@nocobase/app-plugin-agents 0.1.0-beta.5 → 0.1.0-beta.6

package/dist/server/core/runs/extensions.js

@@ -13,7 +13,10 @@
  *
  * - Repository access is asked per run (`forRun`, in the claim's transaction) once the run has repositories to check
  *   out. Its credentials are minted in `prepare` (a network call is fine there), handed to the runner in the payload
- *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them.
+ *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them. When the runner
+ *   asks for credentials on demand (the `gitCredentials` feature, `RepoAccessContext.onDemand`), a provider that can
+ *   `issue` one lists its repositories in `RunGit.onDemand` instead and mints nothing at the claim: the runner asks
+ *   for each credential whenever git needs one, for as long as it holds the run (`git-credentials.ts`).
  *
  * Inside the claim's transaction a provider reads through the claim's connection only: on SQLite that transaction
  * holds the one connection there is, so anything else (a person's permissions, another plugin's services) would wait
@@ -104,6 +107,19 @@ export async function mountsFor(conn, registry, context, prepared) {
     }
     return { mounts, resumeNotes };
 }
+/**
+ * What a provider throws from `issue` when it cannot give a credential, with a message safe to show the run's people
+ * and the agent (no credential, no internal detail): `unavailable` when its code host is down or slow and asking again
+ * later may work, `denied` when it will not issue one (no access to the repository, an installation gone).
+ */
+export class RepoAccessError extends Error {
+    name = 'RepoAccessError';
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+    }
+}
 export function createRepoAccessRegistry() {
     const providers = new Map();
     return {
@@ -121,7 +137,9 @@ export function createRepoAccessRegistry() {
 }
 /**
  * The run's git, from every provider: the first author given, every trailer and credential in order (one credential
- * per URL, the first).
+ * per URL, the first). With `context.onDemand`, the URLs any provider lists in `onDemand` (only repositories of the
+ * run) are asked for on demand, and no credential of the claim is handed out for them; without it, `onDemand` is
+ * dropped.
  */
 export async function repoAccessFor(conn, registry, context, prepared) {
     if (context.repos.length === 0)
@@ -129,6 +147,8 @@ export async function repoAccessFor(conn, registry, context, prepared) {
     let author;
     const trailers = [];
     const credentials = new Map();
+    const repoUrls = new Set(context.repos.map((repo) => repo.url));
+    const onDemand = new Set();
     for (const provider of registry?.list() ?? []) {
         const given = await provider.forRun(conn, context, prepared.get(`repo:${provider.key}`));
         if (!given)
@@ -140,20 +160,30 @@ export async function repoAccessFor(conn, registry, context, prepared) {
         for (const credential of given.credentials ?? [])
             if (!credentials.has(credential.url))
                 credentials.set(credential.url, credential);
+        if (context.onDemand)
+            for (const url of given.onDemand ?? [])
+                if (repoUrls.has(url))
+                    onDemand.add(url);
     }
-    if (!author && trailers.length === 0 && credentials.size === 0)
+    for (const url of onDemand)
+        credentials.delete(url);
+    if (!author &&
+        trailers.length === 0 &&
+        credentials.size === 0 &&
+        onDemand.size === 0)
         return null;
     return {
         ...(author ? { author } : {}),
         ...(trailers.length > 0 ? { trailers } : {}),
         ...(credentials.size > 0 ? { credentials: [...credentials.values()] } : {}),
+        ...(onDemand.size > 0 ? { onDemand: [...onDemand] } : {}),
     };
 }
 /**
  * Runs every provider's `prepare` for `run`, outside any transaction. A provider whose preparation fails gets
  * undefined, and is told so by its own absent answer; the claim goes on.
  */
-export async function prepareExtensions(run, sections, mounts, onError, repoAccess) {
+export async function prepareExtensions(run, sections, mounts, onError, repoAccess, repoOptions = { onDemand: false }) {
     const prepared = new Map();
     const hooks = [
         ...(sections?.list() ?? []).flatMap((provider) => provider.prepare
@@ -166,11 +196,17 @@ export async function prepareExtensions(run, sections, mounts, onError, repoAcce
                 [`mount:${provider.name}`, provider.prepare],
             ]
             : []),
-        ...(repoAccess?.list() ?? []).flatMap((provider) => provider.prepare
-            ? [
-                [`repo:${provider.key}`, provider.prepare],
-            ]
-            : []),
+        ...(repoAccess?.list() ?? []).flatMap((provider) => {
+            const prepare = provider.prepare;
+            return prepare
+                ? [
+                    [
+                        `repo:${provider.key}`,
+                        (each) => prepare(each, repoOptions),
+                    ],
+                ]
+                : [];
+        }),
     ];
     for (const [key, prepare] of hooks)
         try {

