@minionry/minion 0.7.36 → 0.7.39

package/dist/server/services/sdk/files-workspace.js

@@ -2,11 +2,14 @@
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
 import { readdirSync, realpathSync, statSync } from 'node:fs';
 import { basename, resolve, sep } from 'node:path';
-import { createDirectory, deleteFile, listDirectory, renameFile, writeFile } from '../files.js';
+import { validatePathWithinRoots } from '../file-explorer-ops.js';
+import { createDirectory, deleteFile, listDirectory, renameFile } from '../files.js';
+import { containsDangerousPatterns } from '../pathUtils.js';
 import { SPACE_DIRNAME, SPACE_LAYOUT } from '../space-layout.js';
 import { readFileContent } from '../websocket/file-utils.js';
+import { parseExpectedModifiedAt, writeFileAtomic } from './atomic-write.js';
 import { notifyFileChangedAbsolute } from './file-change-notify.js';
-import { FILES_APP_MAX_WRITE_BYTES, filesDeleteHandler, filesListHandler, filesMkdirHandler, filesReadEntryHandler, filesReadHandler, filesRenameHandler, filesWriteHandler, } from './files-app.js';
+import { FILES_APP_MAX_WRITE_BYTES, filesDeleteHandler, filesListHandler, filesMkdirHandler, filesReadEntryHandler, filesReadHandler, filesRenameHandler, filesWriteHandler, readEntryResult, } from './files-app.js';
 import { SdkMethodError } from './registry.js';
 import { resolveWithinRoot } from './sandbox.js';
 export const WORKSPACE_PATH_PREFIX = 'workspace:';
@@ -45,7 +48,7 @@ function inSpaceAppArea(segments) {
     }
     return false;
 }
-export function guardWorkspacePath(workingDir, rel) {
+export function guardWorkspacePath(workingDir, rel, opts) {
     let realWorkingDir;
     try {
         realWorkingDir = realpathSync(resolve(workingDir));
@@ -53,7 +56,7 @@ export function guardWorkspacePath(workingDir, rel) {
     catch (error) {
         throw new SdkMethodError('INTERNAL', `Space working directory unavailable: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const guarded = resolveWithinRoot(realWorkingDir, rel);
+    const guarded = resolveWithinRoot(realWorkingDir, rel, opts);
     if (!guarded.valid) {
         throw new SdkMethodError('SCOPE_DENIED', 'Access denied: path escapes the Space workspace');
     }
@@ -127,6 +130,17 @@ export function filesReadRoutedHandler(args) {
         throw serviceError(result.error);
     return result.content;
 }
+function refuseLikeWriteFile(resolvedPath, realWorkingDir) {
+    if (containsDangerousPatterns(resolvedPath)) {
+        console.error(`[FileService] SECURITY: Dangerous pattern in path: "${resolvedPath}"`);
+        throw serviceError('Invalid path: contains dangerous patterns');
+    }
+    const validation = validatePathWithinRoots(resolvedPath, realWorkingDir, []);
+    if (!validation.valid)
+        throw serviceError(validation.error);
+    if (statOrUndefined(resolvedPath)?.isDirectory())
+        throw serviceError('Cannot write to a directory');
+}
 export function filesWriteRoutedHandler(args) {
     const target = parseWorkspacePath(args.params);
     if (target === null)
@@ -135,14 +149,21 @@ export function filesWriteRoutedHandler(args) {
     if (typeof raw.content !== 'string') {
         throw new SdkMethodError('BAD_REQUEST', `${args.method} requires params { path, content } with string content`);
     }
+    const expectedModifiedAt = parseExpectedModifiedAt(raw, args.method);
     const bytes = Buffer.byteLength(raw.content, 'utf-8');
     if (bytes > FILES_APP_MAX_WRITE_BYTES) {
         throw new SdkMethodError('BAD_REQUEST', `content is ${bytes} bytes — exceeds the ${FILES_APP_MAX_WRITE_BYTES}-byte per-file files.write cap`);
     }
     const { realWorkingDir, resolvedPath } = guardWorkspacePath(args.workingDir, target.rel);
-    const result = writeFile(resolvedPath, raw.content, realWorkingDir);
-    if (!result.success)
-        throw serviceError(result.error);
+    refuseLikeWriteFile(resolvedPath, realWorkingDir);
+    try {
+        writeFileAtomic({ target: resolvedPath, content: raw.content, expectedModifiedAt, displayPath: target.original });
+    }
+    catch (error) {
+        if (error instanceof SdkMethodError)
+            throw error;
+        throw serviceError(error instanceof Error ? error.message : undefined);
+    }
     notifyFileChangedAbsolute(args.spaceKey, resolvedPath, 'changed');
     return null;
 }
@@ -182,9 +203,7 @@ export function filesReadEntryRoutedHandler(args) {
     const result = readFileContent(resolvedPath, realWorkingDir);
     if (result.error)
         throw serviceError(result.error);
-    return result.isImage
-        ? { kind: 'binary', content: result.content, mimeType: result.mimeType ?? 'application/octet-stream' }
-        : { kind: 'text', content: result.content };
+    return readEntryResult(result, stat);
 }
 export function filesMkdirRoutedHandler(args) {
     const target = parseWorkspacePath(args.params);
@@ -194,6 +213,7 @@ export function filesMkdirRoutedHandler(args) {
     const result = createDirectory(resolvedPath, realWorkingDir);
     if (!result.success)
         throw serviceError(result.error);
+    notifyFileChangedAbsolute(args.spaceKey, resolvedPath, 'created', { dir: true });
     return null;
 }
 export function filesRenameRoutedHandler(args) {
@@ -216,6 +236,10 @@ export function filesRenameRoutedHandler(args) {
     const result = renameFile(resolvedOld, resolvedNew, realWorkingDir);
     if (!result.success)
         throw serviceError(result.error);
+    notifyFileChangedAbsolute(args.spaceKey, resolvedOld, 'renamed', {
+        newPath: resolvedNew,
+        dir: statOrUndefined(resolvedNew)?.isDirectory(),
+    });
     return null;
 }
 export function filesDeleteRoutedHandler(args) {
@@ -223,11 +247,13 @@ export function filesDeleteRoutedHandler(args) {
     if (target === null)
         return filesDeleteHandler(args);
     const { realWorkingDir, resolvedPath } = guardWorkspacePath(args.workingDir, target.rel);
-    if (!statOrUndefined(resolvedPath))
+    const stat = statOrUndefined(resolvedPath);
+    if (!stat)
         throw notFound(target.original);
     refuseAppAreaTree(resolvedPath);
     const result = deleteFile(resolvedPath, realWorkingDir);
     if (!result.success)
         throw serviceError(result.error);
+    notifyFileChangedAbsolute(args.spaceKey, resolvedPath, 'deleted', { dir: stat.isDirectory() });
     return null;
 }

