@piagent/platform 1.7.1 → 1.9.0

package/packages/piagent-core/managed/request-stream.mjs

@@ -0,0 +1,129 @@
+// One model request of a company role: through Studio with the role's grant,
+// on the route the harness chose. Studio answers a failure with a machine
+// code; this says who failed and why, in words. Only refusals that come before
+// the model does any work are asked again: a refusal for capacity waits in
+// line, a brief one (a sign-in being renewed, a lapsed grant) is asked again a
+// few times. Nothing that reached the model is sent twice.
+import { randomUUID } from 'node:crypto';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { describeFailure, failureCode, failureIsAdmissionRefusal, failureIsBriefRefusal, failureReason, unnamedFailureText } from '../runtime/managed-failure.mjs';
+
+// How long one request waits in line for a free company model account.
+const CAPACITY_WAIT_MS = 20 * 60_000;
+// A brief refusal (see failureIsBriefRefusal) is asked again up to three times,
+// 3, 6 and 9 s apart.
+const BRIEF_ASKS = 3, BRIEF_PAUSE_MS = 3_000;
+
+export function wrapRoleStreams(owner, runtime, role, { provider, verifyGrant }) {
+  for (const method of ['stream', 'streamSimple']) {
+    const original = runtime[method].bind(runtime);
+    runtime[method] = (model, context, options) => {
+      // Tools run between two answers: the count names the answer they came from.
+      if (role === 'main') owner.mainAnswers = (owner.mainAnswers ?? 0) + 1;
+      const out = owner.ai.createAssistantMessageEventStream(), signal = options?.signal;
+      void (async () => {
+        let wait = null, noted = false, brief = 0, refused = null;
+        // The error event and the final message carry the same failure: kept once.
+        const unnamed = raw => { noted ||= keepUnnamed(owner, role, raw); return raw; };
+        try {
+          if (role === 'main' && owner.preflight) throw Error(owner.preflight);
+          if (!owner.grant || model.provider !== provider) throw Error('managed-run-required');
+          // Studio's answer to a failed request is a machine code: say who
+          // failed and why, in words. Only an admission refusal is asked again.
+          // A request the member stopped ended, it did not fail; the provider may
+          // still report it as an error ("This operation was aborted").
+          const told = message => message?.stopReason !== 'error' ? message
+            : signal?.aborted ? { ...message, stopReason: 'aborted', errorMessage: 'Request was aborted' }
+            : { ...message, errorMessage: describeFailure(role, unnamed(message.errorMessage)) };
+          for (;;) {
+            // Asked again after a refusal and the grant cannot be renewed (the
+            // run was closed): the refusal says why, not the renewal.
+            const grant = await owner.broker.request('renew', { role }).catch((error) => { throw refused ? Error(refused) : error; });
+            verifyGrant(grant, owner.manifest, role);
+            if (role === 'main') owner.grant = grant;
+            const route = owner.routes.get(runtime);
+            if (!route || grant.provider_model_id !== route.native || grant.provider !== route.provider || grant.model_id !== route.model_id || model.id !== 'agent-watch-auto') throw Error('managed-route-changed');
+            const asked = Date.now();
+            const stream = original({ ...model, id: route.native }, context, { ...options, apiKey: grant.token, sessionId: grant.role_id, maxRetries: 0,
+              headers: { ...options?.headers, 'X-Session-Id': grant.role_id } });
+            // Whether Studio admitted the request is known at its first event
+            // after "start": until then nothing is passed on, so a refused
+            // request leaves no trace in the conversation.
+            let opening = [], refusal = null;
+            for await (const event of stream) {
+              if (opening && event.type === 'start') { opening.push(event); continue; }
+              const code = event.type === 'error' ? failureCode(event.error?.errorMessage) : null;
+              if (opening && code && !signal?.aborted && (failureIsAdmissionRefusal(code) || failureIsBriefRefusal(code) && brief < BRIEF_ASKS)) { refusal = event.error; break; }
+              if (opening) { for (const held of opening) out.push(held); opening = null; wait = capacityWaitEnded(owner, wait, 'admitted'); }
+              out.push(event.type === 'error' ? { ...event, ...(signal?.aborted ? { reason: 'aborted' } : {}), error: told(event.error) } : event);
