@robota-sdk/agent-session 3.0.0-beta.99 → 3.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +995 -1
- package/package.json +5 -5
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,999 @@
|
|
|
1
1
|
# @robota-sdk/agent-session
|
|
2
2
|
|
|
3
|
+
## 3.0.2
|
|
4
|
+
### Patch Changes
|
|
5
|
+
|
|
6
|
+
- @robota-sdk/agent-core@3.0.2
|
|
7
|
+
- @robota-sdk/agent-file-authority@3.0.2
|
|
8
|
+
- @robota-sdk/agent-interface-execution@3.0.2
|
|
9
|
+
- @robota-sdk/agent-interface-session@3.0.2
|
|
10
|
+
|
|
11
|
+
## 3.0.1
|
|
12
|
+
### Patch Changes
|
|
13
|
+
|
|
14
|
+
- @robota-sdk/agent-core@3.0.1
|
|
15
|
+
- @robota-sdk/agent-file-authority@3.0.1
|
|
16
|
+
- @robota-sdk/agent-interface-execution@3.0.1
|
|
17
|
+
- @robota-sdk/agent-interface-session@3.0.1
|
|
18
|
+
|
|
19
|
+
## 3.0.0
|
|
20
|
+
### Major Changes
|
|
21
|
+
|
|
22
|
+
- 807d161: **BREAKING — ARCH-010: the execution root is a required contract field, and the containment guard now fails closed.**
|
|
23
|
+
|
|
24
|
+
The file-tool containment guard was fail-open: with no root configured it answered "allowed". A tool
|
|
25
|
+
built with no `cwd` therefore had no boundary — measured, a `Read` constructed that way returned the
|
|
26
|
+
contents of `/etc/hostname` — and the child-process subagent worker called `createDefaultTools()` with
|
|
27
|
+
no argument at all, so subagents got exactly that. Three independent auditors found three different
|
|
28
|
+
symptoms of this one missing field.
|
|
29
|
+
|
|
30
|
+
**Removed — seven context-free tool singletons.** `readTool`, `writeTool`, `editTool`, `globTool`,
|
|
31
|
+
`grepTool`, `shellTool`, `bashTool` are gone from `@robota-sdk/agent-tools`. A module-level instance is
|
|
32
|
+
bound at import time and can carry no containment root, so after the guard was inverted they could only
|
|
33
|
+
refuse everything.
|
|
34
|
+
|
|
35
|
+
Migrate to the factory of the same name, passing the directory the tool is allowed to work in:
|
|
36
|
+
|
|
37
|
+
```ts
|
|
38
|
+
// before
|
|
39
|
+
import { readTool, globTool } from '@robota-sdk/agent-tools';
|
|
40
|
+
const tools = [readTool, globTool];
|
|
41
|
+
|
|
42
|
+
// after
|
|
43
|
+
import { createReadTool, createGlobTool } from '@robota-sdk/agent-tools';
|
|
44
|
+
const cwd = process.cwd(); // or the workspace this agent is scoped to
|
|
45
|
+
const tools = [createReadTool({ cwd }), createGlobTool({ cwd })];
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
`webFetchTool`, `webSearchTool` and `askUserQuestionTool` are unchanged — they touch no filesystem, so
|
|
49
|
+
there is no root to contain them by.
|
|
50
|
+
|
|
51
|
+
**`cwd` is now REQUIRED** on `ISandboxToolOptions`, `IContainedBuiltinToolOptions` (and everything
|
|
52
|
+
extending them), `ICreateDefaultToolsOptions`, `ISessionOptions` and `ISubagentOptions`. The `= {}`
|
|
53
|
+
default parameter was removed from every builtin factory — that default was the mechanism by which
|
|
54
|
+
"forgot the root" was legal. `new Session({...})` without `cwd` no longer compiles, and also throws at
|
|
55
|
+
construction, because a required field is only required to a TypeScript caller.
|
|
56
|
+
|
|
57
|
+
**`Session` no longer reads `process.cwd()`.** It uses the root it was given, and `getCwd()` exposes it
|
|
58
|
+
so a fork or subagent asks the session instead of re-deriving a root that can disagree with it.
|
|
59
|
+
|
|
60
|
+
**Behavioural change even for callers that already passed a root**: a tool that somehow reaches the
|
|
61
|
+
guard with no root now REFUSES with an explicit error ("no containment root is configured … this is an
|
|
62
|
+
assembly bug, not a path problem") instead of allowing the access.
|
|
63
|
+
- 64ba748: **BREAKING — ARCH-042: project filesystem access is now an explicit, host-issued authority instead of an ambient consequence of `cwd`.**
|
|
64
|
+
|
|
65
|
+
`@robota-sdk/agent-framework` adds `WorkspaceTrustService` and the opaque
|
|
66
|
+
`IWorkspaceProjectAuthority`, plus bounded reader, settings-writer, state-storage, and mutation
|
|
67
|
+
facets. Public session, settings, context, checkpoint, memory, contribution, query, and replay
|
|
68
|
+
contracts consume those facets. A caller that does not supply `projectAccess` is deliberately
|
|
69
|
+
restricted to user-owned host state and receives no project filesystem capability.
|
|
70
|
+
|
|
71
|
+
The framework removes or renames ambient Node/project exports. Migrate `checkSettingsFile` to
|
|
72
|
+
`checkNodeHostSettingsFile`, `readMergedProviderSettingsFromPaths` to
|
|
73
|
+
`readMergedProviderSettingsFromSources`, `resolveProviderSettingsWriteTargetPath` to
|
|
74
|
+
`resolveProviderSettingsWriteTarget`, `FileSystemMemoryStore` / `createFileSystemMemoryStore` to
|
|
75
|
+
`WorkspaceMemoryStore` / `createWorkspaceMemoryStore`, and `PluginSettingsStore` to
|
|
76
|
+
`NodeHostPluginSettingsStore`. Host-only git helpers now carry the `FromNodeHost` suffix.
|
|
77
|
+
`projectPaths`, `resolveSettingsPathForScope`, and `getProviderSettingsPaths` are removed; project
|
|
78
|
+
consumers must use the authority facets rather than recover absolute paths.
|
|
79
|
+
|
|
80
|
+
`@robota-sdk/agent-session` renames the Node filesystem implementation `SessionStore` to
|
|
81
|
+
`NodeSessionStore` and adds explicit session-log/external-payload source and sink ports. Session
|
|
82
|
+
replay no longer resolves external payload files from an ambient directory.
|
|
83
|
+
|
|
84
|
+
`@robota-sdk/agent-interface-transport` changes `ISkillExecutionPort.loadCommands(cwd, home?)` to
|
|
85
|
+
the authority-bound `loadCommands()` and removes the optional absolute-path leak
|
|
86
|
+
`IInteractiveSessionStore.getFilePath`. `@robota-sdk/agent-command` consequently replaces the
|
|
87
|
+
`cwd` option of `createSkillsCommandModule` with required `contributionSources`; default command
|
|
88
|
+
composition accepts explicit contribution sources and discovers no project skills when none are
|
|
89
|
+
provided.
|
|
90
|
+
|
|
91
|
+
`@robota-sdk/agent-cli`, `@robota-sdk/agent-transport`, and
|
|
92
|
+
`@robota-sdk/agent-transport-tui` thread the trusted-or-restricted project decision through every
|
|
93
|
+
session surface. Embedded callers that need project settings, state, context, skills, checkpoints,
|
|
94
|
+
or mutation must mint access through `WorkspaceTrustService` and pass the returned
|
|
95
|
+
`projectAccess` (and a separately approved mutation/settings facet where required). Omitting it is
|
|
96
|
+
still type-compatible but is behaviorally breaking: the surface now fails closed instead of
|
|
97
|
+
reading or writing the current directory.
|
|
98
|
+
- 242a644: Require versioned, event-decoded session replay logs. Reject unknown, malformed, and unsupported
|
|
99
|
+
entries instead of dropping them or inventing message fields. Replay-only session loads and lists
|
|
100
|
+
report damaged logs explicitly. Legacy unversioned JSONL is not accepted; snapshot encoding remains
|
|
101
|
+
unchanged. Persisted logs now use schema version 1, and all replay entry points share the session-owned
|
|
102
|
+
decoder and preserve sidecar integrity failures.
|
|
103
|
+
|
|
104
|
+
### Minor Changes
|
|
105
|
+
|
|
106
|
+
- 9368d00: Advisor escalation: the main model can consult a second model at the decision points it chooses.
|
|
107
|
+
|
|
108
|
+
With an advisor configured (`--advisor <profile>[:<model>]`, or the `advisorModel` setting that
|
|
109
|
+
`/advisor` saves; the flag wins), the session gets an `Advisor({ question? })` tool. The advisor reads
|
|
110
|
+
the whole conversation — system prompt, messages, tool calls and results — serialized into one prompt
|
|
111
|
+
and sent with `toolChoice: 'none'`, truncated from the front to fit its window with the system prompt
|
|
112
|
+
kept, and declines when even that does not fit. Its answer comes back framed as guidance to verify;
|
|
113
|
+
an empty or refusing answer reads as declined. Calls are limited to two per turn and a fixed number
|
|
114
|
+
per session, parallel calls in one round share those limits, and a repeated question in the same
|
|
115
|
+
turn returns the earlier answer. A request that was sent counts even when the provider failed (the
|
|
116
|
+
decline is reported by class, never by its text); only a call declined before sending gives its slot
|
|
117
|
+
back.
|
|
118
|
+
|
|
119
|
+
Advisor usage, including in-process subagents', is recorded where each turn's usage is recorded —
|
|
120
|
+
the persisted session history, under the advisor's own provider and model — so `/cost`, usage reports
|
|
121
|
+
and resumed sessions include it. `/cost` now totals that history and prices each part on its own
|
|
122
|
+
model, showing "mixed" when more than one model was priced.
|
|
123
|
+
|
|
124
|
+
`/advisor <model>` and `/advisor off` change only where calls go, never the tool list, so the main
|
|
125
|
+
model's prompt cache is not invalidated mid-session; the tool is added only when a session starts
|
|
126
|
+
with an advisor. Sending history to a destination (provider type and endpoint host) the main model
|
|
127
|
+
does not already use needs a one-time consent per destination, kept in the user settings file; a
|
|
128
|
+
refusal is remembered for the session. The organization's `allowedProviders` applies, and
|
|
129
|
+
`PRODUCT_DISABLE_ADVISOR=1` turns it off completely. In-process subagents inherit the advisor, bound
|
|
130
|
+
to their own conversation; child-process subagents do not get it.
|
|
131
|
+
|
|
132
|
+
**`@robota-sdk/agent-framework` is `major` for one reason: `ICommandHostSessionAccess` gains a
|
|
133
|
+
required member,** `getSessionUsage()`, the session's persisted usage records. An external
|
|
134
|
+
implementation of that role port stops compiling until it adds the method. The rest is additive.
|
|
135
|
+
|
|
136
|
+
- `agent-session` — `formatConversationEntries`, the one text rendering of a conversation, now used
|
|
137
|
+
by compaction too. It keeps tool calls and results, marks a user message a peer session sent
|
|
138
|
+
(`user [from "peer:<id>"]`), and JSON-encodes every message onto one line so no content can forge
|
|
139
|
+
another entry; compaction previously flattened all of this. `Session.getProvider()` returns the
|
|
140
|
+
provider the session currently uses.
|
|
141
|
+
- `agent-framework` — `AdvisorController`, `createAdvisorTool`, the advisor spec helpers, provider
|
|
142
|
+
destinations (`describeProviderDestination`, `rememberProviderDestination`), `getSessionUsage` and
|
|
143
|
+
`ISessionUsageRecord`, the `onUsageRecorded` session option, and the optional `advisor` command
|
|
144
|
+
host adapter. Session assembly binds a host-supplied Advisor tool to the session holding it.
