@on-mission/sdk 0.1.11 → 0.1.13

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { FileRef, StagingProvenance, ToolCallInput } from '@mission/models';
-export { FileRef, FileRefStore, MAX_STAGING_UPLOAD_BYTES, StagingProvenance, Tool, ToolCallContext, ToolCallEnvelope, ToolCallInput, ToolFunction, ToolFunctionPermission, ToolKind, fileRefSchema } from '@mission/models';
+export { AuthoredToolResultTransport, FileRef, FileRefStore, IdentityBearingKey, MAX_STAGING_UPLOAD_BYTES, StagingProvenance, TOOL_RESULT_TRANSPORT_MAX_BYTES, Tool, ToolCallContext, ToolCallEnvelope, ToolCallInput, ToolFunction, ToolFunctionPermission, ToolKind, ToolResultEnvelope, ToolResultTransport, fileRefSchema, toolResult } from '@mission/models';
 import { createTRPCProxyClient } from '@trpc/client';
 
 /**
@@ -153,6 +153,69 @@ type ConfigModule = {
     get: <T = Record<string, unknown>>(defaults?: Partial<T>) => Promise<T>;
 };
 
+/**
+ * Content-identity test kit (MIS-649).
+ *
+ * Mission content-addresses tool results: the platform serializes a result,
+ * sha256s the bytes, and that digest becomes the sandbox filename, the GCS key,
+ * and the dedup key. A tool that echoes a volatile value INSIDE its result
+ * payload — a pagination cursor, a request id, a fetch timestamp — makes two
+ * byte-identical result SETS hash differently. Dedup silently fails and the
+ * model is handed N artifacts where it should have seen one.
+ *
+ * `toolResult(content, transport)` is the fix: the platform hashes `content`
+ * alone and excludes `transport`. But a tool only gets that property if it puts
+ * the volatile fields in the right half, and NOTHING about the return type can
+ * tell it apart from getting it wrong — both compile.
+ *
+ * `assertContentIdentityStable` is the check that can. It runs a tool's real
+ * invocations and asserts the two properties that matter:
+ *
+ *   1. Two calls that returned the SAME records with a DIFFERENT volatile value
+ *      produce the SAME content identity.
+ *   2. A call that returned DIFFERENT records produces a DIFFERENT one.
+ *
+ * Property 2 is not decoration — without it, a tool that dumps its whole payload
+ * into `transport` (or returns a constant) passes property 1 perfectly and has
+ * destroyed the very identity the store depends on.
+ *
+ * It is framework-agnostic on purpose: it throws a plain `Error` on failure, so
+ * it works under vitest, node:test, or a plain script, and importing it never
+ * drags a test runner into a skill's runtime bundle.
+ */
+/**
+ * The content identity the PLATFORM would compute for a tool result: sha256 over
+ * the serialized bytes of the hashed subject that `selectHashedContent` picks.
+ *
+ * BOTH halves are imported, not reimplemented. The selection
+ * (`selectHashedContent`) and the serialization (`serializeForIdentity`) are the
+ * platform's own definitions, so this function cannot report an address the
+ * platform will not produce. A local re-implementation of either half is exactly
+ * the defect this contract exists to eliminate, one level up.
+ */
+declare const contentIdentity: (result: unknown) => string;
+declare const assertContentIdentityContractLoaded: () => void;
+type ContentIdentityStableInput = Readonly<{
+    /**
+     * Two invocations that returned THE SAME RECORDS but a different volatile
+     * value (page 1 fetched twice with a fresh cursor, the same query re-run with a
+     * new request id). Their content identity must match.
+     */
+    sameRecordsDifferentCursor: readonly [
+        () => Promise<unknown> | unknown,
+        () => Promise<unknown> | unknown
+    ];
+    /**
+     * An invocation that returned DIFFERENT records. Its content identity must
+     * differ from the pair above — the guard against a tool that has collapsed all
+     * of its results onto one address.
