@rallycry/conveyor-agent 11.0.43 → 11.0.45

package/dist/{chunk-FHYK2NIT.js → chunk-IIYEASRQ.js}

@@ -8,7 +8,7 @@ import {
   readWorkspaceBytes,
   statWorkspacePath,
   workspacePathExists
-} from "./chunk-4SX3FFVU.js";
+} from "./chunk-IBLFLCFK.js";
 import {
   reportBootMilestone
 } from "./chunk-Q4FQOJ7D.js";

package/dist/{chunk-XDIMT2ZM.js → chunk-NHKEFOCV.js}

@@ -98,7 +98,7 @@ import {
   statWorkspacePath,
   updateRemoteToken,
   verifyGitCredential
-} from "./chunk-4SX3FFVU.js";
+} from "./chunk-IBLFLCFK.js";
 import {
   registerBootMilestoneSocketFallback,
   reportBootMilestone
@@ -9343,6 +9343,109 @@ var evaluateQuestionsContract = defineToolContract({
   }
 });
 var evaluateContracts = [evaluateQuestionsContract];
+var listSiteAssetTargetsContract = defineToolContract({
+  name: "list_site_asset_targets",
+  agent: {
+    description: "List the registered static-site media targets this card's project may publish to.",
+    fields: {}
+  },
+  mcp: {
+    description: "List registered static-site media targets for a project.",
+    fields: { projectId: mcpProjectId }
+  }
+});
+var uploadSiteAssetsContract = defineToolContract({
+  name: "upload_site_assets",
+  agent: {
+    description: "Upload up to 50 workspace image or video files (25 MiB each) to a registered site using Conveyor identity. Call list_site_asset_targets first for the registered siteId. Returns verified immutable keys and public URLs per file.",
+    fields: {
+      siteId: f.string({ min: 1, max: 100 }),
+      paths: f.array(f.string({ min: 1 }), { min: 1, max: 50 })
+    }
+  },
+  mcp: {
+    description: "Upload up to 50 workspace image or video files (25 MiB each) to a registered site using Conveyor identity. Call list_site_asset_targets first for the registered siteId. Returns verified immutable keys and public URLs per file.",
+    fields: {
+      projectId: mcpProjectId,
+      siteId: f.string({ min: 1, max: 100 }),
+      paths: f.array(f.string({ min: 1 }), { min: 1, max: 50 })
+    }
+  }
+});
+var siteAssetsContracts = [
+  listSiteAssetTargetsContract,
+  uploadSiteAssetsContract
+];
+function validateSiteAssetResult(value, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("verify returned invalid JSON");
+  const result = value;
+  for (const key of ["key", "publicUrl", "sha256", "sizeBytes", "mimeType"]) {
+    if (result[key] !== expected[key])
+      throw new Error(`verify response ${key} does not match upload capability`);
+  }
+  if (result.status !== "uploaded" && result.status !== "existing")
+    throw new Error("verify response has invalid status");
+  return { ...expected, status: result.status };
+}
+async function readReply(response) {
+  if (!response.body) throw new Error("verify returned an empty response");
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 16384) throw new Error("verify response exceeds 16KiB");
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+  } finally {
+    await reader.cancel();
+    reader.releaseLock();
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error("verify returned invalid JSON");
+  }
+}
+async function transferSiteAsset(capability, bytes, expected) {
+  const options = {
+    headers: capability.headers,
+    redirect: "error",
+    signal: AbortSignal.timeout(6e4)
+  };
+  let put;
+  try {
+    put = await fetch(capability.uploadUrl, { ...options, method: "PUT", body: bytes });
+  } catch {
+    throw new Error("Upload transfer failed or timed out; retry this file");
+  }
+  await put.body?.cancel();
+  if (!put.ok) throw new Error(`upload HTTP ${put.status}; retry or check site access`);
+  let verify;
+  try {
+    verify = await fetch(`${new URL(capability.uploadUrl).origin}/_site-assets/verify`, {
+      ...options,
+      method: "POST",
+      signal: AbortSignal.timeout(6e4)
+    });
+  } catch {
+    throw new Error("Upload verification failed or timed out; retry this file");
+  }
+  if (!verify.ok) {
+    await verify.body?.cancel();
+    throw new Error(`verify HTTP ${verify.status}; retry or check site access`);
+  }
+  return {
+    ...validateSiteAssetResult(await readReply(verify), expected),
+    status: put.status === 201 ? "uploaded" : "existing"
+  };
+}
 var TOOL_CONTRACTS = Object.fromEntries(
   [
     ...tasksContracts,
@@ -9361,7 +9464,8 @@ var TOOL_CONTRACTS = Object.fromEntries(
     ...logsContracts,
     ...ciWaitContracts,
     ...evaluateContracts,
-    ...incidentsContracts
+    ...incidentsContracts,
+    ...siteAssetsContracts
   ].map((contract) => [contract.name, contract])
 );
 
