@pikku/core 0.12.94 → 0.12.96

package/src/wirings/agent/agent-helpers.test.ts

@@ -6,6 +6,7 @@ import {
   agentResume,
   agentApprove,
 } from './agent-helpers.js'
+import { agentCallOptions } from './agent-prepare.js'
 
 describe('agent helpers', () => {
   describe('agent', () => {
@@ -150,3 +151,65 @@ describe('agent helpers', () => {
     })
   })
 })
+
+describe('agentCallOptions', () => {
+  // An explicit `undefined` overrides the agent's own declared default with
+  // nothing, so a request that names no model would silently unset the one the
+  // agent declares.
+  test('a field nobody supplied is left out rather than sent as undefined', () => {
+    const options = agentCallOptions({
+      message: 'hello',
+      threadId: 't1',
+      resourceId: 'r1',
+    })
+    assert.equal('model' in options, false)
+    assert.equal('temperature' in options, false)
+    assert.equal('context' in options, false)
+    assert.equal('attachments' in options, false)
+  })
+
+  test('what was supplied is carried through unchanged', () => {
+    const options = agentCallOptions({
+      message: 'hello',
+      threadId: 't1',
+      resourceId: 'user-1',
+      model: 'a-model',
+      temperature: 0.2,
+      context: 'some context',
+      attachments: [{ type: 'image' as const, url: 'a.png' }],
+    })
+    assert.deepEqual(options, {
+      message: 'hello',
+      threadId: 't1',
+      resourceId: 'user-1',
+      attachments: [{ type: 'image' as const, url: 'a.png' }],
+      model: 'a-model',
+      temperature: 0.2,
+      context: 'some context',
+    })
+  })
+
+  // Zero is a temperature a caller can mean, and the falsy check every other
+  // field uses would drop it.
+  test('a temperature of zero survives, unlike an empty string', () => {
+    assert.equal(
+      agentCallOptions({
+        message: 'x',
+        threadId: 't',
+        resourceId: 'r',
+        temperature: 0,
+      }).temperature,
+      0
+    )
+    assert.equal(
+      'context' in
+        agentCallOptions({
+          message: 'x',
+          threadId: 't',
+          resourceId: 'r',
+          context: '',
+        }),
+      false
+    )
+  })
+})

package/src/wirings/agent/agent-prepare.ts

@@ -149,6 +149,31 @@ export function canAccessThread(
   )
 }
 
+/**
+ * An agent call with the fields nobody supplied left out.
+ *
+ * Omitted rather than passed as `undefined`, because an explicit `undefined`
+ * overrides the agent's own declared default with nothing — a request that
+ * names no model would silently unset the one the agent declares.
+ *
+ * Shared by the scaffolded `run` and `stream` routes, which receive the same
+ * input and differ only in what they do with the reply. `agentName` is not part
+ * of it: both callers pass that separately, because `rpc.agent.run` and
+ * `rpc.agent.stream` take it as their first argument and type the rest
+ * against it.
+ */
+export const agentCallOptions = (input: AgentInput): AgentInput => ({
+  message: input.message,
+  threadId: input.threadId,
+  resourceId: input.resourceId,
+  ...(input.attachments ? { attachments: input.attachments } : {}),
+  ...(input.model ? { model: input.model } : {}),
+  ...(input.temperature !== undefined
+    ? { temperature: input.temperature }
+    : {}),
+  ...(input.context ? { context: input.context } : {}),
+})
+
 export type StreamAgentOptions = {
   requiresToolApproval?: 'all' | 'explicit' | false
   onRunCreated?: (runId: string) => void

package/src/wirings/agent/index.ts

@@ -33,6 +33,7 @@ export {
   type StreamAgentOptions,
   ToolApprovalRequired,
   ToolCredentialRequired,
+  agentCallOptions,
   canAccessThread,
   isOwnedByPrincipal,
   threadOwnerConstraint,

package/src/wirings/scheduler/scheduler-runner.test.ts

@@ -213,6 +213,97 @@ describe('runScheduledTask', () => {
     assert.deepEqual(receivedSession, session)
   })
 
