@rynx-ai/daemon 0.1.11-beta.53 → 0.1.11-beta.54

package/bundled-plugins/plugins/lark/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rynx-ai/plugin-channel-lark",
-  "version": "0.1.11-beta.53",
+  "version": "0.1.11-beta.54",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/rynx-ai/rynx.git",

package/dist/plugin-host-rpc.js

@@ -9,7 +9,7 @@ import { PluginRunnerError } from "@rynx-ai/plugin-runner";
 import { ensurePluginSessionLaunch, replayPluginSessionLaunch, SessionLaunchOperationConflictError, SessionLaunchOperationTargetDeletedError, } from "./session-launch-operations.js";
 import { createControlLink } from "./control-link-store.js";
 import { nodeLogFiles, sessionLogFiles } from "./log-files.js";
-import { issueSessionPortalTicket, revokeSessionPortalGrant, } from "./session-portal-grant-store.js";
+import { issueSessionPortalTicket, revokeSessionPortalGrant, renewSessionPortalGrant, } from "./session-portal-grant-store.js";
 import { claimSessionTimelineProjection, completeSessionTimelineProjection, } from "./session-timeline-projection-store.js";
 const MAX_MESSAGE_LENGTH = 1_000_000;
 /** Leaves ample room for the RPC envelope below the runner's 1 MiB line cap. */
@@ -134,6 +134,7 @@ export class PluginHostRpc {
                         ? {
                             sessionPortalEmbedOrigin: true,
                             sessionPortalGrantRevocation: true,
+                            sessionPortalGrantRenewal: true,
                         }
                         : {}),
                 },
@@ -251,6 +252,33 @@ export class PluginHostRpc {
                     this.ownedSession(sessionId);
                     return this.issueSessionPortalLink("single_session", requiredSessionPortalAccess(input), sessionId, optionalSessionPortalEmbedOrigin(input.embedOrigin), optionalString(input.grantHandle, "grantHandle", 128));
                 }
+                case "session.portal.grant.renew": {
+                    const input = record(params);
+                    const scope = input.scope;
+                    if (scope !== "single_session" && scope !== "plugin_sessions") {
+                        throw new PluginHostCallError("INVALID_PARAMS", "scope must be single_session or plugin_sessions");
+                    }
+                    const sessionId = scope === "single_session" ? requiredSessionId(input) : undefined;
+                    if (sessionId)
+                        this.ownedSession(sessionId);
+                    else if (input.sessionId !== undefined) {
+                        throw new PluginHostCallError("INVALID_PARAMS", "plugin_sessions scope cannot specify a Session");
+                    }
+                    const embedOrigin = optionalSessionPortalEmbedOrigin(input.embedOrigin);
+                    if (!embedOrigin)
+                        throw new PluginHostCallError("INVALID_PARAMS", "embedOrigin is required for renewal");
+                    const renewed = renewSessionPortalGrant({
+                        pluginId: this.principalId,
+                        grantHandle: requiredString(input.grantHandle, "grantHandle", 128),
+                        scope,
+                        access: requiredSessionPortalAccess(input),
+                        sessionId,
+                        embedOrigin,
+                    });
+                    if (!renewed)
+                        throw new PluginHostCallError("HOST_CALL_FAILED", "Session Portal grant expired, revoked, or does not match the authorized scope");
+                    return renewed;
+                }
                 case "session.portal.grant.revoke": {
                     const grantHandle = requiredString(record(params).grantHandle, "grantHandle", 128);
                     return revokeSessionPortalGrant({

