@skaile/workspaces 0.32.0 → 0.34.0

package/dist/{chunk-SIW5I47F.js → chunk-4RSCLQYX.js}

@@ -1,17 +1,17 @@
-import { WorkspacePlugin } from './chunk-MA7HSL5S.js';
+import { WorkspacePlugin } from './chunk-QLHOORR7.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { PROTOCOL_VERSION } from './chunk-TDSRLMDB.js';
-import { EventNormalizer } from './chunk-7FLLPKX3.js';
+import { EventNormalizer } from './chunk-NSVAJWWQ.js';
 import { classifyClaudeSdkError } from './chunk-NGJ6E344.js';
-import { createDriver } from './chunk-OEXA7BBK.js';
+import { createDriver } from './chunk-CIFTUSBV.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-GXHJDQ37.js';
-import { loadConnectorDeclarations, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-2RQ3KLY3.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-WQRDLR3K.js';
+import { loadConnectorDeclarations, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-UQ5JY2GQ.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
-import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-7WHBI3I6.js';
-import { resolveRuntimeAssets } from './chunk-SN2RWSB3.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr } from './chunk-DTJNHYFE.js';
+import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-DVIIYYD5.js';
+import { resolveRuntimeAssets } from './chunk-2VM62DX7.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr } from './chunk-E5VRPYUX.js';
 import { parseAssetRef } from './chunk-LFDZYCEO.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { getLogStore, resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, registerLogStore, resetLogStore, createLogger } from './chunk-JB35MVBN.js';
@@ -24,7 +24,7 @@ import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } fr
 import { homedir } from 'os';
 import * as z5 from 'zod';
 import { z } from 'zod';
-import fs4, { mkdir, writeFile, rename } from 'fs/promises';
+import fs4, { mkdir, writeFile, rename, readFile } from 'fs/promises';
 import { createHash, randomUUID } from 'crypto';
 import { execFile, spawnSync } from 'child_process';
 import { promisify } from 'util';
@@ -983,6 +983,17 @@ function warnUnresolvedRecipeMarkers(recipeLog, declId, resolvedCommand, resolve
 var PASSTHROUGH_INPUT_ZOD = {
   parse: (v) => v
 };
+function isMcpAuthError(err) {
+  if (!err || typeof err !== "object") return false;
+  const code = err.code ?? err.status;
+  if (code === 401 || code === "401") return true;
+  const message = err.message;
+  if (typeof message !== "string") return false;
+  return /\b401\b|invalid[_ ]token|invalid[_ ]grant/i.test(message);
+}
+function errMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 function buildTransport(decl, secrets) {
   const transport = decl.transport ?? "stdio";
   if (transport === "stdio") {
@@ -1029,10 +1040,14 @@ var ExternalMcpManager = class {
    * @param connect   Optional connector override (tests inject a fake client so
    *                  no live subprocess is spawned). Defaults to the real SDK
    *                  client + transport.
+   * @param reauthorize Optional re-mint callback for `auth: backend` remote
+   *                  servers. When present, a 401 from a tool call (or the
+   *                  initial connect) triggers a re-mint + reconnect.
    */
-  constructor(registry, secrets, sessionId, connect) {
+  constructor(registry, secrets, sessionId, connect, reauthorize) {
     this.registry = registry;
     this.connect = connect ?? defaultMcpClientConnector(secrets);
+    this.reauthorize = reauthorize;
     this.log = createLogger({
       kind: "mcp",
       subkind: "runner-managed",
@@ -1043,6 +1058,7 @@ var ExternalMcpManager = class {
   servers = [];
   log;
   connect;
+  reauthorize;
   /** True when at least one external server connected and registered tools. */
   hasServers() {
     return this.servers.length > 0;
@@ -1064,12 +1080,13 @@ var ExternalMcpManager = class {
     }
   }
   async startServer(decl) {
-    const client = await this.connect(decl);
+    const client = await this.connectWithReauth(decl);
+    const server = { id: decl.id, decl, client, toolNames: [] };
     const toolNames = [];
     try {
       const { tools } = await client.listTools();
       for (const tool of tools) {
-        const cap = this.buildToolCapability(decl.id, tool, client);
+        const cap = this.buildToolCapability(server, tool);
         this.registry.register(cap, "agent");
         toolNames.push(cap.name);
       }
@@ -1081,7 +1098,8 @@ var ExternalMcpManager = class {
       }
       throw err;
     }
-    this.servers.push({ id: decl.id, client, toolNames });
+    server.toolNames = toolNames;
+    this.servers.push(server);
     this.log.info("MCP server registered (runner-managed)", {
       id: decl.id,
       transport: decl.transport ?? "stdio",
@@ -1089,14 +1107,72 @@ var ExternalMcpManager = class {
       tools: toolNames
     });
   }
+  /**
+   * Connect, re-minting once on an initial-connect 401: the provisioned bearer
+   * may already be stale by the time the server is reached. Only retries for
+   * `auth: backend` servers with a reauthorizer wired.