+            }
+            if (!refusal) { for (const held of opening ?? []) out.push(held); out.end(told(await stream.result())); return; }
+            refused = String(refusal.errorMessage ?? '');
+            // A brief refusal is asked again after a short pause, without a wait step.
+            if (failureIsBriefRefusal(failureCode(refusal.errorMessage))) { brief += 1; await sleep((owner.briefPauseMs ?? BRIEF_PAUSE_MS) * brief, undefined, { signal }); continue; }
+            wait = await waitForCapacity(owner, wait, role, failureCode(refusal.errorMessage), signal, Date.now() - asked);
+            if (!wait) { out.push({ type: 'error', reason: 'error', error: told(refusal) }); return; }
+          }
+        } catch (error) {
+          // A request the member stopped ended, it did not fail: Pi's providers
+          // report it as "aborted", and so does this one.
+          const aborted = !!signal?.aborted;
+          out.push({ type: 'error', reason: aborted ? 'aborted' : 'error', error: { role: 'assistant', content: [], api: model.api, provider: provider, model: model.id,
+            stopReason: aborted ? 'aborted' : 'error', errorMessage: aborted ? 'Request was aborted' : describeFailure(role, unnamed(error?.message)), timestamp: Date.now(),
+            usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } } } });
+        } finally { capacityWaitEnded(owner, wait, signal?.aborted ? 'stopped' : 'ended'); }
+      })();
+      return out;
+    };
+  }
+}
+
+// A failure no code names is shown as "could not be sent"; its own words are
+// kept, redacted, in the conversation file (never shown) so it can be told
+// apart later. True when it was kept.
+export const UNNAMED_FAILURE_ENTRY = 'agent-watch-failure-detail';
+function keepUnnamed(owner, role, raw) {
+  const text = unnamedFailureText(raw);
+  if (text === null) return false;
+  try { owner.session?.sessionManager?.appendCustomEntry(UNNAMED_FAILURE_ENTRY, { role, text }); return true; }
+  catch { return false; /* the failure is still shown */ }
+}
+
+// Studio itself holds a refused request up to 30 s while it waits for a slot:
+// one it held is asked again almost at once, so a long wait keeps its place
+// against requests that just arrived. One refused at once (a rate limit) backs
+// off, 2 s doubling to 15 s.
+export function capacityDelayMs(asks, heldMs, random = Math.random()) {
+  return heldMs >= 10_000 ? 500 + 1000 * random : Math.min(15_000, 1_000 * 2 ** Math.min(asks, 4)) * (0.75 + random / 2);
+}
+
+// Studio refused a request for capacity (every company model account that
+// can serve this conversation is busy): the request waits in line and asks
+// again, shown as a step of the running turn; Stop ends the wait. Each ask
+// is an event, so the WebUI's idle watchdog sees the turn alive. After
+// CAPACITY_WAIT_MS it fails with Studio's reason. Null: stop waiting.
+async function waitForCapacity(owner, wait, role, code, signal, heldMs = 0) {
+  if (wait && Date.now() - wait.since >= (owner.capacityWaitMs ?? CAPACITY_WAIT_MS)) { capacityWaitEnded(owner, wait, 'gave-up'); return null; }
+  wait ??= { id: randomUUID(), role, since: Date.now(), asks: 0, open: true };
+  wait.asks += 1; wait.code = code;
+  owner.capacityWaits.add(wait);
+  owner.notify({ type: 'managed_capacity_wait', id: wait.id, role, code, state: wait.asks === 1 ? 'start' : 'waiting', waitedMs: Date.now() - wait.since });
+  capacityStatus(owner);
+  try { await sleep(capacityDelayMs(wait.asks, heldMs), undefined, { signal }); }
+  catch (error) { capacityWaitEnded(owner, wait, 'stopped'); throw error; }
+  return wait;
+}
+function capacityWaitEnded(owner, wait, outcome) {
+  if (!wait?.open) return null;
+  wait.open = false; owner.capacityWaits.delete(wait);
+  owner.notify({ type: 'managed_capacity_wait', id: wait.id, role: wait.role, code: wait.code, state: 'end', outcome, waitedMs: Date.now() - wait.since });
+  capacityStatus(owner);
+  return null;
+}
+// The Terminal's working line says who waits and why, while anyone does.
+function capacityStatus(owner) {
+  const wait = [...owner.capacityWaits].at(-1);
+  const who = wait?.role === 'main' ? 'main agent' : `${wait?.role} subagent`;
+  try { owner.session?.extensionRunner?.getUIContext?.()?.setWorkingMessage?.(wait ? `Agent Watch ${who}: waiting for a free company model account (${failureReason(wait.code)}). Esc stops.` : undefined); }
+  catch { /* no Terminal */ }
+}