+     */
+    differentRecords: () => Promise<unknown> | unknown;
+    /** Optional label used in failure messages (e.g. the tool name). */
+    label?: string;
+}>;
+declare const assertContentIdentityStable: (input: ContentIdentityStableInput) => Promise<void>;
+
 /**
  * Debug Logging — Local Development
  *
@@ -888,4 +951,4 @@ type WebhookResult = {
     response?: WebhookResponse;
 };
 
-export { type AgentMessage, type ApiClient, type AttachmentLimits, type AuthCredentials, type AuthModule, type ConfigModule, EmailAttachments, type EventHandler, type EventHandlerRegistry, FileTransferTimeoutError, type FilesModule, type IngressHandler, type IngressModule, type IngressRequest, type IngressResponse, type IngressStreamEvents, type IngressUrl, type LogModule, type MimeBodyParts, type MissionSDK, type MissionSDKOptions, type OAuthCredentials, type RedeemedAttachment, type SendIntentClaimOutcome, type SendIntentCompletion, type SendIntentRecord, type SendIntentStatus, type SendIntentsModule, type SendMessageId, type SendMessageIdInput, type SkillContext, type SkillEvent, SkillToolHttpError, type ToolHandler, type ToolsModule, type WebhookRequest, type WebhookResponse, type WebhookResult, clearDebugLog, createMissionSDK, debugLog };
+export { type AgentMessage, type ApiClient, type AttachmentLimits, type AuthCredentials, type AuthModule, type ConfigModule, type ContentIdentityStableInput, EmailAttachments, type EventHandler, type EventHandlerRegistry, FileTransferTimeoutError, type FilesModule, type IngressHandler, type IngressModule, type IngressRequest, type IngressResponse, type IngressStreamEvents, type IngressUrl, type LogModule, type MimeBodyParts, type MissionSDK, type MissionSDKOptions, type OAuthCredentials, type RedeemedAttachment, type SendIntentClaimOutcome, type SendIntentCompletion, type SendIntentRecord, type SendIntentStatus, type SendIntentsModule, type SendMessageId, type SendMessageIdInput, type SkillContext, type SkillEvent, SkillToolHttpError, type ToolHandler, type ToolsModule, type WebhookRequest, type WebhookResponse, type WebhookResult, assertContentIdentityContractLoaded, assertContentIdentityStable, clearDebugLog, contentIdentity, createMissionSDK, debugLog };

package/dist/index.js

@@ -14256,7 +14256,6 @@ var hostFsOpSchema = external_exports.union([
   external_exports.literal("move"),
   external_exports.literal("delete")
 ]);
-var wireGrantsSchema = external_exports.array(external_exports.unknown());
 var workingFileSchema = external_exports.strictObject({
   path: external_exports.string().min(1),
   name: external_exports.string().min(1),
@@ -14269,7 +14268,6 @@ var invokeFrameSchema = external_exports.object({
   particleId: particleIdSchema,
   action: external_exports.string().min(1),
   input: external_exports.unknown(),
-  grants: wireGrantsSchema,
   workingFile: workingFileSchema.optional()
 });
 var resultOutcomeSchema = external_exports.union([
@@ -14344,16 +14342,10 @@ var childToSupervisorFrameSchema = external_exports.discriminatedUnion("type", [
   heartbeatFrameSchema
 ]);
 
+// ../models/src/skill-runtime/fs-root.ts
+var rootSchema = external_exports.enum(["documents", "downloads", "desktop"]);
+
 // ../models/src/skill-runtime/manifest-verbs.ts
-var capabilityKindSchema = external_exports.union([
-  external_exports.literal("fs:read:scoped"),
-  external_exports.literal("fs:write:scoped"),
-  external_exports.literal("fs:read:host"),
-  external_exports.literal("fs:write:host"),
-  external_exports.literal("proc:read"),
-  external_exports.literal("net:egress"),