|
|
145
|
+
- `agent-command` — the `/advisor` command module; `/cost` reads the session's persisted usage.
|
|
146
|
+
- `agent-cli` — the `--advisor` flag, `advisorModel` setting, per-destination consent store and kill
|
|
147
|
+
switch.
|
|
148
|
+
- `agent-ui-terminal` — a usage line from another source (the advisor, a background task) names that
|
|
149
|
+
source and leaves out the context window it does not have.
|
|
150
|
+
- `agent-session-analytics` — personal usage counts an advisor call's tokens and cost toward its
|
|
151
|
+
turn without counting it as a turn.
|
|
152
|
+
- 4078a72: Model fallback chain. `--fallback-model a,b` (or the `fallbackModel` settings array; the flag wins) names up to three models a turn moves to when its model is overloaded, unavailable or failing on the server. An entry is a provider profile, `profile:model`, a bare model on the primary's provider, or `default`. The move happens only before any output has streamed, lasts for the current turn, and is shown as a system note; entries that cannot be built are passed over and entries outside the organization's `allowedProviders` are dropped with a notice. `FallbackProvider` in agent-framework implements it over the session's provider; `IChatOptions` gains `executionId`, `onModelFallback` and `preserveContextWindow`, `IAIProvider` gains optional `resolveModelRoute`, and the execution loop emits a `provider_fallback` event and attributes requests, call observations, committed replies, the response cache and usage to the model that answered. A turn that ran on more than one model records per-model `modelShares` on its usage observation, which personal usage reports split by model and provider. A `/provider` switch keeps the chain, read again for the new primary.
|
|
153
|
+
- 196a900: Permission rules can say more than one argument per tool.
|
|
154
|
+
|
|
155
|
+
- **`Tool(name:value)` in deny and ask rules** matches a named top-level parameter, with `*` in the
|
|
156
|
+
value (`Bash(run_in_background:true)`, `Agent(model:opus*)`, `github__create_issue(repo:acme/*)`).
|
|
157
|
+
It is a parameter rule only when `name` is one of the tool's parameters, so
|
|
158
|
+
`WebFetch(https://…)` keeps its meaning. A parameter the call omits never matches, and a
|
|
159
|
+
non-scalar value is unevaluable, so the call asks. Allow rules may not use the form.
|
|
160
|
+
- **A rule on the primary field** (`Bash(command:rm *)`) is reported at startup and asks on every
|
|
161
|
+
call, instead of being silently ignored.
|
|
162
|
+
- **Tool-name globs.** Deny and ask rules may glob the tool name (`github__*`). Allow rules may do so
|
|
163
|
+
only after a literal `<server>__` prefix; an unanchored allow glob is refused at construction.
|
|
164
|
+
- **A bare-name deny removes the tool from the model's context.** `Tool`, `Tool(*)` or a name glob
|
|
165
|
+
withholds it from the offered set and the deferred-tool catalogue, live, instead of offering it
|
|
166
|
+
and refusing every call. `IAgentConfig.isToolVisible` is the new seam.
|
|
167
|
+
- **MCP canonical names keep the whole `<server>__` prefix when truncated**, so a server glob still
|
|
168
|
+
names every tool of that server.
|
|
169
|
+
- f336838: One permission evaluation order for every caller. The interactive session, background tasks and
|
|
170
|
+
subagents used to run two different resolvers, so the same call could be decided differently
|
|
171
|
+
depending on who made it. They now share `evaluatePermission`, and a background policy only adds a
|
|
172
|
+
ceiling, an ask-everything flag and the task's own lists to it:
|
|
173
|
+
|
|
174
|
+
deny → caller ceiling → unevaluable deny (ask) → never-auto-approve set (ask) → ask-everything →
|
|
175
|
+
bypassPermissions → allow → mode.
|
|
176
|
+
|
|
177
|
+
- **`ask` rules.** `permissions.ask` patterns always ask, in every mode including
|
|
178
|
+
`bypassPermissions`. They are matched per command like a deny rule, and are validated at
|
|
179
|
+
construction alongside `allow` and `deny`.
|
|
180
|
+
- **Never auto-approved, bypass included:** removing a critical path with `rm`/`rmdir` (the root, a
|
|
181
|
+
top-level directory, home, the working directory or a parent), and a modify-class write into
|
|
182
|
+
`.git`, the configured project-state directory, `.claude`, `.agents`, `.mcp.json`, `.gitconfig`, `.npmrc` or a shell rc file.
|
|
183
|
+
Files inside an isolated worktree (`the configured project-state directory/worktrees/<name>/…`) are ordinary files. With no
|
|
184
|
+
approver attached, an ask is a denial.
|
|
185
|
+
- **A ceiling is checked before bypass and before any ask.** A subagent's `inherit-allowlist` ceiling
|
|
186
|
+
is now the parent's *effective* rules, read live at spawn: settings, preset lists and command
|
|
187
|
+
auto-allows. It used to be the raw settings file. An unevaluable deny under a policy now asks,
|
|
188
|
+
like everywhere else, where it used to deny outright; with no approver it is still a denial.
|
|
189
|
+
- **Settings layers union `permissions.allow`**, as they already did `deny`. A checked-in project
|
|
190
|
+
file no longer silently discards the user's allow list.
|
|
191
|
+
- **Print mode, `createQuery()` and headless sessions default to `default` mode**, not
|
|
192
|
+
`bypassPermissions`. They have no approver, so a call that would ask is denied. Pass
|
|
193
|
+
`--permission-mode` / `permissionMode: 'bypassPermissions'` explicitly for unattended runs.
|
|
194
|
+
|
|
195
|
+
**Breaking:**
|
|
196
|
+
- `@robota-sdk/agent-core` removes `resolvePermissionByPolicy` and `TPermissionPolicyDecision` in
|
|
197
|
+
favour of `projectPermissionPolicy` plus `evaluatePermission`'s new `context` argument.
|
|
198
|
+
- `@robota-sdk/agent-framework` changes the settings merge rule for `permissions.allow`, and the
|
|
199
|
+
default permission mode of `createQuery()` and headless sessions.
|
|
200
|
+
- 34e50f0: A new permission mode, `auto`, lets a model classifier approve or block what would otherwise prompt.
|
|
201
|
+
|
|
202
|
+
- **What it decides:**
|
|
203
|
+
- Reads and in-workspace edits run as in `acceptEdits`.
|
|
204
|
+
- Commands and other calls the mode leaves open go to the classifier, a side call to the
|
|
205
|
+
session's own model. It sees the call, the working directory and the git remotes, never the
|
|
206
|
+
conversation.
|
|
207
|
+
- A block reaches the model with its reason, so it can take another route.
|
|
208
|
+
- **What still reaches a person, or is refused:**
|
|
209
|
+
- Deny rules and background ceilings apply first.
|
|
210
|
+
- `ask` rules, critical removals and protected paths ask a person.
|
|
211
|
+
- After 3 refusals in a row (blocks, or no usable verdict), or 20 blocks in the session, the
|
|
212
|
+
mode asks a person until one approves.
|
|
213
|
+
With no one to ask, the call is denied.
|
|
214
|
+
- **Allow rules:** in `auto` mode, allow rules that approve any command are set aside while the
|
|
215
|
+
mode is on. Examples are `Bash(*)`, an interpreter (`Bash(python *)`), a package runner
|
|
216
|
+
(`Bash(npm run *)`, `Bash(pnpm exec *)`), `Agent`, `ExecuteCommand` or `Computer`. Narrow
|
|
217
|
+
rules still apply.
|
|
218
|
+
- **Retry:** `/permissions` lists classifier blocks. `/permissions retry <n>` lets that exact call
|
|
219
|
+
run once, unjudged, when the model tries it again.
|
|
220
|
+
- **Turning it on and off:**
|
|
221
|
+
- `--permission-mode auto`, `/mode auto` or `/permissions auto`.
|
|
222
|
+
- An organization turns it off with `disableAutoMode` in the org policy.
|
|
223
|
+
- **New contracts:**
|
|
224
|
+
- `TPermissionMode` gains `'auto'`.
|
|
225
|
+
- `allowRulesForAutoMode` and `isBroadExecutionAllowRule`.
|
|
226
|
+
- `IPermissionClassifier` and `AutoModeGate`.
|
|
227
|
+
- The `permissionClassifier` session option.
|
|
228
|
+
- `Session.retryPermissionDenial`, and `retryDenial` on the permission-mode adapter.
|
|
229
|
+
- The `'classifier'` denial reason.
|
|
230
|
+
- `createModelPermissionClassifier`.
|
|
231
|
+
- The `disableAutoMode` option on `createSession` and `IOrgPolicy`.
|
|
232
|
+
- 722e88a: Shell commands can run in an OS-level sandbox: bubblewrap on Linux and WSL2, Seatbelt on macOS.
|
|
233
|
+
|
|
234
|
+
- **Confinement:** covers the command and every process it starts.
|
|
235
|
+
- Writes are limited to the working directory, the temporary directories and
|
|
236
|
+
`sandbox.filesystem.allowWrite`.
|
|
237
|
+
- Agent, git-hook, MCP and shell configuration inside the workspace stays read-only.
|
|
238
|
+
- `sandbox.filesystem.denyRead` hides paths from the command.
|
|
239
|
+
- The network is on or off (`sandbox.network.enabled`).
|
|
240
|
+
- **Modes:** `/sandbox` switches between `auto-allow`, `regular` and `off` for the next command and
|
|
241
|
+
saves the choice.
|
|
242
|
+
- In `auto-allow` (`sandbox.autoAllowBashIfSandboxed`), a confined command runs without a prompt
|
|
243
|
+
in `default` and `acceptEdits`.
|
|
244
|
+
- Deny rules, ask rules, critical removals and plan mode still apply first.
|
|
245
|
+
- **Exclusions:** `sandbox.excludedCommands` run unconfined, through the ordinary permission path.
|
|
246
|
+
- **When the sandbox cannot run:** a missing or unusable backend is reported at startup, in
|
|
247
|
+
`robota doctor` and in `/sandbox`, and commands then run unconfined.
|
|
248
|
+
`sandbox.failIfUnavailable` refuses to start instead.
|
|
249
|
+
- **New contracts:**
|
|
250
|
+
- `OsSandboxClient`, `detectOsSandbox`, `bubblewrapArguments`, `seatbeltProfile`.
|
|
251
|
+
- `ISandboxClient.wrapCommand` and `autoApproves`.
|
|
252
|
+
- `IPermissionEvaluationContext.sandboxAutoApproved`.
|
|
253
|
+
- The `commandSandbox` session option.
|
|
254
|
+
- The `sandbox` settings key and the `sandbox` command host adapter.
|
|
255
|
+
- a5cc36e: `/permissions` shows the rules the session enforces and the calls it refused.
|
|
256
|
+
|
|
257
|
+
- **Rules by source:** each allow, deny and ask rule the gate reads is listed under the settings file
|
|
258
|
+
that declares it. Rules added by a CLI flag, a preset or a command are listed under "this session".
|
|
259
|
+
A rule a settings file declares but the session does not enforce is not shown.
|
|
260
|
+
- **Recent denials:** the latest refused calls, most recent first, with the reason: a rule or the
|
|
261
|
+
mode, the user declining, or no one available to approve.