package/packages/piagent-core/managed/resource-loader.mjs

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const INSTRUCTION_FILES = ['AGENTS.override.md', 'AGENTS.md', 'AGENTS.MD', 'CLAUDE.md', 'CLAUDE.MD'];
+// Project instructions from the project folder up to its repository root, as
+// context only (never as permission). Symlinks and large files are skipped;
+// personal/global instruction files are not read.
+export function projectInstructions(cwd, top = cwd) {
+  const files = [];
+  for (let dir = cwd, depth = 0; depth < 12; depth += 1) {
+    for (const name of INSTRUCTION_FILES) {
+      const file = path.join(dir, name);
+      try {
+        const stat = fs.lstatSync(file);
+        if (stat.isFile() && stat.size <= 64 * 1024) { files.unshift({ path: file, content: fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, '') }); break; }
+      } catch { /* absent */ }
+    }
+    if (dir === top || path.dirname(dir) === dir || !(dir + path.sep).startsWith(top + path.sep)) break;
+    dir = path.dirname(dir);
+  }
+  return files.slice(-4);
+}
+
+// Managed sessions never consult the personal trust store or execute resources
+// discovered in a project.
+export function managedResourceLoader(api, { systemPrompt, extensions = [], agentsFiles = [] } = {}) {
+  const runtime = api.createExtensionRuntime();
+  const empty = Object.freeze([]);
+  return Object.freeze({
+    getExtensions: () => ({ extensions, errors: empty, runtime }),
+    getSkills: () => ({ skills: empty, diagnostics: empty }),
+    getPrompts: () => ({ prompts: empty, diagnostics: empty }),
+    getThemes: () => ({ themes: empty, diagnostics: empty }),
+    getAgentsFiles: () => ({ agentsFiles: agentsFiles.map((file) => ({ ...file })) }),
+    getSystemPrompt: () => typeof systemPrompt === 'function' ? systemPrompt() : systemPrompt,
+    getSystemPromptSource: () => undefined,
+    getAppendSystemPrompt: () => empty,
+    getAppendSystemPromptSources: () => empty,
+    extendResources: () => { throw new Error('managed-project-resources-disabled'); },
+    reload: async () => {},
+  });
+}