-  external_exports.literal("exec:subprocess")
-]);
 var manifestVerbPermissionSchema = external_exports.union([
   external_exports.literal("enabled"),
   external_exports.literal("disabled"),
@@ -14378,22 +14370,14 @@ var manifestVerbSchema = external_exports.object({
   action: external_exports.string().min(1),
   inputSchema: jsonObjectSchema,
   prompt: manifestVerbPromptSchema,
-  capability: capabilityKindSchema,
   permissions: manifestVerbPermissionFlagsSchema
-});
+}).strict();
 var manifestDeviceBlockSchema = external_exports.object({
   eligibility: external_exports.object({
     os: external_exports.array(external_exports.string()),
     arch: external_exports.array(external_exports.string())
-  }),
-  roots: external_exports.array(
-    external_exports.union([
-      external_exports.literal("documents"),
-      external_exports.literal("downloads"),
-      external_exports.literal("desktop")
-    ])
-  )
-});
+  })
+}).strict();
 var manifestSandboxBlockSchema = external_exports.object({
   start: external_exports.string().min(1)
 });
@@ -14420,6 +14404,162 @@ var MAX = Number.MAX_SAFE_INTEGER;
 var MAX_BIGINT = BigInt(MAX);
 
 // ../models/src/tools.ts
+var TOOL_RESULT_TRANSPORT_MAX_BYTES = 4096;
+var utf8ByteLength = (value) => new TextEncoder().encode(value).length;
+var toolResultTransportSchema = external_exports.record(
+  external_exports.string(),
+  // `.optional()` (MIS-649 follow-up): an EXPLICITLY-undefined value is
+  // accepted and stripped, so `{ cursor: maybeUndefined }` — the natural
+  // spelling when a cursor may be absent — behaves exactly like an absent
+  // key. Rejecting it made the whole result `malformed`, which on the inline
+  // path handed the model the raw `{"kind":"tool-result-envelope",…}` wrapper
+  // and lost dedup: a punishing outcome for the obvious spelling.
+  external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]).optional()
+).refine(
+  (value) => utf8ByteLength(JSON.stringify(value)) <= TOOL_RESULT_TRANSPORT_MAX_BYTES,
+  {
+    message: `transport exceeds ${TOOL_RESULT_TRANSPORT_MAX_BYTES} bytes when JSON-serialized`
+  }
+);
+var toolResultEnvelopeTagSchema = external_exports.object({
+  kind: external_exports.literal("tool-result-envelope")
+});
+var toolResultEnvelopeSchema = external_exports.object({
+  kind: external_exports.literal("tool-result-envelope"),
+  /**
+   * `z.unknown()` is INTENTIONAL here and is not an R2 violation waiting to be
+   * fixed. R2 bans `z.unknown()` in a schema that defines a contract with the
+   * outside world — because the field then reaches downstream code untyped.
+   * This contract deliberately ENDS at the envelope: the platform's whole job
+   * is to serialize and hash `content` without knowing its shape, and the
+   * moment the platform can describe that shape it has acquired knowledge of a
+   * particular tool. There is no downstream code that reads a field off
+   * `content`; modeling "the real shape" here is not merely unnecessary, it is
+   * the exact coupling this type exists to prevent. Presence (not shape) is
+   * what the platform requires, and the refinement below enforces it.
+   */
+  content: external_exports.unknown(),
+  /** transport holds only values that would differ between two calls that returned
+   *  the same result — echoed cursors, request ids, fetch timestamps. If two results
+   *  differing only in this field are genuinely *different results*, it belongs in
+   *  `content` (`complete`, `capReached`, `truncated`, `total`, `exitCode` all belong
+   *  in `content`). Governs identity, not representation.