package/dist/server/services/sdk/inference-claude.js

@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { buildSpawnEnv, resolveClaudeEffort } from '../../cli/headless/claude-invoker-process.js';
 import { classifyEngineNotice, isSyntheticModel } from '../../cli/headless/engine-notice.js';
-import { resolveClaudeCommand } from '../../engines/claude/claude-command.js';
+import { resolveClaudeCommand, TOOL_LESS_CLAUDE_ARGS } from '../../engines/claude/claude-command.js';
 import { resolveModelProfile } from '../../engines/credentials/model-profiles.js';
 import { SdkInferenceError, } from './inference.js';
 const DEFAULT_SYSTEM_PROMPT = 'You are a helpful assistant.';
@@ -36,7 +36,9 @@ export function buildClaudeInferenceArgs(exec) {
     const effort = resolveClaudeEffort(exec.model, exec.effortLevel ?? 'auto', true);
     if (effort)
         args.push('--effort', effort);
-    args.push('--tools', '', '--strict-mcp-config', '--no-session-persistence', '--system-prompt', exec.system?.trim() ? exec.system : DEFAULT_SYSTEM_PROMPT);
+    if (exec.fastMode)
+        args.push('--settings', JSON.stringify({ fastMode: true }));
+    args.push(...TOOL_LESS_CLAUDE_ARGS, '--no-session-persistence', '--system-prompt', exec.system?.trim() ? exec.system : DEFAULT_SYSTEM_PROMPT);
     return args;
 }
 function parseStreamLine(line) {