|
|
262
|
+
- New contracts: `Session.getRecentPermissionDenials()`, `PermissionEnforcer.getRecentDenials()`,
|
|
263
|
+
`IPermissionDenial`, the `permissionRules` host adapter (`createSettingsPermissionRulesAdapter`),
|
|
264
|
+
and `getPermissionRules` / `listRecentDenials` on `ICommandPermissionModeAdapter`. Settings
|
|
265
|
+
provenance now covers `permissions.ask`.
|
|
266
|
+
- d23c848: Built-in read-only shell commands run without a prompt.
|
|
267
|
+
|
|
268
|
+
A Bash call is decided like a read, and runs without a prompt in every mode (`plan` included), when
|
|
269
|
+
every command in it comes from the fixed read-only set (`ls`, `cat`, `grep`, `find` without actions,
|
|
270
|
+
`git status`/`log`/`diff`/`show` and similar) and it also:
|
|
271
|
+
|
|
272
|
+
- stays inside the workspace: every path operand resolves inside once symlinks are followed, as
|
|
273
|
+
`Read` requires;
|
|
274
|
+
- uses only printable ASCII syntax that bash, zsh, fish and PowerShell all read the same way.
|
|
275
|
+
|
|
276
|
+
Deny and ask rules still apply first. A command that writes through a redirect, expands or
|
|
277
|
+
substitutes anything, or runs git outside the session's repository takes the ordinary path.
|
|
278
|
+
|
|
279
|
+
New exports: `isReadOnlyCommandLine` and `TResolveInWorkspace`. `IPermissionEvaluationContext`
|
|
280
|
+
gains `resolveInWorkspace`, which `PermissionEnforcer` supplies.
|
|
281
|
+
- 3038eb7: A message from another session is instant messaging: text from an untrusted third party that
|
|
282
|
+
carries no authority. What the model does with it is decided by the session's ordinary permissions —
|
|
283
|
+
rules, permission mode and remembered consent — exactly like the session's own work. The per-origin
|
|
284
|
+
peer policy is gone.
|
|
285
|
+
|
|
286
|
+
**BREAKING**
|
|
287
|
+
|
|
288
|
+
- `agent-core`: `IPermissionEvaluationContext.peerTurn` is now a boolean. It decides only whether a
|
|
289
|
+
`repliesToPeer` tool exists; every other call in a peer turn is decided as in any turn. Removed:
|
|
290
|
+
`isToolAvailableInPeerTurn`, `isSecretPath`, `IPeerTurnAuthority`, `TPeerReach` (now exported by
|
|
291
|
+
`agent-interface-session-mobility`) and `IToolPermissionProfile.workspacePaths`.
|
|
292
|
+
- `agent-tools`: `Read` and `Glob` no longer declare `workspacePaths`.
|
|
293
|
+
- `agent-session`: `ISessionRunOptions.peerReach` is replaced by `peerTurn?: boolean`, and
|
|
294
|
+
`ISessionOptions.allowPeerChanges` is removed. An ask in a peer turn is answered like any other:
|
|
295
|
+
a consent the operator remembered answers it, and an "always allow" given there is remembered.
|
|
296
|
+
- `agent-interface-session`: `IPeerTurnContext` no longer has `reach`; it carries only the reply
|
|
297
|
+
route.
|
|
298
|
+
- `agent-interface-session-mobility`: `peerReachOf` is removed; `TPeerReach` moves here. A delegated
|
|
299
|
+
turn carries no reach.
|
|
300
|
+
- `agent-framework`: the `peers.allowChanges` setting is removed (an existing value is ignored). A
|
|
301
|
+
peer turn is offered the ordinary tools, plus `peer_reply`.
|
|
302
|
+
|
|
303
|
+
**Changes**
|
|
304
|
+
|
|
305
|
+
- `agent-framework`: the per-turn statement tells the model the message is an opinion from an
|
|
306
|
+
untrusted third party, not its owner's instruction, and that it decides for itself whether and how
|
|
307
|
+
to act. A message still expands no `@path` and attaches no context reference, and its requests
|
|
308
|
+
still carry no provider-hosted tool, since no permission step can decide one. The session takes
|
|
309
|
+
at most 6 messages a minute and 30 an hour from each sender for a turn; a message over the limit
|
|
310
|
+
is refused with a reason the sender receives. A prompt answer given in the name of a `peer:` or `external:`
|
|
311
|
+
driver is ignored. External-event turns keep their tool-less baseline.
|
|
312
|
+
- `agent-cli`: incoming peer turns carry only their reply route.
|
|
313
|
+
- 02b7452: A reply to a peer session is decided by the permission system like any call that sends something
|
|
314
|
+
off this machine, and it goes only to the sender that was admitted.
|
|
315
|
+
|
|
316
|
+
- `agent-core` — a tool declaring `repliesToPeer` is still refused outside a peer turn; inside one it
|
|
317
|
+
is decided by the ordinary steps: deny, ask and allow rules, then the mode. It declares no risk
|
|
318
|
+
class, so it asks by default, is refused in plan mode and proceeds under bypass. `IPeerTurnAuthority`
|
|
319
|
+
no longer has `toolUsed`.
|
|
320
|
+
- `agent-session` — an "always allow" answer to the reply is remembered and answers later replies,
|
|
321
|
+
as for any tool; other asks in a peer turn still need a fresh approval each time.
|
|
322
|
+
- `agent-framework` — `peer_reply` asks the operator by default, showing the full text and the peer
|
|
323
|
+
it goes to; `permissions.allow`/`deny` rules naming `peer_reply` apply. `PeerMessageIngress`
|
|
324
|
+
refuses a message whose origin names a sender other than the admitted one, or whose admission names
|
|
325
|
+
no sender, and submits the turn with the admitted identity.
|
|
326
|
+
- `agent-cli` — a local peer message is taken as coming from the session it names only when that
|
|
327
|
+
session confirms, at its own socket, that it is sending exactly that message to this receiver.
|
|
328
|
+
The reply target, the driver id and the operator's notices come from the confirmed sender. A
|
|
329
|
+
session on an earlier version cannot confirm, so its messages are refused; both sessions need this
|
|
330
|
+
version to message each other.
|
|
331
|
+
- e689c8e: Follow-ups to connection approval and `/handoff`.
|
|
332
|
+
|
|
333
|
+
- `agent-transport-webrtc-web` — the browser remote client says `Waiting for the host to approve this connection…`
|
|
334
|
+
(`awaiting-approval`) after pairing, and `Connected` only once the host's session answers. A host that closes the
|
|
335
|
+
channel instead is shown as `refused` and is not retried, since a retry would only ask the operator again; a
|
|
336
|
+
first connection lost before the host answered is `failed`. Reconnect attempts count until the host admits a
|
|
337
|
+
connection, so a link that keeps dropping while approval is pending gives up instead of asking again and again.
|
|
338
|
+
- `agent-core`, `agent-session`, `agent-framework` — a turn that did not come from the operator stores its
|
|
339
|
+
`turnSource` (`peer`, `external`, `agent-wakeup`) beside `driverId` on the user message and in the display
|
|
340
|
+
history (`IRunOptions.turnSource`), so a session handed off keeps where each turn came from.
|
|
341
|
+
- `agent-cli` — a `/handoff` resent after a lost confirmation reports what stays behind as it is now, not as it was
|
|
342
|
+
at the first attempt, and after refusing to resend a session that changed, the hand-off status shows that refusal
|
|
343
|
+
instead of the earlier lost confirmation.
|
|
344
|
+
- c7f9203: Connected sessions can send each other files.
|
|
345
|
+
|
|
346
|
+
- `/peers send-file <session-id> <path>` sends a copy of any file the operator can read to another
|
|
347
|
+
live session on this host.
|
|
348
|
+
- The model sends a file only through the `peer_send_file` tool. Every call asks the user, showing
|
|
349
|
+
the path, size, hash and destination; no permission mode, rule or remembered consent answers it.
|
|
350
|
+
The tool reaches only files inside the workspace whose path does not look like it holds secrets
|
|
351
|
+
(`.env*`, `~/.ssh`, keys and credentials), and it does not exist in a turn a peer's message started.
|
|
352
|
+
- The receiving operator approves every file. A received file is kept as an inert copy (mode 0600)
|
|
353
|
+
under `the configured user data directory<sender>/`. It is never run and never placed in the model's context.
|
|
354
|
+
The conversation is told only its name, size and sha256. A name that leaves that directory is
|
|
355
|
+
refused, a symbolic link is never written through, and nothing is overwritten.
|
|
356
|
+
- Transfers travel on a channel of their own (a separate connection on this host, a separate data
|
|
357
|
+
channel between devices), in chunks the receiver paces, up to 32 MiB, and are kept only when the
|
|
358
|
+
whole content matches the offered sha256. A transfer that ends early is discarded; there is no
|
|
359
|
+
resume.
|
|
360
|
+
|
|
361
|
+
**API**
|
|
362
|
+
|
|
363
|
+
- `agent-interface-session-mobility`: the `file` capability, which asks the operator for every
|
|
364
|
+
request; `ConnectionAuthority.authorizeFile`; `IFileOffer` and `IFileFrameChannel`.
|
|
365
|
+
- `agent-transport/node`: `sendFileOverChannel` and `receiveFileOverChannel`, the carrier over any
|
|
366
|
+
`IFileFrameChannel`; `DEFAULT_MAX_FILE_BYTES`.
|
|
367
|
+
- `agent-transport-webrtc`: `IDeviceMeshLink.openFileChannel` and `onFileChannel`.
|
|
368
|
+
- `agent-remote-pairing`: `file` joins `DEVICE_CAPABILITIES`. A device certificate that names it is
|
|
369
|
+
refused as malformed by an earlier version.
|
|
370
|
+
- `agent-core`: `IToolPermissionProfile.notInPeerTurn` withholds a tool from a turn a peer's message
|
|
371
|
+
started.
|
|
372
|
+
- `agent-framework`: `ICommandLocalPeersAdapter.prepareFile`.
|
|
373
|
+
- 18b52cc: Built-in commands are offered to the model deliberately, each described for the model, and never
|
|
374
|
+
with a trust, credential or permission-widening action.
|
|
375
|
+
|
|
376
|
+
- `agent-interface-command` — `ICommand` gains `modelDescription?` (what the model is told, beside the
|
|
377
|
+
short `/help` line), and `modelInvocable` on a subcommand entry now narrows what the model may run.
|
|
378
|
+
- `agent-framework` — `ISystemCommand` gains `modelDescription?` and `modelRequiresPermission?`.
|
|
379
|
+
Once any subcommand of a model-invocable command declares `modelInvocable`, the model may run only
|
|
380
|
+
the bare command and the subcommands declared `true`; everything else, including an alias or an
|
|
381
|
+
undeclared subcommand, is refused before the command runs. The model-facing descriptor lists only
|
|
382
|
+
that subset. A model-requested monitor's command is now decided by the shell tool's gate (its
|
|
383
|
+
Bash/Shell rules, the mode and the prompt) and a refusal rejects with the new
|
|
384
|
+
`MonitorCommandRefusedError`. The `scriptedSession` test harness accepts `permissions` patterns.
|
|
385
|
+
- `agent-session` — `Session.checkToolPermission(toolName, toolArgs)` decides an action that has a
|
|
386
|
+
tool's effect by another route: that tool's PreToolUse hooks, then the gate's rules, mode,
|
|
387
|
+
remembered consent and prompt — never the command sandbox's auto-approval, since the action does
|
|
388
|
+
not run inside the sandbox.
|
|
389
|
+
- `agent-framework` also: `ICommandMCPActivationAdapter.userActionSurface?` tells `/mcp` whether the
|
|
390
|
+
user can type a session command, so the model's status names the terminal sign-in otherwise.
