@myagentroam/node 0.1.8 → 0.9.2

package/dist/service/mcp-installation-verifier.js

@@ -0,0 +1,87 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+const INSTALL_TIMEOUT_MS = 90_000;
+export class McpInstallationVerifier {
+    async verify(input) {
+        const client = new Client({ name: 'myagentroam-node-installer', version: '0.9.1' });
+        try {
+            await withTimeout((async () => {
+                if (input.entry.runtime.transport === 'STDIO') {
+                    await client.connect(new StdioClientTransport({
+                        command: input.entry.runtime.command,
+                        args: [...input.entry.runtime.args, ...(input.configuration.arguments ?? [])],
+                        env: {
+                            ...getDefaultEnvironment(),
+                            ...resolveReferences(input.entry.runtime.environment, input.secrets),
+                            ...resolveReferences(input.configuration.environment, input.secrets)
+                        },
+                        cwd: input.cwd,
+                        stderr: 'pipe'
+                    }));
+                }
+                else {
+                    await client.connect(new StreamableHTTPClientTransport(new URL(input.entry.runtime.url), {
+                        requestInit: {
+                            headers: {
+                                ...resolveReferences(input.entry.runtime.headers, input.secrets),
+                                ...resolveReferences(input.configuration.headers, input.secrets)
+                            }
+                        }
+                    }));
+                }
+                const tools = await client.listTools();
+                if (tools.tools.length === 0)
+                    throw new Error('MCP_TOOLS_UNAVAILABLE');
+            })());
+        }
+        catch (error) {
+            throw installError(error);
+        }
+        finally {
+            await Promise.race([client.close().catch(() => undefined), delay(2_000)]);
+        }
+    }
+}
+function resolveReferences(references, secrets) {
+    const result = {};
+    for (const [name, reference] of Object.entries(references ?? {})) {
+        const value = secrets[reference.secretName];
+        if (value === undefined)
+            throw new Error('MCP_SECRET_MISSING');
+        result[name] = value;
+    }
+    return result;
+}
+async function withTimeout(operation) {
+    let timer;
+    try {
+        await Promise.race([
+            operation,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error('MCP_INSTALL_TIMEOUT')), INSTALL_TIMEOUT_MS);
+            })
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+function installError(error) {
+    const message = error instanceof Error ? error.message : '';
+    if (message === 'MCP_INSTALL_TIMEOUT' ||
+        message === 'MCP_SECRET_MISSING' ||
+        message === 'MCP_TOOLS_UNAVAILABLE')
+        return new Error(message);
+    if (/401|403|unauthorized|forbidden/iu.test(message))
+        return new Error('MCP_AUTH_FAILED');
+    if (/ENOENT|spawn/iu.test(message))
+        return new Error('MCP_COMMAND_UNAVAILABLE');
+    if (/fetch|connect|network|ECONN|ENOTFOUND/iu.test(message))
+        return new Error('MCP_CONNECTION_FAILED');
+    return new Error('MCP_PROTOCOL_VALIDATION_FAILED');
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}

package/dist/service/mcp-node-operation-service.d.ts

@@ -0,0 +1,11 @@
+import type { NodeDatabase } from '../database.js';
+import { McpInstallationVerifier } from './mcp-installation-verifier.js';
+export declare class McpNodeOperationService {
+    private readonly requireDatabase;
+    private readonly verifier;
+    constructor(requireDatabase: () => NodeDatabase, verifier?: McpInstallationVerifier);
+    operations(): Readonly<Record<string, (data: unknown) => unknown>>;
+    private inspect;
+    private install;
+    private remove;
+}