package/dist/server/services/sdk/inference.js

@@ -79,7 +79,7 @@ function settleRun(record, result) {
 }
 function paramsObject(params) {
     if (typeof params !== 'object' || params === null || Array.isArray(params)) {
-        throw new SdkMethodError('BAD_REQUEST', 'inference.chat requires params { messages, system?, engine?, model?, effortLevel? }');
+        throw new SdkMethodError('BAD_REQUEST', 'inference.chat requires params { messages, system?, engine?, model?, effortLevel?, fastMode? }');
     }
     return params;
 }
@@ -122,6 +122,17 @@ function parseEffortLevel(raw, engine) {
     }
     return raw;
 }
+function parseFastMode(raw, engine) {
+    if (raw === undefined)
+        return false;
+    if (typeof raw !== 'boolean') {
+        throw new SdkMethodError('BAD_REQUEST', 'inference.chat fastMode must be a boolean');
+    }
+    if (raw && engine !== 'claude-code') {
+        throw new SdkMethodError('BAD_REQUEST', `inference.chat: fastMode is a claude-code setting — ${engine} has no fast mode`);
+    }
+    return raw;
+}
 export function inferenceBouncerInput(params) {
     const raw = typeof params === 'object' && params !== null && !Array.isArray(params) ? params : {};
     const messages = Array.isArray(raw.messages) ? raw.messages : [];
@@ -133,6 +144,7 @@ export function inferenceBouncerInput(params) {
         engine: typeof raw.engine === 'string' ? raw.engine : 'default',
         model: typeof raw.model === 'string' ? raw.model : 'default',
         effortLevel: typeof raw.effortLevel === 'string' ? raw.effortLevel : 'auto',
+        ...(raw.fastMode === true ? { fastMode: true } : {}),
         messages: messages.length,
         chars: contentChars + (typeof raw.system === 'string' ? raw.system.length : 0),
     };
@@ -145,6 +157,7 @@ export function inferenceChatHandler(args) {
     const messages = parseMessages(raw.messages);
     const system = parseSystem(raw.system);
     const { engine, model } = resolveAutomationTarget(raw.engine, raw.model, 'inference.chat');
+    const fastMode = parseFastMode(raw.fastMode, engine);
     const executor = executors[engine];
     if (!executor) {
         throw new SdkMethodError('UNSUPPORTED', `inference.chat: ${engine} cannot run a tool-less completion on this host — choose one of ${inferenceEngines().join(', ') || '(none)'}`);
@@ -186,7 +199,7 @@ export function inferenceChatHandler(args) {
         decision: 'allow',
         requestId: args.requestId,
         spaceKey: args.spaceKey,
-        reason: `run ${runId} engine=${engine} model=${model ?? 'default'} effort=${effortLevel ?? 'auto'} messages=${messages.length} [tool-less]`,
+        reason: `run ${runId} engine=${engine} model=${model ?? 'default'} effort=${effortLevel ?? 'auto'}${fastMode ? ' fastMode' : ''} messages=${messages.length} [tool-less]`,
     });
     setImmediate(() => {
         if (record.outcome)
@@ -207,6 +220,7 @@ export function inferenceChatHandler(args) {
             engine,
             ...(model ? { model } : {}),
             ...(effortLevel ? { effortLevel } : {}),
+            ...(fastMode ? { fastMode } : {}),
             ...(system !== undefined ? { system } : {}),
             messages,
             signal: record.controller.signal,