package/dist/server/core/runs/extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,GAKd,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,UAAU,0BAA0B;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACvE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CACT,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAC5C,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CACpB;aACA,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,QAA0C,EAC1C,KAAmB,EACnB,QAAyB,EACzB,QAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CACjC,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,CAAC,CACxC,CAAC;QACF,IAAI,IAAI,EAAE,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,MAAM,CAAC;KAChB,CAAC;AACJ,CAAC;AAuDD,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ;oBAC3C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,GAAwB;IACnD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAC1E,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAwB,EACxB,QAAsC,EACtC,OAAqB,EACrB,QAAkB;IAElB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,uGAAuG;YACvG,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YAC1D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AA6BD,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,GAAG,EAAE,CACxD,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,QAAwC,EACxC,OAA0B,EAC1B,QAAkB;IAElB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAwB,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAKD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,QAA0C,EAC1C,MAAoC,EACpC,OAAkC,EAClC,UAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,KAAK,GAAiC;QAC1C,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG3C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACjD,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAGxC;aACF;YACH,CAAC,CAAC,EAAE,CACP;KACF,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAChC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,GAKd,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,UAAU,0BAA0B;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACvE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CACT,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAC5C,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CACpB;aACA,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,QAA0C,EAC1C,KAAmB,EACnB,QAAyB,EACzB,QAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CACjC,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,CAAC,CACxC,CAAC;QACF,IAAI,IAAI,EAAE,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,MAAM,CAAC;KAChB,CAAC;AACJ,CAAC;AAuDD,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ;oBAC3C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,GAAwB;IACnD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAC1E,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAwB,EACxB,QAAsC,EACtC,OAAqB,EACrB,QAAkB;IAElB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,uGAAuG;YACvG,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YAC1D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AA0CD;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,iBAAiB,CAAC;IACzB,IAAI,CAA2B;IAExC,YAAY,IAA8B,EAAE,OAAe;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAmCD,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,GAAG,EAAE,CACxD,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,QAAwC,EACxC,OAA0B,EAC1B,QAAkB;IAElB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAwB,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,QAAQ;YAClB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;gBACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,IACE,CAAC,MAAM;QACP,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,WAAW,CAAC,IAAI,KAAK,CAAC;QACtB,QAAQ,CAAC,IAAI,KAAK,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAKD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,QAA0C,EAC1C,MAAoC,EACpC,OAAkC,EAClC,UAA+B,EAC/B,cAAkC,EAAE,QAAQ,EAAE,KAAK,EAAE;IAErD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,KAAK,GAAiC;QAC1C,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG3C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,OAAO,OAAO;gBACZ,CAAC,CAAC;oBACE;wBACE,QAAQ,QAAQ,CAAC,GAAG,EAAE;wBACtB,CAAC,IAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;qBACZ;iBAChC;gBACH,CAAC,CAAC,EAAE,CAAC;QACT,CAAC,CAAC;KACH,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAChC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/server/core/runs/git-credentials.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Repository credentials on demand (`RUNNER_ROUTES.gitCredential`, the `gitCredentials` feature): a runner asks for the
+ * credential of one of its run's repositories whenever git needs one, instead of keeping the one a claim handed out
+ * for the whole run, which a long run outlives.
+ *
+ * The answer is given only while the asking runner holds the run (`reports.holds`), for the attempt it names, under a
+ * lease that has not run out, and for a URL the claim listed in `RunGit.onDemand` (`agRuns.gitCredentialUrls`),
+ * compared exactly: case, a trailing `.git` and anything else the runner sends must match what it was given. Anything
+ * else is refused, so a run that ended, went back to the queue or was taken by another attempt gets nothing.
+ *
+ * The application issues the credential (`RepoAccessProvider.issue`), outside any transaction, within
+ * `ISSUE_TIMEOUT_MS`; whether a cached one is still good enough is its decision. Every credential handed out is added
+ * to the run's remembered secrets, so what the run reports afterwards is redacted of it too. A failure is answered
+ * with a reason the runner can act on and a message safe to show: `REPO_ACCESS_UNAVAILABLE` (try again later) or
+ * `REPO_ACCESS_DENIED` (the application will not issue one).
+ */
+import { type GitCredential, type GitCredentialRequest } from '@nocobase/agent-protocol';
+import type { Clock } from '../../kernel/clock.js';
+import { type SecretMemory } from '../../kernel/redaction.js';
+import type { TxRunner } from '../../kernel/tx.js';
+import type { Runner } from '../../../shared/runners.js';
+import { type RepoAccessRegistry } from './extensions.js';
+import type { RunnerReports } from './lifecycle.js';
+import { type RunRecord } from './run.store.js';
+/** How long the server waits for the application to issue a credential before answering `REPO_ACCESS_UNAVAILABLE`. */
+export declare const ISSUE_TIMEOUT_MS = 15000;
+export interface GitCredentialService {
+    issue(runner: Pick<Runner, 'id'>, runId: string, request: GitCredentialRequest): Promise<GitCredential>;
+}
+export interface GitCredentialDeps {
+    readonly tx: TxRunner;
+    readonly clock: Clock;
+    readonly reports: Pick<RunnerReports, 'holds'>;
+    readonly repoAccess: RepoAccessRegistry;
+    readonly secrets?: SecretMemory;
+    /** Told what went wrong when a provider failed in a way it did not explain (`RepoAccessError`). */
+    readonly onError?: (message: string, error: unknown) => void;
+    readonly timeoutMs?: number;
+}
+/** The URLs a claim listed for on-demand credentials, as stored on the run. */
+export declare function gitCredentialUrls(run: Pick<RunRecord, 'gitCredentialUrls'>): string[];
+export declare function createGitCredentialService(deps: GitCredentialDeps): GitCredentialService;
+//# sourceMappingURL=git-credentials.d.ts.map