+   */
+  async connectWithReauth(decl) {
+    try {
+      return await this.connect(decl);
+    } catch (err) {
+      if (isMcpAuthError(err) && this.reauthorize && decl.auth === "backend") {
+        this.log.warn("MCP initial connect 401 \u2014 re-minting and retrying", { id: decl.id });
+        if (await this.reauthorize(decl)) {
+          return this.connect(decl);
+        }
+      }
+      throw err;
+    }
+  }
+  /**
+   * Re-mint the bearer and reconnect one server in place after a 401. Concurrent
+   * 401s for the same server share a single round-trip via `reauthInFlight`.
+   * Returns `true` once `server.client` points at a freshly-authed connection.
+   */
+  reauthAndReconnect(server) {
+    server.reauthInFlight ??= this.doReauthAndReconnect(server).finally(() => {
+      server.reauthInFlight = void 0;
+    });
+    return server.reauthInFlight;
+  }
+  async doReauthAndReconnect(server) {
+    if (!this.reauthorize || server.decl.auth !== "backend") return false;
+    let provisioned;
+    try {
+      provisioned = await this.reauthorize(server.decl);
+    } catch (err) {
+      this.log.warn("MCP re-mint failed after 401", { id: server.id, error: errMessage(err) });
+      return false;
+    }
+    if (!provisioned) return false;
+    let next;
+    try {
+      next = await this.connect(server.decl);
+      await next.listTools();
+    } catch (err) {
+      this.log.warn("MCP reconnect after 401 failed", { id: server.id, error: errMessage(err) });
+      return false;
+    }
+    const old = server.client;
+    server.client = next;
+    try {
+      await old.close();
+    } catch {
+    }
+    this.log.info("MCP server reconnected after 401 re-mint", { id: server.id });
+    return true;
+  }
   /**
    * Wrap a single MCP tool as a {@link DefinedCapability}. The capability name
    * is `mcp__<server>__<tool>` (the naming claude-sdk wildcards and prompts
-   * depend on). The handler proxies the call to the live MCP client; a tool
-   * error (`isError`) is rethrown so the capability dispatch path surfaces it
-   * to the LLM as a tool failure.
+   * depend on). The handler proxies the call to the server's LIVE client (read
+   * lazily so a 401 reconnect is transparent); a tool error (`isError`) is
+   * rethrown so the capability dispatch path surfaces it to the LLM, and a 401
+   * triggers a re-mint + reconnect followed by a single retry.
    */
-  buildToolCapability(serverId, tool, client) {
+  buildToolCapability(server, tool) {
+    const serverId = server.id;
     const name = `mcp__${serverId}__${tool.name}`;
     const inputSchema = tool.inputSchema && typeof tool.inputSchema === "object" ? tool.inputSchema : { type: "object" };
     return {
@@ -1111,10 +1187,18 @@ var ExternalMcpManager = class {
       audience: ["llm"],
       inputZod: PASSTHROUGH_INPUT_ZOD,
       handler: async (input, ctx) => {
-        const result = await client.callTool({
-          name: tool.name,
-          arguments: input ?? {}
-        });
+        const call = { name: tool.name, arguments: input ?? {} };
+        let result;
+        try {
+          result = await server.client.callTool(call);
+        } catch (err) {
+          if (isMcpAuthError(err) && await this.reauthAndReconnect(server)) {
+            ctx.log.info("mcp tool retried after 401 re-mint", { tool: name });
+            result = await server.client.callTool(call);
+          } else {
+            throw err;
+          }
+        }
         const content = result.content ?? [];
         const text = content.filter((c) => c.type === "text" && typeof c.text === "string").map((c) => c.text).join("\n");
         if (result.isError) {
@@ -1128,8 +1212,14 @@ var ExternalMcpManager = class {
   /**
    * Deregister every tool and close every client (kills the subprocesses).
