@pikku/core 0.12.107 → 0.12.112

package/src/wirings/agent/agent-resume-authorization.test.ts

@@ -1,206 +0,0 @@
-import { beforeEach, describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-
-import {
-  resetPikkuState,
-  pikkuState,
-  setSingletonServices,
-} from '../../pikku-state.js'
-import { resumeAgentSync } from './agent-runner.js'
-import { resumeAgent } from './agent-stream.js'
-import { clearPermissionsCache } from '../../permissions.js'
-import { ForbiddenError, MissingScopeError } from '../../errors/errors.js'
-import type { CoreAgent } from './agent.types.js'
-import type { CoreUserSession } from '../../types/core.types.js'
-
-const logger = {
-  debug: () => {},
-  info: () => {},
-  warn: () => {},
-  error: () => {},
-} as any
-
-const RUN_ID = 'run-1'
-const TOOL_CALL_ID = 'tc-1'
-
-const suspendedRun = (agentName: string, resourceId: string) => ({
-  id: RUN_ID,
-  agentName,
-  resourceId,
-  threadId: 'thread-1',
-  status: 'suspended',
-  pendingApprovals: [
-    { toolCallId: TOOL_CALL_ID, toolName: 'refund', args: {}, runId: RUN_ID },
-  ],
-  messages: [],
-})
-
-const setup = (agentName: string, resourceId = 'u1') => {
-  const resolved: string[] = []
-  setSingletonServices({
-    logger,
-    agentRunState: {
-      getRun: async () => suspendedRun(agentName, resourceId),
-      resolveApproval: async (toolCallId: string) => {
-        resolved.push(toolCallId)
-        return true
-      },
-    },
-  } as any)
-  return resolved
-}
-
-const addAgent = (
-  agentName: string,
-  overrides: Partial<CoreAgent> = {}
-): CoreAgent => {
-  const agent: CoreAgent = {
-    name: agentName,
-    description: `${agentName} description`,
-    goal: `${agentName} goal`,
-    model: 'test/test-model',
-    ...overrides,
-  } as CoreAgent
-
-  pikkuState(null, 'agent', 'agents').set(agentName, agent)
-  return agent
-}
-
-const sessionService = (session: CoreUserSession | undefined) =>
-  ({
-    get: () => session,
-    setInitial: () => {},
-    sessionChanged: false,
-  }) as any
-
-beforeEach(() => {
-  resetPikkuState()
-  clearPermissionsCache()
-})
-
-describe('resumeAgentSync authorization', () => {
-  test('rejects when the agent permissions deny', async () => {
-    const resolved = setup('denied-agent')
-    addAgent('denied-agent', {
-      permissions: { denied: async () => false },
-    } as Partial<CoreAgent>)
-
-    await assert.rejects(
-      () =>
-        resumeAgentSync(
-          RUN_ID,
-          [{ toolCallId: TOOL_CALL_ID, approved: true }],
-          { sessionService: sessionService({ userId: 'u1' }) } as any
-        ),
-      ForbiddenError
-    )
-    assert.deepEqual(
-      resolved,
-      [],
-      'approvals must not be resolved when authorization fails'
-    )
-  })
-
-  test('rejects when a required scope is no longer held', async () => {
-    const resolved = setup('scoped-agent')
-    addAgent('scoped-agent', { scopes: ['admin:refund'] })
-
-    await assert.rejects(
-      () =>
-        resumeAgentSync(
-          RUN_ID,
-          [{ toolCallId: TOOL_CALL_ID, approved: true }],
-          {
-            sessionService: sessionService({
-              userId: 'u1',
-              scopes: ['support'],
-            }),
-          } as any
-        ),
-      MissingScopeError
-    )
-    assert.deepEqual(resolved, [], 'a revoked scope must block resumption')
-  })
-
-  test('passes the gate when the session still holds the scope', async () => {
-    setup('scoped-agent-ok')
-    addAgent('scoped-agent-ok', { scopes: ['admin:refund'] })
-
-    await assert.rejects(
-      () =>
-        resumeAgentSync(
-          RUN_ID,
-          [{ toolCallId: TOOL_CALL_ID, approved: true }],
-          {
-            sessionService: sessionService({
-              userId: 'u1',
-              scopes: ['admin:refund'],
-            }),
-          } as any
-        ),
-      (error: Error) =>
-        !(error instanceof ForbiddenError) &&
-        !(error instanceof MissingScopeError)
-    )
-  })
-
-  test('rejects when auth is required and the session is gone', async () => {
-    setup('auth-agent')
-    addAgent('auth-agent', { auth: true })
-
-    await assert.rejects(
-      () =>
-        resumeAgentSync(
-          RUN_ID,
-          [{ toolCallId: TOOL_CALL_ID, approved: true }],
-          { sessionService: sessionService(undefined) } as any
-        ),
-      ForbiddenError
-    )
-  })
-})
-
-describe('resumeAgent (streaming) authorization', () => {
-  const channel = {
-    send: async () => {},
-    close: async () => {},
-  } as any
-
-  test('rejects when the agent permissions deny', async () => {
-    const resolved = setup('stream-denied')
-    addAgent('stream-denied', {
-      permissions: { denied: async () => false },
-    } as Partial<CoreAgent>)
-
-    await assert.rejects(
-      () =>
-        resumeAgent(
-          { runId: RUN_ID, toolCallId: TOOL_CALL_ID, approved: true },
-          channel,
-          { sessionService: sessionService({ userId: 'u1' }) } as any
-        ),
-      ForbiddenError
-    )
-    assert.deepEqual(resolved, [])
-  })
-
-  test('rejects when a required scope is no longer held', async () => {
-    setup('stream-scoped')
-    addAgent('stream-scoped', { scopes: ['admin:refund'] })
-
-    await assert.rejects(
-      () =>
-        resumeAgent(
-          { runId: RUN_ID, toolCallId: TOOL_CALL_ID, approved: true },
-          channel,
-          {
-            sessionService: sessionService({
-              userId: 'u1',
-              scopes: ['support'],
-            }),
-          } as any
-        ),
-      MissingScopeError
-    )
-  })
-})