package/dist/server/core/runs/git-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEtE,sHAAsH;AACtH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,MAAM,WAAW,oBAAoB;IACnC,KAAK,CACH,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,mGAAmG;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,GACxC,MAAM,EAAE,CAEV;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB,GACtB,oBAAoB,CAwJtB"}

package/dist/server/core/runs/git-credentials.js

@@ -0,0 +1,129 @@
+/**
+ * Repository credentials on demand (`RUNNER_ROUTES.gitCredential`, the `gitCredentials` feature): a runner asks for the
+ * credential of one of its run's repositories whenever git needs one, instead of keeping the one a claim handed out
+ * for the whole run, which a long run outlives.
+ *
+ * The answer is given only while the asking runner holds the run (`reports.holds`), for the attempt it names, under a
+ * lease that has not run out, and for a URL the claim listed in `RunGit.onDemand` (`agRuns.gitCredentialUrls`),
+ * compared exactly: case, a trailing `.git` and anything else the runner sends must match what it was given. Anything
+ * else is refused, so a run that ended, went back to the queue or was taken by another attempt gets nothing.
+ *
+ * The application issues the credential (`RepoAccessProvider.issue`), outside any transaction, within
+ * `ISSUE_TIMEOUT_MS`; whether a cached one is still good enough is its decision. Every credential handed out is added
+ * to the run's remembered secrets, so what the run reports afterwards is redacted of it too. A failure is answered
+ * with a reason the runner can act on and a message safe to show: `REPO_ACCESS_UNAVAILABLE` (try again later) or
+ * `REPO_ACCESS_DENIED` (the application will not issue one).
+ */
+import { ProtocolError, } from '@nocobase/agent-protocol';
+import { runSecretsKey } from '../../kernel/redaction.js';
+import { stringArray } from '../../kernel/values.js';
+import { RepoAccessError, } from './extensions.js';
+import { findRunRecord, toRun } from './run.store.js';
+/** How long the server waits for the application to issue a credential before answering `REPO_ACCESS_UNAVAILABLE`. */
+export const ISSUE_TIMEOUT_MS = 15_000;
+/** The URLs a claim listed for on-demand credentials, as stored on the run. */
+export function gitCredentialUrls(run) {
+    return stringArray(run.gitCredentialUrls);
+}
+export function createGitCredentialService(deps) {
+    const timeoutMs = deps.timeoutMs ?? ISSUE_TIMEOUT_MS;
+    const lost = (message, status) => new ProtocolError('LEASE_LOST', message, { status });
+    async function withTimeout(issue) {
+        const controller = new AbortController();
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                reject(new RepoAccessError('unavailable', 'The application did not issue a credential in time.'));
+            }, timeoutMs);
+        });
+        try {
+            return await Promise.race([issue(controller.signal), timeout]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    function checked(grant, now) {
+        const expires = Date.parse(grant.expiresAt);
+        if (typeof grant.username !== 'string' ||
+            grant.username === '' ||
+            typeof grant.password !== 'string' ||
+            grant.password === '' ||
+            Number.isNaN(expires) ||
+            expires <= now.getTime())
+            throw new RepoAccessError('unavailable', 'The application issued a credential that is incomplete or already expired.');
+        return grant;
+    }
+    /**
+     * The run while `runner` still holds this attempt of it under a live lease and the claim listed `url`; the protocol
