@skaile/workspaces 0.36.0 → 0.38.0

package/dist/{chunk-FDLVPYSN.js → chunk-OW32SQU3.js}

@@ -1,4 +1,4 @@
-import { WorkspacePlugin } from './chunk-YPRW2ROJ.js';
+import { WorkspacePlugin } from './chunk-GL3MUJ5L.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { PROTOCOL_VERSION } from './chunk-TDSRLMDB.js';
@@ -6,12 +6,12 @@ import { EventNormalizer } from './chunk-5IXCNMMU.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
 import { createDriver } from './chunk-KM6DCR7A.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-JNH6TTIO.js';
-import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-MCQ4TJ3P.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-DQLRTCA2.js';
+import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, deriveSingleMaterializedConnectorDeclaration } from './chunk-WLWHOA3S.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
-import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-2Q6OY3SU.js';
-import { resolveRuntimeAssets } from './chunk-5DPQ766L.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr } from './chunk-56YT6CWS.js';
+import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-FBIQ4QPF.js';
+import { resolveRuntimeAssets } from './chunk-CFCSDZYF.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-HL66R2P2.js';
 import { parseAssetRef } from './chunk-BM7XANVN.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { getLogStore, resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, registerLogStore, resetLogStore, createLogger } from './chunk-JB35MVBN.js';
@@ -19,7 +19,7 @@ import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import { readdirSync, existsSync, readFileSync, unlinkSync, mkdirSync, writeFileSync, statSync, watch, openSync, readSync, closeSync } from 'fs';
+import { readdirSync, existsSync, readFileSync, unlinkSync, mkdirSync, writeFileSync, statSync, watch, chmodSync, openSync, readSync, closeSync } from 'fs';
 import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } from 'path';
 import { homedir } from 'os';
 import * as z5 from 'zod';
@@ -882,6 +882,14 @@ function validateSubstitutedPaths(command, args) {
 }
 
 // runner/src/external-mcp.ts
+var McpServerAlreadyRegisteredError = class extends Error {
+  constructor(id) {
+    super(`MCP server '${id}' is already registered`);
+    this.id = id;
+    this.name = "McpServerAlreadyRegisteredError";
+  }
+  id;
+};
 function resolveRecordSecrets(record, secrets) {
   if (!secrets) return record;
   const resolved = {};
@@ -1086,7 +1094,7 @@ var ExternalMcpManager = class {
    */
   async addServer(decl) {
     if (this.servers.some((s) => s.id === decl.id)) {
-      throw new Error(`MCP server '${decl.id}' is already registered`);
+      throw new McpServerAlreadyRegisteredError(decl.id);
     }
     const client = await this.connectWithReauth(decl);
     const server = { id: decl.id, decl, client, toolNames: [] };
@@ -2941,8 +2949,16 @@ function buildLifecycleHandler(deps) {
     return { ok: true };
   };
 }
-
-// runner/src/session-resource-handlers.ts
+function readResolvedConnectorSecret(instancePath, id) {
+  if (!existsSync(instancePath)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync(instancePath, "utf8"));
+    const value = parsed.resolvedSecrets?.[`connector:${id}`];
+    return typeof value === "string" ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function asDeclaration(declaration) {
   if (declaration !== null && typeof declaration === "object" && typeof declaration.id === "string" && typeof declaration.driver === "string") {
     return declaration;
@@ -2953,7 +2969,7 @@ function toPreMinted(token) {
   return { ok: true, token: token.token, expiresAt: token.expiresAt ?? null };
 }
 function buildSessionResourceHandlers(deps) {
-  const { getResourceManager, getPreMintedSecrets, emitResourcesAvailable, log } = deps;
+  const { getResourceManager, getPreMintedSecrets, emitResourcesAvailable, log, getProjectDir } = deps;
   async function add(kind, input) {
     const rm = getResourceManager();
     if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
@@ -2967,6 +2983,9 @@ function buildSessionResourceHandlers(deps) {
     try {
       await rm.connect(decl);
     } catch (err) {
+      if (input.preMintedToken) {
+        getPreMintedSecrets()?.unset(kind, decl.id);
+      }
       const message = err instanceof Error ? err.message : String(err);
       log(`[session-resource] runner.add_${kind} failed for ${decl.id}: ${message}`);
       return { ok: false, code: "connect_failed", message };
@@ -2975,9 +2994,52 @@ function buildSessionResourceHandlers(deps) {