+   *
+   *  TAINT-BEARING FIELDS BELONG IN `content`, NEVER IN `transport`. Downstream
+   *  taint admission parses `taintSources` off the tool result AFTER
+   *  `wrapToolResult` has run (see
+   *  `apps/temporal/src/workflows/agent-conversation/activities/conversation-history-taint.ts`),
+   *  and by then `transport` has been split off the hashed bytes and rides on the
+   *  reference instead. A tool that moved `taintSources` into `transport` would
+   *  lose its taint SILENTLY — no schema error, no log, just an untainted turn.
+   *  `transport` is for values the platform is contractually indifferent to;
+   *  taint is the opposite of indifferent. */
+  transport: toolResultTransportSchema.optional()
+}).strict().refine((value) => value.content !== void 0, {
+  message: "tool-result envelope `content` is missing or undefined"
+});
+var toolResult = (content, transport) => transport === void 0 ? { kind: "tool-result-envelope", content } : { kind: "tool-result-envelope", content, transport };
+var definedTransport = (transport) => {
+  if (transport === void 0) return void 0;
+  const entries = Object.entries(transport).filter(
+    ([, value]) => value !== void 0
+  );
+  return entries.length === 0 ? void 0 : Object.fromEntries(entries);
+};
+var selectHashedContent = (input) => {
+  const probe = () => {
+    const claimsEnvelope = toolResultEnvelopeTagSchema.safeParse(input.result);
+    if (!claimsEnvelope.success) {
+      return {
+        classification: "absent",
+        hashed: input.offloadText ?? input.result
+      };
+    }
+    const parsed = toolResultEnvelopeSchema.safeParse(input.result);
+    if (!parsed.success) {
+      return {
+        classification: "malformed",
+        hashed: input.offloadText ?? input.result,
+        reason: parsed.error.issues.map((issue2) => `${issue2.path.join(".") || "<root>"}: ${issue2.message}`).join("; ")
+      };
+    }
+    const transport = definedTransport(parsed.data.transport);
+    return {
+      classification: "valid",
+      hashed: input.offloadText ?? parsed.data.content,
+      transport
+    };
+  };
+  try {
+    return probe();
+  } catch (err) {
+    return {
+      classification: "malformed",
+      hashed: input.offloadText ?? input.result,
+      reason: `envelope probe threw while reading the result: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+};
+var serializeForIdentity = (value) => {
+  if (value instanceof Uint8Array) {
+    return {
+      bytes: value,
+      contentType: "application/octet-stream",
+      ext: "bin",
+      previewSource: `[binary ${value.length}b]`
+    };
+  }
+  if (typeof value === "string") {
+    const isJsonString = (s) => {
+      try {
+        JSON.parse(s);
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    const isJson = isJsonString(value);
+    return {
+      bytes: new TextEncoder().encode(value),
+      contentType: isJson ? "application/json" : "text/plain",
+      ext: isJson ? "json" : "txt",
+      previewSource: value
+    };
+  }
+  const safeJson = (v) => {
+    try {
+      return JSON.stringify(
+        v ?? null,
+        (_, x) => typeof x === "bigint" ? x.toString() : x
+      );
+    } catch {
+      return null;
+    }
+  };
+  const json2 = safeJson(value);
+  if (typeof json2 === "string") {
+    return {
+      bytes: new TextEncoder().encode(json2),
+      contentType: "application/json",
+      ext: "json",
+      previewSource: json2
+    };
+  }
+  const safeText = (v) => {
+    try {
+      return String(v);
+    } catch {
+      return `[unserializable ${typeof v}]`;
+    }
+  };
+  const text = safeText(value);
+  return {
+    bytes: new TextEncoder().encode(text),
+    contentType: "text/plain",
+    ext: "txt",
+    previewSource: text
+  };
+};
 var DEVICE_WRITE_TOOL_NAME_LIST = [
   "file_write",
   "file_update",
@@ -14441,7 +14581,8 @@ var DEVICE_DELIVERABLE_TOOL_NAME_LIST = [
 var DEVICE_READ_TOOL_NAME_LIST = [
   "file_read",
   "file_list",
-  "file_find",
+  // search_files — ripgrep-powered find-and-count; a read/extract verb.