package/dist/service/mcp-node-operation-service.js

@@ -0,0 +1,90 @@
+import { mcpCatalogEntrySchema, mcpInstallationInputSchema, mcpTargetInspectionSchema } from '@myagentroam/protocol';
+import { homedir } from 'node:os';
+import { McpInstallationVerifier } from './mcp-installation-verifier.js';
+export class McpNodeOperationService {
+    requireDatabase;
+    verifier;
+    constructor(requireDatabase, verifier = new McpInstallationVerifier()) {
+        this.requireDatabase = requireDatabase;
+        this.verifier = verifier;
+    }
+    operations() {
+        return {
+            'node.mcps.inspect': () => this.inspect('NODE', ''),
+            'node.mcps.install': (data) => this.install('NODE', '', data),
+            'node.mcps.remove': (data) => this.remove('NODE', '', data),
+            'workspace.mcps.inspect': (data) => this.inspect('WORKSPACE', workspaceId(data)),
+            'workspace.mcps.install': (data) => this.install('WORKSPACE', workspaceId(data), data),
+            'workspace.mcps.remove': (data) => this.remove('WORKSPACE', workspaceId(data), data)
+        };
+    }
+    inspect(targetKind, targetId) {
+        const database = this.requireDatabase();
+        const own = database.listMcpInstallations(targetKind, targetId);
+        const ownNames = new Set(own.map((installation) => installation.serverName));
+        const installations = [
+            ...(targetKind === 'WORKSPACE'
+                ? database
+                    .listMcpInstallations('NODE')
+                    .filter((installation) => !ownNames.has(installation.serverName))
+                : []),
+            ...own
+        ].map((installation) => ({
+            catalogEntryId: installation.catalogEntryId,
+            serverName: installation.serverName,
+            displayName: installation.displayName,
+            version: installation.version,
+            origin: installation.targetKind,
+            enabled: installation.enabled,
+            status: 'CURRENT',
+            installedAt: installation.installedAt
+        }));
+        return mcpTargetInspectionSchema.parse({ targetKind, installations });
+    }
+    async install(targetKind, targetId, raw) {
+        if (!isRecord(raw))
+            throw new Error('MCP_INSTALL_INPUT_INVALID');
+        const entry = mcpCatalogEntrySchema.parse(raw['entry']);
+        const input = mcpInstallationInputSchema.parse({
+            catalogEntryId: entry.id,
+            enabled: raw['enabled'] ?? true,
+            configuration: raw['configuration'] ?? {}
+        });
+        const database = this.requireDatabase();
+        const secretEnvironment = isRecord(raw['secretEnvironment'])
+            ? Object.fromEntries(Object.entries(raw['secretEnvironment']).filter((entry) => typeof entry[1] === 'string'))
+            : {};
+        const cwd = targetKind === 'WORKSPACE' ? database.getWorkspace(targetId)?.path : homedir();
+        if (cwd === undefined)
+            throw new Error('WORKSPACE_NOT_FOUND');
+        if (input.enabled)
+            await this.verifier.verify({
+                entry,
+                configuration: input.configuration,
+                secrets: secretEnvironment,
+                cwd
+            });
+        database.saveMcpInstallation({
+            targetKind,
+            ...(targetKind === 'WORKSPACE' ? { targetId } : {}),
+            entry,
+            enabled: input.enabled,
+            configuration: input.configuration
+        });
+        return this.inspect(targetKind, targetId);
+    }
+    remove(targetKind, targetId, raw) {
+        if (!isRecord(raw) || typeof raw['serverName'] !== 'string')
+            throw new Error('MCP_INSTALL_INPUT_INVALID');
+        this.requireDatabase().removeMcpInstallation(targetKind, targetId, raw['serverName']);
+        return this.inspect(targetKind, targetId);
+    }
+}
+function workspaceId(raw) {
+    if (!isRecord(raw) || typeof raw['workspaceId'] !== 'string' || raw['workspaceId'] === '')
+        throw new Error('WORKSPACE_INVALID');
+    return raw['workspaceId'];
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}

package/dist/service/mcp-package-installer.d.ts

@@ -0,0 +1,8 @@
+import type { McpCatalogEntry } from '@myagentroam/protocol';
+export declare class McpPackageInstaller {
+    private readonly dataDirectory;
+    constructor(dataDirectory: string | (() => string));
+    prepare(entry: McpCatalogEntry): Promise<McpCatalogEntry>;
+    private install;
+    private prepareRuntimeEnvironment;
+}