package/dist/server/services/sdk/pm-schedule.js

@@ -1,8 +1,11 @@
 // Copyright (c) 2025-present Minionry, Inc.
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { basename } from 'node:path';
 import { resolvePmDir } from '../plan/parser.js';
-import { cleanupScheduleSource, isValidTiming, parseUpdatePatch, resolveCreateSource } from '../schedule/schedule-wire.js';
+import { cleanupScheduleSource, isValidTiming, parseMaxLatenessMs, parseUpdatePatch, resolveCreateSource } from '../schedule/schedule-wire.js';
+import { scaffoldPmDirectory } from '../websocket/plan-helpers.js';
 import { logAppAudit } from './audit.js';
+import { guardWorkspacePath, WORKSPACE_PATH_PREFIX } from './files-workspace.js';
 import { parseBoardRunInput } from './pm.js';
 import { SdkMethodError } from './registry.js';
 function toScheduleSnapshot(record) {
@@ -21,6 +24,8 @@ function toScheduleSnapshot(record) {
         snapshot.input = record.input;
     if (record.lastFire !== undefined)
         snapshot.lastFire = { ...record.lastFire };
+    if (record.maxLatenessMs !== undefined)
+        snapshot.maxLatenessMs = record.maxLatenessMs;
     return snapshot;
 }
 let scheduleHost = null;
@@ -51,19 +56,41 @@ function parseScheduleIdParams(params, method) {
 function scheduleNotFound(scheduleId) {
     return new SdkMethodError('BAD_REQUEST', `schedule '${scheduleId}' not found in this Space`);
 }
-function parseCreateParams(params) {
-    const raw = paramsObject(params);
-    const rawSource = paramsObject(raw.source);
-    if (rawSource.kind !== 'template-json' || typeof rawSource.content !== 'string' || rawSource.content === '') {
-        throw new SdkMethodError('BAD_REQUEST', "pm.schedules.create requires params { source: { kind: 'template-json', content }, timing } — board-zip and path-addressed sources are not supported over the SDK");
+function resolveBoardZipPathParam(workingDir, raw, method) {
+    if (typeof raw !== 'string' || !raw.startsWith(WORKSPACE_PATH_PREFIX)) {
+        throw new SdkMethodError('BAD_REQUEST', `${method}: a board-zip source.path must be a workspace-rooted path ('${WORKSPACE_PATH_PREFIX}/<path>')`);
+    }
+    const rel = raw.slice(WORKSPACE_PATH_PREFIX.length).replace(/^\/+/, '');
+    if (rel === '' || rel.split('/').some((segment) => segment === '..')) {
+        throw new SdkMethodError('BAD_REQUEST', `${method}: source.path '${raw}' must not contain a '..' segment`);
+    }
+    return guardWorkspacePath(workingDir, rel).resolvedPath;
+}
+function parseCreateSourceParam(rawSource, workingDir, method) {
+    const source = paramsObject(rawSource);
+    if (source.kind === 'template-json') {
+        if (typeof source.content !== 'string' || source.content === '') {
+            throw new SdkMethodError('BAD_REQUEST', `${method} requires params.source.content for a 'template-json' source`);
+        }
+        return { kind: 'template-json', content: source.content };
     }
+    if (source.kind === 'board-zip') {
+        return { kind: 'board-zip', path: resolveBoardZipPathParam(workingDir, source.path, method) };
+    }
+    throw new SdkMethodError('BAD_REQUEST', `${method} requires params.source of kind 'template-json' (with content) or 'board-zip' (with a workspace:-rooted path)`);
+}
+export function resolvePmSchedulesCreateScopes(params) {
+    const raw = paramsObject(params);
+    const source = paramsObject(raw.source);
+    return source.kind === 'board-zip' ? ['pm:schedule', 'files:workspace:read'] : ['pm:schedule'];
+}
+function parseCreateParams(args) {
+    const raw = paramsObject(args.params);
+    const source = parseCreateSourceParam(raw.source, args.workingDir, args.method);
     if (!isValidTiming(raw.timing)) {
         throw new SdkMethodError('BAD_REQUEST', 'pm.schedules.create requires a valid params.timing');
     }
-    const parsed = {
-        source: { kind: 'template-json', content: rawSource.content },
-        timing: raw.timing,
-    };
+    const parsed = { source, timing: raw.timing };
     if (typeof raw.name === 'string')
         parsed.name = raw.name;
     if (raw.enabled !== undefined) {
@@ -73,6 +100,12 @@ function parseCreateParams(params) {
     }
     if (raw.input !== undefined)
         parsed.input = parseBoardRunInput(raw.input, 'pm.schedules.create');
+    const maxLateness = parseMaxLatenessMs(raw.maxLatenessMs);
+    if (!maxLateness.ok) {
+        throw new SdkMethodError('BAD_REQUEST', 'pm.schedules.create: maxLatenessMs must be an integer >= the schedule minimum');
+    }
+    if (maxLateness.value !== undefined)
+        parsed.maxLatenessMs = maxLateness.value;
     return parsed;
 }
 function parseUpdateParams(params) {
@@ -99,10 +132,14 @@ export function pmSchedulesListHandler(args) {
 }
 export function pmSchedulesCreateHandler(args) {
     const host = requireScheduleHost(args.method);
-    const { name, source, timing, input, enabled } = parseCreateParams(args.params);
-    const pmDir = resolvePmDir(args.workingDir);
+    const { name, source, timing, input, enabled, maxLatenessMs } = parseCreateParams(args);
+    let pmDir = resolvePmDir(args.workingDir);
+    if (!pmDir) {
+        scaffoldPmDirectory(args.workingDir, basename(args.workingDir) || 'My Project');
+        pmDir = resolvePmDir(args.workingDir);
+    }
     if (!pmDir) {
-        throw new SdkMethodError('BAD_REQUEST', 'pm.schedules.create: no PM directory in this Space yet — create a board first');
+        throw new SdkMethodError('INTERNAL', 'pm.schedules.create: failed to initialize the Space PM directory');
     }
     let resolved;
     try {
@@ -113,9 +150,9 @@ export function pmSchedulesCreateHandler(args) {
     }
     const store = host.getStore(args.workingDir);
     if (!store) {
-        throw new SdkMethodError('BAD_REQUEST', 'pm.schedules.create: no PM directory in this Space yet — create a board first');
+        throw new SdkMethodError('INTERNAL', 'pm.schedules.create: PM directory initialization did not take effect');
     }
-    const record = store.create({ name, source: resolved.source, input, timing, enabled });
+    const record = store.create({ name, source: resolved.source, input, timing, enabled, maxLatenessMs });
     host.notifyAndBroadcast(args.workingDir);
     logAppAudit({
         appId: args.appId,
@@ -163,3 +200,23 @@ export function pmSchedulesDeleteHandler(args) {
     });
     return null;
 }
+export function pmSchedulesRunNowHandler(args) {
+    const host = requireScheduleHost(args.method);
+    const scheduleId = parseScheduleIdParams(args.params, args.method);
+    const result = host.fireNow(args.workingDir, scheduleId);
+    if (result.kind === 'not-found')
+        throw scheduleNotFound(scheduleId);
+    if (result.kind === 'disabled') {
+        throw new SdkMethodError('BAD_REQUEST', `schedule '${scheduleId}' is disabled — enable it before running it now`);
+    }
+    logAppAudit({
+        appId: args.appId,
+        origin: args.origin,
+        method: 'pm.schedules.runNow.fired',
+        decision: 'allow',
+        requestId: args.requestId,
+        spaceKey: args.spaceKey,
+        reason: `schedule ${scheduleId} fired on demand`,
+    });
+    return toScheduleSnapshot(result.record);
+}