+     * reason otherwise. Checked before the application is asked and again once it answered, since issuing may take long
+     * enough for the run to end, be taken back or move to another attempt.
+     */
+    async function held(runner, runId, request) {
+        await deps.reports.holds(runner, runId);
+        const run = await findRunRecord(deps.tx.read(), runId);
+        if (!run)
+            throw new ProtocolError('RUN_NOT_FOUND', 'No such run.');
+        if (Number(run.attempt) !== request.attempt)
+            throw lost(`Attempt ${request.attempt} of the run is over; it is on attempt ${Number(run.attempt)}.`, run.status);
+        if (run.leaseExpiresAt === null ||
+            Date.parse(run.leaseExpiresAt) <= deps.clock.now().getTime())
+            throw lost('The run’s lease ran out.', run.status);
+        if (!gitCredentialUrls(run).includes(request.url))
+            throw new ProtocolError('INVALID_REQUEST', 'This repository is not one the run asks credentials for on demand.', { url: request.url });
+        return run;
+    }
+    /** The first answer of a provider that issues for the URL; null when none does. */
+    async function ask(run, runner, request) {
+        const providers = deps.repoAccess
+            .list()
+            .filter((provider) => provider.issue !== undefined);
+        try {
+            for (const provider of providers) {
+                const grant = await withTimeout((signal) => provider.issue({
+                    run: toRun(run),
+                    runnerId: runner.id,
+                    attempt: request.attempt,
+                    url: request.url,
+                    refresh: request.refresh === true,
+                    signal,
+                }));
+                if (grant)
+                    return grant;
+            }
+            return null;
+        }
+        catch (error) {
+            if (error instanceof RepoAccessError)
+                throw new ProtocolError(error.kind === 'denied'
+                    ? 'REPO_ACCESS_DENIED'
+                    : 'REPO_ACCESS_UNAVAILABLE', error.message, { url: request.url });
+            deps.onError?.(`Agents could not issue a repository credential for run ${run.id}.`, error);
+            throw new ProtocolError('REPO_ACCESS_UNAVAILABLE', 'The application could not issue a credential for this repository.', { url: request.url });
+        }
+    }
+    return {
+        async issue(runner, runId, request) {
+            const run = await held(runner, runId, request);
+            const grant = await ask(run, runner, request);
+            if (!grant)
+                throw new ProtocolError('REPO_ACCESS_DENIED', 'The application issues no credential for this repository.', { url: request.url });
+            // The run may have ended, been taken back or moved to another attempt while the application issued: then the
+            // credential is dropped, never remembered, and the runner told why.
+            await held(runner, runId, request);
+            let valid;
+            try {
+                // Checked against the time it came back, not the time it was asked for.
+                valid = checked(grant, deps.clock.now());
+            }
+            catch (error) {
+                throw new ProtocolError('REPO_ACCESS_UNAVAILABLE', error instanceof Error ? error.message : String(error), { url: request.url });
+            }
+            const { username, password, expiresAt } = valid;
+            deps.secrets?.add(runSecretsKey(run.id), [password]);
+            return { username, password, expiresAt };
+        },
+    };
+}
+//# sourceMappingURL=git-credentials.js.map

