { codeTool } from './packem_shared/codeTool-CjgJOC9t.mjs';
 export { agentComponent, agentExtension } from './component.mjs';
 export { default as createAgentContext } from './packem_shared/createAgentContext-4xJGXNR4.mjs';
-export { defineAgent, defineAgentTool, isAgentDefinition } from './packem_shared/defineAgent-D6maSbVc.mjs';
+export { defineAgent, defineAgentTool, isAgentDefinition } from './packem_shared/defineAgent-DAwAZC9P.mjs';
 export { functionTool } from './packem_shared/functionTool-D6lCa2jB.mjs';
 export { createAgentGenerate, createEpisodeExtract, createGraphExtract, createStreamGenerate, resolveAgentModel } from './packem_shared/createAgentGenerate-BQv9YJ01.mjs';
 export { adaptMcpResult, mcpTools } from './packem_shared/adaptMcpResult-wtNMvLoP.mjs';
@@ -15,4 +15,4 @@ export { browserTool, containerTool, fsTool } from './sandbox.mjs';
 export { defineSkill, isSkillDefinition } from './packem_shared/defineSkill-Ctf_S-rz.mjs';
 export { default as VoiceSessionDO } from './packem_shared/VoiceSessionDO-DLoXsHGF.mjs';
 export { runVoiceTurn } from './packem_shared/runVoiceTurn-LnqLvCRR.mjs';
-export { default as compileAgentWorkflow } from './packem_shared/compileAgentWorkflow-BxJjHgtD.mjs';
+export { default as compileAgentWorkflow } from './packem_shared/compileAgentWorkflow-DX90058f.mjs';

package/dist/packem_shared/{agentAsTool-Dt8NlU6k.mjs → agentAsTool-CUHlWsmt.mjs}

@@ -1,5 +1,6 @@
 import { LunoraError } from '@lunora/errors';
 import { jsonSchema } from 'ai';
+import { isDuplicateInstanceError } from '../channels.mjs';
 import { agentBindingName } from '../naming.mjs';
 import { toFunctionReference, DEFAULT_AGENT_FUNCTION_PATHS } from './AGENT_MODULE-Dnt_-AAT.mjs';
 
@@ -64,7 +65,10 @@ const agentAsTool = (options) => {
     try {
       const handle = await binding.create({ id: childInstanceId, params });
       instance = await binding.get(handle.id);
-    } catch {
+    } catch (error) {
+      if (!isDuplicateInstanceError(error)) {
+        throw error;
+      }
       instance = await binding.get(childInstanceId);
     }
     const terminal = await pollUntilTerminal(instance, maxPolls, pollIntervalMs, wait);

package/dist/packem_shared/{compileAgentWorkflow-BxJjHgtD.mjs → compileAgentWorkflow-DX90058f.mjs}

@@ -1,5 +1,5 @@
 import { defineWorkflow } from '@lunora/workflow';
-import { runAgentLoop } from './runAgentLoop-Dhg4ZNvw.mjs';
+import { runAgentLoop } from './runAgentLoop-B3Q2o-Uz.mjs';
 import { createStreamGenerate, createAgentGenerate, createEpisodeExtract, createGraphExtract, createCompact } from './createAgentGenerate-BQv9YJ01.mjs';
 import { agentDefaultName } from '../naming.mjs';
 import { DEFAULT_AGENT_FUNCTION_PATHS } from './AGENT_MODULE-Dnt_-AAT.mjs';

package/dist/packem_shared/{defineAgent-D6maSbVc.mjs → defineAgent-DAwAZC9P.mjs}

@@ -1,6 +1,6 @@
 import { LunoraError } from '@lunora/errors';
 import { collectAgenticMemoryTools } from './collectAgenticMemoryTools-QrzpV-WX.mjs';
-import { agentAsTool } from './agentAsTool-Dt8NlU6k.mjs';
+import { agentAsTool } from './agentAsTool-CUHlWsmt.mjs';
 import { i as isInjectedMemorySource } from './memory-D4FPcBsX.mjs';
 import { SKILL_NAME_PATTERN, RESERVED_SKILL_NAME } from './defineSkill-Ctf_S-rz.mjs';
 

package/dist/packem_shared/{graph-component-aoUwO-f0.mjs → graph-component-Bbaxxymp.mjs}

