@opensoha/contracts 0.1.22 → 0.1.24

package/agent/personal-guest-runtime-result.schema.json

@@ -0,0 +1,164 @@
+{
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "operationId",
+    "bindingId",
+    "environment"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "opensoha.dev/personal-guest-runtime-result/v1"
+    },
+    "operationId": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+    },
+    "bindingId": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+    },
+    "environment": {
+      "$ref": "personal-environment-result.schema.json"
+    },
+    "file": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256",
+        "size"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1024,
+          "pattern": "^(?!/)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*//)[^\\x00\\r\\n\\\\]+$"
+        },
+        "contentBase64": {
+          "type": "string",
+          "maxLength": 60076
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "size": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 45056
+        }
+      }
+    },
+    "browser": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "controlId",
+        "generation",
+        "instanceId",
+        "width",
+        "height"
+      ],
+      "properties": {
+        "controlId": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+        },
+        "generation": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 9007199254740991
+        },
+        "instanceId": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+        },
+        "url": {
+          "type": "string",
+          "maxLength": 4096
+        },
+        "title": {
+          "type": "string",
+          "maxLength": 512
+        },
+        "text": {
+          "type": "string",
+          "maxLength": 4096
+        },
+        "jpegBase64": {
+          "type": "string",
+          "maxLength": 49152
+        },
+        "width": {
+          "const": 800
+        },
+        "height": {
+          "const": 600
+        }
+      }
+    },
+    "proof": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "instanceId",
+        "artifactSHA256",
+        "filesystemId",
+        "dockerImage",
+        "command",
+        "fileRead",
+        "fileWrite",
+        "browser",
+        "docker",
+        "credentialsHidden",
+        "namespacesIsolated"
+      ],
+      "properties": {
+        "instanceId": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+        },
+        "artifactSHA256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "filesystemId": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+        },
+        "dockerImage": {
+          "type": "string",
+          "pattern": "^docker\\.io/library/debian@sha256:[a-f0-9]{64}$"
+        },
+        "command": {
+          "type": "boolean"
+        },
+        "fileRead": {
+          "type": "boolean"
+        },
+        "fileWrite": {
+          "type": "boolean"
+        },
+        "browser": {
+          "type": "boolean"
+        },
+        "docker": {
+          "type": "boolean"
+        },
+        "credentialsHidden": {
+          "type": "boolean"
+        },
+        "namespacesIsolated": {
+          "type": "boolean"
+        }
+      }
+    }
+  },
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://opensoha.dev/schemas/personal-guest-runtime-result.schema.json",
+  "title": "personal-guest-runtime-result",
+  "description": "Frozen owner-authorized VM operation. Current mTLS pin, user authorization, resource scope and original reservation must all be valid. SSH launches only a fixed broker; tools installation cannot format, delete or accept model commands. Runtime policy and receipt correlation are additionally validated by the typed protocol."
+}

package/agent/personal-guest-runtime.schema.json

@@ -0,0 +1,304 @@
+{
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "operationId",
+    "binding",
+    "kind",
+    "request",
+    "deadline",
+    "artifactSHA256"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "opensoha.dev/personal-guest-runtime/v1"
+    },
+    "operationId": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+    },
+    "binding": {
+      "$ref": "personal-guest-binding.schema.json"
+    },
+    "kind": {
+      "enum": [
+        "environment",
+        "file_read",
+        "file_write",
+        "docker",
+        "browser"
+      ]
+    },
+    "request": {
+      "$ref": "personal-environment-request.schema.json"
+    },
+    "deadline": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "file": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1024,
+          "pattern": "^(?!/)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*//)[^\\x00\\r\\n\\\\]+$"
+        },
+        "contentBase64": {
+          "type": "string",
+          "maxLength": 60076
+        },
+        "expectedSHA256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        }
+      }
+    },
+    "browser": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "action",
+        "controlId",
+        "generation",
+        "owner"
+      ],
+      "properties": {
+        "action": {
+          "enum": [
+            "navigate",
+            "snapshot",
+            "click",
+            "type",
+            "pointer",
+            "acquire",
+            "takeover",
+            "return",
+            "release"
+          ]
+        },
+        "controlId": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+        },
+        "generation": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 9007199254740991
+        },
+        "owner": {
+          "enum": [
+            "agent",
+            "user"
+          ]
+        },
+        "taskId": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+        },
+        "url": {
+          "type": "string",
+          "maxLength": 4096
+        },
+        "selector": {
+          "type": "string",
+          "maxLength": 2048
+        },
+        "text": {
+          "type": "string",
+          "maxLength": 4096
+        },
+        "x": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 799
+        },
+        "y": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 599
+        }
+      }
+    },
+    "dockerImage": {
+      "type": "string",
+      "pattern": "^docker\\.io/library/debian@sha256:[a-f0-9]{64}$"
+    },
+    "source": {
+      "type": "string",
+      "enum": [
+        "native",
+        "user"
+      ]
+    },
+    "requestHash": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "artifactSHA256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "file_read"
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "file"
+        ]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "file_write"
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "file"
+        ]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "browser"
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "browser"
+        ]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "docker"
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "dockerImage"
+        ]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "environment"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "file": false,
+          "browser": false,
+          "dockerImage": false
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "file_read"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "browser": false,
+          "dockerImage": false
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "file_write"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "browser": false,
+          "dockerImage": false
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "browser"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "file": false,
+          "dockerImage": false
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "kind": {
+            "const": "docker"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "file": false,
+          "browser": false
+        }
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "source"
+        ],
+        "properties": {
+          "source": {
+            "const": "user"
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "requestHash"
+        ]
+      }
+    }
+  ],
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://opensoha.dev/schemas/personal-guest-runtime.schema.json",
+  "title": "personal-guest-runtime",
+  "description": "Frozen owner-authorized VM operation. Current mTLS pin, user authorization, resource scope and original reservation must all be valid. SSH launches only a fixed broker; tools installation cannot format, delete or accept model commands. Runtime policy and receipt correlation are additionally validated by the typed protocol."
+}