package/dist/service/mcp-package-installer.js

@@ -0,0 +1,136 @@
+import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { promisify } from 'node:util';
+const execute = promisify(execFile);
+const installs = new Map();
+export class McpPackageInstaller {
+    dataDirectory;
+    constructor(dataDirectory) {
+        this.dataDirectory = dataDirectory;
+    }
+    prepare(entry) {
+        if (entry.runtime.transport !== 'STDIO')
+            return Promise.resolve(entry);
+        const request = packageRequest(entry.runtime.command, entry.runtime.args);
+        if (request === undefined)
+            return Promise.resolve(entry);
+        const key = `${request.spec}\0${entry.serverName}`;
+        const active = installs.get(key);
+        if (active !== undefined)
+            return active;
+        const operation = this.install(entry, request).finally(() => installs.delete(key));
+        installs.set(key, operation);
+        return operation;
+    }
+    async install(entry, request) {
+        const dataDirectory = typeof this.dataDirectory === 'string' ? this.dataDirectory : this.dataDirectory();
+        if (entry.runtime.transport !== 'STDIO')
+            return entry;
+        const runtimeEnvironment = entry.runtime.environment;
+        const digest = createHash('sha256').update(request.spec).digest('hex');
+        const root = resolve(dataDirectory, 'mcp-packages', digest);
+        const metadataPath = resolve(root, 'installation.json');
+        let executable = await installedExecutable(metadataPath, request.spec);
+        if (executable === undefined) {
+            const staging = `${root}.install-${randomUUID()}`;
+            await mkdir(dirname(root), { recursive: true, mode: 0o700 });
+            try {
+                await mkdir(staging, { recursive: true, mode: 0o700 });
+                await runNpmInstall(staging, request.spec);
+                executable = await resolvePackageExecutable(staging, request.spec);
+                await writeFile(resolve(staging, 'installation.json'), `${JSON.stringify({ spec: request.spec, executable: executable.slice(staging.length) })}\n`, { mode: 0o600 });
+                await rm(root, { recursive: true, force: true });
+                await rename(staging, root);
+                executable = resolve(root, `.${executable.slice(staging.length)}`);
+            }
+            catch (error) {
+                await rm(staging, { recursive: true, force: true });
+                throw packageError(error);
+            }
+        }
+        const prefixArgs = await this.prepareRuntimeEnvironment(entry.serverName, root, dataDirectory);
+        return {
+            ...entry,
+            runtime: {
+                transport: 'STDIO',
+                command: process.execPath,
+                args: [...prefixArgs, executable, ...request.serverArgs],
+                ...(runtimeEnvironment === undefined ? {} : { environment: runtimeEnvironment })
+            }
+        };
+    }
+    async prepareRuntimeEnvironment(serverName, packageRoot, dataDirectory) {
+        if (serverName !== 'io.github.microsoft/playwright-mcp')
+            return [];
+        const browserRoot = resolve(dataDirectory, 'mcp-browsers', 'playwright');
+        await mkdir(browserRoot, { recursive: true, mode: 0o700 });
+        const preload = resolve(packageRoot, 'playwright-environment.cjs');
+        await writeFile(preload, `process.env.PLAYWRIGHT_BROWSERS_PATH = ${JSON.stringify(browserRoot)};\n`, { mode: 0o600 });
+        const playwright = resolve(packageRoot, 'node_modules', 'playwright', 'cli.js');
+        await run(process.execPath, [playwright, 'install', 'chromium'], {
+            PLAYWRIGHT_BROWSERS_PATH: browserRoot
+        });
+        const modulePath = resolve(packageRoot, 'node_modules', 'playwright');
+        await run(process.execPath, [
+            '-e',
+            `const {chromium}=require(${JSON.stringify(modulePath)});chromium.launch({headless:true}).then(b=>b.close())`
+        ], { PLAYWRIGHT_BROWSERS_PATH: browserRoot });
+        return ['--require', preload];
+    }
+}
+function packageRequest(command, args) {
+    if (command !== 'npx')
+        return undefined;
+    const index = args.findIndex((argument) => !argument.startsWith('-'));
+    const spec = index < 0 ? '' : args[index];
+    if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+@\d[0-9A-Za-z.+-]*$/u.test(spec))
+        throw new Error('MCP_PACKAGE_SPEC_INVALID');
+    return { spec, serverArgs: args.slice(index + 1) };
+}
+async function runNpmInstall(root, spec) {
+    await run(process.platform === 'win32' ? 'npm.cmd' : 'npm', [
+        'install',
+        '--prefix',
+        root,
+        '--no-save',
+        '--package-lock=false',
+        '--ignore-scripts',
+        spec
+    ]);
+}
+async function run(command, args, environment = {}) {
+    await execute(command, [...args], {
+        env: { ...process.env, ...environment },
+        timeout: 300_000,
+        maxBuffer: 1024 * 1024,
+        ...(process.platform === 'win32' && command.endsWith('.cmd') ? { shell: true } : {})
+    });
+}
+async function resolvePackageExecutable(root, spec) {
+    const packageName = spec.slice(0, spec.lastIndexOf('@'));
+    const packageRoot = resolve(root, 'node_modules', ...packageName.split('/'));
+    const manifest = JSON.parse(await readFile(resolve(packageRoot, 'package.json'), 'utf8'));
+    const candidates = typeof manifest.bin === 'string' ? [manifest.bin] : Object.values(manifest.bin ?? {});
+    if (candidates.length !== 1)
+        throw new Error('MCP_PACKAGE_EXECUTABLE_INVALID');
+    return resolve(packageRoot, candidates[0]);
+}
+async function installedExecutable(metadataPath, spec) {
+    try {
+        const metadata = JSON.parse(await readFile(metadataPath, 'utf8'));
+        if (metadata['spec'] !== spec || typeof metadata['executable'] !== 'string')
+            return undefined;
+        return resolve(dirname(metadataPath), `.${metadata['executable']}`);
+    }
+    catch {
+        return undefined;
+    }
+}
+function packageError(error) {
+    const message = error instanceof Error ? error.message : '';
+    if (message.startsWith('MCP_'))
+        return new Error(message);
+    return new Error('MCP_PACKAGE_INSTALL_FAILED');
+}

