@meistrari/agent-core 0.1.12 → 0.2.0-experimental.0

package/docs/credential-isolation-loopback-2026-09-14.md

@@ -0,0 +1,30 @@
+# Credential isolation: resident supervisor loopback
+
+This regression exercises the shared worker-to-supervisor transport on the
+0.1.13 source line. It does not change provider behavior or package contracts.
+
+The loopback supplies independently generated synthetic credentials for initial
+bootstrap, reconnect rotation, process-restart bootstrap, Git authentication and
+reverse credential RPC. Assertions verify that the provider factory receives the
+initial credential, the existing provider receives the rotated credential, and
+the recovered supervisor receives the replacement credential. Successful reconnect
+also verifies that changing these secrets does not change immutable binding identity.
+
+The test scans every file in its isolated supervisor state directory while SQLite
+is open (including WAL), after shutdown, and after restart/shutdown. It scans
+captured trace-level logger output, durable/ephemeral event records, readiness
+snapshots and failure records. Literal, base64 and hex representations must be
+absent. RPC completion emits only a boolean receipt, never the returned credential.
+
+The observed run passed 188 assertions. Synthetic values are generated only in
+memory. Only the test-owned temporary directory is cleaned afterward; no live
+sandbox, workspace, validation database or production resource is touched.
+
+## Limits
+
+This uses a scripted provider and an in-memory worker control plane. It is not
+proof for native Codex persistence, Postgres staging, Vault uploads, reusable E2B
+snapshots, arbitrary provider error messages, or encoded/exfiltrated tool output.
+Those gates require their own evidence. The separate native-Codex canary test
+and live credential-expiry resume evidence supplement, rather than replace, it.
+No release publication or admission enablement is part of this regression.

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@meistrari/agent-core",
     "type": "module",
-    "version": "0.1.12",
+    "version": "0.2.0-experimental.0",
     "packageManager": "bun@1.3.12",
     "description": "Shared contracts and runtime modules for Tela coding-agent sandboxes: agent protocol, supervisor wire protocol, resident supervisor, worker runtime client, and Claude/Codex harness adapters.",
     "license": "UNLICENSED",

package/src/agents/model-rebinding-run.ts

@@ -19,6 +19,7 @@ export class ModelRebindingRun implements AgentRun {
     private workspacePrepared = false
     private workspaceChanging = false
     private readonly lifetime = new AbortController()
+    private readonly controls = new Set<Promise<unknown>>()
 
     constructor(run: AgentRun, private readonly reopen: (model: string, signal: AbortSignal) => Promise<AgentRun>, private readonly rootAdded?: (root: string) => void) {
         this.run = run
@@ -41,11 +42,11 @@ export class ModelRebindingRun implements AgentRun {
         })
     }
 
-    respondUserInput: AgentRun['respondUserInput'] = async (command, options) => await this.run.respondUserInput(command, options)
-    interrupt: AgentRun['interrupt'] = async (command, options) => await this.run.interrupt(command, options)
+    respondUserInput: AgentRun['respondUserInput'] = async (command, options) => await this.withControl(signal => this.run.respondUserInput(command, { ...options, signal }), options)
+    interrupt: AgentRun['interrupt'] = async (command, options) => await this.withControl(signal => this.run.interrupt(command, { ...options, signal }), options)
 
     async sendPrompt(command: SendPromptCommand, options: AgentOperationOptions = {}): Promise<AgentPromptAcceptance> {
-        if (this.dispatching || this.workspaceChanging)
+        if (this.dispatching || this.workspaceChanging || this.controls.size)
             throw new AgentPromptDeferredError({ message: 'A prompt admission is already in progress.' })
         const task = this.dispatchPrompt(command, options)
         this.dispatching = task
@@ -112,6 +113,7 @@ export class ModelRebindingRun implements AgentRun {
             throw new AgentRunStateError({ message: 'Stop does not target the bound run.' })
         this.stopped = true
         this.lifetime.abort()
+        await Promise.allSettled([...this.controls])
         await this.run.stop(command, options)
         await this.dispatching?.catch(() => undefined)
         await this.pump
@@ -122,6 +124,23 @@ export class ModelRebindingRun implements AgentRun {
         return { provider: this.metadata.provider, sessionId: this.metadata.sessionId, providerSessionId: this.metadata.providerSessionId }
     }
 
+    private async withControl<T>(operation: (signal: AbortSignal) => Promise<T>, options: AgentOperationOptions = {}): Promise<T> {
+        if (this.stopped)
+            throw new AgentRunStateError({ message: 'The run stopped.' })
+        if (this.changing || this.needsRebind)
+            throw new AgentPromptDeferredError({ message: 'The provider model is being rebound.' })
+        const signal = AbortSignal.any([this.lifetime.signal, ...(options.signal ? [options.signal] : [])])
+        const task = Promise.resolve().then(async () => {
+            signal.throwIfAborted()
+            return await operation(signal)
+        })
+        this.controls.add(task)
+        try {
+            return await task
+        }
+        finally { this.controls.delete(task) }
+    }
+
     private async withWorkspaceChange(operation: () => Promise<void>): Promise<void> {
         if (this.stopped)
             throw new AgentRunStateError({ message: 'The run stopped.' })

package/src/provenance.gen.ts

@@ -1,6 +1,6 @@
 // Generated by scripts/write-provenance.ts. Do not edit by hand.
 export const generatedProvenance = {
-    version: "0.1.12",
-    sha: "5ae702eaa6828a3f52fd17ae64587ec3908a205d",
-    buildTime: "2026-09-14T18:55:01.358Z",
+    version: "0.2.0-experimental.0",
+    sha: "da33c4f2db2875602c75e8ad3fde2d01d8ea7a94",
+    buildTime: "2026-09-22T18:15:52.470Z",
 } as const