package/dist/server/core/runs/git-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.js","sourceRoot":"","sources":["../../../../server/core/runs/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,aAAa,GAGd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAqB,MAAM,2BAA2B,CAAC;AAE7E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EACL,eAAe,GAGhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAkB,MAAM,gBAAgB,CAAC;AAEtE,sHAAsH;AACtH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAqBvC,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAC/B,GAAyC;IAEzC,OAAO,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CAC/C,IAAI,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,KAAK,UAAU,WAAW,CACxB,KAAmE;QAEnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,KAAiC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CACJ,IAAI,eAAe,CACjB,aAAa,EACb,qDAAqD,CACtD,CACF,CAAC;YACJ,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,KAA0B,EAAE,GAAS;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;YACrB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;YACrB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YACrB,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;YAExB,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,4EAA4E,CAC7E,CAAC;QACJ,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,IAAI,CACjB,MAA0B,EAC1B,KAAa,EACb,OAA6B;QAE7B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO;YACzC,MAAM,IAAI,CACR,WAAW,OAAO,CAAC,OAAO,yCAAyC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EACzF,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,IACE,GAAG,CAAC,cAAc,KAAK,IAAI;YAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YAE5D,MAAM,IAAI,CAAC,0BAA0B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YAC/C,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,oEAAoE,EACpE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;QACJ,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,GAAG,CAChB,GAAc,EACd,MAA0B,EAC1B,OAA6B;QAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU;aAC9B,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,QAAQ,CAAC,KAAM,CAAC;oBACd,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;oBACf,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;oBACjC,MAAM;iBACP,CAAC,CACH,CAAC;gBACF,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAClC,MAAM,IAAI,aAAa,CACrB,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACrB,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,yBAAyB,EAC7B,KAAK,CAAC,OAAO,EACb,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,IAAI,CAAC,OAAO,EAAE,CACZ,0DAA0D,GAAG,CAAC,EAAE,GAAG,EACnE,KAAK,CACN,CAAC;YACF,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,mEAAmE,EACnE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,2DAA2D,EAC3D,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,6GAA6G;YAC7G,oEAAoE;YACpE,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACnC,IAAI,KAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,wEAAwE;gBACxE,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;YAChD,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/core/runs/index.d.ts

@@ -1,7 +1,8 @@
 export { briefOf, createClaimService, fits, fitsActor, hasTool, onlineEntryOf, pickEntry, isServerHolder, payloadDirs, payloadRequires, skillTargets, variableTargets, type ClaimService, type RenderedBrief, type ServerClaim, type ServerHolder, } from './claim.js';
 export { resolveAgentCli, type AgentCli } from './policy.js';
 export { createClaimEligibility, type ClaimEligibility, type EligibilityRequest, } from './eligibility.js';
-export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, type BriefSectionProvider, type BriefSectionRegistry, type ExtensionPrepare, type MountContext, type MountOffer, type RepoAccessContext, type RepoAccessProvider, type RepoAccessRegistry, type RunMountProvider, type RunMountRegistry, } from './extensions.js';
+export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, type BriefSectionProvider, type BriefSectionRegistry, type ExtensionPrepare, type MountContext, type MountOffer, RepoAccessError, type RepoAccessContext, type RepoAccessProvider, type RepoAccessRegistry, type RepoCredentialGrant, type RepoCredentialRequest, type RepoPrepareOptions, type RunMountProvider, type RunMountRegistry, } from './extensions.js';
+export { createGitCredentialService, ISSUE_TIMEOUT_MS, type GitCredentialService, } from './git-credentials.js';
 export { createBriefPreviewer, type BriefPreviewer } from './preview.js';
 export { findBrief, requestReset } from './workspace.store.js';
 export { createRunnerReports, type OnlineUsageRecord, type RunnerReports, } from './lifecycle.js';

package/dist/server/core/runs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,SAAS,EACT,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,SAAS,EACT,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/server/core/runs/index.js

@@ -1,7 +1,8 @@
 export { briefOf, createClaimService, fits, fitsActor, hasTool, onlineEntryOf, pickEntry, isServerHolder, payloadDirs, payloadRequires, skillTargets, variableTargets, } from './claim.js';
 export { resolveAgentCli } from './policy.js';
 export { createClaimEligibility, } from './eligibility.js';
-export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, } from './extensions.js';
+export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, RepoAccessError, } from './extensions.js';
+export { createGitCredentialService, ISSUE_TIMEOUT_MS, } from './git-credentials.js';
 export { createBriefPreviewer } from './preview.js';
 export { findBrief, requestReset } from './workspace.store.js';
 export { createRunnerReports, } from './lifecycle.js';