package/packages/piagent-core/managed/review-snapshot-worker.mjs

@@ -0,0 +1,27 @@
+import fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { managedGit } from './toolchain.mjs';
+// Executed only through the tool Seatbelt boundary; repo-local Git config cannot
+// grant a hook, textconv or credential helper access to the trusted runtime.
+const git = args => execFileSync(managedGit(), ['--no-pager', ...args], { encoding: 'utf8', maxBuffer: 160000, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_CONFIG_NOSYSTEM: '1' } });
+const patch = git(['diff', '--binary', '--no-ext-diff', '--no-textconv', 'HEAD', '--', '.']);
+const paths = git(['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean).sort();
+if (paths.length > 100) throw Error('review-untracked-limit');
+const untracked = paths.map(name => {
+  const stat = fs.lstatSync(name);
+  if (stat.isSymbolicLink()) return { path: name, mode: 'symlink', target: fs.readlinkSync(name) };
+  if (!stat.isFile() || stat.size > 120000) throw Error('review-file-limit');
+  // Text goes as text, so the reviewer can read new files; binary as base64.
+  const data = fs.readFileSync(name);
+  let text = null;
+  if (!data.includes(0)) { try { text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(data); } catch { text = null; } }
+  return text === null ? { path: name, mode: stat.mode & 0o777, contents: data.toString('base64'), encoding: 'base64' } : { path: name, mode: stat.mode & 0o777, contents: text, encoding: 'utf8' };
+});
+const snapshot = JSON.stringify({ patch, untracked });
+if (Buffer.byteLength(snapshot) > 120000) throw Error('review-patch-limit');
+// With a part number the snapshot is sent in base64 parts small enough for the
+// shell tool's output limit, each headed by the whole snapshot's digest.
+const part = process.argv[2], bytes = Buffer.from(snapshot), SIZE = 30000;
+if (part === undefined) process.stdout.write(snapshot);
+else process.stdout.write(`${createHash('sha256').update(bytes).digest('hex')} ${Math.max(1, Math.ceil(bytes.length / SIZE))}\n${bytes.subarray(Number(part) * SIZE, (Number(part) + 1) * SIZE).toString('base64')}`);

package/packages/piagent-core/managed/sandbox-diagnostic.mjs

@@ -0,0 +1,12 @@
+const DENIAL = /\b(?:EPERM|EACCES)\b|operation not permitted|permission denied/i;
+const OFFLINE = /ENOTFOUND|EAI_AGAIN|Could not resolve host|getaddrinfo|npm error network|Failed to establish a new connection/i;
+// `network`: the member approved this command and it ran with network, so a
+// name that does not resolve is the machine's network, not the sandbox.
+export function sandboxDiagnostic(message, { network = false } = {}) {
+  const text=String(message);
+  if(network&&!DENIAL.test(text)&&OFFLINE.test(text))return 'managed-network-unreachable: Lệnh đã được duyệt và chạy có mạng nhưng không tới được host (máy đang offline, cần VPN/proxy công ty, hoặc sai tên host). Không xin duyệt lại cùng lệnh; báo người dùng lỗi mạng này.\n'+text;
+  if(!DENIAL.test(text)&&OFFLINE.test(text))return 'managed-network-blocked: Lệnh bash thường không có mạng trong chế độ công ty. Nếu lệnh thật sự cần mạng (cài package, tải dữ liệu), dùng run_with_network để người dùng duyệt đúng lệnh đó.\n'+text;
+  if(!DENIAL.test(text))return text;
+  return 'managed-sandbox-denied: Công cụ bị giới hạn quyền trong chế độ công ty (hoặc quyền file của hệ điều hành). Keychain và file chứa credential như .env/.npmrc bị chặn. Lệnh cần mạng (cài package, tải dữ liệu) dùng run_with_network để xin duyệt; git fetch origin dùng fetch_origin. Không tự chạy lại bên ngoài sandbox.\n'+text;
+}
+