package/src/wirings/agent/agent-rpc.ts

@@ -1,116 +0,0 @@
-import type { PikkuRawWire } from '../../types/core.types.js'
-import type { SessionService } from '../../services/user-session-service.js'
-import type { CoreUserSession } from '../../types/core.types.js'
-import type { PikkuRPC } from '../rpc/rpc-types.js'
-import type { AgentInput, AgentStreamChannel } from './agent.types.js'
-import type { StreamAgentOptions } from './agent-prepare.js'
-import { runAgent, resumeAgentSync } from './agent-runner.js'
-import { streamAgent, resumeAgent, interruptAgent } from './agent-stream.js'
-import { wrapChannelWithAGUI } from './agent-agui.js'
-
-export type AgentRPCOptions = {
-  sessionService?: SessionService<CoreUserSession>
-}
-
-/**
- * `wire.rpc.agent`, implemented.
- *
- * Lives here rather than in `rpc-runner` so the agent surface is one file next
- * to the runner and stream code it delegates to, instead of a wing of the RPC
- * primitive.
- */
-export const createAgentRPC = (
-  wire: PikkuRawWire,
-  options: AgentRPCOptions
-): PikkuRPC['agent'] => {
-  const params = () => ({
-    sessionService: options.sessionService,
-    getCredential: wire.getCredential?.bind(wire),
-  })
-
-  const streamingChannel = (): AgentStreamChannel => {
-    const channel = wire.channel as unknown as AgentStreamChannel | undefined
-    if (!channel) throw new Error('No channel available for streaming')
-    return channel
-  }
-
-  /** `run` and `approve` return the same shape; only the call differs. */
-  const asRunResult = (result: Awaited<ReturnType<typeof runAgent>>) => ({
-    runId: result.runId,
-    result: result.object ?? result.text,
-    usage: result.usage,
-    ...(result.status === 'suspended' && {
-      status: 'suspended' as const,
-      pendingApprovals: result.pendingApprovals,
-    }),
-  })
-
-  return {
-    run: async (agentName: string, input: AgentInput) =>
-      asRunResult(await runAgent(agentName, input, params())),
-
-    stream: async (
-      agentName: string,
-      input: {
-        message: string
-        threadId: string
-        resourceId: string
-        model?: string
-        temperature?: number
-      },
-      streamOptions?: StreamAgentOptions
-    ) => {
-      let currentRunId: string | undefined
-      await streamAgent(
-        agentName,
-        input,
-        wrapChannelWithAGUI(streamingChannel(), {
-          threadId: input.threadId,
-          getRunId: () => currentRunId,
-        }),
-        params(),
-        undefined,
-        {
-          ...streamOptions,
-          onRunCreated: (runId) => {
-            currentRunId = runId
-            streamOptions?.onRunCreated?.(runId)
-          },
-        }
-      )
-    },
-
-    resume: async (
-      runId: string,
-      input: { toolCallId: string; approved: boolean },
-      streamOptions?: StreamAgentOptions
-    ) => {
-      await resumeAgent(
-        { runId, ...input },
-        wrapChannelWithAGUI(streamingChannel(), { runId }),
-        params(),
-        streamOptions
-      )
-    },
-
-    interrupt: async (runId: string, reason?: 'speech' | 'user' | 'timeout') =>
-      interruptAgent(
-        { runId, ...(reason ? { reason } : {}) },
-        { sessionService: options.sessionService }
-      ),
-
-    approve: async (
-      runId: string,
-      approvals: { toolCallId: string; approved: boolean }[],
-      expectedAgentName?: string
-    ) =>
-      asRunResult(
-        await resumeAgentSync(
-          runId,
-          approvals,
-          { sessionService: options.sessionService },
-          expectedAgentName
-        )
-      ),
-  }
-}