package/dist/server/core/runs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,GAKhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAiB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,GAGvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,GAWb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAuB,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,SAAS,EACT,SAAS,GAcV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,GAEd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,GAQV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,GAKnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAkC,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,YAAY,GAEb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,GAEf,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,GAKhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAiB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,GAGvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EAMZ,eAAe,GAShB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAuB,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,SAAS,EACT,SAAS,GAcV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,GAEd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,GAQV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,GAKnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAkC,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,YAAY,GAEb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,GAEf,MAAM,kBAAkB,CAAC"}

package/dist/server/core/runs/input-gate.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The subject's admission and input policy (`ContextProvider.admit` and `selectInputs`) applied to a run that is
+ * already working: before new input joins it, and before its pending input is delivered.
+ */
+import type { RunInput } from '@nocobase/agent-protocol';
+import type { DatabaseConnection } from '@nocobase/db';
+import type { Agent } from '../../../shared/agents.js';
+import { type InputRecord, type RunRecord } from './run.store.js';
+import { type SubjectRegistry } from './ports.js';
+export interface InputGateDeps {
+    readonly subjects: SubjectRegistry;
+    readonly cliName: string;
+    readonly appName: string;
+}
+/**
+ * Of `inputs` for `run`, the ones its agent may act on now: none when the subject rejects the agent's work on it, else
+ * what the subject selects. Without a policy, all of them.
+ */
+export declare function gateInputs(conn: DatabaseConnection, deps: InputGateDeps, run: RunRecord, agent: Agent, inputs: readonly RunInput[]): Promise<readonly RunInput[]>;
+/** Marks the inputs of `ids` handled without delivering them: the run is not to act on them. */
+export declare function dropInputs(conn: DatabaseConnection, ids: readonly string[], now: string): Promise<void>;
+/** A working run's unhandled input, split by whether the run may still act on it. */
+export interface GatedPending {
+    /** What the run was already given, and the new input the subject still admits and selects. */
+    readonly kept: readonly InputRecord[];
+    /** New input the subject no longer lets the run act on. */
+    readonly withheld: readonly InputRecord[];
+}
+/**
+ * Splits `run`'s unhandled input by the subject's policy. Input already delivered stays with the run, whatever
+ * happened since; only input not yet delivered is judged.
+ */
+export declare function gatePending(conn: DatabaseConnection, deps: InputGateDeps, run: RunRecord): Promise<GatedPending>;
+//# sourceMappingURL=input-gate.d.ts.map

package/dist/server/core/runs/input-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-gate.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/input-gate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,SAAS,QAAQ,EAAE,GAC1B,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAgB9B;AAED,gGAAgG;AAChG,wBAAsB,UAAU,CAC9B,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,YAAY,CAAC,CAevB"}

package/dist/server/core/runs/input-gate.js

@@ -0,0 +1,56 @@
+import { findAgent } from '../agents/index.js';
+import { inputsRepo, pendingInputs, toInput, toRun, } from './run.store.js';
+import { dialectOf } from './ports.js';
+/**
+ * Of `inputs` for `run`, the ones its agent may act on now: none when the subject rejects the agent's work on it, else
+ * what the subject selects. Without a policy, all of them.
+ */
+export async function gateInputs(conn, deps, run, agent, inputs) {
+    const context = deps.subjects.get(run.subjectKind)?.context;
+    if (!context || inputs.length === 0)
+        return inputs;
+    const claim = {
+        run: toRun(run),
+        agent,
+        runner: null,
+        inputs,
+        cli: deps.cliName,
+        appName: deps.appName,
+        dialect: dialectOf(agent),
+    };
+    if (await context.admit?.(conn, claim))
+        return [];
+    return context.selectInputs
+        ? await context.selectInputs(conn, claim)
+        : inputs;
+}
+/** Marks the inputs of `ids` handled without delivering them: the run is not to act on them. */
+export async function dropInputs(conn, ids, now) {
+    if (ids.length === 0)
+        return;
+    await inputsRepo(conn).updateMany({
+        filter: (f) => f.and([
+            f.or(ids.map((id) => f.string('id').eq(id))),
+            f.date('handledAt').empty(),
+        ]),
+        values: { handledAt: now },
+    });
+}
+/**
+ * Splits `run`'s unhandled input by the subject's policy. Input already delivered stays with the run, whatever
+ * happened since; only input not yet delivered is judged.
+ */
+export async function gatePending(conn, deps, run) {
+    const pending = await pendingInputs(conn, run.id);
+    const fresh = pending.filter((input) => !input.deliveredAt);
+    const agent = fresh.length > 0 ? await findAgent(conn, run.agentId) : null;
+    if (!agent)
+        return { kept: pending, withheld: [] };
+    const admitted = new Set((await gateInputs(conn, deps, run, agent, fresh.map(toInput))).map((input) => input.id));
+    const withheld = fresh.filter((input) => !admitted.has(input.id));
+    return {
+        kept: pending.filter((input) => !withheld.includes(input)),
+        withheld,
+    };
+}
+//# sourceMappingURL=input-gate.js.map