package/dist/service/native-session-watch-service.d.ts

@@ -8,6 +8,7 @@ export interface NativeSessionWatchOptions<TPage extends {
     readonly refreshActivity: (session: NodeAgentSession) => Promise<void>;
     readonly present: (session: NodeAgentSession) => unknown;
     readonly readPage: (session: NodeAgentSession, limit: number) => Promise<TPage>;
+    readonly projectInitialPage?: (session: NodeAgentSession, page: TPage, unit: 'SEGMENT', limit: number) => unknown;
     readonly emitSession: (session: unknown) => void;
     readonly emitTurn: (turn: unknown) => void;
 }

package/dist/service/native-session-watch-service.js

@@ -15,7 +15,12 @@ export class NativeSessionWatchService {
         };
     }
     async executeWatch(input) {
-        if (typeof input.sessionId !== 'string' || (input.mode !== 'initial' && input.mode !== 'renew'))
+        const projectInitialPage = this.options.projectInitialPage;
+        if (input.unit === 'SEGMENT' && projectInitialPage === undefined)
+            throw new Error('SESSION_INVALID');
+        if (typeof input.sessionId !== 'string' ||
+            (input.mode !== 'initial' && input.mode !== 'renew') ||
+            (input.unit !== undefined && input.unit !== 'SEGMENT'))
             throw new Error('SESSION_INVALID');
         const session = await this.options.resolve(input.sessionId);
         if (session === undefined || session.externalSessionId === null)
@@ -27,9 +32,21 @@ export class NativeSessionWatchService {
             return { renewed: true };
         }
         const watch = this.watch(session);
-        const snapshot = watch === undefined ? undefined : await this.refresh(session.id, INITIAL_TURN_LIMIT);
-        if (watch !== undefined && snapshot === undefined)
+        const turnSnapshot = watch === undefined ? undefined : await this.refresh(session.id, INITIAL_TURN_LIMIT);
+        if (watch !== undefined && turnSnapshot === undefined) {
+            this.stop(session.id);
             throw new Error('NATIVE_TRANSCRIPT_UNAVAILABLE');
+        }
+        let snapshot = turnSnapshot;
+        if (turnSnapshot !== undefined && input.unit === 'SEGMENT') {
+            try {
+                snapshot = projectInitialPage(session, turnSnapshot, 'SEGMENT', 10);
+            }
+            catch (error) {
+                this.stop(session.id);
+                throw error;
+            }
+        }
         return {
             session: this.options.present(session),
             watch: watch === undefined ? null : { expiresAt: watch.expiresAt },
@@ -131,7 +148,7 @@ export class NativeSessionWatchService {
             }
             const page = await this.options.readPage(session, limit);
             watch.failures = 0;
-            const turns = page.turns.length <= 10 ? page.turns : page.turns.slice(0, 10);
+            const turns = page.turns.length <= 10 ? page.turns : page.turns.slice(-10);
             const signature = JSON.stringify(turns);
             if (signature === watch.signature)
                 return page;