+  test('a task middleware can set the session the task runs as', async () => {
+    let frozenSession: CoreUserSession | undefined
+    const machineSession: CoreUserSession = {
+      userId: 'cron:machine-session-task',
+    }
+
+    const mockTask: CoreScheduledTask = {
+      name: 'machine-session-task',
+      schedule: '0 0 * * *',
+      middleware: [
+        async (_services: any, wire: any, next: any) => {
+          wire.setSession(machineSession)
+          return next()
+        },
+      ] as any,
+      func: {
+        func: async (_services: any, _data: any, wire: any) => {
+          frozenSession = wire.session
+        },
+        auth: false,
+      },
+    }
+
+    pikkuState(null, 'scheduler', 'meta')['machine-session-task'] = {
+      pikkuFuncId: 'scheduler_machine-session-task',
+      name: 'machine-session-task',
+      schedule: '0 0 * * *',
+    }
+    pikkuState(null, 'function', 'meta')['scheduler_machine-session-task'] = {
+      pikkuFuncId: 'scheduler_machine-session-task',
+      inputSchemaName: null,
+      outputSchemaName: null,
+      sessionless: true,
+    }
+    wireScheduler(mockTask)
+
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: createMockLogger(),
+    } as any)
+
+    await runScheduledTask({ name: 'machine-session-task' })
+
+    assert.deepEqual(frozenSession, machineSession)
+  })
+
+  test('a session-taking task does not warn that auth was disabled', async () => {
+    const mockTask: CoreScheduledTask = {
+      name: 'identified-task',
+      schedule: '0 0 * * *',
+      middleware: [
+        async (_services: any, wire: any, next: any) => {
+          wire.setSession({ userId: 'cron:identified-task' })
+          return next()
+        },
+      ] as any,
+      func: {
+        func: async () => {},
+      },
+    }
+
+    pikkuState(null, 'scheduler', 'meta')['identified-task'] = {
+      pikkuFuncId: 'scheduler_identified-task',
+      name: 'identified-task',
+      schedule: '0 0 * * *',
+    }
+    pikkuState(null, 'function', 'meta')['scheduler_identified-task'] = {
+      pikkuFuncId: 'scheduler_identified-task',
+      inputSchemaName: null,
+      outputSchemaName: null,
+      sessionless: false,
+    }
+    wireScheduler(mockTask)
+
+    const mockLogger = createMockLogger()
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: mockLogger,
+    } as any)
+
+    await runScheduledTask({ name: 'identified-task' })
+
+    assert.deepEqual(
+      mockLogger
+        .getLogs()
+        .filter(
+          (log) =>
+            log.level === 'warn' && /auth was explicitly disabled/.test(log.message)
+        ),
+      []
+    )
+  })
+
   test('should throw ScheduledTaskNotFoundError when task not found', async () => {
     const mockLogger = createMockLogger()
     pikkuState(null, 'package', 'singletonServices', {
@@ -655,3 +746,90 @@ describe('getScheduledTasks', () => {
     assert.equal(tasks.size, 0)
   })
 })
+
+/**
+ * A cron has no caller to authenticate, so the only thing that can give it an
+ * identity is its own wiring. These cover the mechanism the virtual-user
+ * scaffold's `virtualUserPlatformSession` relies on: middleware on the task
+ * sets the session, and the scope gate on the function it drives is enforced
+ * against exactly that session — a tick with no identity, or one holding the
+ * wrong scope, is refused the same way a person would be.
+ */
+describe('a scheduled task authorizes on the session its own middleware sets', () => {
+  const wireGatedTask = (
+    name: string,
+    middleware?: Array<
+      (services: any, wire: any, next: any) => Promise<void> | void
+    >
+  ) => {
+    let seen: CoreUserSession | undefined
+    const task: CoreScheduledTask = {
+      name,
+      schedule: '0 * * * *',
+      func: {
+        func: async (_services: any, _data: any, wire: any) => {
+          seen = await wire.getSession()
+        },
+      } as any,
+      middleware,
+    }
+    pikkuState(null, 'scheduler', 'meta')[name] = {
+      pikkuFuncId: `scheduler_${name}`,
+      name,
+      schedule: '0 * * * *',
+    }
+    pikkuState(null, 'function', 'meta')[`scheduler_${name}`] = {
+      pikkuFuncId: `scheduler_${name}`,
+      inputSchemaName: null,
+      outputSchemaName: null,
+      sessionless: false,
+      scopes: ['virtualUser:run'],
+    }
+    wireScheduler(task)
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: createMockLogger(),
+    } as any)
+    return () => seen
+  }
+
+  const settingSession = (session: CoreUserSession) => [
+    async (_services: any, wire: any, next: any) => {
+      await wire.setSession(session)
+      return next()
+    },
+  ]
+
+  test('is refused outright when nothing gives the tick an identity', async () => {
+    wireGatedTask('unidentified-tick')
+    await assert.rejects(
+      runScheduledTask({ name: 'unidentified-tick' }),
+      /Authentication required/
+    )
+  })
+
+  test('is refused when the identity it sets holds the wrong scope', async () => {
+    wireGatedTask(
+      'misscoped-tick',
+      settingSession({
+        userId: 'pikku-platform',
+        scopes: ['admin'],
+      } as CoreUserSession)
+    )
+    await assert.rejects(
+      runScheduledTask({ name: 'misscoped-tick' }),
+      /virtualUser:run/
+    )
+  })
+
+  test('runs as the platform user its middleware set', async () => {
+    const seen = wireGatedTask(
+      'platform-tick',
+      settingSession({
+        userId: 'pikku-platform',
+        scopes: ['virtualUser:run'],
+      } as CoreUserSession)
+    )
+    await runScheduledTask({ name: 'platform-tick' })
+    assert.equal(seen()?.userId, 'pikku-platform')
+  })
+})