    * Best-effort: a failed close on one server does not prevent the rest.
+   *
+   * Drains any in-flight 401 reconnect first: a `doReauthAndReconnect` resolving
+   * after teardown would set `server.client` to a freshly-connected client that
+   * nothing then closes (leak). Awaiting `reauthInFlight` guarantees we close the
+   * LATEST client.
    */
   async dispose() {
+    await Promise.allSettled(this.servers.map((s) => s.reauthInFlight).filter(Boolean));
     for (const server of this.servers) {
       for (const toolName of server.toolNames) {
         this.registry.deregister(toolName);
@@ -1346,11 +1436,42 @@ async function startExternalMcpServers(capabilityRegistry, projectDir, secretPro
   const externalMcpManager = new ExternalMcpManager(
     capabilityRegistry,
     secretProvider,
-    sessionMeta?.sessionId
+    sessionMeta?.sessionId,
+    void 0,
+    buildMcpReauthorizer(capabilityRegistry, secretProvider, sessionMeta?.sessionId)
   );
   await externalMcpManager.start(resolvedDecls);
   return externalMcpManager;
 }
+function mcpAuthSecretKey(id) {
+  return `MCP__${id.replace(/[^A-Za-z0-9_]/g, "_")}__AUTH`;
+}
+function buildMcpReauthorizer(capabilityRegistry, secretProvider, sessionId) {
+  const provider = secretProvider;
+  const provision = provider?.provision?.bind(provider);
+  if (!provision) return void 0;
+  const log = createLogger({ kind: "mcp", subkind: "reauth", instance: sessionId ?? "no-session" });
+  return async (decl) => {
+    if (!decl.providerLinkId || decl.auth !== "backend") return false;
+    let mint;
+    try {
+      mint = await capabilityRegistry.invokeRemote("host.refresh_credential", {
+        kind: "mcp-server",
+        id: decl.providerLinkId,
+        reason: "retry-401"
+      });
+    } catch (err) {
+      log.warn("MCP credential re-mint round-trip failed", {
+        id: decl.id,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      return false;
+    }
+    if (!mint?.ok || !mint.token) return false;
+    provision({ [mcpAuthSecretKey(decl.id)]: `Bearer ${mint.token}` });
+    return true;
+  };
+}
 function wireExternalMcpServersForSdk(mcpServers, projectDir, secretProvider, sessionMeta) {
   const mcpLog = createLogger({
     kind: "mcp",
@@ -2719,6 +2840,57 @@ function rewriteFileChangedPath(event, cwd, mounts) {
   return event;
 }
 
+// runner/src/lifecycle-handler.ts
+function buildLifecycleHandler(deps) {
+  const { getCompactionOrchestrator, getResourceManager, log } = deps;
+  return async ({ phase }) => {
+    switch (phase) {
+      case "compact": {
+        const orchestrator = getCompactionOrchestrator();
+        if (orchestrator) await orchestrator.compact("manual");
+        else log("[lifecycle] compact: no compaction orchestrator \u2014 skipped");
+        break;
+      }
+      case "hibernate": {
+        const manager = getResourceManager();
+        if (manager) await manager.hibernateAll();
+        else log("[lifecycle] hibernate: no resource manager \u2014 skipped");
+        break;
+      }
+      case "close": {
+        const manager = getResourceManager();
+        if (manager) await manager.closeAll();
+        else log("[lifecycle] close: no resource manager \u2014 skipped");
+        break;
+      }
+    }
+    return { ok: true };
+  };
+}
+function parseFleetHealthBody(body) {
+  return body.trim().toLowerCase() === "healthy" ? "healthy" : "error";
+}
+async function dispatchFleetHealthFlag(dir, fileName, manager, log) {
+  if (!manager) return;
+  const connectorId = fileName;
+  if (!connectorId || connectorId.startsWith(".")) return;
+  let verdict;
+  try {
+    verdict = parseFleetHealthBody(await readFile(join(dir, connectorId), "utf8"));
+  } catch {
+    verdict = "error";
+  }
+  try {
+    await manager.reportFleetHealth(connectorId, verdict);
+    log.debug("fleet-health flag dispatched", { connectorId, verdict });
+  } catch (err) {
+    log.warn("fleet-health flag dispatch failed", {
+      connectorId,
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+