package/dist/service/node-request-service.js

@@ -1,5 +1,6 @@
 import { nodeLog } from '../operational.js';
 import { validUserAuthorization } from '../runner/codex/conversation-parser.js';
+import { safeErrorCode } from '../util/safe-error.js';
 /** Validates and executes the closed Admin-facing Node operation envelope. */
 export class NodeRequestService {
     options;
@@ -44,7 +45,7 @@ export class NodeRequestService {
                 durationMs: Math.round(performance.now() - startedAt),
                 error: error instanceof Error ? error.message : 'INTERNAL_ERROR'
             });
-            this.options.send('node.response', { error: error instanceof Error ? error.message : 'INTERNAL_ERROR' }, envelope.id);
+            this.options.send('node.response', { error: safeErrorCode(error, 'INTERNAL_ERROR') }, envelope.id);
         }
     }
 }

package/dist/service/run-attachment-service.d.ts

@@ -11,14 +11,15 @@ export interface NativeImageSource {
     readonly name: string;
     readonly mime: string;
     readonly path: string;
+    readonly root: string;
 }
 export type RunnerImageAttachment = NodeMessageAttachmentInput & {
     readonly mime: 'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp';
 };
 export declare class RunAttachmentService {
-    private readonly nativeImageRoot;
+    private readonly nativeImageRoots;
     readonly state: AttachmentDomainState<CachedRunImages, NativeImageSource>;
-    constructor(nativeImageRoot: (session: NodeAgentSession) => string | undefined);
+    constructor(nativeImageRoots: (session: NodeAgentSession) => readonly string[]);
     materializeCodex(runId: string, attachments: readonly RunnerImageAttachment[]): Promise<readonly Extract<CodexComposerInput, {
         readonly type: 'localImage';
     }>[]>;

package/dist/service/run-attachment-service.js

@@ -1,14 +1,14 @@
 import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve } from 'node:path';
-import { lstat, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises';
 import { AttachmentDomainState } from './attachment-domain-state.js';
 const MAX_ATTACHMENT_BYTES = 5 * 1024 * 1024;
 const IMAGE_CACHE_TTL_MS = 60 * 60_000;
 export class RunAttachmentService {
-    nativeImageRoot;
+    nativeImageRoots;
     state = new AttachmentDomainState();
-    constructor(nativeImageRoot) {
-        this.nativeImageRoot = nativeImageRoot;
+    constructor(nativeImageRoots) {
+        this.nativeImageRoots = nativeImageRoots;
     }
     async materializeCodex(runId, attachments) {
         if (attachments.length === 0)
@@ -95,8 +95,8 @@ export class RunAttachmentService {
         return cached.images[imageIndex];
     }
     registerNative(session, images) {
-        const root = this.nativeImageRoot(session);
-        if (root === undefined)
+        const roots = this.nativeImageRoots(session).map((root) => resolve(root));
+        if (roots.length === 0)
             return [];
         const runId = `native-history:${session.id}`;
         const sources = this.state.nativeHistoryImages.get(runId) ?? [];
@@ -107,15 +107,18 @@ export class RunAttachmentService {
                 continue;
             }
             const path = resolve(image.localPath);
-            const relation = relative(root, path);
-            if (relation.length === 0 || relation.startsWith('..') || isAbsolute(relation)) {
+            const root = roots.find((candidate) => {
+                const relation = relative(candidate, path);
+                return relation.length > 0 && !relation.startsWith('..') && !isAbsolute(relation);
+            });
+            if (root === undefined) {
                 attachments.push({ name: image.name, mime: image.mime });
                 continue;
             }
             let imageIndex = sources.findIndex((source) => source.path === path);
             if (imageIndex < 0) {
                 imageIndex = sources.length;
-                sources.push({ name: image.name, mime: image.mime, path });
+                sources.push({ name: image.name, mime: image.mime, path, root });
             }
             attachments.push({ name: image.name, mime: image.mime, runId, imageIndex });
         }
@@ -128,10 +131,17 @@ export class RunAttachmentService {
         if (source === undefined)
             return undefined;
         try {
-            const info = await lstat(source.path);
+            const [actualRoot, actualPath] = await Promise.all([
+                realpath(source.root),
+                realpath(source.path)
+            ]);
+            const relation = relative(actualRoot, actualPath);
+            if (relation.length === 0 || relation.startsWith('..') || isAbsolute(relation))
+                return undefined;
+            const info = await lstat(actualPath);
             if (!info.isFile() || info.size <= 0 || info.size > MAX_ATTACHMENT_BYTES)
                 return undefined;
-            return { ...source, dataBase64: (await readFile(source.path)).toString('base64') };
+            return { ...source, dataBase64: (await readFile(actualPath)).toString('base64') };
         }
         catch {
             return undefined;