+  "search_files",
   "excel_read",
   "word_read",
   "pdf_read",
@@ -14489,8 +14630,83 @@ var PLATFORM_READ_OR_GATHER_TOOL_NAMES = new Set(
   PLATFORM_READ_OR_GATHER_TOOL_NAME_LIST
 );
 
+// src/content-identity.ts
+import { createHash } from "crypto";
+var contentIdentity = (result) => {
+  assertNotWireWrapped(result, "contentIdentity");
+  const { hashed } = selectHashedContent({ result });
+  return createHash("sha256").update(serializeForIdentity(hashed).bytes).digest("hex");
+};
+var PROBE_CONTENT = { records: [{ id: "probe-1" }] };
+var PROBE_OTHER_CONTENT = { records: [{ id: "probe-2" }] };
+var staleBuildAdvice = "The loaded @on-mission/sdk build does not implement the content-identity envelope contract (MIS-649). This is almost certainly a STALE BUILD: `@mission/models` is source-only and is bundled into `packages/sdk/dist`, and the turbo `test` task does not depend on `build`, so editing `packages/models/src/tools.ts` leaves the dist that tests actually import untouched. Rebuild it \u2014 `yarn turbo build --filter=@on-mission/sdk` \u2014 and run again. If a fresh build still fails this check, the contract itself is broken and every content-identity assertion below it is meaningless.";
+var WIRE_WRAPPER_KEY = "result";
+var looksLikeUndecodedWireResponse = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const keys = Object.keys(value);
+  return keys.length === 1 && keys[0] === WIRE_WRAPPER_KEY;
+};
+var assertNotWireWrapped = (value, where) => {
+  if (!looksLikeUndecodedWireResponse(value)) return;
+  throw new Error(
+    `${where}: the value handed to the content-identity module has exactly one key, \`result\` \u2014 which is the shape \`@on-mission/sdk\` puts on the WIRE (\`POST /_mission/tools/:toolName\` answers \`{ result: <handler return> }\`), not the shape a handler returns. The likely cause is an UN-DECODED SDK wire response: something passed \`await response.json()\` straight into identity instead of the platform's decoded result (\`parseSkillToolResponse\`). Hashing the wrapper is the MIS-649 production defect \u2014 the envelope tag probe tests the wrapper, classification is \`absent\`, and a volatile cursor stays in the hashed bytes. Pass the handler's own return value. (If your handler genuinely returns \`{ result: \u2026 }\` and nothing else, that shape is indistinguishable from the wrapper \u2014 give the payload a name.)`
+  );
+};
+var assertContentIdentityContractLoaded = () => {
+  const cursorA = contentIdentity(toolResult(PROBE_CONTENT, { offset: "A" }));
+  const cursorB = contentIdentity(
+    toolResult(PROBE_CONTENT, { offset: "B-TOTALLY-DIFFERENT" })
+  );
+  if (cursorA !== cursorB) {
+    throw new Error(
+      `content-identity contract NOT PRESENT in the loaded build: an identical \`content\` under two different \`transport\` values hashed differently (${cursorA} vs ${cursorB}); transport is supposed to be excluded from the digest entirely. ${staleBuildAdvice}`
+    );
+  }
+  const other = contentIdentity(
+    toolResult(PROBE_OTHER_CONTENT, { offset: "A" })
+  );
+  if (other === cursorA) {
+    throw new Error(
+      `content-identity contract NOT PRESENT in the loaded build: two DIFFERENT \`content\` values hashed to the same digest (${other}); the digest is not reading \`content\` at all. ${staleBuildAdvice}`
+    );
+  }
+  const armed = (() => {
+    try {
+      contentIdentity({ result: PROBE_CONTENT });
+      return false;
+    } catch {
+      return true;
+    }
+  })();
+  if (!armed) {
+    throw new Error(