package/agent/personal-guest-tools.schema.json

@@ -0,0 +1,75 @@
+{
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "operationId",
+    "binding",
+    "artifactSHA256",
+    "diskQuotaBytes",
+    "cpuQuotaMilli",
+    "memoryBytes",
+    "pidsLimit",
+    "dockerImage",
+    "bubblewrapVersion",
+    "dockerVersion",
+    "chromiumVersion"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "opensoha.dev/personal-guest-tools/v1"
+    },
+    "operationId": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+    },
+    "binding": {
+      "$ref": "personal-guest-binding.schema.json"
+    },
+    "artifactSHA256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "diskQuotaBytes": {
+      "type": "integer",
+      "minimum": 16777216,
+      "maximum": 1099511627776,
+      "multipleOf": 1024
+    },
+    "cpuQuotaMilli": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 8000
+    },
+    "memoryBytes": {
+      "type": "integer",
+      "minimum": 33554432,
+      "maximum": 17179869184
+    },
+    "pidsLimit": {
+      "type": "integer",
+      "minimum": 4,
+      "maximum": 256
+    },
+    "dockerImage": {
+      "type": "string",
+      "pattern": "^docker\\.io/library/debian@sha256:[a-f0-9]{64}$"
+    },
+    "bubblewrapVersion": {
+      "type": "string",
+      "pattern": "^[0-9][a-zA-Z0-9.+:~_-]{0,127}$"
+    },
+    "dockerVersion": {
+      "type": "string",
+      "pattern": "^[0-9][a-zA-Z0-9.+:~_-]{0,127}$"
+    },
+    "chromiumVersion": {
+      "type": "string",
+      "pattern": "^[0-9][a-zA-Z0-9.+:~_-]{0,127}$"
+    }
+  },
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://opensoha.dev/schemas/personal-guest-tools.schema.json",
+  "title": "personal-guest-tools",
+  "description": "Frozen owner-authorized VM operation. Current mTLS pin, user authorization, resource scope and original reservation must all be valid. SSH launches only a fixed broker; tools installation cannot format, delete or accept model commands. Runtime policy and receipt correlation are additionally validated by the typed protocol."
+}

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "be2c1caf05e680f75b40e6ce017e55f1c35f7977cf045ca3ec562adbd6cb37dc"
-	PermissionCatalogSHA256 = "2822fab5a3963270e806884ce46402bb42f3384d5530e6ae0acc8bf253811de5"
+	PermissionCatalogContentSHA256 = "b1a07eef4c26f91735b65ec18799e530271a47d0eed1de60f9a955d11208f9a2"
+	PermissionCatalogSHA256 = "e89a89c109f4dca0ba3a5bea754df659aa8d9bf0298344e5f0b9c5cc7520a2d2"
 )
 
 //go:embed permission-catalog.json

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:be2c1caf05e680f75b40e6ce017e55f1c35f7977cf045ca3ec562adbd6cb37dc",
+  "contentHash": "sha256:b1a07eef4c26f91735b65ec18799e530271a47d0eed1de60f9a955d11208f9a2",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -11886,6 +11886,37 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "virtualization.vm_access.update",
+      "domain": "virtualization",
+      "resource": "vm_access",
+      "action": "update",
+      "displayName": "管理虚拟机登录绑定",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true,
+      "legacyAliases": []
+    },
+    {
+      "key": "virtualization.vms.connect",
+      "domain": "virtualization",
+      "resource": "vms",
+      "action": "connect",
+      "displayName": "连接虚拟机 SSH",
+      "riskLevel": "execute",
+      "scopeKinds": [
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "virtualization.vms.console",
       "domain": "virtualization",

package/auth/token-claims.schema.json

@@ -41,6 +41,11 @@
       ]
     },
     "sessionId": { "type": "string" },
+    "authzVersion": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Authorization version at session access-token issuance. A version mismatch invalidates this token even after its session refreshes. Legacy tokens without this field require an authoritative current-identity lookup; their embedded roles must not restore revoked grants."
+    },
     "subjectType": {
       "type": "string",
       "enum": ["user", "service_account", "runner", "anonymous"]

package/compat/consumer-revisions.json

@@ -1,7 +1,8 @@
 {
-  "soha": "d675a708806072a2fee42e3c2c00309091a8cfb9",
-  "soha-web": "816ec0fb82e6e804f0f66d47d3446a7b5baeabc1",
+  "soha": "c29cc6294dd4b7cb69db1187d728c227475fdf7c",
+  "soha-web": "447cbe5358802ef40d86ac67b7b59c5afe9c846a",
+  "soha-app": "0c3c76c373246f7d2218b48f68b89bf3097f777b",
   "soha-cli": "1c9b760c986a9c1a5148db55b72ab99d23edd7a3",
   "soha-agent": "af1efc0b0cd6bb544153429fa28244dd6cc81ac7",
-  "soha-skills": "0345171ee1c9f23ab5d4350767395d0919dfb21c"
+  "soha-skills": "bc115fab583d00d4cc7350d8f314077d11bb5488"
 }

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.22",
+  "version": "0.1.24",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.22",
+  "version": "0.1.24",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {