@matatbread/matbot-core 0.4.19 → 0.4.20

package/package.json

@@ -4,7 +4,7 @@
     "node",
     "browser"
   ],
-  "version": "0.4.19",
+  "version": "0.4.20",
   "engines": {
     "node": ">=24.0.0"
   },
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@matatbread/matbot-plugin-api": "^0.4.19"
+    "@matatbread/matbot-plugin-api": "^0.4.20"
   },
   "devDependencies": {
     "typescript": "^6.0.3"

package/src/assemble.ts

@@ -69,8 +69,6 @@ export interface AssembleOptions {
   providers:        ProviderRegistryImpl;
   gate:             HostGate;
   defaultSettings?: ReadonlyMap<string, Readonly<Record<string, unknown>>> | undefined;
-  /** Registry values present from boot, which an unregister reverts to rather than deleting. */
-  seed?:            Partial<MatbotServices>;
   builtinTools?:    Tool[];
   /** Resolve one `${NAME}` reference; the browser prompts for a missing secret. Defaults to the vault. */
   resolveSecret?(ref: string, vault: Vault): Promise<string>;
@@ -183,6 +181,9 @@ export function assembleMachine(opts: AssembleOptions): AssembledMachine {
   // registers its own (forwarding to its parent) over it — and unloading that reverts to refusing, which
   // is the honest answer for a job with no channel. Late-bound, as `services` is built below. It writes
   // through the shared runner, the one writer of the sessions in `services.sessions`.
+  // Not a host-supplied set: an embedder with a service of its own registers it on the returned
+  // `services` before `loaded()`, which is the same moment and one mechanism rather than two. A `seed`
+  // option existed for the node `FunctionRunner`, and went with it when that became a plugin.
   const seed: Partial<MatbotServices> = {
     MediaStore:      fileStore,
     SessionAppender: createSessionAppender({
@@ -191,7 +192,6 @@ export function assembleMachine(opts: AssembleOptions): AssembledMachine {
       notifier:   () => services.Notifier,
       isSubAgent: () => services.isSubAgent(),
     }),
-    ...opts.seed,
   };
   const serviceRegistry = new Map<string, unknown>(Object.entries(seed));
   // The validator lookup is late-bound and read per call: one is registered by a plugin long after the

package/src/config/loader.ts

@@ -21,12 +21,6 @@ export interface MatbotConfig {
    * config rather than data. A stored value always wins; `delete` reverts to the default here.
    */
   defaultSettings?:  ReadonlyMap<string, Readonly<Record<string, unknown>>>;
-  /**
-   * Longest a `tool_function` body may run synchronously — without awaiting — before it is stopped
-   * (`function_timeout_ms`). Absent ⇒ the host's default. `0` ⇒ no limit at all, for testing: bodies run
-   * directly, and a loop that never awaits freezes the process.
-   */
-  functionTimeoutMs?: number;
 }
 
 function asString(v: YamlValue | undefined, label: string): string {
@@ -144,17 +138,6 @@ export function parseConfig(
     }
   }
 
-  const functionTimeoutRaw = doc['function_timeout_ms'];
-  let functionTimeoutMs: number | undefined;
-  if (functionTimeoutRaw !== undefined && functionTimeoutRaw !== null) {
-    functionTimeoutMs = asNumber(functionTimeoutRaw, 'function_timeout_ms');
-    // Refused rather than clamped, like maxRounds: a negative or fractional limit is a typo, and `0` already
-    // means something of its own.
-    if (!Number.isInteger(functionTimeoutMs) || functionTimeoutMs < 0) {
-      throw new Error(`Config: "function_timeout_ms" must be a non-negative integer (milliseconds; 0 removes the limit), got ${functionTimeoutMs}`);
-    }
-  }
-
   const prompt           = typeof doc['prompt']            === 'string' ? doc['prompt']            : undefined;
   const ephemeral        = doc['ephemeral'] === true ? true : undefined;
   const defaultProvider  = typeof doc['default_provider'] === 'string' ? doc['default_provider']  : undefined;
@@ -168,7 +151,6 @@ export function parseConfig(
     ...(defaultProvider  !== undefined ? { defaultProvider  } : {}),
     ...(principal        !== undefined ? { principal        } : {}),
     ...(defaultSettings.size > 0       ? { defaultSettings  } : {}),
-    ...(functionTimeoutMs !== undefined ? { functionTimeoutMs } : {}),
   };
 }
 

package/src/index.ts

@@ -18,12 +18,12 @@ export type {
   MissingSecretError, IncompatibleRuntimeError, NotAPluginError, PromptCancelledError, ReadOnlyError,
   MediaRejectedError, InvalidSecretNameError, MatbotErrorKind,
 } from '@matatbread/matbot-plugin-api';
-export { applyCreateSecret, assertStorableKey, unreferenceableKey, REFERENCEABLE_KEY_RULE } from '@matatbread/matbot-plugin-api';
+export { applyResolve, applyCreateSecret, assertStorableKey, unreferenceableKey, REFERENCEABLE_KEY_RULE } from '@matatbread/matbot-plugin-api';
 // The `provider update` patch policy, alongside the vault's: written once in plugin-api so the hosts
 // that apply one cannot differ on what a patch MEANS, and re-exported here so an app needs no direct
 // plugin-api dependency to get it.
 export { applyProviderPatch, patchedFields } from '@matatbread/matbot-plugin-api';
-export { isTruncatedToolResult, notifyingStore, ItemChangeKind, RegistryChangeKind, SessionAppendKind, FUNCTION_TIMEOUT } from '@matatbread/matbot-plugin-api';
+export { isTruncatedToolResult, notifyingStore, ItemChangeKind, RegistryChangeKind, SessionAppendKind, FUNCTION_TIMEOUT, permitted, refused, refusalMessage } from '@matatbread/matbot-plugin-api';
 // The canonical `type: 'confirm'` answers. Same reason as the patch policy above: an app implementing a
 // PromptFn (or a test standing one in) has to speak them, and must not hard-code the rendered label.
 export { CONFIRM_YES, CONFIRM_NO } from '@matatbread/matbot-plugin-api';

package/src/registry.ts

@@ -60,7 +60,7 @@ async function resolveToolCollision(
 ): Promise<boolean> {
   const owner = existingOwner !== undefined ? `"${existingOwner}"` : 'a built-in';
   const label = `Tool \`"${toolName}"\` is already registered by **${owner}**. Overwrite it with the one from **"${incomingOwner}"**?`;
-  const allowed = await (services.PermissionGate ?? askPermissionGate).decide({
+  const decision = await (services.PermissionGate ?? askPermissionGate).decide({
     gate:     'tools.overwrite',
     subject:  toolName,
     // The incoming OWNER rides in the label rather than in a field of its own: a single `subject`
@@ -73,9 +73,10 @@ async function resolveToolCollision(
   // changed hands" is exactly the report this line answers. A policy that overwrites after ASKING
   // needs no warning — the user just saw the question.
   if (prompt === undefined) {
-    console.warn(`[matbot] ${label} — non-interactive, ${allowed ? 'overwriting' : 'keeping the existing tool'}.`);
+    console.warn(`[matbot] ${label} — non-interactive (${decision.source}), `
+      + `${decision.allowed ? 'overwriting' : 'keeping the existing tool'}.`);
   }
-  return allowed;
+  return decision.allowed;
 }
 
 // ── Version check ─────────────────────────────────────────────────────────────

package/src/runner.ts

@@ -192,6 +192,7 @@ export async function* runSession(opts: RunSessionOpts): AsyncIterable<TurnEvent
     async createSecret() { throw new Error('No vault configured'); },
     async writeSecret()  { throw new Error('No vault configured'); },
     hasKey() { return false; },
+    async readSecret() { return undefined; },
     async resolve(ref: string) { return ref; },
     scrub(text: string) { return text; },
   };
@@ -449,6 +450,9 @@ export async function* runSession(opts: RunSessionOpts): AsyncIterable<TurnEvent
           case 'thinking':
             yield { type: 'thinking', delta: ev.delta, traceId };
             break;
+          case 'progress':
+            yield { type: 'progress', pct: ev.pct, ...(ev.message !== undefined ? { message: ev.message } : {}), traceId };
+            break;
           case 'thinking-block':
             assistantParts.push({ type: 'thinking', thinking: ev.thinking, signature: ev.signature });
             break;
@@ -668,7 +672,7 @@ export async function* runSession(opts: RunSessionOpts): AsyncIterable<TurnEvent
         // default, so a gate handed it could never tell "no human is reachable" from "a human answered
         // with the default" — and would get the fallback back one layer too late to reason about.
         // `ToolContext.prompt` keeps the stand-in exactly as before; only the gate sees the truth.
-        ...bindGate(opts.permissionGate, tc.name, opts.prompt),
+        ...bindGate(opts.permissionGate, tool, opts.prompt, opts.toolRegistry ?? { resolve: n => tools.get(n) ?? null }),
         ...(opts.workdir     !== undefined ? { workdir:     opts.workdir     } : {}),
         ...(opts.configPath  !== undefined ? { configPath:  opts.configPath  } : {}),
         ...(opts.files       !== undefined ? { files:       opts.files       } : {}),

package/src/security/vault.ts

@@ -1,7 +1,6 @@
 import type { Vault } from '@matatbread/matbot-plugin-api';
-import { missingSecretError, applyCreateSecret, assertStorableKey, unreferenceableKey } from '@matatbread/matbot-plugin-api';
+import { applyResolve, applyCreateSecret, assertStorableKey, unreferenceableKey } from '@matatbread/matbot-plugin-api';
 
-const REF_RE = /\$\{([^}]+)\}/g;
 
 /**
  * Default vault implementation: a single flat namespace of secrets keyed by name.
@@ -58,19 +57,12 @@ export class VaultImpl implements Vault {
     return undefined;
   }
 
-  async resolve(ref: string): Promise<string> {
-    const errors: string[] = [];
-
-    const result = ref.replace(REF_RE, (_, name: string) => {
-      const value = this.store.get(name);
-      if (value === undefined) { errors.push(name); return ''; }
-      return value;
-    });
+  async readSecret(name: string): Promise<string | undefined> {
+    return this.store.get(name);
+  }
 
-    if (errors.length > 0) {
-      throw missingSecretError(errors);
-    }
-    return result;
+  resolve(ref: string): Promise<string> {
+    return applyResolve(this, ref);
   }
 
   scrub(text: string): string {