|
|
391
|
+
- `agent-command` — `/context` (bare and `list`), `/cost` (the report, not `budget`) and `/mcp`
|
|
392
|
+
(`status` only, without a prompt) are now model-invocable; `/memory approve` and `/memory reject`
|
|
393
|
+
are now user-only; the model's `/monitor` is decided by the shell gate rather than by consent to
|
|
394
|
+
the command's name. Every model-invocable command carries a model-facing description. The model's
|
|
395
|
+
`/mcp status` shows only safe names, states and the command to suggest, and a caller that does not
|
|
396
|
+
identify itself gets that view. `/context list` accounts only for turns still in context. New
|
|
397
|
+
`mcpUserActionNotice`, `mcpUserActionCommand` and `mcpUnavailableServersNotice` build the fixed
|
|
398
|
+
notices.
|
|
399
|
+
- `agent-command-workflows` — `/workflows` carries a model-facing description.
|
|
400
|
+
- `agent-mcp` — `createDiscoveredTool` accepts `authFailureNotice`: a call the server refuses for
|
|
401
|
+
authentication returns that host text instead of the generic failure.
|
|
402
|
+
- `agent-cli` — an MCP server that did not start because the user must approve it, trust the
|
|
403
|
+
workspace or sign in is named to the model at the start of an interactive session with the
|
|
404
|
+
command to suggest, and a
|
|
405
|
+
signed-in OAuth server that refuses a call tells the model to suggest `/mcp login <server>` — or, in print and serve runs, the terminal
|
|
406
|
+
`robota mcp login <server>`.
|
|
407
|
+
|
|
408
|
+
A command whose bare form is a complete action declares `runsBare`, so choosing `/cost` or `/mcp`
|
|
409
|
+
from the autocomplete menu still runs it even though they now declare subcommands.
|
|
410
|
+
- 9843fe6: Sign in to a remote MCP server from inside a session, and use its tools without restarting.
|
|
411
|
+
|
|
412
|
+
- **`/mcp login <server> [--no-browser]`** runs the same per-server OAuth sign-in as
|
|
413
|
+
`robota mcp login` (discovery checks, PKCE, `state`, RFC 9207 `iss`, RFC 8707 resource, the
|
|
414
|
+
loopback listener, the lock-guarded store). It opens the browser through the argv opener; with
|
|
415
|
+
`--no-browser`, or when no browser can be opened, it shows the authorization URL and asks for the
|
|
416
|
+
redirect URL in the session's own prompt (masked), held to the same rules as a pasted redirect in
|
|
417
|
+
the terminal. A failed, refused, timed-out or cancelled sign-in changes nothing and is reported by
|
|
418
|
+
a fixed reason only. `/mcp login <server> --client-secret` is refused: a secret is never typed into
|
|
419
|
+
a session, and `robota mcp login <server> --client-secret` is named instead (also after a failed
|
|
420
|
+
token exchange for a pre-registered client). `/mcp` stays user-only (`modelInvocable: false`).
|
|
421
|
+
- **Connected in the same session:** after a sign-in, a server that could not connect for want of
|
|
422
|
+
one goes through the normal admission (approval, fingerprint, trust) and connects, and its tools
|
|
423
|
+
are offered from the next message; a server that was already connected is admitted again and
|
|
424
|
+
reconnects, and its authenticator drops what it held and reads the new credential. A tool left out
|
|
425
|
+
because the session already has its name is reported, and only tools actually added get
|
|
426
|
+
provenance. In browser mode the authorization URL is shown in the session prompt before the
|
|
427
|
+
browser opens, where the user can also choose to paste the redirect instead or cancel.
|
|
428
|
+
- **`runMCPOAuthLogin`** takes `readRedirectWhenBrowserFails`: when `openBrowser` rejects, the
|
|
429
|
+
loopback listener stops and the pasted redirect is read instead, for the same redirect URI. The
|
|
430
|
+
loopback listener's time limit now runs from its first `wait()` — once the authorization page is
|
|
431
|
+
handed over — so time spent at a prompt before the browser opens does not count against it.
|
|
432
|
+
- **`Session.addTools`** (and `ICommandSessionTools.addTools`) offers tools that became usable
|
|
433
|
+
mid-session, through the same permission gate and — via `ISessionOptions.wrapAddedTools`, which
|
|
434
|
+
`createSession` sets — the same edit-checkpoint and reversible-execution wraps as the assembled
|
|
435
|
+
tools. A name the session already has is left out, never replaced. Calls are serialized, and tools
|
|
436
|
+
added while a turn runs are applied when the next turn starts, so a turn's rounds all see one
|
|
437
|
+
tool list and the prompt cache misses once, at that boundary.
|
|
438
|
+
- **Breaking (`agent-framework`, major):** `addTools` is a new required member of the
|
|
439
|
+
`ICommandSessionTools` role port (and so of `ICommandSessionRuntime`). A host that implements the
|
|
440
|
+
port itself must add it; one that passes an `agent-session` `Session` already has it.
|
|
441
|
+
- **`ICommandMCPActivationAdapter.oauthLogin`** (`ICommandMCPOAuthLoginRequest`,
|
|
442
|
+
`ICommandMCPOAuthLoginResult`, `ICommandMCPOAuthRedirectPrompt`) is the port behind it.
|
|
443
|
+
- The sign-in notice and `/mcp status` now suggest `/mcp login <server>` in a session and
|
|
444
|
+
`robota mcp login <server>` in a terminal; the server's name is shown only when it is safe to paste
|
|
445
|
+
into any shell, otherwise `<server>`.
|
|
446
|
+
- 9f46375: A session can save a pending tool approval and answer it after it is reopened.
|
|
447
|
+
`Session.runRecoverable()` runs a prompt with a host-owned execution journal from
|
|
448
|
+
`@robota-sdk/agent-core`. When a tool call needs approval, it returns `waiting` with the saved
|
|
449
|
+
request (the exact action and its arguments) instead of asking a live approver.
|
|
450
|
+
`Session.resumeRecoverable()` takes the answer and continues that execution without adding another
|
|
451
|
+
user message; a session recreated with the same session ID, workspace, provider and model can do the
|
|
452
|
+
same. Ordinary `run()` keeps asking for approval live.
|
|
453
|
+
|
|
454
|
+
An approval covers only the action and arguments it was given; it never grants session-wide consent.
|
|
455
|
+
Current permissions, hooks and task restrictions are still checked when the tool runs, and a saved
|
|
456
|
+
denial holds even if the policy has since become more permissive. Reusing a response ID with
|
|
457
|
+
different content is refused.
|
|
458
|
+
|
|
459
|
+
While an execution waits, the session refuses new prompts. `Session.getPendingExecution()` returns
|
|
460
|
+
its `executionId` and saved requests, also after a cancellation that ended the turn once the wait
|
|
461
|
+
was saved. A resume refused before it continues, such as a stale response or a storage failure,
|
|
462
|
+
leaves the execution pending for another attempt; once it has continued, a later failure ends it
|
|
463
|
+
like an ordinary turn. `Session.abandonPendingExecution(executionId)` gives it up so the session
|
|
464
|
+
accepts new input: nothing runs and nothing is written to the journal, its open tool calls are
|
|
465
|
+
closed as failed in history, and that execution can no longer be resumed. The same journal also
|
|
466
|
+
records compaction's model call before history changes, and a journal write failure stays a failure
|
|
467
|
+
even when the turn is being cancelled.
|
|
468
|
+
- 94b2c87: A PreToolUse `command` hook can now steer a tool call, not only refuse it. The permission gate
|
|
469
|
+
applies the winning `hookSpecificOutput.permissionDecision`:
|
|
470
|
+
|
|
471
|
+
- `allow` skips the prompt a person would otherwise get. Deny rules, refusals from the mode, the
|
|
472
|
+
`auto` mode classifier and asks that must reach a person (an `ask` rule, a protected path, a
|
|
473
|
+
policy that asks about everything) still apply.
|
|
474
|
+
- `ask` sends the call to a person even when the mode or a remembered consent would run it. The
|
|
475
|
+
answer is not remembered, and with no one to ask the call is refused.
|
|
476
|
+
- `defer` leaves the call to the normal flow, as before.
|
|
477
|
+
|
|
478
|
+
Before this change these decisions were read and then ignored.
|
|
479
|
+
|
|
480
|
+
`updatedInput` is still not applied: the call runs the input it was made with, and an `allow` sent
|
|
481
|
+
with an `updatedInput` is not applied either, since it approved another input.
|
|
482
|
+
|
|
483
|
+
`runHooks` (agent-core) now reads a decision and an `updatedInput` only from `command` hooks: a
|
|
484
|
+
`prompt` or `agent` hook answers from a model that reads the tool input it judges, so it can only
|
|
485
|
+
refuse. With several hooks, `ask` now outranks `defer` (`deny` > `ask` > `defer` > `allow`), and the
|
|
486
|
+
reported `updatedInput` is the one sent with the winning decision.
|
|
487
|
+
- 04719a9: **A permission request names the tool call it is about.**
|
|
488
|
+
|
|
489
|
+
`IPermissionRequestEvent` gains an optional `executionId`: the same id the call's `tool_start` and
|
|
490
|
+
`tool_end` carry, so a surface can hold one row from the request to the call's end. The session's
|
|
491
|
+
permission path carries the call's id from the tool wrapper to the prompt (`IPermissionAskContext.executionId`)
|
|
492
|
+
and the framework's prompt registry stamps it on the event, so it reaches every client that receives
|
|
493
|
+
the event, the WebSocket and HTTP `permission_request` frames included. It is present whenever the
|
|
494
|
+
session reports that call (its own, or an in-process background agent's) and absent for a
|
|
495
|
+
child-process agent's forwarded request.
|
|
496
|
+
|
|
497
|
+
The ACP agent transport keys its permission rows by that id: the request's `toolCallId` is the
|
|
498
|
+
call's execution id, its start and end address the same row, a denial the session decides on its
|
|
499
|
+
own while the editor's dialog is open closes that one row, and two same-named calls each follow
|
|
500
|
+
their own row whatever order the editor answers in. A request that names no call gets a row that
|
|
501
|
+
closes with the answer, and is closed at the end of the turn if no answer came. The name-ordered
|
|
502
|
+
matching is gone.
|
|
503
|
+
- 04a6de4: **Reasoning text a provider streams now reaches the editor as an ACP `agent_thought_chunk`, through a new `thinking_delta` session event.**
|
|
504
|
+
|
|
505
|
+
`IChatOptions.onThinkingDelta`, `IRunOptions.onThinkingDelta` and `IResumeExecutionOptions.onThinkingDelta`
|
|
506
|
+
(typed `TThinkingDeltaCallback`) carry reasoning text from a provider through the run, and the session
|
|
507
|
+
options (`ISessionOptions.onThinkingDelta`, `ICreateSessionOptions.onThinkingDelta`) hand it to the
|
|
508
|
+
session's owner. `InteractiveSession` emits it as `thinking_delta(delta)`, beside `text_delta`. The
|
|
509
|
+
text is never part of the reply: it is not appended to the conversation, not streamed through
|
|
510
|
+
`onTextDelta`, and the core adds no record of its own for it (no text-delta log entry, no
|
|
511
|
+
`provider_stream_raw_delta`); a provider's own native payload capture and response metadata keep
|
|
512
|
+
what the provider sent, as before. A reasoning delta counts as provider activity for the idle
|
|
513
|
+
timeout whether or not anyone listens to it, so a model that is only thinking is not cut off. The
|
|
514
|
+
existing `thinking(isThinking)` event is unchanged and remains the busy indicator. Where a provider
|
|
515
|
+
sends no reasoning text, nothing is emitted and nothing new is switched on.