package/dist/server/services/sdk/pm.js

@@ -265,6 +265,27 @@ function issueNotFound(boardId, issueId) {
 function badRequest(message) {
     return new SdkMethodError('BAD_REQUEST', message);
 }
+function assertReviewGateNotBypassed(args, issue, fields) {
+    if (issue.reviewGate !== 'required' || fields.status === undefined)
+        return;
+    const completesGate = fields.status === 'done';
+    const parked = issue.status === 'awaiting_approval';
+    if (!completesGate && !parked)
+        return;
+    const reason = completesGate
+        ? `${issue.id} is review_gate: required — an app cannot set it to done; approval is only possible from the Specs view`
+        : `${issue.id} is awaiting approval — its status can only be changed from the Specs view`;
+    logAppAudit({
+        appId: args.appId,
+        origin: args.origin,
+        method: 'pm.updateIssue.blocked',
+        decision: 'deny',
+        requestId: args.requestId,
+        spaceKey: args.spaceKey,
+        reason,
+    });
+    throw badRequest(reason);
+}
 function assertYamlSafe(value, field, method, listItem = false) {
     if (/[\r\n]/.test(value))
         throw badRequest(`${method} ${field} must not contain line breaks`);
@@ -589,6 +610,7 @@ export function pmUpdateIssueHandler(args) {
     const issue = full.issues.find((candidate) => candidate.id === issueId);
     if (!issue)
         throw issueNotFound(boardId, issueId);
+    assertReviewGateNotBypassed(args, issue, fields);
     const fullPath = resolvePlanPath(args.workingDir, issue.path);
     if (!fullPath || !existsSync(fullPath))
         throw issueNotFound(boardId, issueId);