     log(`[session-resource] runner.add_${kind} connected ${decl.id}`);
     return { ok: true, id: decl.id };
   }
+  async function attachConnectorInstance(name) {
+    if (!name) {
+      return { ok: false, code: "invalid_input", message: "name is required" };
+    }
+    if (name.includes("/") || name.includes("\\") || name.includes("..")) {
+      return {
+        ok: false,
+        code: "invalid_input",
+        message: "name must not contain path separators or traversal segments"
+      };
+    }
+    const projectDir = getProjectDir?.();
+    if (!projectDir) {
+      return { ok: false, code: "no_project_dir", message: "getProjectDir not configured" };
+    }
+    const root = join(projectDir, ".skaile/assets/connector");
+    const decl = deriveSingleMaterializedConnectorDeclaration(root, name);
+    if (!decl) {
+      return {
+        ok: false,
+        code: "not_materialized",
+        message: `no materialized connector at ${join(root, name)}`
+      };
+    }
+    const rm = getResourceManager();
+    if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
+    const token = readResolvedConnectorSecret(join(root, name, ".instance.json"), decl.id);
+    if (token !== void 0) {
+      getPreMintedSecrets()?.set("connector", decl.id, { ok: true, token, expiresAt: null });
+    }
+    try {
+      await rm.connect(decl);
+    } catch (err) {
+      getPreMintedSecrets()?.unset("connector", decl.id);
+      const message = err instanceof Error ? err.message : String(err);
+      log(`[session-resource] runner.attach_instance connector failed for ${decl.id}: ${message}`);
+      return { ok: false, code: "connector_connect_failed", message };
+    }
+    emitResourcesAvailable();
+    log(`[session-resource] runner.attach_instance connected connector ${decl.id}`);
+    return { ok: true, id: decl.id, live: true, toolCount: 0 };
+  }
   return {
     addConnector: (input) => add("connector", input),
     addMount: (input) => add("mount", input),
+    attachConnectorInstance,
     removeResource: async (input) => {
       const rm = getResourceManager();
       if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
@@ -3040,7 +3102,57 @@ function buildMcpRuntimeHandlers(deps) {
       } catch (err) {
         deps.getPreMintedSecrets()?.unset("mcp", decl.id);
         const message = err instanceof Error ? err.message : String(err);
-        const code = message.includes("already registered") ? "mcp_already_registered" : "mcp_connect_failed";
+        const code = err instanceof McpServerAlreadyRegisteredError ? "mcp_already_registered" : "mcp_connect_failed";
+        return { ok: false, code, message };
+      }
+    },
+    attachInstance: async (input) => {
+      if (input.kind !== "mcp-server") {
+        return {
+          ok: false,
+          code: "unsupported_kind",
+          message: `attach_instance supports mcp-server only; '${input.kind}' is not yet supported`
+        };
+      }
+      if (!input.name) {
+        return { ok: false, code: "invalid_input", message: "name is required" };
+      }
+      if (input.name.includes("/") || input.name.includes("\\") || input.name.includes("..")) {
+        return {
+          ok: false,
+          code: "invalid_input",
+          message: "name must not contain path separators or traversal segments"
+        };
+      }
+      if (!deps.getProjectDir) {
+        return { ok: false, code: "no_project_dir", message: "getProjectDir not configured" };
+      }
+      const subDir = join(deps.getProjectDir(), ".skaile/assets/mcp-server", input.name);
+      const decl = deriveSingleMaterializedMcpDeclaration(subDir, input.name);
+      if (!decl) {
+        return {
+          ok: false,
+          code: "not_materialized",
+          message: `no materialized mcp-server at ${subDir}`
+        };
+      }
+      const mgr = deps.getOrCreateMcpManager();
+      if (!mgr) return { ok: false, code: "no_session", message: "session resources not ready" };
+      try {
+        const { toolNames } = await mgr.addServer(decl);
+        deps.emitResourcesAvailable();
+        deps.log(
+          `[mcp-runtime] runner.attach_instance connected ${decl.id} (${toolNames.length} tools)`
+        );
+        return {
+          ok: true,
+          id: decl.id,
+          live: deps.driverPicksUpToolsLive(),
+          toolCount: toolNames.length
+        };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const code = err instanceof McpServerAlreadyRegisteredError ? "mcp_already_registered" : "mcp_connect_failed";
         return { ok: false, code, message };
       }
     }