 // runner/src/refresh-flag-dispatcher.ts
 async function dispatchRefreshToExposedGitMounts(manager, log) {
   if (!manager) return;
@@ -2807,7 +2979,7 @@ var setStateInput = z5.strictObject({
   value: requiredUnknown
 });
 var lifecycleInput = z5.strictObject({
-  action: z5.enum(["hibernate", "close", "shutdown"])
+  phase: z5.enum(["hibernate", "close", "compact"])
 });
 var VALID_LOG_STORE_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 function buildRunnerCapabilities(handlers) {
@@ -2921,7 +3093,7 @@ function buildRunnerCapabilities(handlers) {
     defineCapability({
       name: "runner.lifecycle",
       displayName: "Session lifecycle",
-      description: "Transition the session lifecycle: hibernate to disk, close the active flow, or shut down the runner.",
+      description: "Transition the session lifecycle: hibernate (connectors persist state), close (connectors finalize), or compact conversation history.",
       side: "agent",
       origin: RUNNER_CAP_ORIGIN,
       audience: ["runtime"],
@@ -3515,17 +3687,15 @@ async function startAgentServer(opts) {
       const { skillsDir } = resolveDriverPaths({
         driver: opts.driver ?? wsConfig.agent_config?.default?.driver ?? "claude-sdk"
       });
-      const strict = process.env.SKAILE_STRICT_YAML === "true";
-      const declared = strict ? (wsConfig.dependencies ?? []).flatMap((dep) => {
+      const declared = (wsConfig.dependencies ?? []).flatMap((dep) => {
         try {
           const ref = parseAssetRef(dep);
           return ref.kind === "skill" ? [ref.name] : [];
         } catch {
           return [];
         }
-      }) : [];
+      });
       const stagedSkills = stageMaterializedSkills(opts.projectDir, skillsDir, {
-        strict,
         declared
       });
       if (stagedSkills.length > 0) {
@@ -3842,6 +4012,25 @@ async function startAgentServer(opts) {
       error: err instanceof Error ? err.message : String(err)
     });
   }
+  const fleetHealthDir = join(opts.projectDir, ".skaile", "fleet-health");
+  try {
+    mkdirSync(fleetHealthDir, { recursive: true });
+  } catch (err) {
+    serverLog.warn("failed to pre-create fleet-health dir \u2014 platform health signal disabled", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+  let fleetHealthWatcher = null;
+  try {
+    fleetHealthWatcher = watch(fleetHealthDir, (_event, fileName) => {
+      if (!fileName) return;
+      void dispatchFleetHealthFlag(fleetHealthDir, fileName.toString(), resourceManager, serverLog);
+    });
+  } catch (err) {
+    serverLog.warn("fs.watch on fleet-health dir failed \u2014 platform health signal disabled", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
   async function cleanup() {
     try {
       await Promise.race([
@@ -3868,6 +4057,11 @@ async function startAgentServer(opts) {
     } catch {
     }
     refreshFlagWatcher = null;
+    try {
+      fleetHealthWatcher?.close();
+    } catch {
+    }
+    fleetHealthWatcher = null;
     if (agentSession) {
       try {
         await agentSession.dispose();
@@ -3963,10 +4157,14 @@ async function startAgentServer(opts) {
             });
           },
           log
+        }),
+        // setLogLevel left undefined (the cap self-falls-back to getLogStore);
+        // setState remains a stub (not resource hot-plug).
+        lifecycle: buildLifecycleHandler({
+          getCompactionOrchestrator: () => compactionOrchestrator,
+          getResourceManager: () => resourceManager,
+          log
         })
-        // setLogLevel left undefined — the cap's built-in fallback calls
-        // getLogStore()?.setLevel(...) directly. setState / lifecycle
-        // remain stubs (not resource hot-plug; out of Sprint 2 scope).
       });
       for (const cap of runnerCaps) {
         capabilityRegistry.register(cap, "agent");
@@ -4847,5 +5045,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-SIW5I47F.js.map
-//# sourceMappingURL=chunk-SIW5I47F.js.map
+//# sourceMappingURL=chunk-4RSCLQYX.js.map
+//# sourceMappingURL=chunk-4RSCLQYX.js.map