@@ -34,7 +34,7 @@ const graphTables = {
     type: v.optional(v.string()),
     updatedAt: v.number(),
     weight: v.optional(v.number())
-  }).index("byOwnerName", ["owner", "name"], { unique: true }).public(),
+  }).index("byOwnerName", ["owner", "name"], { unique: true }).index("byOwnerUpdatedAt", ["owner", "updatedAt"]).public(),
   /**
    * Graph-memory edges — directed triples storing the normalized endpoint
    * NAMES (no join on write), owner-scoped like the nodes. `weight` is
@@ -57,6 +57,7 @@ const DEFAULT_GRAPH_DEPTH = 2;
 const DEFAULT_GRAPH_MAX_SEEDS = 4;
 const DEFAULT_GRAPH_FAN_OUT = 8;
 const DEFAULT_GRAPH_MAX_NODES = 32;
+const GRAPH_SEED_SCAN_CAP = 500;
 const WHITESPACE_RUN = /\s+/gu;
 const NON_WORD = /[^\p{L}\p{N}]+/u;
 const normalizeEntityName = (name) => name.trim().replaceAll(WHITESPACE_RUN, " ").toLowerCase();
@@ -186,7 +187,7 @@ const graphComponent = () => {
     if (tokens.length === 0) {
       return { context: "" };
     }
-    const ownerEntities = await context.db.query(ENTITIES_TABLE).withIndex("byOwnerName", (q) => q.eq("owner", args.owner)).collect();
+    const ownerEntities = await context.db.query(ENTITIES_TABLE).withIndex("byOwnerUpdatedAt", (q) => q.eq("owner", args.owner)).order("desc").take(GRAPH_SEED_SCAN_CAP);
     const seeds = ownerEntities.filter((row) => matchesSeed(row["name"], tokens)).toSorted(
       (a, b) => (b["weight"] ?? 1) - (a["weight"] ?? 1) || a["name"].localeCompare(b["name"])
     ).slice(0, args.maxSeeds ?? DEFAULT_GRAPH_MAX_SEEDS).map((row) => row["name"]);

package/dist/packem_shared/{normalizeEntityName-CyEEWFkR.mjs → normalizeEntityName-BouctxLC.mjs}

@@ -1,3 +1,3 @@
 import '@lunora/server';
 import '@lunora/values';
-export { b as graphComponent, g as graphTables, n as normalizeEntityName } from './graph-component-aoUwO-f0.mjs';
+export { b as graphComponent, g as graphTables, n as normalizeEntityName } from './graph-component-Bbaxxymp.mjs';

package/dist/packem_shared/{runAgentLoop-Dhg4ZNvw.mjs → runAgentLoop-B3Q2o-Uz.mjs}

@@ -63,7 +63,7 @@ const awaitApproval = async (turnContext, call) => {
     toolName: call.name
   });
   await patchThread({ status: "awaiting_input" });
-  const event = await step.waitForEvent(`approval:${call.id}`, { type: "agent-approval" });
+  const event = await step.waitForEvent(`approval:${call.id}`, { type: `agent-approval:${call.id}` });
   await patchThread({ status: "running" });
   return { decision: event.payload.decision, ...event.payload.note === void 0 ? {} : { note: event.payload.note } };
 };