@@ -11893,8 +11997,60 @@ function buildEvaluateTools(connection, projectId) {
   ];
 }
 
+// src/tools/site-asset-tools.ts
+import crypto from "crypto";
+import { extname as extname2, isAbsolute as isAbsolute3, join as join19 } from "path";
+var MAX_SITE_ASSET_BYTES = 25 * 1024 * 1024;
+function buildSiteAssetTools(connection, config, projectId) {
+  const list = defineContractTool(listSiteAssetTargetsContract, async () => {
+    try {
+      return textResult(
+        JSON.stringify(await connection.call("listSiteAssetTargets", { projectId }), null, 2)
+      );
+    } catch (error) {
+      return textResult(
+        `Failed to list static-site targets: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+    }
+  });
+  const upload = defineContractTool(uploadSiteAssetsContract, async ({ siteId, paths }) => {
+    const results = [];
+    for (const requestedPath of [...paths].sort()) {
+      const path = isAbsolute3(requestedPath) ? requestedPath : join19(config.workspaceDir, requestedPath);
+      try {
+        const info = await statWorkspacePath(path);
+        if (!info.isFile) throw new Error("not a file");
+        if (info.size > MAX_SITE_ASSET_BYTES) throw new Error("asset exceeds 25MiB limit");
+        const bytes = await readWorkspaceBytes(path);
+        if (bytes.length !== info.size || bytes.length > MAX_SITE_ASSET_BYTES)
+          throw new Error("asset changed during read or exceeds 25MiB limit");
+        const sha256 = crypto.createHash("sha256").update(bytes).digest("hex");
+        const capability = await connection.call("requestSiteAssetUpload", {
+          projectId,
+          siteId,
+          sha256,
+          ext: extname2(path).slice(1).toLowerCase(),
+          sizeBytes: bytes.length
+        });
+        const result = await transferSiteAsset(capability, new Uint8Array(bytes), {
+          key: capability.key,
+          publicUrl: capability.publicUrl,
+          sha256,
+          sizeBytes: bytes.length,
+          mimeType: capability.headers["content-type"]
+        });
+        results.push({ path, ...result });
+      } catch (error) {
+        results.push({ path, error: error instanceof Error ? error.message : "Upload failed" });
+      }
+    }
+    return textResult(JSON.stringify({ results }, null, 2));
+  });
+  return [list, upload];
+}
+
 // src/tools/connected-tools.ts
-function connectedToolsFor(connection, context) {
+function connectedToolsFor(connection, context, config) {
   const projectId = context?.projectId;
   if (!projectId) return [];
   return [
@@ -11910,7 +12066,8 @@ function connectedToolsFor(connection, context) {
     ...buildEvaluateTools(connection, projectId),
     ...context.googleAnalyticsConfigured ? [buildAnalyticsSummaryTool(connection, projectId)] : [],
     ...context.gcpLogsConfigured ? [buildQueryGcpLogsTool(connection, projectId)] : [],
-    ...context.grafanaLogsConfigured ? [buildQueryGrafanaLogsTool(connection, projectId)] : []
+    ...context.grafanaLogsConfigured ? [buildQueryGrafanaLogsTool(connection, projectId)] : [],
+    ...config && context.siteAssetTargetsConfigured ? buildSiteAssetTools(connection, config, projectId) : []
   ];
 }
 
@@ -12125,7 +12282,7 @@ function buildConveyorTools(connection, config, context, agentMode) {
   const handoffTools = config.mode === "pm" && (effectiveMode === "discovery" || effectiveMode === "auto") ? [buildHandoffTool(connection)] : [];
   const emergencyTools = [buildForceUpdateTaskStatusTool(connection)];
   const glossaryTools = glossaryToolsFor(connection, config, context);
-  const connectedTools = connectedToolsFor(connection, context);
+  const connectedTools = connectedToolsFor(connection, context, config);
   const isPack = config.mode === "pack" || Boolean(context?.isParentTask);
   return withAlwaysLoad(
     [
@@ -12368,6 +12525,7 @@ function handleRateLimitEvent(event, host) {
   const resetsAt = epochSecondsToISO(rate_limit_info.resetsAt);
   const utilization = rate_limit_info.utilization ?? (status === "rejected" ? 1 : void 0);
   if (utilization !== void 0 && rate_limit_info.rateLimitType) {
+    const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
     host.connection.sendEvent({
       type: "rate_limit_update",
       rateLimitType: rate_limit_info.rateLimitType,
@@ -12376,7 +12534,8 @@ function handleRateLimitEvent(event, host) {
       // The server parses this into the key's sessionResetsAt / weeklyResetsAt;
       // Codex reports a reset instant with every gauge, so allowed events carry
       // it too, not only rejections.
-      ...resetsAt ? { resetsAt } : {}
+      ...resetsAt ? { resetsAt } : {},
+      ...codingAgentKeyId ? { codingAgentKeyId } : {}
     });
   }
   if (status === "rejected") {
@@ -12707,7 +12866,7 @@ function fallbackResetIso(rateLimitType, now = Date.now()) {
 }
 