@@ -3141,6 +3253,10 @@ var addMcpServerInputSchema = z5.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema
 });
+var attachInstanceInputSchema = z5.strictObject({
+  kind: z5.string(),
+  name: z5.string()
+});
 var removeResourceInput = z5.strictObject({
   id: z5.string()
 });
@@ -3219,6 +3335,20 @@ function buildRunnerCapabilities(handlers) {
         });
       }
     }),
+    defineCapability({
+      name: "runner.attach_instance",
+      displayName: "Attach instance",
+      description: "Materialize-then-attach-by-ref: the platform writes the asset to .skaile/assets/ then invokes this cap; the runner self-derives the declaration from disk and attaches it live.",
+      side: "agent",
+      origin: RUNNER_CAP_ORIGIN,
+      audience: ["runtime"],
+      kind: "effect",
+      input: attachInstanceInputSchema,
+      handler: async (input) => {
+        if (!handlers.attachInstance) return notImplemented("runner.attach_instance");
+        return handlers.attachInstance({ kind: input.kind, name: input.name });
+      }
+    }),
     defineCapability({
       name: "runner.remove_resource",
       displayName: "Remove resource",
@@ -4150,11 +4280,15 @@ async function startAgentServer(opts) {
   }
   const fleetHealthDir = join(opts.projectDir, ".skaile", "fleet-health");
   try {
-    mkdirSync(fleetHealthDir, { recursive: true });
+    mkdirSync(fleetHealthDir, { recursive: true, mode: 1528 });
+    chmodSync(fleetHealthDir, 1528);
   } catch (err) {
-    serverLog.warn("failed to pre-create fleet-health dir \u2014 platform health signal disabled", {
-      error: err instanceof Error ? err.message : String(err)
-    });
+    serverLog.warn(
+      "failed to pre-create/chmod fleet-health dir \u2014 platform health signal may be degraded",
+      {
+        error: err instanceof Error ? err.message : String(err)
+      }
+    );
   }
   let fleetHealthWatcher = null;
   try {
@@ -4284,25 +4418,36 @@ async function startAgentServer(opts) {
       emitResourcesAvailable();
       agentSession.startWatching();
       capabilityRegistry.setRemoteInvoker(remoteCapabilityInvoker);
+      const { attachConnectorInstance, ...resourceCaps } = buildSessionResourceHandlers({
+        getResourceManager: () => resourceManager,
+        getPreMintedSecrets: () => preMintedSecrets,
+        emitResourcesAvailable,
+        log,
+        getProjectDir: () => opts.projectDir
+      });
+      const mcpHandlers = buildMcpRuntimeHandlers({
+        getOrCreateMcpManager: () => agentSession?.getOrCreateExternalMcpManager() ?? null,
+        getPreMintedSecrets: () => preMintedSecrets ?? null,
+        driverPicksUpToolsLive,
+        emitResourcesAvailable,
+        log,
+        getProjectDir: () => opts.projectDir
+      });
       const runnerCaps = buildRunnerCapabilities({
-        // Resource hot-plug handlers, wired to the live session's
-        // ConnectorManager + PreMintedSecretProvider via getters because
-        // both are lazily (re)assigned in this scope.
-        ...buildSessionResourceHandlers({
-          getResourceManager: () => resourceManager,
-          getPreMintedSecrets: () => preMintedSecrets,
-          emitResourcesAvailable,
-          log
-        }),
-        // runner.add_mcp_server — wired to the live session's lazily-created
-        // ExternalMcpManager + PreMintedSecretProvider.
-        ...buildMcpRuntimeHandlers({
-          getOrCreateMcpManager: () => agentSession?.getOrCreateExternalMcpManager() ?? null,
-          getPreMintedSecrets: () => preMintedSecrets ?? null,
-          driverPicksUpToolsLive,
-          emitResourcesAvailable,
-          log
-        }),
+        ...resourceCaps,
+        ...mcpHandlers,
+        // attach_instance routes by kind: connectors take the materialize-then-
+        // connect path; everything else stays on the MCP attach path.
+        attachInstance: async (input) => {
+          if (input.kind === "connector") {
+            return attachConnectorInstance(input.name);
+          }
+          return mcpHandlers.attachInstance ? mcpHandlers.attachInstance(input) : {
+            ok: false,
+            code: "not_implemented",
+            message: "attach_instance handler not configured"
+          };
+        },
         // setLogLevel left undefined (the cap self-falls-back to getLogStore);
         // setState remains a stub (not resource hot-plug).
         lifecycle: buildLifecycleHandler({
@@ -5195,5 +5340,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-FDLVPYSN.js.map
-//# sourceMappingURL=chunk-FDLVPYSN.js.map
+//# sourceMappingURL=chunk-OW32SQU3.js.map
+//# sourceMappingURL=chunk-OW32SQU3.js.map