|
|
516
|
+
|
|
517
|
+
`@robota-sdk/agent-interface-session` is a major change because a new session event name makes an
|
|
518
|
+
exhaustive map over the event names stop compiling until it classifies the event.
|
|
519
|
+
|
|
520
|
+
`@robota-sdk/agent-transport-acp` sends each non-empty `thinking_delta` to the editor as an
|
|
521
|
+
`agent_thought_chunk`, in order with the message chunks, so `robota acp` shows the model's reasoning
|
|
522
|
+
in the editor. A turn that streamed only thoughts still shows its result text, because only reply
|
|
523
|
+
text marks a turn as streamed. The WebSocket wire, the HTTP stream, headless stream-json, `query()`
|
|
524
|
+
and the terminal UI do not carry the new event in this change (`@robota-sdk/agent-transport` and
|
|
525
|
+
`@robota-sdk/agent-ui-terminal` classify it as non-surface). A forked skill and an in-process subagent
|
|
526
|
+
pass their reply text up but not their reasoning.
|
|
527
|
+
|
|
528
|
+
Two providers already receive reasoning text and now report it. `@robota-sdk/agent-provider-openai`
|
|
529
|
+
passes `response.reasoning_summary_text.delta` events of a streamed Responses call to
|
|
530
|
+
`onThinkingDelta`; the API sends them only when the provider profile asks for a reasoning summary, and
|
|
531
|
+
no request option changed; a summary streamed in several parts, and the summary of a later reasoning
|
|
532
|
+
item, each start on a new paragraph (`\n\n`) so the parts do not run together.
|
|
533
|
+
`@robota-sdk/agent-provider-openai-compatible` reports the text of Gemma's thought channel, which the
|
|
534
|
+
provider already removed from the reply, as it streams across chunk boundaries, with each later
|
|
535
|
+
channel of one reply on a new paragraph; the reply text is unchanged. No other provider reports
|
|
536
|
+
reasoning, and Anthropic thinking is not enabled. A model fallback chain still moves to the next model when only reasoning had streamed.
|
|
537
|
+
|
|
538
|
+
The scripted test provider (`@robota-sdk/agent-core/testing`) accepts an optional `thinking` string on
|
|
539
|
+
a turn and delivers it through `onThinkingDelta` before the turn's text; the scripted session harness
|
|
540
|
+
collects `thinking_delta` and now keeps a scripted tool-call turn's `usage`, which it used to drop.
|
|
541
|
+
- 0ba247b: A tool result can now carry a view its source declared (an MCP app), and a surface can invoke a
|
|
542
|
+
runtime tool through the session's permission gate with a prompt. This is the contract and wiring
|
|
543
|
+
layer: nothing produces a view yet, and the GUI does not yet host one.
|
|
544
|
+
|
|
545
|
+
- `agent-core` — `IToolResult.view` carries an `IToolAppView` (source, `ui://` resource, mime type,
|
|
546
|
+
HTML, structured content, callable tools, the call's input). `view` is now a typed key of
|
|
547
|
+
`IToolResult`, so an extension that already used a `view` key with another type must rename it.
|
|
548
|
+
The view is display data: it never enters model context or the size that decides a spill, and a
|
|
549
|
+
result replaced by its reference keeps it.
|
|
550
|
+
- `agent-interface-session` — `invokeRuntimeTool` takes `permissionInteraction` (`'interactive'` or
|
|
551
|
+
the default `'deny'`), a `driverId` (a host that attributes prompts names it as the requester) and
|
|
552
|
+
an `executionId` its events carry. A finished model call's `tool_end` names its view with
|
|
553
|
+
`IToolState.appView` (`viewId`, source, resource), and the new
|
|
554
|
+
`ISessionToolAppViews.readToolAppView(viewId)` reads the document. A permission handler may take
|
|
555
|
+
`{ signal }`, and aborting it withdraws the prompt.
|
|
556
|
+
- `agent-session` — a direct call asks a person only when its caller says so, and the handler is
|
|
557
|
+
given the call's own signal; the tool end event carries the view, never in the logged result data.
|
|
558
|
+
- `agent-framework` — the view of a model's call is kept under a `viewId` the session mints, in a
|
|
559
|
+
bounded per-session store (16 views, 4 MiB each, 16 MiB in all, measured on the whole serialized
|
|
560
|
+
view), and read on demand, so the document never rides `tool_end` to every surface, never enters
|
|
561
|
+
the recorded history, and a repeated provider tool-call id cannot overwrite another turn's view.
|
|
562
|
+
A malformed view is dropped. A direct call keeps and names no view, recognised by the id it was
|
|
563
|
+
started with. A submission or agent wakeup that arrives while a direct call holds the session is
|
|
564
|
+
queued behind it, as during a turn, instead of refused. A direct call acting for a driver
|
|
565
|
+
attributes its permission prompt and tool events to that driver, and aborting its signal withdraws
|
|
566
|
+
an open prompt from every surface.
|
|
567
|
+
- `agent-transport` — a driving connection sends `call-app-tool` (answered by `app_tool_result`) and
|
|
568
|
+
`read-app-view` (answered by `app_view`). A call names its view and reaches only the tools that
|
|
569
|
+
view's source declared; a call or read that decodes but cannot be served answers `protocol_error`
|
|
570
|
+
echoing the `requestId`, while an observer's attempt is refused like any non-read. A call still
|
|
571
|
+
waiting on its prompt is cancelled when its connection goes away (for the resume bridge, when the
|
|
572
|
+
bridge is disposed). `maxFrameBytes` bounds an app answer to what a carrier's channel carries;
|
|
573
|
+
the WebRTC carrier uses a history page's worth. `IProtocolSession` now includes the runtime-tool
|
|
574
|
+
and app-view roles.
|
|
575
|
+
- `agent-ui-web` — the two new server messages are recorded as not rendered until the app-view host
|
|
576
|
+
consumes them.
|
|
577
|
+
|
|
578
|
+
An implementation of `IInteractiveSession` or `IProtocolSession` outside this repository must add
|
|
579
|
+
`readToolAppView` (and, for `IProtocolSession`, `listRuntimeTools` and `invokeRuntimeTool`); the
|
|
580
|
+
members are required so a host cannot silently lack them.
|
|
581
|
+
- b078afa: Restore full-fidelity replay for session-log values externalized to content-addressed sidecar files.
|
|
582
|
+
|
|
583
|
+
`agent-session` now exports a bounded, containment- and integrity-checked recursive payload resolver,
|
|
584
|
+
hydrates JSONL logs at their read boundary, and rejects unresolved replay-substrate values during raw
|
|
585
|
+
validation. `agent-provider-replay` reuses that resolver for direct construction and file loading so
|
|
586
|
+
large recorded responses remain aligned with later calls.
|
|
587
|
+
- b078afa: Preserve complete resumable session records when the raw Session writer re-saves them.
|
|
588
|
+
|
|
589
|
+
`IInteractiveSessionStore` is now the canonical persistence port, including its optional file-backed
|
|
590
|
+
record-path capability. `agent-session` consumes the canonical record and store contracts directly and
|
|
591
|
+
keeps its former type names only as compatibility re-exports.
|
|
592
|
+
- 2ebff01: Complete the public session-log event vocabulary for every production writer/reader event and pass
|
|
593
|
+
the session-owned compaction trigger unchanged to PreCompact, PostCompact, logging, and callbacks.
|
|
594
|
+
- 7d9cc66: Preserve an explicitly supplied host tool scheduling policy through session assembly and CLI presentation modes, retaining permission admission and conservative handling of undeclared resources.
|
|
595
|
+
- 4b76cfa: NEUT-005 (wave 2): restore an actionable context-capacity hint at the surface tier, neutrally. The zero-dependency `agent-core` layer emits a product-neutral hard-capacity notice and exposes the `IAgentConfig.contextCapacityHint` seam (wave 1). This wave wires that seam end-to-end without baking product vocabulary into a neutral library:
|
|
596
|
+
|
|
597
|
+
- `agent-session`: `ISessionOptions.contextCapacityHint` is forwarded into the ConversationAgent config (`buildConversationAgent`), making the core seam reachable from the consuming layer.
|
|
598
|
+
- `agent-framework`: new `deriveContextCapacityHint(commandModules)` derives the concrete remediation wording from the surface's OWN registered command set (names a registered `compact` command → `"Run /compact and retry."`; `undefined` when none, leaving the neutral core default). It is applied automatically in interactive session assembly across the TUI, print, and `--serve` surfaces.
|
|
599
|
+
- `agent-cli`: the default command set registers `/compact`, so end users regain the actionable hint.
|
|
600
|
+
- `agent-interface-transport`: reworded the `'allow-project'` permission comment so it no longer hardcodes a storage path (the location is owned by the consuming layer), matching the `agent-session` twin.
|
|
601
|
+
- fcb0da3: PAYLOAD-2153: make external-payload replay stable across Linux, macOS, and Windows.
|
|
602
|
+
|
|
603
|
+
- Add the domain-free `@robota-sdk/agent-file-authority` leaf with bounded, root-relative reads over retained native handles and a typed, path-safe refusal taxonomy.
|
|
604
|
+
- Route session replay and framework project reads through the shared authority while preserving their existing domain-specific budgets, integrity checks, and error mappings.
|
|
605
|
+
- Expose the canonical safe session-id predicate through the framework facade so CLI exact-session lookup stays within the SDK package boundary.
|
|
606
|
+
- Package the pinned native bridge in clean-installed Node CLI archives and exact-host standalone Bun binaries, refusing unsupported or mismatched targets before artifact mutation.
|
|
607
|
+
- 9814afc: Type-SSOT convergence (TYPE-003; re-audit CONTRACT-002/003/011/012 + RUNTIME-47 + STRUCT-04). Behavior is unchanged — this is a type-level refactor. `ITokenUsage` (agent-core) is confirmed as the usage-triple SSOT: `ISessionUsageTotals` and `IBackgroundTaskUsage` become aliases, and every inline `{ promptTokens; completionTokens; totalTokens }` copy (service/orchestration/executor/remote-client shapes) now references the SSOT (structurally identical → patch). The subagent-job contracts derive from the background-task SSOT — `TSubagentJobStatus = Exclude<TBackgroundTaskStatus, 'paused'>`, mode alias, and a `Pick`-projection `ISubagentJobState` — with a compile-enforced parity test so a drifting hand copy can no longer exist. `@robota-sdk/agent-session` is minor because the public `ISessionRecord` type is now the typed `IInteractiveSessionRecord` alias (previously a relaxed `unknown[]` mirror): runtime behavior of `SessionStore` is identical, but downstream code that assigned loose payloads to the record's fields may need explicit casts at its own trust boundary (the framework store facade's `as unknown as` cast bridge is deleted). agent-session's duplicate `@robota-sdk/agent-core` deps/devDeps declaration is also removed (STRUCT-04).
|
|
608
|
+
|
|
609
|
+
### Patch Changes
|
|
610
|
+
|
|
611
|
+
- 5307f8a: Discriminate `IBackgroundTaskResult` by kind, the same way `TBackgroundTaskRequest` already is:
|
|
612
|
+
`exitCode`/`signalCode` exist only on the `process` member and `usage` only on the `agent` member,
|
|
613
|
+
instead of being optional-and-unreachable on every kind. `IBackgroundTaskResult<K>` narrows to the
|
|
614
|
+
kind-specific member; called with no type argument it is still the full union, which is what
|
|
615
|
+
`IBackgroundTaskState.result` continues to hold (that field stays undiscriminated — a later change).
|
|
616
|
+
`ISubagentJobResult` is now derived as `Omit<IBackgroundTaskResult<'agent'>, 'kind'>` rather than a
|
|
617
|
+
hand-maintained `Omit<IBackgroundTaskResult, 'kind' | 'exitCode' | 'signalCode'>`.