package/dist/service/run-event-service.d.ts

@@ -25,6 +25,7 @@ export declare class RunEventService {
     constructor(options: RunEventServiceOptions);
     emit(runId: string, eventType: string, payload: unknown, status?: FakeRunnerStatus): void;
     clear(): void;
+    flushPendingText(runId: string): void;
     private enqueueText;
     private flushText;
     private emitNow;

package/dist/service/run-event-service.js

@@ -25,6 +25,9 @@ export class RunEventService {
             clearTimeout(pending.timer);
         this.pendingText.clear();
     }
+    flushPendingText(runId) {
+        this.flushText(runId);
+    }
     enqueueText(runId, text) {
         if (text.length === 0)
             return;
@@ -59,8 +62,9 @@ export class RunEventService {
             nodeLog('run.event', { runId, eventType, status });
         if (status === 'FAILED')
             this.options.metrics.runnerFailed();
+        let persisted = undefined;
         try {
-            this.options.runtime.appendRunEvent({
+            persisted = this.options.runtime.appendRunEvent({
                 runId,
                 sequence: event.sequence,
                 eventType,
@@ -84,7 +88,9 @@ export class RunEventService {
             if (session !== undefined)
                 this.options.emitWorkbench('session', { session: this.options.presentSession(session) });
         }
-        this.options.emitWorkbench('conversation', { event });
+        this.options.emitWorkbench('conversation', {
+            event: { ...event, createdAt: persisted?.createdAt ?? Date.now() }
+        });
         if (status === undefined || !isTerminalRunStatus(status))
             return;
         const turn = this.options.runtime.conversationTurnForRun(runId);

package/dist/service/runner-service.d.ts

@@ -17,6 +17,8 @@ export declare class RunnerService {
             id: string;
             label: string;
             supportedEfforts: string[];
+            isDefault?: boolean | undefined;
+            defaultEffort?: string | undefined;
         }[];
         accessOptions: {
             id: string;

package/dist/service/runner-service.js

@@ -54,14 +54,17 @@ export class RunnerService {
             profiles: await this.refreshProfiles(workspaceId, environment),
             defaults: this.database()
                 .getRunnerDefaults()
-                .filter((value) => this.runners.supportsConfiguration(value))
+                .filter((value) => this.runners.supportsConfiguration(value, undefined, environment))
         };
     }
     saveDefaults(data) {
+        const environment = parseSecretEnvironment(typeof data === 'object' && data !== null
+            ? data.secretEnvironment
+            : undefined);
         const parsed = runnerDefaultConfigurationSchema.safeParse(data);
         if (!parsed.success)
             throw new Error('RUNNER_DEFAULT_INVALID');
-        if (!this.runners.supportsConfiguration(parsed.data))
+        if (!this.runners.supportsConfiguration(parsed.data, undefined, environment))
             throw new Error('RUNNER_CONFIGURATION_UNSUPPORTED');
         return { defaults: this.database().saveRunnerDefaults(parsed.data) };
     }