package/dist/sandbox.d.mts

@@ -154,13 +154,17 @@ declare const browserTool: (options?: BrowserToolOptions) => AgentToolDefinition
 * the model picks via `op`. The call dispatches to the auto-registered
 * `sandbox:invoke` action, which carries `ctx.containers`.
 *
-* By default a `fetch` runs unattended while command execution is gated behind a
-* human approval — an `exec`, AND a `fetch` whose path resolves to the privileged
-* `/exec` route (both reach the same command-execution path in the container, so
-* gating on the `op` name alone would let a `fetch` to `/exec` run a command
-* unattended). Note a `fetch` can still reach any *other* container route
-* unattended, so scope the container's routes accordingly. Pass
-* `opts.needsApproval` to widen or disable the gate.
+* By default a read-only (GET/HEAD/OPTIONS, or method-omitted) `fetch` runs
+* unattended while everything else is gated behind a human approval — an
+* `exec`; a `fetch` whose path resolves to the privileged `/exec` route (both
+* reach the same command-execution path in the container, so gating on the
+* `op` name alone would let a `fetch` to `/exec` run a command unattended);
+* and a `fetch` using a non-idempotent method (POST/PUT/PATCH/DELETE) to ANY
+* route, since a prompt-injected model could otherwise mutate container state
+* through some other privileged route just by avoiding the literal `/exec`
+* path. A `fetch` can still reach any *other read* route unattended, so scope
+* the container's GET routes accordingly. Pass `opts.needsApproval` to widen
+* or disable the gate.
 *
 * ```ts
 * import { containerTool, defineAgent } from "@lunora/agent/sandbox";

package/dist/sandbox.d.ts

@@ -154,13 +154,17 @@ declare const browserTool: (options?: BrowserToolOptions) => AgentToolDefinition
 * the model picks via `op`. The call dispatches to the auto-registered
 * `sandbox:invoke` action, which carries `ctx.containers`.
 *
-* By default a `fetch` runs unattended while command execution is gated behind a
-* human approval — an `exec`, AND a `fetch` whose path resolves to the privileged
-* `/exec` route (both reach the same command-execution path in the container, so
-* gating on the `op` name alone would let a `fetch` to `/exec` run a command
-* unattended). Note a `fetch` can still reach any *other* container route
-* unattended, so scope the container's routes accordingly. Pass
-* `opts.needsApproval` to widen or disable the gate.
+* By default a read-only (GET/HEAD/OPTIONS, or method-omitted) `fetch` runs
+* unattended while everything else is gated behind a human approval — an
+* `exec`; a `fetch` whose path resolves to the privileged `/exec` route (both
+* reach the same command-execution path in the container, so gating on the
+* `op` name alone would let a `fetch` to `/exec` run a command unattended);
+* and a `fetch` using a non-idempotent method (POST/PUT/PATCH/DELETE) to ANY
+* route, since a prompt-injected model could otherwise mutate container state
+* through some other privileged route just by avoiding the literal `/exec`
+* path. A `fetch` can still reach any *other read* route unattended, so scope
+* the container's GET routes accordingly. Pass `opts.needsApproval` to widen
+* or disable the gate.
 *
 * ```ts
 * import { containerTool, defineAgent } from "@lunora/agent/sandbox";

package/dist/sandbox.mjs

@@ -44,11 +44,15 @@ const normalizeContainerPath = (path) => {
   }
   return `/${segments.join("/")}`;
 };
+const NON_IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
 const defaultContainerGate = (input) => {
   if (input.op === "exec") {
     return true;
   }
-  return normalizeContainerPath(input.path) === CONTAINER_EXEC_ROUTE;
+  if (normalizeContainerPath(input.path) === CONTAINER_EXEC_ROUTE) {
+    return true;
+  }
+  return NON_IDEMPOTENT_METHODS.has((input.method ?? "GET").toUpperCase());
 };
 const CONTAINER_TOOL_SCHEMA = jsonSchema({
   properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/agent",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.4",
   "description": "Durable AI agents for Lunora: defineAgent compiles a replay-safe tool-loop onto Cloudflare Workflows, with DO SQLite threads and live message subscriptions",
   "keywords": [
     "agent",
@@ -76,10 +76,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/ai": "1.0.0-alpha.15",
+    "@lunora/ai": "1.0.0-alpha.16",
     "@lunora/errors": "1.0.0-alpha.5",
     "@lunora/mail": "1.0.0-alpha.15",
-    "@lunora/server": "1.0.0-alpha.25",
+    "@lunora/server": "1.0.0-alpha.27",
     "@lunora/values": "1.0.0-alpha.8",
     "@lunora/workflow": "1.0.0-alpha.10",
     "@modelcontextprotocol/sdk": "^1.29.0",