@namzu/sdk 30.2.0 → 31.0.0

package/src/utils/id.ts

@@ -16,6 +16,7 @@ import type {
 	EmergencySaveId,
 	EnvironmentId,
 	ExecutionContextId,
+	GoalId,
 	HandoffId,
 	KnowledgeBaseId,
 	KnowledgeBaseRef,
@@ -101,6 +102,10 @@ export function generateSessionId(): SessionId {
 	return generateId('ses_')
 }
 
+export function generateGoalId(): GoalId {
+	return generateId('goal_')
+}
+
 export function generateToolCallId(): ToolCallId {
 	return generateId('call_', 8)
 }
@@ -309,6 +314,7 @@ function makeIdParser<T extends `${P}${string}`, P extends string = string>(
 export const asRunId: IdParser<RunId> = makeIdParser('run_')
 export const asMessageId: IdParser<MessageId> = makeIdParser('msg_')
 export const asSessionId: IdParser<SessionId> = makeIdParser('ses_')
+export const asGoalId: IdParser<GoalId> = makeIdParser('goal_')
 export const asToolCallId: IdParser<ToolCallId> = makeIdParser('call_')
 export const asActivityId: IdParser<ActivityId> = makeIdParser('act_')
 export const asTaskId: IdParser<TaskId> = makeIdParser('task_')

package/src/utils/process-environment.ts

@@ -0,0 +1,101 @@
+/**
+ * Windows variables that let an ordinary child find executables, the command
+ * interpreter, system DLLs, its profile and temporary storage.
+ *
+ * This is a fragment rather than a complete inheritance policy. MCP stdio and
+ * LocalSandbox have different ambient grants; both need this fragment on the
+ * Windows paths that already promise to launch a working process.
+ */
+export const WINDOWS_CORE_ENV_KEYS: readonly string[] = [
+	'PATHEXT',
+	'SystemRoot',
+	'SystemDrive',
+	'ComSpec',
+	'WINDIR',
+	'TEMP',
+	'TMP',
+	'USERPROFILE',
+	'HOMEDRIVE',
+	'HOMEPATH',
+	'APPDATA',
+	'LOCALAPPDATA',
+	'PROGRAMDATA',
+	'PROGRAMFILES',
+	'NUMBER_OF_PROCESSORS',
+	'PROCESSOR_ARCHITECTURE',
+]
+
+type EnvironmentSource = Readonly<Record<string, string | undefined>>
+
+function sameEnvironmentName(left: string, right: string, platform: NodeJS.Platform): boolean {
+	return platform === 'win32' ? left.toUpperCase() === right.toUpperCase() : left === right
+}
+
+/** Read one environment entry using the host platform's key semantics. */
+export function readEnvironmentEntry(
+	source: EnvironmentSource,
+	name: string,
+	platform: NodeJS.Platform = process.platform,
+): [name: string, value: string] | undefined {
+	if (platform !== 'win32') {
+		const value = source[name]
+		return value === undefined ? undefined : [name, value]
+	}
+
+	// Enumerate rather than relying on process.env's Windows proxy so the key
+	// handed to the child retains the spelling the parent actually used. Prefer
+	// an exact spelling if an injected/plain object contains impossible twins.
+	const entries = Object.entries(source).filter((entry): entry is [string, string] => {
+		return entry[1] !== undefined
+	})
+	return (
+		entries.find(([key]) => key === name) ??
+		entries.find(([key]) => sameEnvironmentName(key, name, platform))
+	)
+}
+
+/**
+ * Set one entry, making a later override the sole spelling on Windows.
+ *
+ * JavaScript objects are case-sensitive; Windows environments are not. Without
+ * removing the earlier spelling, `{ PATH, Path }` reaches Node's spawn layer
+ * with two apparent winners and the configured precedence becomes accidental.
+ */
+export function setEnvironmentEntry(
+	target: Record<string, string>,
+	name: string,
+	value: string,
+	platform: NodeJS.Platform = process.platform,
+): void {
+	if (platform === 'win32') {
+		for (const existing of Object.keys(target)) {
+			if (sameEnvironmentName(existing, name, platform)) delete target[existing]
+		}
+	}
+	target[name] = value
+}
+
+/** Copy only the named ambient entries. */
+export function pickEnvironmentEntries(
+	names: Iterable<string>,
+	source: EnvironmentSource = process.env,
+	platform: NodeJS.Platform = process.platform,
+): Record<string, string> {
+	const env: Record<string, string> = {}
+	for (const name of names) {
+		const found = readEnvironmentEntry(source, name, platform)
+		if (found) setEnvironmentEntry(env, found[0], found[1], platform)
+	}
+	return env
+}
+
+/** Apply explicit entries in insertion order; later calls therefore win. */
+export function applyEnvironmentOverrides(
+	target: Record<string, string>,
+	overrides: EnvironmentSource | undefined,
+	platform: NodeJS.Platform = process.platform,
+): void {
+	for (const [name, value] of Object.entries(overrides ?? {})) {
+		if (value !== undefined) setEnvironmentEntry(target, name, value, platform)
+	}
+}

package/src/vault/InMemoryCredentialVault.ts

@@ -6,6 +6,13 @@ import type { LogAttributes } from '../utils/log/index.js'
 import { SCOPE_ATTRIBUTE } from '../utils/log/types.js'
 import { type Logger, resolveLogger } from '../utils/logger.js'
 
+function copyAuth(auth: AuthConfig): AuthConfig {
+	return {
+		type: auth.type,
+		...(auth.credentials ? { credentials: { ...auth.credentials } } : {}),
+	}
+}
+
 export class InMemoryCredentialVault implements CredentialVault {
 	private refs: Map<CredentialId, CredentialRef> = new Map()
 	private secrets: Map<CredentialId, AuthConfig> = new Map()
@@ -32,18 +39,30 @@ export class InMemoryCredentialVault implements CredentialVault {
 		}
 
 		this.refs.set(id, ref)
-		this.secrets.set(id, auth)
+		this.secrets.set(id, copyAuth(auth))
 		const storedAttributes: LogAttributes = {
 			[NAMZU.CREDENTIAL_ID]: id,
 			[NAMZU.CREDENTIAL_LABEL]: label,
 			[NAMZU.TENANT_ID]: tenantId,
 		}
 		this.log.info('Credential stored', storedAttributes)
-		return ref
+		return { ...ref }
 	}
 
 	async retrieve(credentialId: CredentialId): Promise<AuthConfig | undefined> {
-		return this.secrets.get(credentialId)
+		const auth = this.secrets.get(credentialId)
+		return auth ? copyAuth(auth) : undefined
+	}
+
+	async retrieveForScope(
+		tenantId: TenantId,
+		connectorId: ConnectorId,
+		credentialId: CredentialId,
+	): Promise<AuthConfig | undefined> {
+		const ref = this.refs.get(credentialId)
+		if (!ref || ref.tenantId !== tenantId || ref.connectorId !== connectorId) return undefined
+		const auth = this.secrets.get(credentialId)
+		return auth ? copyAuth(auth) : undefined
 	}
 
 	async revoke(credentialId: CredentialId): Promise<boolean> {
@@ -59,12 +78,18 @@ export class InMemoryCredentialVault implements CredentialVault {
 		return existed
 	}
 
+	async revokeForTenant(tenantId: TenantId, credentialId: CredentialId): Promise<boolean> {
+		const ref = this.refs.get(credentialId)
+		if (!ref || ref.tenantId !== tenantId) return false
+		return this.revoke(credentialId)
+	}
+
 	async list(tenantId: TenantId, connectorId?: ConnectorId): Promise<CredentialRef[]> {
 		const results: CredentialRef[] = []
 		for (const ref of this.refs.values()) {
 			if (ref.tenantId !== tenantId) continue
 			if (connectorId && ref.connectorId !== connectorId) continue
-			results.push(ref)
+			results.push({ ...ref })
 		}
 		return results
 	}

package/src/vault/instrumentation.ts

@@ -48,10 +48,34 @@ export function wrapVaultWithProbes(
 			return result
 		},
 
+		async retrieveForScope(
+			tenantId: TenantId,
+			connectorId: ConnectorId,
+			credentialId: CredentialId,
+		): Promise<AuthConfig | undefined> {
+			const result = await vault.retrieveForScope(tenantId, connectorId, credentialId)
+			probes.dispatch(
+				{
+					type: 'vault_lookup',
+					vaultId,
+					credentialId,
+					tenantId,
+					found: result !== undefined,
+					runId,
+				},
+				buildProbeContext({ runId }),
+			)
+			return result
+		},
+
 		revoke(credentialId: CredentialId): Promise<boolean> {
 			return vault.revoke(credentialId)
 		},
 
+		revokeForTenant(tenantId: TenantId, credentialId: CredentialId): Promise<boolean> {
+			return vault.revokeForTenant(tenantId, credentialId)
+		},
+
 		list(tenantId: TenantId, connectorId?: ConnectorId): Promise<CredentialRef[]> {
 			return vault.list(tenantId, connectorId)
 		},