|
|
618
|
+
|
|
619
|
+
`IBackgroundTaskHandle` gains the same kind parameter as `IBackgroundTaskStart`: a runner declared
|
|
620
|
+
for kind `K` resolves its handle's `result` to `IBackgroundTaskResult<K>`, so a caller that starts a
|
|
621
|
+
known-kind runner gets a correctly-narrowed result with no cast, and reading a cross-kind field on it
|
|
622
|
+
is a compile error. Consumers reading `state.result` through the generic (kind-erased) manager or
|
|
623
|
+
task-state path are unaffected in behavior, but a `.exitCode`/`.signalCode`/`.usage` read there must
|
|
624
|
+
now narrow on the result's own `kind` first, since the fallback default keeps `IBackgroundTaskResult`
|
|
625
|
+
as the full union rather than the previously flat, always-present shape.
|
|
626
|
+
|
|
627
|
+
`agent-session`'s session-record decoder now rejects a persisted result carrying a field outside its
|
|
628
|
+
own kind (e.g. an `'agent'` result with `exitCode`) as corrupt, reported at that field's own path —
|
|
629
|
+
the same corruption-reporting style the taskId/kind identity check already uses.
|
|
630
|
+
|
|
631
|
+
**Breaking for `@robota-sdk/agent-interface-execution` and `@robota-sdk/agent-executor`**: code that
|
|
632
|
+
read `exitCode`/`signalCode`/`usage` off an unnarrowed `IBackgroundTaskResult`, or that implemented
|
|
633
|
+
`IBackgroundTaskHandle`/a custom runner without specifying its kind parameter, needs to narrow on
|
|
634
|
+
`result.kind` (or specify the kind parameter) before those fields are visible again.
|
|
635
|
+
- b462ee7: Discriminate `IBackgroundTaskState` by kind, the same way `TBackgroundTaskRequest` and (as of the
|
|
636
|
+
prior change) `TBackgroundTaskResult` already are. Fields only one runner ever produces now live
|
|
637
|
+
only on that kind's member instead of being optional-and-cross-kind-reachable on every kind:
|
|
638
|
+
|
|
639
|
+
- `agent`-only: `agentType`, `isolation`, `resumeSessionId`, `promptPreview`, and the
|
|
640
|
+
worktree-isolation fields (`worktreePath`, `branchName`, `worktreeStatus`, `worktreeNextAction`,
|
|
641
|
+
`worktreeBaseRevision`, `parentWorktreeStatus`).
|
|
642
|
+
- `scheduled`-only: `schedule`, `nextFireAt`.
|
|
643
|
+
- Every kind except `agent`: `commandPreview` (a process command, an MCP tool-invocation summary, or
|
|
644
|
+
a schedule's shell command / wake instruction).
|
|
645
|
+
- `state.result` is now `IBackgroundTaskResult<K>` — correlated with `state.kind`, not the free
|
|
646
|
+
full-result union.
|
|
647
|
+
|
|
648
|
+
`pid`, `logPath`, and `transcriptPath` stay on the shared base rather than becoming agent- or
|
|
649
|
+
process-exclusive: the runner handle SPI already reports them for whichever runner's process
|
|
650
|
+
happens to produce them, and a subagent run via the worktree/child-process runner carries a `pid`
|
|
651
|
+
exactly as a `process`-kind task does. `timeoutReason` also stays base — session restore sets
|
|
652
|
+
`'stale_worker'` on any non-terminal, non-rearmable task regardless of kind, not only agent ones.
|
|
653
|
+
|
|
654
|
+
`IBackgroundTaskState<K>` narrows to the kind-specific member; called with no type argument it is
|
|
655
|
+
still the full union. The session-record decoder (`agent-session`) now rejects a persisted task
|
|
656
|
+
state carrying a field outside its own kind as corrupt, reported at that field's own path, the same
|
|
657
|
+
way it already rejects a `state.result` whose kind disagrees with `state.kind`.
|
|
658
|
+
|
|
659
|
+
**Breaking for `@robota-sdk/agent-interface-execution` and `@robota-sdk/agent-executor`**: code that
|
|
660
|
+
read a kind-specific field (e.g. `state.agentType`, `state.schedule`, `state.commandPreview`) off an
|
|
661
|
+
unnarrowed `IBackgroundTaskState` needs to narrow on `state.kind` first, since the fallback default
|
|
662
|
+
no longer carries every field on every kind. `agent-session`, `agent-framework`, and `agent-command`
|
|
663
|
+
land the corresponding narrowing at every read site the type change touched; no runtime behavior
|
|
664
|
+
changes there beyond the state decoder's new corruption checks.
|
|
665
|
+
- 30e5e50: Reject background runner results whose task ID or kind differs from the task being completed, and report the same mismatch as corruption when decoding a persisted session record.
|
|
666
|
+
- be0e53c: A tool instance shared by several sessions sends each call's span to the session that made the call.
|
|
667
|
+
|
|
668
|
+
- **Before:** each session set its event service on the shared instance, so the span went to whichever session had set it last.
|
|
669
|
+
- **`agent-core`:** `IToolExecutionContext` gains an optional `instanceEventService`. `FunctionTool` emits its span there when a call carries one.
|
|
670
|
+
- **`agent-session`:** the permission wrapper keeps its session's service and passes it with every call.
|
|
671
|
+
- 57280bf: Every published package now declares `"engines": { "node": ">=22.12.0" }`. Before, 27 of the 38
|
|
672
|
+
packages declared no floor (`agent-core`, `agent-tools` and every provider among them),
|
|
673
|
+
`agent-session` and `agent-file-authority` declared `>=20.19.0`, and the other nine declared
|
|
674
|
+
`>=22.0.0`, so a consumer on Node 20 saw at most a warning from a transitive dependency.
|
|
675
|
+
|
|
676
|
+
Why 22.12: `agent-cli` and `agent-ui-terminal` need Node 22 through `ink` 7, and the CommonJS entries
|
|
677
|
+
of `agent-tools` and its dependents, `agent-transport`/`node` and its dependents, and
|
|
678
|
+
`agent-ui-terminal` `require()` ESM-only dependencies (`p-limit`, `jose`, `chalk`), which Node 22
|
|
679
|
+
supports unflagged only from 22.12. `engines` is advisory unless the consumer enables `engine-strict`.
|
|
680
|
+
|
|
681
|
+
No code changes: `tsdown` now reads `node22.12.0` as its build target from the field.
|
|
682
|
+
- 18c0d5c: Every published package now exports `./package.json`, so `require('<package>/package.json')` and
|
|
683
|
+
`import('<package>/package.json', { with: { type: 'json' } })` work instead of failing with
|
|
684
|
+
`ERR_PACKAGE_PATH_NOT_EXPORTED`, and each tarball now ships the package's `CHANGELOG.md`.
|
|
685
|
+
- 10597b2: Apply command-hook PreToolUse input rewrites only after every enforcing hook evaluates the final
|
|
686
|
+
input. Permission checks and tool execution share those arguments; rewrite cycles and replacements
|
|
687
|
+
that a delegated or already-settled action cannot apply are refused.
|
|
688
|
+
- 2c612ba: Release the migrated Robota product with its public SDK namespace, robota command, compatible SDK exports, internal product configuration, and verified CLI startup and delivery corrections.
|
|
689
|
+
- e706b43: Live telemetry can name its spans with the OpenTelemetry GenAI semantic conventions. Set
|
|
690
|
+
`PRODUCT_TELEMETRY_SEMCONV` to `gen_ai` to export `invoke_agent`, `chat {model}` (client) and
|
|
691
|
+
`execute_tool {tool}` spans with `gen_ai.*` attributes, keeping Robota-only facts as `agent.*`; or to
|
|
692
|
+
`gen_ai/dup` to emit both attribute sets while dashboards move. The default, `agent`, exports exactly
|
|
693
|
+
the spans it did before. An unknown value, or the setting while neither traces nor metrics are exported,
|
|
694
|
+
refuses startup. Console traces under a GenAI mode print the same projected spans.
|
|
695
|
+
|
|
696
|
+
The live prompt trace now carries each tool body's name (the session's tool-body observation includes it
|
|
697
|
+
and the framework's live projection passes a label-safe name through); it reaches spans only under a
|
|
698
|
+
GenAI mode and is never written to session history.
|
|
699
|
+
- 60f3965: **`robota mcp serve --ask-client` puts a caller's permission and ask prompts to the calling MCP client through elicitation instead of failing them.**
|
|
700
|
+
|
|
701
|
+
`@robota-sdk/agent-transport-mcp`: `createMcpTransport`, `createMcpHttpHost`,
|
|
702
|
+
`createMcpRemoteHttpHost` and `createAgentMcpServer` take `askClient`. Off by default, every prompt
|
|
703
|
+
is a tool error as before. On, and when the client declared form-mode elicitation, a permission or
|
|
704
|
+
ask prompt raised by that client's own call is put to it: a permission offers allow once or deny
|
|
705
|
+
only, never a remembered grant; an ask becomes a form (choice, multiple choice, free text); a masked
|
|
706
|
+
ask is never sent; deny, decline, cancel, a client error or an answer naming nothing offered keeps
|
|
707
|
+
today's outcome. stdio asks during the call. The HTTP hosts keep no session state, so they ask only
|
|
708
|
+
a client on the 2026-07-28 revision, through input-required rounds whose `requestState` is a
|
|
709
|
+
single-use random token naming one parked call; a 2025-era HTTP client keeps the tool error.
|
|
710
|
+
A call listens for prompts only while its own work drives the session, so a submission waiting
|
|
711
|
+
in the queue never holds another caller's prompt that it cannot answer.
|
|
712
|
+
Breaking for hand-written sessions: `IMcpTransportSession` now also requires `ISessionEvents`
|
|
713
|
+
(`on`/`off`), `ISessionPromptResolution` (`resolvePermission`/`resolveAsk`) and
|
|
714
|
+
`ISessionDriverAttribution` (`getActiveDriverId`), which `InteractiveSession` and the published
|
|
715
|
+
test double already implement.
|
|
716
|
+
|
|
717
|
+
`@robota-sdk/agent-interface-session` / `@robota-sdk/agent-session` / `@robota-sdk/agent-framework`:
|
|
718
|
+
`ISessionRuntimeTools.invokeRuntimeTool` (and `Session.invokeRuntimeTool`) accept
|
|
719
|
+
`options.permissionInteraction` and `options.driverId`. A direct call still denies a decision that
|
|
720
|
+
would need a person, and finds no one to ask a question, unless its caller passes
|
|
721
|
+
`permissionInteraction: 'interactive'`; then it asks the session's permission handler and its
|
|
722
|
+
tools get the session's ask port. `InteractiveSession` makes `driverId` the active driver while
|
|
723
|
+
the direct call runs, so a prompt the call raises carries it as `requesterDriverId`. With
|
|
724
|
+
`askClient` on, an MCP call runs under its own `mcp:<n>` driver id; a submission made that way is
|
|
725
|
+
attributed to it rather than to the owner.
|
|
726
|
+
|
|
727
|
+
`@robota-sdk/agent-transport`: exports `permissionSummaryArgument`, the argument a person recognises
|
|
728
|
+
a tool call by (`filePath` for the built-in file tools), for every transport that puts a permission
|
|
729
|
+
request to a person in its own wire form.
|
|
730
|
+
|
|
731
|
+
`@robota-sdk/agent-cli`: `mcp serve --ask-client` turns this on for whichever carrier the run serves.