+      `content-identity contract NOT PRESENT in the loaded build: the wire-wrapper tripwire did not fire for \`{ result: \u2026 }\`, so an un-decoded SDK wire response would be hashed as if it were a tool result \u2014 the MIS-649 defect, undetected. ${staleBuildAdvice}`
+    );
+  }
+};
+var assertContentIdentityStable = async (input) => {
+  assertContentIdentityContractLoaded();
+  const where = input.label === void 0 ? "" : ` [${input.label}]`;
+  const [firstCall, secondCall] = input.sameRecordsDifferentCursor;
+  const first = contentIdentity(await firstCall());
+  const second = contentIdentity(await secondCall());
+  if (first !== second) {
+    throw new Error(
+      `content identity is NOT stable${where}: two calls returning the same records hashed differently (${first} vs ${second}). A volatile value \u2014 a cursor, a request id, a timestamp \u2014 is inside \`content\`. Move it to \`transport\`.`
+    );
+  }
+  const other = contentIdentity(await input.differentRecords());
+  if (other === first) {
+    throw new Error(
+      `content identity is NOT discriminating${where}: a call returning different records hashed to the same value (${other}). Records that distinguish one result from another belong in \`content\`, not \`transport\`.`
+    );
+  }
+};
+
 // src/email-attachments.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash as createHash2, randomBytes } from "crypto";
 var GMAIL_ATTACHMENT_LIMITS = {
   provider: "Gmail",
   maxTotalRawBytes: 18 * 1024 * 1024
@@ -14642,7 +14858,7 @@ var assembleMimeMessage = (input, attachments) => {
   return [...headers, "", parts.join(CRLF)].join(CRLF);
 };
 var sendMessageId = (input) => {
-  const attachmentDigest = input.attachments.map((a) => createHash("sha256").update(a.bytes).digest("hex")).join(",");
+  const attachmentDigest = input.attachments.map((a) => createHash2("sha256").update(a.bytes).digest("hex")).join(",");
   const idSeed = [
     input.workspaceId,
     [...input.to].sort().join(","),
@@ -14653,7 +14869,7 @@ var sendMessageId = (input) => {
     input.html ?? "",
     attachmentDigest
   ].join("|");
-  const hash2 = createHash("sha256").update(idSeed).digest("hex");
+  const hash2 = createHash2("sha256").update(idSeed).digest("hex");
   return { hash: hash2, messageId: `<${hash2}@mission.send>` };
 };
 var EmailAttachments = {
@@ -14670,7 +14886,7 @@ var EmailAttachments = {
 };
 
 // src/files.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var FileTransferTimeoutError = class extends Error {
   constructor(operation) {
     super(`File transfer timed out: ${operation}`);
@@ -14736,7 +14952,7 @@ function createFilesModule(api2) {
   };
   const stageInboundBytes = async (input) => {
     const buffer2 = Buffer.isBuffer(input.bytes) ? input.bytes : Buffer.from(input.bytes);
-    const sha256 = createHash2("sha256").update(buffer2).digest("hex");
+    const sha256 = createHash3("sha256").update(buffer2).digest("hex");
     const contentType = normalizeContentType(input.contentType);
     const filename = sanitizeStagedName(input.filename);
     const { uploadUrl, contentLengthRange, key } = await api2.trpc.skill.requestStagingUpload.mutate({
@@ -15836,9 +16052,14 @@ export {
   FileTransferTimeoutError,
   MAX_STAGING_UPLOAD_BYTES,
   SkillToolHttpError,
+  TOOL_RESULT_TRANSPORT_MAX_BYTES,
+  assertContentIdentityContractLoaded,
+  assertContentIdentityStable,
   clearDebugLog,
+  contentIdentity,
   createMissionSDK,
   debugLog,
-  fileRefSchema
+  fileRefSchema,
+  toolResult
 };
 //# sourceMappingURL=index.js.map