package/packages/piagent-core/managed/search-fallback.mjs

@@ -0,0 +1,93 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+// Built-in grep/find for machines without ripgrep/fd (and where they could not
+// be downloaded). Runs inside the sandbox worker. Files come from git (so
+// .gitignore applies) or a bounded walk; unreadable files, such as credential
+// files the sandbox denies, are skipped. Output mirrors Pi's grep/find.
+const SKIP = new Set(['.git', 'node_modules', '.hg', '.svn']);
+const MAX_FILES = 20_000, MAX_FILE_BYTES = 2 * 1024 * 1024, MAX_LINE = 500, MAX_OUTPUT = 50 * 1024;
+
+export function globToRegExp(glob) {
+  let out = '', index = 0;
+  while (index < glob.length) {
+    const char = glob[index];
+    if (char === '*' && glob[index + 1] === '*') { out += glob[index + 2] === '/' ? '(?:.*/)?' : '.*'; index += glob[index + 2] === '/' ? 3 : 2; continue; }
+    if (char === '*') out += '[^/]*';
+    else if (char === '?') out += '[^/]';
+    else if (char === '{') { const end = glob.indexOf('}', index); if (end > index) { out += '(?:' + glob.slice(index + 1, end).split(',').map(part => part.replace(/[.+^$()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*')).join('|') + ')'; index = end + 1; continue; } out += '\\{'; }
+    else out += char.replace(/[.+^$()|[\]\\]/g, '\\$&');
+    index += 1;
+  }
+  return new RegExp('^' + out + '$');
+}
+const matcher = glob => {
+  if (!glob) return () => true;
+  const regex = globToRegExp(glob.replace(/^\.\//, ''));
+  return glob.includes('/') ? file => regex.test(file) : file => regex.test(file) || regex.test(path.basename(file));
+};
+
+function listFiles(root) {
+  try {
+    const out = execFileSync('git', ['-C', root, 'ls-files', '-co', '--exclude-standard', '-z'], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] });
+    return out.split('\0').filter(Boolean).slice(0, MAX_FILES);
+  } catch { /* not a repository: walk */ }
+  const files = [];
+  const walk = dir => {
+    let entries = [];
+    try { entries = fs.readdirSync(path.join(root, dir), { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      if (files.length >= MAX_FILES) return;
+      const rel = dir ? `${dir}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) { if (!SKIP.has(entry.name)) walk(rel); }
+      else if (entry.isFile()) files.push(rel);
+    }
+  };
+  walk('');
+  return files;
+}
+
+function scope(cwd, target = '.') {
+  const absolute = path.resolve(cwd, target);
+  if (fs.statSync(absolute).isFile()) return { root: path.dirname(absolute), only: path.basename(absolute), base: absolute };
+  return { root: absolute, only: null, base: absolute };
+}
+
+export function fallbackGrep(cwd, { pattern, path: target, glob, ignoreCase, literal, context = 0, limit = 100 }) {
+  const { root, only } = scope(cwd, target);
+  const source = literal ? String(pattern).replace(/[.*+?^${}()|[\]\\]/g, '\\$&') : String(pattern);
+  const regex = new RegExp(source, ignoreCase ? 'i' : '');
+  const accept = matcher(glob), cap = Math.max(1, Math.min(1000, Number(limit) || 100)), around = Math.max(0, Math.min(10, Number(context) || 0));
+  const lines = []; let matches = 0, bytes = 0;
+  for (const rel of only ? [only] : listFiles(root)) {
+    if (matches >= cap || bytes > MAX_OUTPUT) break;
+    if (!accept(rel)) continue;
+    const file = path.join(root, rel), shown = path.relative(cwd, file) || rel;
+    let text;
+    try { if (fs.statSync(file).size > MAX_FILE_BYTES) continue; text = fs.readFileSync(file, 'utf8'); } catch { continue; }
+    if (text.includes('\0')) continue;
+    const rows = text.split(/\r?\n/);
+    for (let index = 0; index < rows.length && matches < cap; index += 1) {
+      if (!regex.test(rows[index])) continue;
+      matches += 1;
+      for (let at = Math.max(0, index - around); at <= Math.min(rows.length - 1, index + around); at += 1) {
+        const line = `${shown}${at === index ? ':' : '-'}${at + 1}${at === index ? ':' : '-'} ${rows[at].slice(0, MAX_LINE)}`;
+        lines.push(line); bytes += line.length;
+      }
+    }
+  }
+  const notice = matches >= cap ? `\n\n[${cap} matches limit reached. Use limit=${cap * 2} for more, or refine pattern]` : '';
+  return { content: [{ type: 'text', text: matches ? lines.join('\n') + notice : 'No matches found' }], details: matches >= cap ? { matchLimitReached: cap } : undefined };
+}
+
+export function fallbackFind(cwd, { pattern, path: target, limit = 1000 }) {
+  const { root } = scope(cwd, target);
+  const accept = matcher(String(pattern)), cap = Math.max(1, Math.min(5000, Number(limit) || 1000));
+  const found = [];
+  for (const rel of listFiles(root)) {
+    if (found.length >= cap) break;
+    if (accept(rel)) found.push(path.relative(cwd, path.join(root, rel)) || rel);
+  }
+  return { content: [{ type: 'text', text: found.length ? found.join('\n') : 'No files found matching pattern' }], details: undefined };
+}