package/dist/server/services/sdk/rate-limits.js

@@ -10,6 +10,8 @@ export const REQUEST_BUCKET_REFILL_PER_SECOND = 15;
 export const AI_ASSIST_BUCKET_CAPACITY = 3;
 export const AI_ASSIST_REFILL_PER_SECOND = 1 / 30;
 export const DEFAULT_INFERENCE_CONCURRENCY = 2;
+export const CHAIN_WRITE_BUCKET_CAPACITY = 10;
+export const CHAIN_WRITE_REFILL_PER_SECOND = 1 / 6;
 function ledgerKey(appId, spaceKey) {
     return `${appId}\u0000${spaceKey}`;
 }
@@ -20,12 +22,14 @@ const pendingStarts = new Map();
 const pendingInferenceStarts = new Map();
 const requestBuckets = new Map();
 const aiAssistBuckets = new Map();
+const chainWriteBuckets = new Map();
 const sessionUsage = new Map();
 export function resetSdkRateLimitState() {
     pendingStarts.clear();
     pendingInferenceStarts.clear();
     requestBuckets.clear();
     aiAssistBuckets.clear();
+    chainWriteBuckets.clear();
     sessionUsage.clear();
 }
 function intKnob(value, fallback) {
@@ -79,6 +83,25 @@ function throttleAiAssist(appId, nowMs) {
     bucket.tokens -= 1;
     return false;
 }
+function throttleChainWrite(appId, nowMs) {
+    let bucket = chainWriteBuckets.get(appId);
+    if (!bucket) {
+        bucket = { tokens: CHAIN_WRITE_BUCKET_CAPACITY, lastRefillMs: nowMs };
+        chainWriteBuckets.set(appId, bucket);
+    }
+    const elapsedMs = Math.max(0, nowMs - bucket.lastRefillMs);
+    bucket.tokens = Math.min(CHAIN_WRITE_BUCKET_CAPACITY, bucket.tokens + (elapsedMs / 1000) * CHAIN_WRITE_REFILL_PER_SECOND);
+    bucket.lastRefillMs = nowMs;
+    if (bucket.tokens < 1)
+        return true;
+    bucket.tokens -= 1;
+    return false;
+}
+export const CHAIN_WRITE_METHODS = new Set([
+    'pm.chains.create',
+    'pm.chains.update',
+    'pm.chains.delete',
+]);
 const ENGINE_RUN_METHODS = new Set([
     'agents.run',
     'browser.automate',
@@ -183,6 +206,15 @@ export function checkSdkRateLimit(op, now = Date.now) {
         }
         return null;
     }
+    if (CHAIN_WRITE_METHODS.has(op.method)) {
+        if (throttleChainWrite(op.appId, now())) {
+            return {
+                limited: true,
+                message: `pm.chains write rate limit reached (burst ${CHAIN_WRITE_BUCKET_CAPACITY}, then one every 6s); retry shortly`,
+            };
+        }
+        return null;
+    }
     if (throttleRequest(op.appId, now())) {
         return {
             limited: true,

package/dist/server/services/sdk/registry.js

@@ -1,6 +1,7 @@
 // Copyright (c) 2025-present Minionry, Inc.
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
 import { createHash } from 'node:crypto';
+import { agentSchedulesCreateHandler, agentSchedulesDeleteHandler, agentSchedulesListHandler, agentSchedulesRunNowHandler, agentSchedulesUpdateHandler, resolveAgentSchedulesScopes, } from './agent-schedule.js';
 import { agentsSessionsAnswerQuestionHandler, agentsSessionsApproveHandler, agentsSessionsAttachHandler, agentsSessionsCloseHandler, agentsSessionsCreateHandler, agentsSessionsHistoryHandler, agentsSessionsListHandler, agentsSessionsPromptHandler, agentsSessionsRenameHandler, agentsSessionsReplayHandler, agentsSessionsStopHandler, } from './agent-sessions.js';
 import { agentsResultHandler, agentsRunAdmit, agentsRunBouncerInput, agentsRunHandler, resolveAgentsRunScopes, sdkCancelHandler, } from './agents.js';
 import { toolsRegisterHandler, toolsResultHandler } from './app-tools.js';
@@ -16,8 +17,9 @@ import { auditRecentHandler, listGrantsHandler } from './host-ops.js';
 import { inferenceBouncerInput, inferenceChatHandler, inferenceResultHandler } from './inference.js';
 import { getLiveSubscriptionsForApp } from './live-registry.js';
 import { pmCreateBoardHandler, pmCreateIssueHandler, pmDeleteIssueHandler, pmGetBoardHandler, pmListBoardsHandler, pmOnBoardUpdateHandler, pmUpdateBoardHandler, pmUpdateIssueHandler, } from './pm.js';
+import { pmChainsCreateHandler, pmChainsDeleteHandler, pmChainsListHandler, pmChainsUpdateHandler, } from './pm-chain.js';
 import { pmExecuteHandler, pmPauseHandler, pmResumeHandler, pmStopHandler } from './pm-execute.js';
-import { pmSchedulesCreateHandler, pmSchedulesDeleteHandler, pmSchedulesListHandler, pmSchedulesUpdateHandler, } from './pm-schedule.js';
+import { pmSchedulesCreateHandler, pmSchedulesDeleteHandler, pmSchedulesListHandler, pmSchedulesRunNowHandler, pmSchedulesUpdateHandler, resolvePmSchedulesCreateScopes, } from './pm-schedule.js';
 import { qualityCancelHandler, qualityDetectToolsHandler, qualityInstallToolsHandler, qualityResultHandler, qualityRunHandler, qualitySaveDirectoriesHandler, qualitySetFindingStateHandler, qualitySetSettingsHandler, qualitySettingsHandler, qualityStateHandler, qualitySubscribeChangesHandler, } from './quality.js';
 import { qualitySchedulesCreateHandler, qualitySchedulesDeleteHandler, qualitySchedulesListHandler, qualitySchedulesUpdateHandler, } from './quality-schedule.js';
 import { dropSubscription, revokeGrantsHandler } from './revoke.js';
@@ -29,6 +31,7 @@ export const SDK_WRITE_CAPABILITY = {
     sdkPmWrite: 'editPlan',
     sdkPmExecute: 'editPlan',
     sdkPmSchedule: 'editPlan',
+    sdkPmChain: 'editPlan',
     sdkFilesWrite: 'editFiles',
     sdkStorageWrite: 'editFiles',
     sdkCancel: 'execute',
@@ -85,7 +88,17 @@ function sdkFeaturesHandler() {
         'agentsAppEndpoint',
         'qualityFindingState',
         'agentsModelSelection',
+        'filesChangeKinds',
+        'filesWatch',
+        'filesConditionalWrite',
+        'inferenceFastMode',
         'qualitySchedules',
+        'pmChains',
+        'agentsEngineSelection',
+        'agentSchedules',
+        'scheduleWallClock',
+        'pmScheduleZip',
+        'pmScheduleRunNow',
     ];
 }
 function notificationsUnsupportedHandler() {
@@ -264,6 +277,8 @@ export const SDK_METHOD_REGISTRY = {
     'pm.listBoards': { scopes: ['pm:read'], type: 'sdkRequest', handler: pmListBoardsHandler },
     'pm.subscribeBoard': { scopes: ['pm:read'], type: 'sdkRequest', handler: pmOnBoardUpdateHandler },
     'pm.schedules.list': { scopes: ['pm:schedule'], type: 'sdkRequest', handler: pmSchedulesListHandler },
+    'pm.chains.list': { scopes: ['pm:chain'], type: 'sdkRequest', handler: pmChainsListHandler },
+    'agents.schedules.list': { scopes: ['agents:schedule'], type: 'sdkRequest', handler: agentSchedulesListHandler },
     'agents.result': { scopes: ['agents:run'], type: 'sdkRequest', handler: agentsResultHandler },
     'inference.result': { scopes: ['inference:run'], type: 'sdkRequest', handler: inferenceResultHandler },
     'endpoints.list': { scopes: ['endpoints:register'], type: 'sdkRequest', handler: endpointsListHandler },
@@ -367,9 +382,18 @@ export const SDK_METHOD_REGISTRY = {
     'pm.pause': { scopes: ['pm:execute'], type: 'sdkPmExecute', handler: pmPauseHandler },
     'pm.resume': { scopes: ['pm:execute'], type: 'sdkPmExecute', handler: pmResumeHandler },
     'pm.stop': { scopes: ['pm:execute'], type: 'sdkPmExecute', handler: pmStopHandler },
-    'pm.schedules.create': { scopes: ['pm:schedule'], type: 'sdkPmSchedule', handler: pmSchedulesCreateHandler },
+    'pm.schedules.create': {
+        scopes: ['pm:schedule'],
+        resolveScopes: resolvePmSchedulesCreateScopes,
+        type: 'sdkPmSchedule',
+        handler: pmSchedulesCreateHandler,
+    },
     'pm.schedules.update': { scopes: ['pm:schedule'], type: 'sdkPmSchedule', handler: pmSchedulesUpdateHandler },
     'pm.schedules.delete': { scopes: ['pm:schedule'], type: 'sdkPmSchedule', handler: pmSchedulesDeleteHandler },
+    'pm.schedules.runNow': { scopes: ['pm:schedule'], type: 'sdkPmSchedule', handler: pmSchedulesRunNowHandler },
+    'pm.chains.create': { scopes: ['pm:chain'], type: 'sdkPmChain', handler: pmChainsCreateHandler },
+    'pm.chains.update': { scopes: ['pm:chain'], type: 'sdkPmChain', handler: pmChainsUpdateHandler },
+    'pm.chains.delete': { scopes: ['pm:chain'], type: 'sdkPmChain', handler: pmChainsDeleteHandler },
     'files.write': {
         scopes: ['files:app'],
         resolveScopes: resolveFilesWriteScopes,
@@ -415,6 +439,20 @@ export const SDK_METHOD_REGISTRY = {
     },
     'agents.sessions.prompt': { scopes: ['agents:sessions'], type: 'sdkAgentInteract', handler: agentsSessionsPromptHandler },
     'agents.sessions.stop': { scopes: ['agents:sessions'], type: 'sdkAgentInteract', handler: agentsSessionsStopHandler },
+    'agents.schedules.create': {
+        scopes: ['agents:schedule'],
+        resolveScopes: resolveAgentSchedulesScopes,
+        type: 'sdkAgentSession',
+        handler: agentSchedulesCreateHandler,
+    },
+    'agents.schedules.update': {
+        scopes: ['agents:schedule'],
+        resolveScopes: resolveAgentSchedulesScopes,
+        type: 'sdkAgentSession',
+        handler: agentSchedulesUpdateHandler,
+    },
+    'agents.schedules.delete': { scopes: ['agents:schedule'], type: 'sdkAgentSession', handler: agentSchedulesDeleteHandler },
+    'agents.schedules.runNow': { scopes: ['agents:schedule'], type: 'sdkAgentSession', handler: agentSchedulesRunNowHandler },
     'git.stage': { scopes: ['git:write'], type: 'sdkGitWrite', handler: gitStageHandler, bouncerToolName: 'git_stage' },
     'git.unstage': { scopes: ['git:write'], type: 'sdkGitWrite', handler: gitUnstageHandler, bouncerToolName: 'git_unstage' },
     'git.commit': { scopes: ['git:write'], type: 'sdkGitWrite', handler: gitCommitHandler, bouncerToolName: 'git_commit' },