|
|
732
|
+
- c207a31: Keep automatic compaction aligned with the active model and pending input, preserve provider usage when estimating new context, and keep summary text out of the response stream. Display live context changes and successful automatic compaction in the shared app interface.
|
|
733
|
+
- 9b4f63b: Allow explicitly borrowed providers to outlive agent destruction and Session shutdown while keeping
|
|
734
|
+
owned providers as the default. Track replaced and removed provider cleanup, expose current provider
|
|
735
|
+
registrations after swapping, and hold Roundtable resource leases until runtime teardown finishes.
|
|
736
|
+
Borrowing does not permit concurrent provider use across leases.
|
|
737
|
+
Serialize manager lifecycle transitions so reinitialization cannot admit providers during pending teardown.
|
|
738
|
+
- 4f3c075: Assemble complete, verified package generations before switching build output; preserve the previous generation on build failure and pack only verified regular-file images. Include copied CLI web assets in affected-build ordering and artifact transfer. Preserve the CLI version in managed build paths. Public runtime contracts remain compatible (patch).
|
|
739
|
+
- 6085cad: CORE-031: a compaction with nothing to summarise no longer replaces the conversation
|
|
740
|
+
|
|
741
|
+
`Session.compact()` guarded on the FULL conversation and then compacted a DIFFERENT array — the same
|
|
742
|
+
history with system messages filtered out. So a conversation consisting only of system messages
|
|
743
|
+
passed the guard, reached the orchestrator empty, took its `return ''` shortcut, and came back as a
|
|
744
|
+
"summary" the caller wrote over the conversation: cleared, and replaced with an empty
|
|
745
|
+
`[Context Summary]` block.
|
|
746
|
+
|
|
747
|
+
The guard now tests the messages that will actually be compacted. Nothing to summarise is a no-op,
|
|
748
|
+
not a failure — the conversation is left exactly as found, no hook fires, no `context_compact` event
|
|
749
|
+
is written, and the provider is not called.
|
|
750
|
+
|
|
751
|
+
`CompactionOrchestrator.compact()` correspondingly throws `CompactionError` on an empty `history`
|
|
752
|
+
rather than returning `''`, which contradicted the contract two lines above it in its own docblock
|
|
753
|
+
("always a non-empty string") and was the value that made the overwrite possible. Whether there is
|
|
754
|
+
anything worth compacting is the caller's judgement, made before it commits to replacing anything.
|
|
755
|
+
|
|
756
|
+
Reachable from the public SDK surface: `Session.injectMessage` is what `--resume` and `--fork` drive
|
|
757
|
+
on every restore.
|
|
758
|
+
- 93d061d: CORE-043: structured output now knows which transport can carry the schema before the first call
|
|
759
|
+
|
|
760
|
+
`run(input, { output })` asked every provider for `responseFormat: { type: 'json_schema' }`. A
|
|
761
|
+
provider whose surface cannot express that accepted the option and dropped it — and the schema was
|
|
762
|
+
stated in words only by the RETRY feedback turn, which runs on attempt two. So against such a
|
|
763
|
+
provider, attempt one carried nothing describing the required shape and could only succeed by luck:
|
|
764
|
+
the advertised three attempts were really two, and the first was spent discovering something the
|
|
765
|
+
capability table already knew.
|
|
766
|
+
|
|
767
|
+
A `(provider, model)` pair now resolves to a mechanism (`response_schema` / `json_object` / `none`)
|
|
768
|
+
and a provenance (`catalog` / `vendor-default` / `undeclared` / `unverified-endpoint`), and the
|
|
769
|
+
request is shaped to match at the one seam that holds both the resolved provider and the outgoing
|
|
770
|
+
messages. When the wire cannot carry the shape, the schema is stated in the prompt on the FIRST
|
|
771
|
+
attempt. Each structured request emits a `structured_output_transport` event reporting what the
|
|
772
|
+
request actually did.
|
|
773
|
+
|
|
774
|
+
- `IAIProvider.endpointIsVendorDefault?()` — a provider configured with a custom `baseURL` reports
|
|
775
|
+
it, so the runtime stops claiming enforcement a gateway may not provide. Separate from
|
|
776
|
+
`capabilityTable?()` on purpose: `@robota-sdk/agent-provider-openai` declares no table (nobody has
|
|
777
|
+
verified one) and must still be able to answer.
|
|
778
|
+
- DeepSeek's capability table declared `json_schema`; DeepSeek guarantees the response PARSES but
|
|
779
|
+
takes no schema parameter. Corrected to `json_object`.
|
|
780
|
+
- A provider that declares nothing is still sent the request unchanged — silence is not a denial.
|
|
781
|
+
- bed26ea: Fix: an in-flight autonomous `goal` is no longer lost on session resume. `fromSessionRecord` was a hand-enumerated field whitelist that omitted `goal` (while the write path persisted it), so the goal silently vanished on load. The read path is now a structural mirror of the write path (`{ ...session }`), so every persisted field — including `goal` — round-trips, and a future field cannot be dropped by omission (ARL-08 / DATA-006). `ISessionRecord` gains an opaque `goal?: unknown` for contract honesty.
|
|
782
|
+
- bad976f: Persist turn and tool intent before effects, restore interrupted calls with unknown outcomes, reap owned foreground shell groups after owner death, and prune proven dead peer announcements.
|
|
783
|
+
- 07b627f: A local peer can now be answered, and what its turn may do depends on where it runs.
|
|
784
|
+
|
|
785
|
+
- `agent-core`: the permission evaluator takes a peer turn's authority as one more input
|
|
786
|
+
(`IPermissionEvaluationContext.peerTurn`), decided after the deny list and ceiling and before
|
|
787
|
+
bypass and allow rules. A peer on another host uses no tool. A peer on the same host may use an
|
|
788
|
+
inspect-class tool that declares `workspacePaths`, only when every named location resolves inside
|
|
789
|
+
the workspace and is not a credential (`isSecretPath`); write and execute tools are refused unless
|
|
790
|
+
enabled, and then every use asks. A tool declaring `repliesToPeer` exists only in a peer turn and
|
|
791
|
+
asks once the turn used another tool. New: `isToolAvailableInPeerTurn`, `TPeerReach`,
|
|
792
|
+
`IPeerTurnAuthority`. `IRunOptions.withholdHostedTools` leaves a provider's hosted tools out of a
|
|
793
|
+
run's requests (`nativeWebTools` with `false` withholds a hosted tool for one call).
|
|
794
|
+
- `agent-tools`: `Read` and `Glob` declare the arguments that say where they look. `Grep` does not:
|
|
795
|
+
it reads files it was never named, so a peer turn does not get it.
|
|
796
|
+
- `agent-session`: `ISessionRunOptions.peerReach` makes a run a peer turn for the permission policy;
|
|
797
|
+
every ask in it needs a fresh approval, and its requests carry no provider-hosted tool. `ISessionOptions.allowPeerChanges` enables write and execute
|
|
798
|
+
tools for same-host peer turns.
|
|
799
|
+
- `agent-interface-session`: `ISubmitOptions.peer` (`IPeerTurnContext`) carries a peer turn's reach,
|
|
800
|
+
the message it answers and the session a reply goes to.
|
|
801
|
+
- `agent-interface-session-mobility`: `IPeerMessage.inReplyTo` threads a conversation;
|
|
802
|
+
`peerReachOf(admission)` maps admission to a reach.
|
|
803
|
+
- `agent-framework`: a peer turn is offered what its origin allows, and a new `peer_reply` tool
|
|
804
|
+
answers the peer that sent the message, threaded to it. The setting `peers.allowChanges` enables
|
|
805
|
+
write and execute tools for same-host peer turns.
|
|
806
|
+
- `agent-ui-terminal`: a permission prompt in a peer turn names the requesting peer.
|
|
807
|
+
- `agent-cli`: incoming peer turns carry their reach and reply route; a conversation is limited in
|
|
808
|
+
depth and in how often this session answers it, and a reply over a limit is not sent and the
|
|
809
|
+
operator is told.
|
|
810
|
+
- `agent-provider-anthropic`, `agent-provider-openai-compatible` (Qwen): a request whose
|
|
811
|
+
`nativeWebTools` sets a hosted tool to `false` is sent without it.
|
|
812
|
+
- d0de5b2: A peer session's message now reaches the model as a peer's, and a peer turn runs on the external
|
|
813
|
+
baseline.
|
|
814
|
+
|
|
815
|
+
- `agent-core` marks every user message whose driver id starts with `peer:` as
|
|
816
|
+
`<peer_message from="…">…</peer_message>` in the outgoing request — both the round and the forced
|
|
817
|
+
summary — while the stored history keeps the text as sent. Wrapper-shaped text in user and tool
|
|
818
|
+
messages is escaped, and an id that is not a plain identifier is printed as `peer:unverified`.
|
|
819
|
+
New exports: `peerDriverOf`, `printablePeerDriver`.
|
|
820
|
+
- `agent-session`'s conversation transcript (compaction, advisor) labels a peer message with the same
|
|
821
|
+
printable id, so no rendering echoes a sender-chosen id that is not a plain identifier.
|
|
822
|
+
- `agent-framework` runs a `peer` turn like an `external` one — no tools (`toolChoice: 'none'`), no
|
|
823
|
+
`@path` expansion, no context references — and adds a per-turn system statement that the message
|
|
824
|
+
came from another session and carries no authority. A `peer` turn must carry a `peer:` driver id.
|
|
825
|
+
- 7d9cc66: Retain typed resource and audio observations alongside structured tool results through history, durable receipts, recovery, size admission, and session persistence. Preserve opaque resource references without fetching them, project embedded text and explicit unsupported binary/audio diagnostics into provider requests and compaction transcripts, and validate persisted observation shapes on reload.
|
|
826
|
+
- 7d9cc66: Retain registered tool source attribution in observations and preserve ordered outcome receipts independently of conversation summaries.
|
|
827
|
+
- 7911a7d: Preserve pending execution discovery and input admission in atomic Session conversation snapshots.
|
|
828
|
+
Strict synchronous checkpoints now gate waiting, settlement and abandonment acknowledgment; failed saves
|
|
829
|
+
require checkpoint repair without repeating execution. Restore before framework queue and autonomous
|
|
830
|
+
input admission, and refuse unresolved conversation copies. Read v1/v2 session envelopes and write v2;
|
|
831
|
+
older readers preserve v2 as unsupported, so coordinate reader versions when rolling back.
|
|
832
|
+
- ebd40a0: Harden on-disk log permissions against CWE-377 (SEC-003, CodeQL `js/insecure-temporary-file`).
|
|
833
|
+
|
|
834
|
+
Session logs, externalized session payloads, and OpenAI request/response payload logs all carry
|
|
835
|
+
conversation and prompt content, but were created with the process umask (typically `0644`) inside a
|
|
836
|
+
caller-supplied directory that may be shared or world-writable. They are now created owner-only
|
|
837
|
+
(`0600`), and the directories that hold them are created `0700`.
|
|
838
|
+
|
|
839
|
+
This is a permissions change only — file locations, names, formats, and APIs are unchanged. Anything
|
|
840
|
+
that read these logs as a _different_ OS user will no longer be able to; the owning user is
|
|
841
|
+
unaffected.
|
|
842
|
+
- 7d9cc66: Retain mixed tool observations alongside structured results through live session events and history
|
|
843
|
+
display. The shared app renderer previews inline raster images and keeps resource URIs inert, with
|
|
844
|
+
explicit diagnostics for unsupported media instead of silently dropping it.
|
|
845
|
+
- 7d9cc66: Retain registered attribution on refused and interrupted call receipts without replacing the source of actual or recovered settlements, and project undispatched registered calls into live and restored presentation history.