package/dist/server/core/runs/input-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-gate.js","sourceRoot":"","sources":["../../../../server/core/runs/input-gate.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,aAAa,EACb,OAAO,EACP,KAAK,GAGN,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAwB,MAAM,YAAY,CAAC;AAQ7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwB,EACxB,IAAmB,EACnB,GAAc,EACd,KAAY,EACZ,MAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;QACf,KAAK;QACL,MAAM,EAAE,IAAI;QACZ,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;KAC1B,CAAC;IACF,IAAI,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,OAAO,CAAC,YAAY;QACzB,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwB,EACxB,GAAsB,EACtB,GAAW;IAEX,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7B,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QAChC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE;SAC5B,CAAC;QACJ,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;KAC3B,CAAC,CAAC;AACL,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAwB,EACxB,IAAmB,EACnB,GAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CACpB,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/server/core/runs/lifecycle.d.ts

@@ -9,6 +9,7 @@ import { type Clock } from '../../kernel/clock.js';
 import type { IdSource } from '../../kernel/ids.js';
 import { type SecretMemory } from '../../kernel/redaction.js';
 import type { TxRunner } from '../../kernel/tx.js';
+import { type InputGateDeps } from './input-gate.js';
 import { type TransitionDeps } from './transitions.js';
 export interface RunnerReports {
     /** Resolves while `runner` holds the run; `LEASE_LOST`, `RUN_NOT_ACTIVE` or `RUN_NOT_OWNED` otherwise. */
@@ -42,7 +43,7 @@ export interface OnlineUsageRecord {
     readonly cacheWriteTokens?: number;
     readonly reasoningTokens?: number;
 }
-export interface RunnerReportsDeps extends TransitionDeps {
+export interface RunnerReportsDeps extends TransitionDeps, InputGateDeps {
     readonly tx: TxRunner;
     readonly ids: IdSource;
     readonly clock: Clock;

package/dist/server/core/runs/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAML,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAElB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEpB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAS,KAAK,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAM,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAmBvD,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAO9E,MAAM,WAAW,aAAa;IAC5B,0GAA0G;IAC1G,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,KAAK,CACH,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,cAAc,GAAG,WAAW,CAAC,GACpE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B;;;OAGG;IACH,WAAW,CACT,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CACJ,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CACN,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,IAAI,CACF,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,SAAS,CACP,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,mFAAmF;IACnF,SAAS,CACP,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,SAAS,EAAE,GAC3B,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAgb1E"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAML,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAElB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEpB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAS,KAAK,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAM,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAgB9E,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAO9E,MAAM,WAAW,aAAa;IAC5B,0GAA0G;IAC1G,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,KAAK,CACH,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,cAAc,GAAG,WAAW,CAAC,GACpE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B;;;OAGG;IACH,WAAW,CACT,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CACJ,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CACN,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,IAAI,CACF,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,SAAS,CACP,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,mFAAmF;IACnF,SAAS,CACP,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,SAAS,EAAE,GAC3B,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,iBAAkB,SAAQ,cAAc,EAAE,aAAa;IACtE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CA4c1E"}