package/src/wirings/scheduler/scheduler-runner.ts

@@ -116,7 +116,6 @@ export async function runScheduledTask({
     await runPikkuFunc('scheduler', meta.name, meta.pikkuFuncId, {
       singletonServices,
       createWireServices,
-      auth: false,
       data: () => undefined,
       inheritedMiddleware: meta.middleware,
       wireMiddleware: task.middleware,

package/src/wirings/virtual-user/index.ts

@@ -85,3 +85,23 @@ export {
   personaVirtualUserTarget,
   type PersonaTargetOptions,
 } from './virtual-user-target.js'
+export {
+  executeVirtualUserRun,
+  logVirtualUserTick,
+  requireVirtualUserRunStore,
+  requireVirtualUserScheduleStore,
+  runnablePersona,
+  serializeVirtualUserRun,
+  serializeVirtualUserSchedule,
+  serializeVirtualUserSteps,
+  signInPathFor,
+  startVirtualUserRun,
+  VIRTUAL_USER_VARIABLES,
+  virtualUserScheduleRunInput,
+  writeVirtualUserSchedule,
+  type ExecuteVirtualUserRunParams,
+  type ScaffoldPersonas,
+  type StartedVirtualUserRun,
+  type StartVirtualUserRunParams,
+  type WriteVirtualUserScheduleParams,
+} from './virtual-user-scaffold.js'

package/src/wirings/virtual-user/virtual-user-derive.test.ts

@@ -222,10 +222,10 @@ describe('deriving intents from scenarios', () => {
   test('the prose comes through with its placeholders left open', () => {
     const [intent] = deriveIntents(workflows, functions)
     assert.deepEqual(intent!.steps, [
-      'Given the orgAdmin is signed in',
+      'Given orgAdmin is signed in',
       // The scenario knows which address it invites. The user has to pick one.
-      'When the orgAdmin invites {email}',
-      'Then the orgAdmin sees the new member in the list',
+      'When orgAdmin invites {email}',
+      'Then orgAdmin sees the new member in the list',
     ])
   })
 
@@ -298,8 +298,8 @@ describe('deriving intents from scenarios', () => {
     )
 
     assert.deepEqual(intents[0]!.steps, [
-      'Given the orgAdmin is signed in',
-      'When the orgAdmin invites {email}',
+      'Given orgAdmin is signed in',
+      'When orgAdmin invites {email}',
     ])
     assert.deepEqual(intents[0]!.personas, ['orgAdmin'])
   })
@@ -396,3 +396,31 @@ describe('driving a virtual user through a signed-in actor', () => {
     assert.match(verdict.reasoning, /no assistant called 'concierge'/)
   })
 })
+
+// An adversarial run's transcript is working exploits against this same app,
+// and a schedule outlives the run that wrote it. Neither belongs in the hands
+// of the thing being run.
+test('a virtual user is never offered the machinery that runs virtual users', () => {
+  const catalogue = deriveCatalogue({
+    runVirtualUser: {
+      name: 'runVirtualUser',
+      expose: true,
+      scopes: ['virtualUser:run'],
+    },
+    getVirtualUserRunSteps: {
+      name: 'getVirtualUserRunSteps',
+      expose: true,
+      scopes: ['virtualUser:read'],
+    },
+    listBookings: {
+      name: 'listBookings',
+      expose: true,
+      scopes: ['bookings:read'],
+    },
+  } as any)
+
+  assert.deepEqual(
+    catalogue.map((entry) => entry.name),
+    ['listBookings']
+  )
+})

package/src/wirings/virtual-user/virtual-user-derive.ts

@@ -35,6 +35,15 @@ export const deriveCatalogue = (
     if (meta.scenario || meta.scenarioStep || meta.scenarioStepKind) continue
     // knowledge: decisions/internals/only-exposed-functions-enter-a-virtual-user-catalogue.md
     if (meta.expose !== true) continue
+    // A virtual user is not offered the machinery that runs virtual users. A
+    // persona whose role carries `virtualUser:*` would otherwise be able to
+    // start further runs, read every run's findings — an adversarial run's
+    // transcript is working exploits against this same app — and put a persona
+    // on a schedule that outlives it. Same reasoning as the scenario-step rule
+    // above: the tool is about the run, not about the product being explored.
+    if (meta.scopes?.some((scope) => scope.split(':')[0] === 'virtualUser')) {
+      continue
+    }
 
     const inputSchema = meta.inputSchemaName
       ? schemas[meta.inputSchemaName]