 // src/execution/tool-access.ts
-import { isAbsolute as isAbsolute3, posix } from "path";
+import { isAbsolute as isAbsolute4, posix } from "path";
 
 // src/execution/task-property-utils.ts
 function collectMissingProps(taskProps) {
@@ -12853,7 +13012,7 @@ function isPlanFile(input) {
 }
 function isScratchPath(input) {
   const filePath = String(input.file_path ?? input.path ?? "");
-  if (!isAbsolute3(filePath)) return false;
+  if (!isAbsolute4(filePath)) return false;
   return posix.normalize(filePath).startsWith("/tmp/");
 }
 var ARTIFACT_DENIED = "Publish deliverables on the card with upload_attachment; the Artifact tool is not available in Conveyor sessions.";
@@ -16187,6 +16346,7 @@ var SessionRunner = class _SessionRunner {
       baseBranch: ctx.baseBranch ?? "",
       projectName: ctx.projectName ?? null,
       projectDescription: ctx.projectDescription ?? null,
+      siteAssetTargetsConfigured: ctx.siteAssetTargetsConfigured ?? false,
       githubPRUrl: ctx.githubPRUrl,
       claudeSessionId: ctx.claudeSessionId ?? null,
       lastSeenMessageId: ctx.lastSeenMessageId ?? null,

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   WorkspaceCommandSupervisor,
   startWorkspaceCommandsAfterConnect,
   stopWorkspaceCommands
-} from "./chunk-FHYK2NIT.js";
+} from "./chunk-IIYEASRQ.js";
 import {
   PtyHarness,
   SessionRunner,
@@ -27,7 +27,7 @@ import {
   runUsageProbe,
   sampleKeyUsage,
   usesNativeUsageReporting
-} from "./chunk-XDIMT2ZM.js";
+} from "./chunk-NHKEFOCV.js";
 import "./chunk-37J5MMQT.js";
 import {
   inheritedEnv,
@@ -47,7 +47,7 @@ import {
   fetchBootstrap,
   loadAndAnnotateDiscoveredPorts,
   loadConveyorConfig
-} from "./chunk-4SX3FFVU.js";
+} from "./chunk-IBLFLCFK.js";
 import "./chunk-Q4FQOJ7D.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-372R6E4C.js";
@@ -1470,7 +1470,7 @@ if (!RUNNER_MODES.includes(CONVEYOR_MODE)) {
   process.exit(1);
 }
 if (CONVEYOR_MODE === "serving") {
-  const { runServingSession } = await import("./serve-boot-4KWT7W2I.js");
+  const { runServingSession } = await import("./serve-boot-G4LZGJ6W.js");
   exitContext.runnerMode = "serving";
   exitContext.sessionId = process.env.CONVEYOR_SESSION_ID ?? exitContext.sessionId;
   const outcome = await runServingSession({

package/dist/index.d.ts

@@ -374,6 +374,12 @@ declare class AgentConnection {
      * limited and hand back the best remaining key's credential env (or a
      * requeue confirmation when none is left). Awaited: the caller swaps
      * credentials and resumes on success, so it needs the real response.
+     *
+     * Names the key this pod is running so the server stamps THAT key: the
+     * session's own attribution can lag the credential a wake handed out, and
+     * stamping it blindly is how one key's cap landed on another. Read from the
+     * env at call time on purpose — `applyCycledKeyEnv` rewrites the var after a
+     * successful cycle, so a second cap names the replacement.
      */
     cycleCodingAgentKey(rateLimitType: string, resetsAt?: string): Promise<{
         cycled: true;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   SessionRunner,
   unshallowRepo
-} from "./chunk-XDIMT2ZM.js";
+} from "./chunk-NHKEFOCV.js";
 import "./chunk-37J5MMQT.js";
 import "./chunk-EKTPDG3G.js";
 import {
@@ -17,7 +17,7 @@ import {
   stageAndCommit,
   updateRemoteToken,
   workspacePathExists
-} from "./chunk-4SX3FFVU.js";
+} from "./chunk-IBLFLCFK.js";
 import "./chunk-Q4FQOJ7D.js";
 import {
   runAuthTokenCommand,

package/dist/{serve-boot-4KWT7W2I.js → serve-boot-G4LZGJ6W.js}

@@ -1,6 +1,6 @@
 import {
   WorkspaceCommandSupervisor
-} from "./chunk-FHYK2NIT.js";
+} from "./chunk-IIYEASRQ.js";
 import {
   AgentConnection,
   CodespacePortVisibility,
@@ -12,7 +12,7 @@ import {
   ensureOnTaskBranch,
   loadAndAnnotateDiscoveredPorts,
   loadConveyorConfig
-} from "./chunk-4SX3FFVU.js";
+} from "./chunk-IBLFLCFK.js";
 import "./chunk-Q4FQOJ7D.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-IA45XHOA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "11.0.43",
+  "version": "11.0.45",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",