package/dist/server/core/runs/lifecycle.js

@@ -10,8 +10,9 @@ import { later } from '../../kernel/clock.js';
 import { createSecretMemory, runSecretsKey, } from '../../kernel/redaction.js';
 import { asJson, jsonObject, truncateBytes } from '../../kernel/values.js';
 import { recordActualModels } from './execution.js';
+import { dropInputs, gatePending } from './input-gate.js';
 import { everHeld } from './run-tokens.js';
-import { eventsRepo, findRunRecord, inputsRepo, isActive, isTerminal, markDelivered, pendingInputs, reposRepo, runsRepo, sessionsRepo, toInput, usageRepo, } from './run.store.js';
+import { eventsRepo, findRunRecord, inputsRepo, isActive, isTerminal, markDelivered, reposRepo, runsRepo, sessionsRepo, toInput, usageRepo, } from './run.store.js';
 import { finishRun, requeueRun } from './transitions.js';
 const executionReport = z.object({
     effort: z.string().trim().min(1).max(200).nullable(),
@@ -44,11 +45,22 @@ export function createRunnerReports(deps) {
         });
         return leaseExpiresAt;
     }
-    async function deliver(conn, runId) {
-        const pending = await pendingInputs(conn, runId);
-        await markDelivered(conn, pending, clock.now().toISOString());
+    /**
+     * The run's unhandled input, marking what is new delivered. New input passes the subject's policy first, as it would
+     * at a claim: what the run's agent may not act on now is marked handled instead and never reaches the runner.
+     */
+    async function deliver(conn, run) {
+        const now = clock.now().toISOString();
+        const pending = await settlePending(conn, run, now);
+        await markDelivered(conn, pending, now);
         return pending.map(toInput);
     }
+    /** The run's unhandled input it may act on, marking what it may no longer act on handled. */
+    async function settlePending(conn, run, now) {
+        const { kept, withheld } = await gatePending(conn, deps, run);
+        await dropInputs(conn, withheld.map((input) => input.id), now);
+        return kept;
+    }
     /** Records what every ending reports: handled inputs, usage, branches. */
     async function recordOutcome({ conn }, run, report) {
         const now = clock.now().toISOString();
@@ -87,6 +99,10 @@ export function createRunnerReports(deps) {
                 branch: repo.branch,
                 pushed: repo.pushed,
                 headSha: repo.headSha ?? null,
+                failureReason: repo.failure?.reason ?? null,
+                failureDetail: repo.failure === undefined
+                    ? null
+                    : redactorOf(run.id).text(repo.failure.message).slice(0, 2000),
                 updatedAt: now,
             };
             if (existing)
@@ -157,7 +173,7 @@ export function createRunnerReports(deps) {
             return {
                 leaseExpiresAt,
                 cancelRequested: run.cancelRequestedAt !== null,
-                inputs: await deliver(conn, run.id),
+                inputs: await deliver(conn, run),
             };
         }),
         start: (runner, runId, request) => tx.run(async (unit) => {
@@ -189,7 +205,7 @@ export function createRunnerReports(deps) {
                 status: current.status,
                 leaseExpiresAt,
                 cancelRequested,
-                inputs: await deliver(conn, run.id),
+                inputs: await deliver(conn, run),
             };
         }),
         events: (runner, runId, request) => tx.run(async (unit) => {
@@ -288,14 +304,15 @@ export function createRunnerReports(deps) {
             return {
                 status: current.status,
                 cancelRequested: current.cancelRequestedAt !== null,
-                inputs: await deliver(conn, current.id),
+                inputs: await deliver(conn, current),
                 leaseExpiresAt: current.leaseExpiresAt,
             };
         }),
         complete: (runner, runId, request) => tx.run(async (unit) => {
             const run = await held(unit.conn, runner, runId);
             const handled = new Set(request.handledInputIds);
-            const missing = (await pendingInputs(unit.conn, run.id)).filter((input) => !handled.has(input.id));
+            // Input the run may no longer act on does not hold it open: the runner would get none of it.
+            const missing = (await settlePending(unit.conn, run, clock.now().toISOString())).filter((input) => !handled.has(input.id));
             if (missing.length > 0)
                 throw new ProtocolError('RUN_INPUT_PENDING', 'The run has input it has not handled; handle it before completing.', {
                     inputIds: missing.map((input) => input.id),
@@ -348,9 +365,11 @@ export function createRunnerReports(deps) {
         cancelAck: (runner, runId, request) => tx.run(async (unit) => {
             const run = await held(unit.conn, runner, runId);
             await recordOutcome(unit, run, request);
+            await rememberSession(unit, run, request.sessionId, false);
             const ended = await finishRun(unit, deps, run, {
                 status: 'cancelled',
                 reason: 'cancelled',
+                ...(request.sessionId ? { sessionId: request.sessionId } : {}),
             });
             if (!ended)
                 throw new ProtocolError('LEASE_LOST', 'The run moved on; stop it.');