package/dist/service/session-catalog-service.js

@@ -1,5 +1,6 @@
 import { removeNativeSession } from '../native-session-history.js';
 import { isTerminalRunStatus, sessionPage } from '../util/node-operation-parsers.js';
+import { latestSessionActivityAt } from './session-presentation-service.js';
 export class SessionCatalogService {
     options;
     rewindQueue = Promise.resolve();
@@ -35,7 +36,7 @@ export class SessionCatalogService {
                     pinOrder: source.pinOrder ?? null,
                     externalDiscovered: true,
                     titleSource: session.customTitle === null ? source.titleSource : session.titleSource,
-                    lastActivityAt: source.lastActivityAt
+                    lastActivityAt: latestSessionActivityAt(session.lastActivityAt, source.lastActivityAt)
                 });
         });
         const merged = new Map([
@@ -100,8 +101,7 @@ export class SessionCatalogService {
             delivery: resumed === undefined ? 'REJECTED' : 'RESUMABLE',
             ...(resumed === undefined
                 ? {
-                    reasonCode: failure?.code ?? 'SESSION_RESUME_REJECTED',
-                    ...(failure?.detail === undefined ? {} : { reasonDetail: failure.detail })
+                    reasonCode: failure?.code ?? 'SESSION_RESUME_REJECTED'
                 }
                 : {})
         };
@@ -130,7 +130,7 @@ export class SessionCatalogService {
         const expected = input.position === 'BEFORE' ? turn?.rewind?.before : turn?.rewind?.after;
         if (turn === undefined || expected !== input.boundary)
             throw new Error('SESSION_REWIND_TARGET_INVALID');
-        const title = rewindTitle(source.customTitle ?? source.runnerTitle ?? '未命名会话', this.options.runtime
+        const title = rewindTitle(source.customTitle ?? source.runnerTitle ?? 'Untitled session', this.options.runtime
             .listAgentSessions()
             .flatMap((candidate) => [candidate.customTitle ?? candidate.runnerTitle].filter(isString)));
         const runner = this.options.runners.require(source.runner);

package/dist/service/session-lifecycle-service.js

@@ -1,5 +1,6 @@
 import { validSessionEffort, validSessionOption, validSessionTitle } from '../util/node-operation-parsers.js';
 import { isPlainRecord } from '../util/node-operation-parsers.js';
+import { parseSecretEnvironment } from '../util/secret-environment.js';
 export class SessionLifecycleService {
     options;
     starts = new Map();
@@ -75,18 +76,19 @@ export class SessionLifecycleService {
         const workspace = database.getWorkspace(input.workspaceId);
         if (workspace === undefined)
             throw new Error('WORKSPACE_NOT_FOUND');
+        const environment = parseSecretEnvironment(input.secretEnvironment);
         const saved = database
             .getRunnerDefaults()
             .find((value) => value.runner === runner.name &&
-            this.options.runners.supportsConfiguration(value, workspace));
-        const fallback = runner.defaultConfiguration(workspace);
+            this.options.runners.supportsConfiguration(value, workspace, environment));
+        const fallback = runner.defaultConfiguration(workspace, environment);
         const configuration = {
             runner: runner.name,
             model: typeof input.model === 'string' ? input.model : (saved?.model ?? fallback.model),
             effort: typeof input.effort === 'string' ? input.effort : (saved?.effort ?? fallback.effort),
             access: typeof input.access === 'string' ? input.access : (saved?.access ?? fallback.access)
         };
-        if (!this.options.runners.supportsConfiguration(configuration, workspace))
+        if (!this.options.runners.supportsConfiguration(configuration, workspace, environment))
             throw new Error('RUNNER_CONFIGURATION_UNSUPPORTED');
         const session = this.options.runtime.createAgentSession({
             workspaceId: input.workspaceId,
@@ -125,8 +127,9 @@ export class SessionLifecycleService {
             access: input.access
         };
         const workspace = this.options.database().getWorkspace(current.workspaceId);
+        const environment = parseSecretEnvironment(input.secretEnvironment);
         if (workspace === undefined ||
-            !this.options.runners.supportsConfiguration(configuration, workspace))
+            !this.options.runners.supportsConfiguration(configuration, workspace, environment))
             throw new Error('RUNNER_CONFIGURATION_UNSUPPORTED');
         const session = this.options.runtime.updateAgentSessionConfiguration({
             sessionId: current.id,

package/dist/service/session-presentation-service.d.ts

@@ -30,4 +30,5 @@ export declare class SessionPresentationService {
     present(session: NodeAgentSession): PresentedSession;
     presentDiscovered(sessions: readonly NodeAgentSession[]): readonly PresentedSession[];
 }
+export declare function latestSessionActivityAt(current: number, discovered: number): number;
 export {};