|
|
846
|
+
- Updated dependencies [9c19c50]
|
|
847
|
+
- Updated dependencies [7b6234c]
|
|
848
|
+
- Updated dependencies [5307f8a]
|
|
849
|
+
- Updated dependencies [b462ee7]
|
|
850
|
+
- Updated dependencies [37b4bd7]
|
|
851
|
+
- Updated dependencies [4eea54b]
|
|
852
|
+
- Updated dependencies [1698be4]
|
|
853
|
+
- Updated dependencies [d4189b9]
|
|
854
|
+
- Updated dependencies [9edae52]
|
|
855
|
+
- Updated dependencies [4078a72]
|
|
856
|
+
- Updated dependencies [4c73a0b]
|
|
857
|
+
- Updated dependencies [196a900]
|
|
858
|
+
- Updated dependencies [f336838]
|
|
859
|
+
- Updated dependencies [34e50f0]
|
|
860
|
+
- Updated dependencies [722e88a]
|
|
861
|
+
- Updated dependencies [d23c848]
|
|
862
|
+
- Updated dependencies [3038eb7]
|
|
863
|
+
- Updated dependencies [02b7452]
|
|
864
|
+
- Updated dependencies [e689c8e]
|
|
865
|
+
- Updated dependencies [ec5e477]
|
|
866
|
+
- Updated dependencies [c7f9203]
|
|
867
|
+
- Updated dependencies [7b72344]
|
|
868
|
+
- Updated dependencies [6ae3f28]
|
|
869
|
+
- Updated dependencies [be0e53c]
|
|
870
|
+
- Updated dependencies [57f57f5]
|
|
871
|
+
- Updated dependencies [ba822c1]
|
|
872
|
+
- Updated dependencies [6e6b06b]
|
|
873
|
+
- Updated dependencies [8bd5fac]
|
|
874
|
+
- Updated dependencies [57280bf]
|
|
875
|
+
- Updated dependencies [5033dd9]
|
|
876
|
+
- Updated dependencies [18c0d5c]
|
|
877
|
+
- Updated dependencies [dbd888d]
|
|
878
|
+
- Updated dependencies [1887e54]
|
|
879
|
+
- Updated dependencies [9f46375]
|
|
880
|
+
- Updated dependencies [41cca13]
|
|
881
|
+
- Updated dependencies [ada3841]
|
|
882
|
+
- Updated dependencies [5093a30]
|
|
883
|
+
- Updated dependencies [94b2c87]
|
|
884
|
+
- Updated dependencies [3ab2eca]
|
|
885
|
+
- Updated dependencies [e8d70ac]
|
|
886
|
+
- Updated dependencies [2c612ba]
|
|
887
|
+
- Updated dependencies [66af868]
|
|
888
|
+
- Updated dependencies [60f3965]
|
|
889
|
+
- Updated dependencies [115e104]
|
|
890
|
+
- Updated dependencies [04719a9]
|
|
891
|
+
- Updated dependencies [04a6de4]
|
|
892
|
+
- Updated dependencies [0ba247b]
|
|
893
|
+
- Updated dependencies [6f41c53]
|
|
894
|
+
- Updated dependencies [fec722f]
|
|
895
|
+
- Updated dependencies [2d3b2c0]
|
|
896
|
+
- Updated dependencies [4772067]
|
|
897
|
+
- Updated dependencies [9fbab1b]
|
|
898
|
+
- Updated dependencies [a009f5b]
|
|
899
|
+
- Updated dependencies [c207a31]
|
|
900
|
+
- Updated dependencies [9b4f63b]
|
|
901
|
+
- Updated dependencies [4f3c075]
|
|
902
|
+
- Updated dependencies [475e085]
|
|
903
|
+
- Updated dependencies [e477440]
|
|
904
|
+
- Updated dependencies [9dcb5da]
|
|
905
|
+
- Updated dependencies [a95ca85]
|
|
906
|
+
- Updated dependencies [b6d14ce]
|
|
907
|
+
- Updated dependencies [0382a51]
|
|
908
|
+
- Updated dependencies [93d061d]
|
|
909
|
+
- Updated dependencies [39554a1]
|
|
910
|
+
- Updated dependencies [d28430a]
|
|
911
|
+
- Updated dependencies [7d9cc66]
|
|
912
|
+
- Updated dependencies [7d9cc66]
|
|
913
|
+
- Updated dependencies [7d9cc66]
|
|
914
|
+
- Updated dependencies [df02568]
|
|
915
|
+
- Updated dependencies [fcb0da3]
|
|
916
|
+
- Updated dependencies [07b627f]
|
|
917
|
+
- Updated dependencies [d0de5b2]
|
|
918
|
+
- Updated dependencies [9c6a8db]
|
|
919
|
+
- Updated dependencies [dfb9b15]
|
|
920
|
+
- Updated dependencies [7d9cc66]
|
|
921
|
+
- Updated dependencies [7d9cc66]
|
|
922
|
+
- Updated dependencies [7911a7d]
|
|
923
|
+
- Updated dependencies [d6b9404]
|
|
924
|
+
- Updated dependencies [5783499]
|
|
925
|
+
- Updated dependencies [62663ae]
|
|
926
|
+
- Updated dependencies [9c6a8db]
|
|
927
|
+
- Updated dependencies [23a30cd]
|
|
928
|
+
- Updated dependencies [7d9cc66]
|
|
929
|
+
- Updated dependencies [7d9cc66]
|
|
930
|
+
- Updated dependencies [9814afc]
|
|
931
|
+
- Updated dependencies [7d9cc66]
|
|
932
|
+
- Updated dependencies [02053ec]
|
|
933
|
+
- @robota-sdk/agent-interface-execution@3.0.0
|
|
934
|
+
- @robota-sdk/agent-core@3.0.0
|
|
935
|
+
- @robota-sdk/agent-interface-session@3.0.0
|
|
936
|
+
- @robota-sdk/agent-file-authority@3.0.0
|
|
937
|
+
|
|
938
|
+
## 3.0.0-beta.106
|
|
939
|
+
### Patch Changes
|
|
940
|
+
|
|
941
|
+
- @robota-sdk/agent-core@3.0.0-beta.106
|
|
942
|
+
- @robota-sdk/agent-file-authority@3.0.0-beta.106
|
|
943
|
+
- @robota-sdk/agent-interface-execution@3.0.0-beta.106
|
|
944
|
+
- @robota-sdk/agent-interface-session@3.0.0-beta.106
|
|
945
|
+
|
|
946
|
+
## 3.0.0-beta.105
|
|
947
|
+
### Patch Changes
|
|
948
|
+
|
|
949
|
+
- @robota-sdk/agent-core@3.0.0-beta.105
|
|
950
|
+
- @robota-sdk/agent-file-authority@3.0.0-beta.105
|
|
951
|
+
- @robota-sdk/agent-interface-execution@3.0.0-beta.105
|
|
952
|
+
- @robota-sdk/agent-interface-session@3.0.0-beta.105
|
|
953
|
+
|
|
954
|
+
## 3.0.0-beta.104
|
|
955
|
+
### Patch Changes
|
|
956
|
+
|
|
957
|
+
- @robota-sdk/agent-core@3.0.0-beta.104
|
|
958
|
+
- @robota-sdk/agent-file-authority@3.0.0-beta.104
|
|
959
|
+
- @robota-sdk/agent-interface-execution@3.0.0-beta.104
|
|
960
|
+
- @robota-sdk/agent-interface-session@3.0.0-beta.104
|
|
961
|
+
|
|
962
|
+
## 3.0.0-beta.103
|
|
963
|
+
### Patch Changes
|
|
964
|
+
|
|
965
|
+
- Updated dependencies [6f41c53]
|
|
966
|
+
- @robota-sdk/agent-core@3.0.0-beta.103
|
|
967
|
+
- @robota-sdk/agent-interface-execution@3.0.0-beta.103
|
|
968
|
+
- @robota-sdk/agent-interface-session@3.0.0-beta.103
|
|
969
|
+
- @robota-sdk/agent-file-authority@3.0.0-beta.103
|
|
970
|
+
|
|
971
|
+
## 3.0.0-beta.102
|
|
972
|
+
### Patch Changes
|
|
973
|
+
|
|
974
|
+
- @robota-sdk/agent-core@3.0.0-beta.102
|
|
975
|
+
- @robota-sdk/agent-file-authority@3.0.0-beta.102
|
|
976
|
+
- @robota-sdk/agent-interface-execution@3.0.0-beta.102
|
|
977
|
+
- @robota-sdk/agent-interface-session@3.0.0-beta.102
|
|
978
|
+
|
|
979
|
+
## 3.0.0-beta.101
|
|
980
|
+
### Patch Changes
|
|
981
|
+
|
|
982
|
+
- Updated dependencies [5783499]
|
|
983
|
+
- Updated dependencies [62663ae]
|
|
984
|
+
- @robota-sdk/agent-file-authority@3.0.0-beta.101
|
|
985
|
+
- @robota-sdk/agent-core@3.0.0-beta.101
|
|
986
|
+
- @robota-sdk/agent-interface-execution@3.0.0-beta.101
|
|
987
|
+
- @robota-sdk/agent-interface-session@3.0.0-beta.101
|
|
988
|
+
|
|
989
|
+
## 3.0.0-beta.100
|
|
990
|
+
### Patch Changes
|
|
991
|
+
|
|
992
|
+
- @robota-sdk/agent-core@3.0.0-beta.100
|
|
993
|
+
- @robota-sdk/agent-file-authority@3.0.0-beta.100
|
|
994
|
+
- @robota-sdk/agent-interface-execution@3.0.0-beta.100
|
|
995
|
+
- @robota-sdk/agent-interface-session@3.0.0-beta.100
|
|
996
|
+
|
|
3
997
|
## 3.0.0-beta.99
|
|
4
998
|
### Patch Changes
|
|
5
999
|
|
|
@@ -200,7 +1194,7 @@
|
|
|
200
1194
|
`gen_ai/dup` to emit both attribute sets while dashboards move. The default, `agent`, exports exactly
|
|
201
1195
|
the spans it did before. An unknown value, or the setting while neither traces nor metrics are exported,
|
|
202
1196
|
refuses startup. Console traces under a GenAI mode print the same projected spans.
|
|
203
|
-
|
|
1197
|
+
|
|
204
1198
|
The live prompt trace now carries each tool body's name (the session's tool-body observation includes it
|
|
205
1199
|
and the framework's live projection passes a label-safe name through); it reaches spans only under a
|
|
206
1200
|
GenAI mode and is never written to session history.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@robota-sdk/agent-session",
|
|
3
|
-
"version": "3.0.
|
|
3
|
+
"version": "3.0.2",
|
|
4
4
|
"description": "Session for the Robota SDK: permission-gated tool execution, hooks, context tracking, compaction and persistence",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/node/index.js",
|
|
@@ -63,10 +63,10 @@
|
|
|
63
63
|
"node": ">=22.12.0"
|
|
64
64
|
},
|
|
65
65
|
"dependencies": {
|
|
66
|
-
"@robota-sdk/agent-core": "3.0.
|
|
67
|
-
"@robota-sdk/agent-
|
|
68
|
-
"@robota-sdk/agent-interface-
|
|
69
|
-
"@robota-sdk/agent-
|
|
66
|
+
"@robota-sdk/agent-core": "3.0.2",
|
|
67
|
+
"@robota-sdk/agent-interface-execution": "3.0.2",
|
|
68
|
+
"@robota-sdk/agent-interface-session": "3.0.2",
|
|
69
|
+
"@robota-sdk/agent-file-authority": "3.0.2"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
72
72
|
"eslint": "^8.57.1",
|