package/dist/server/services/sdk/terminal.js

@@ -149,7 +149,7 @@ export async function terminalOpenHandler(args) {
             origin: args.origin,
             spaceKey: args.spaceKey,
             kind: 'terminal.open',
-            viewerId: getGrant(args.appId, args.spaceKey) ? undefined : args.viewerId,
+            viewerId: args.viewerId,
             teardown: () => {
                 unsubscribeRoster();
                 if (isSdkOpenedTerminalId(opened.id))

package/dist/server/services/sentry.js

@@ -4,6 +4,8 @@ import { existsSync, readFileSync } from 'node:fs';
 import { createStackParser, createTransport, initAndBind, nodeStackLineParser, ServerRuntimeClient, captureException as sentryCaptureException, captureMessage as sentryCaptureMessage, flush as sentryFlush, } from '@sentry/core';
 import { machineFile } from '../../bin/machine-layout.js';
 import { resolvePlatformUrl } from './platform-url.js';
+import { relayHttp } from './relay-http-client.js';
+const CONFIG_FETCH_BUDGET_MS = 5_000;
 const SENTRY_TUNNEL_DSN = 'https://tunnel@sentry.io/0';
 const PLATFORM_URL = resolvePlatformUrl();
 let initialized = false;
@@ -27,7 +29,9 @@ function isTelemetryEnabled() {
 }
 async function fetchSentryEnabled() {
     try {
-        const response = await fetch(`${PLATFORM_URL}/api/config/client`);
+        const response = await relayHttp.fetch(`${PLATFORM_URL}/api/config/client`, undefined, {
+            budgetMs: CONFIG_FETCH_BUDGET_MS,
+        });
         if (!response.ok)
             return false;
         const data = await response.json();