package/dist/session-portal-grant-store.d.ts

@@ -34,6 +34,20 @@ export declare function redeemSessionPortalTicket(ticket: string, now?: Date, em
  * exact grant that was issued; it does not authorize an API call. */
 export declare function inspectSessionPortalGrant(portalId: string, now?: Date): SessionPortalAuthorization | undefined;
 export declare function authorizeSessionPortalGrant(portalId: string, secret: string, now?: Date): SessionPortalAuthorization | undefined;
+/** Only the issuing Plugin may extend an embedded grant, after its external
+ * authorizer has rechecked the viewer's current permissions. Match the freshly
+ * authorized scope so an old handle cannot renew another Session or access level. */
+export declare function renewSessionPortalGrant(input: {
+    pluginId: string;
+    grantHandle: string;
+    scope: SessionPortalScope;
+    access: SessionPortalAccess;
+    sessionId?: string;
+    embedOrigin: string;
+    now?: Date;
+}): {
+    expiresAt: string;
+} | undefined;
 /** Revoke one issued Portal link, whether its ticket is still unused or it has
  * already become a browser grant. The opaque handle carries no product meaning. */
 export declare function revokeSessionPortalGrant(input: {

package/dist/session-portal-grant-store.js

@@ -91,6 +91,20 @@ export function authorizeSessionPortalGrant(portalId, secret, now = new Date())
         return undefined;
     return publicGrant(row);
 }
+/** Only the issuing Plugin may extend an embedded grant, after its external
+ * authorizer has rechecked the viewer's current permissions. Match the freshly
+ * authorized scope so an old handle cannot renew another Session or access level. */
+export function renewSessionPortalGrant(input) {
+    if (!input.embedOrigin)
+        return undefined;
+    const now = input.now ?? new Date();
+    const expiresAt = new Date(now.getTime() + GRANT_TTL_MS).toISOString();
+    const updated = db().prepare(`UPDATE session_portal_grants SET expires_at = ?
+      WHERE plugin_id = ? AND grant_handle = ? AND scope = ? AND access = ?
+        AND session_id IS ? AND embed_origin = ?
+        AND revoked_at IS NULL AND expires_at > ?`).run(expiresAt, input.pluginId, input.grantHandle, input.scope, input.access, input.sessionId ?? null, input.embedOrigin, now.toISOString());
+    return updated.changes > 0 ? { expiresAt } : undefined;
+}
 /** Revoke one issued Portal link, whether its ticket is still unused or it has
  * already become a browser grant. The opaque handle carries no product meaning. */
 export async function revokeSessionPortalGrant(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rynx-ai/daemon",
-  "version": "0.1.11-beta.53",
+  "version": "0.1.11-beta.54",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/rynx-ai/rynx.git",
@@ -60,18 +60,18 @@
     "tar": "^7.5.19",
     "undici": "^7.28.0",
     "ws": "^8.21.0",
-    "@rynx-ai/core": "0.1.11-beta.53",
-    "@rynx-ai/emulator": "0.1.11-beta.53",
-    "@rynx-ai/plugin-runner": "0.1.11-beta.53",
-    "@rynx-ai/plugin-sdk": "0.1.11-beta.53",
-    "@rynx-ai/protocol": "0.1.11-beta.53",
-    "@rynx-ai/remote-runtime-client": "0.1.11-beta.53",
-    "@rynx-ai/server": "0.1.11-beta.53"
+    "@rynx-ai/core": "0.1.11-beta.54",
+    "@rynx-ai/emulator": "0.1.11-beta.54",
+    "@rynx-ai/plugin-runner": "0.1.11-beta.54",
+    "@rynx-ai/plugin-sdk": "0.1.11-beta.54",
+    "@rynx-ai/protocol": "0.1.11-beta.54",
+    "@rynx-ai/remote-runtime-client": "0.1.11-beta.54",
+    "@rynx-ai/server": "0.1.11-beta.54"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
-    "@rynx-ai/browser-cdp": "0.1.11-beta.53",
-    "@rynx-ai/plugin-channel-lark": "0.1.11-beta.53"
+    "@rynx-ai/browser-cdp": "0.1.11-beta.54",
+    "@rynx-ai/plugin-channel-lark": "0.1.11-beta.54"
   },
   "scripts": {
     "build": "rm -rf dist bundled-plugins && tsc -p tsconfig.json && chmod +x dist/index-daemon.js && node scripts/prepare-agent-browser.mjs && node ../../scripts/stage-bundled-plugins.mjs && node scripts/build-plugin-maintenance.mjs",