@skaile/workspaces 0.37.0 → 0.38.0

package/dist/{chunk-DAEYSPOC.js → chunk-OW32SQU3.js}

@@ -1,4 +1,4 @@
-import { WorkspacePlugin } from './chunk-CCQ3EMJT.js';
+import { WorkspacePlugin } from './chunk-GL3MUJ5L.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { PROTOCOL_VERSION } from './chunk-TDSRLMDB.js';
@@ -6,8 +6,8 @@ import { EventNormalizer } from './chunk-5IXCNMMU.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
 import { createDriver } from './chunk-KM6DCR7A.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-3HR6IN5B.js';
-import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-CC5ZHSHJ.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-DQLRTCA2.js';
+import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, deriveSingleMaterializedConnectorDeclaration } from './chunk-WLWHOA3S.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
 import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-FBIQ4QPF.js';
 import { resolveRuntimeAssets } from './chunk-CFCSDZYF.js';
@@ -19,7 +19,7 @@ import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import { readdirSync, existsSync, readFileSync, unlinkSync, mkdirSync, writeFileSync, statSync, watch, openSync, readSync, closeSync } from 'fs';
+import { readdirSync, existsSync, readFileSync, unlinkSync, mkdirSync, writeFileSync, statSync, watch, chmodSync, openSync, readSync, closeSync } from 'fs';
 import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } from 'path';
 import { homedir } from 'os';
 import * as z5 from 'zod';
@@ -2949,8 +2949,16 @@ function buildLifecycleHandler(deps) {
     return { ok: true };
   };
 }
-
-// runner/src/session-resource-handlers.ts
+function readResolvedConnectorSecret(instancePath, id) {
+  if (!existsSync(instancePath)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync(instancePath, "utf8"));
+    const value = parsed.resolvedSecrets?.[`connector:${id}`];
+    return typeof value === "string" ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function asDeclaration(declaration) {
   if (declaration !== null && typeof declaration === "object" && typeof declaration.id === "string" && typeof declaration.driver === "string") {
     return declaration;
@@ -2961,7 +2969,7 @@ function toPreMinted(token) {
   return { ok: true, token: token.token, expiresAt: token.expiresAt ?? null };
 }
 function buildSessionResourceHandlers(deps) {
-  const { getResourceManager, getPreMintedSecrets, emitResourcesAvailable, log } = deps;
+  const { getResourceManager, getPreMintedSecrets, emitResourcesAvailable, log, getProjectDir } = deps;
   async function add(kind, input) {
     const rm = getResourceManager();
     if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
@@ -2975,6 +2983,9 @@ function buildSessionResourceHandlers(deps) {
     try {
       await rm.connect(decl);
     } catch (err) {
+      if (input.preMintedToken) {
+        getPreMintedSecrets()?.unset(kind, decl.id);
+      }
       const message = err instanceof Error ? err.message : String(err);
       log(`[session-resource] runner.add_${kind} failed for ${decl.id}: ${message}`);
       return { ok: false, code: "connect_failed", message };
@@ -2983,9 +2994,52 @@ function buildSessionResourceHandlers(deps) {
     log(`[session-resource] runner.add_${kind} connected ${decl.id}`);
     return { ok: true, id: decl.id };
   }
+  async function attachConnectorInstance(name) {
+    if (!name) {
+      return { ok: false, code: "invalid_input", message: "name is required" };
+    }
+    if (name.includes("/") || name.includes("\\") || name.includes("..")) {
+      return {
+        ok: false,
+        code: "invalid_input",
+        message: "name must not contain path separators or traversal segments"
+      };
+    }
+    const projectDir = getProjectDir?.();
+    if (!projectDir) {
+      return { ok: false, code: "no_project_dir", message: "getProjectDir not configured" };
+    }
+    const root = join(projectDir, ".skaile/assets/connector");
+    const decl = deriveSingleMaterializedConnectorDeclaration(root, name);
+    if (!decl) {
+      return {
+        ok: false,
+        code: "not_materialized",
+        message: `no materialized connector at ${join(root, name)}`
+      };
+    }
+    const rm = getResourceManager();
+    if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
+    const token = readResolvedConnectorSecret(join(root, name, ".instance.json"), decl.id);
+    if (token !== void 0) {
+      getPreMintedSecrets()?.set("connector", decl.id, { ok: true, token, expiresAt: null });
+    }
+    try {
+      await rm.connect(decl);
+    } catch (err) {
+      getPreMintedSecrets()?.unset("connector", decl.id);
+      const message = err instanceof Error ? err.message : String(err);
+      log(`[session-resource] runner.attach_instance connector failed for ${decl.id}: ${message}`);
+      return { ok: false, code: "connector_connect_failed", message };
+    }
+    emitResourcesAvailable();
+    log(`[session-resource] runner.attach_instance connected connector ${decl.id}`);
+    return { ok: true, id: decl.id, live: true, toolCount: 0 };
+  }
   return {
     addConnector: (input) => add("connector", input),
     addMount: (input) => add("mount", input),
+    attachConnectorInstance,
     removeResource: async (input) => {
       const rm = getResourceManager();
       if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
@@ -4226,11 +4280,15 @@ async function startAgentServer(opts) {
   }
   const fleetHealthDir = join(opts.projectDir, ".skaile", "fleet-health");
   try {
-    mkdirSync(fleetHealthDir, { recursive: true });
+    mkdirSync(fleetHealthDir, { recursive: true, mode: 1528 });
+    chmodSync(fleetHealthDir, 1528);
   } catch (err) {
-    serverLog.warn("failed to pre-create fleet-health dir \u2014 platform health signal disabled", {
-      error: err instanceof Error ? err.message : String(err)
-    });
+    serverLog.warn(
+      "failed to pre-create/chmod fleet-health dir \u2014 platform health signal may be degraded",
+      {
+        error: err instanceof Error ? err.message : String(err)
+      }
+    );
   }
   let fleetHealthWatcher = null;
   try {
@@ -4360,26 +4418,36 @@ async function startAgentServer(opts) {
       emitResourcesAvailable();
       agentSession.startWatching();
       capabilityRegistry.setRemoteInvoker(remoteCapabilityInvoker);
+      const { attachConnectorInstance, ...resourceCaps } = buildSessionResourceHandlers({
+        getResourceManager: () => resourceManager,
+        getPreMintedSecrets: () => preMintedSecrets,
+        emitResourcesAvailable,
+        log,
+        getProjectDir: () => opts.projectDir
+      });
+      const mcpHandlers = buildMcpRuntimeHandlers({
+        getOrCreateMcpManager: () => agentSession?.getOrCreateExternalMcpManager() ?? null,
+        getPreMintedSecrets: () => preMintedSecrets ?? null,
+        driverPicksUpToolsLive,
+        emitResourcesAvailable,
+        log,
+        getProjectDir: () => opts.projectDir
+      });
       const runnerCaps = buildRunnerCapabilities({
-        // Resource hot-plug handlers, wired to the live session's
-        // ConnectorManager + PreMintedSecretProvider via getters because
-        // both are lazily (re)assigned in this scope.
-        ...buildSessionResourceHandlers({
-          getResourceManager: () => resourceManager,
-          getPreMintedSecrets: () => preMintedSecrets,
-          emitResourcesAvailable,
-          log
-        }),
-        // runner.add_mcp_server + runner.attach_instance — wired to the live
-        // session's lazily-created ExternalMcpManager + PreMintedSecretProvider.
-        ...buildMcpRuntimeHandlers({
-          getOrCreateMcpManager: () => agentSession?.getOrCreateExternalMcpManager() ?? null,
-          getPreMintedSecrets: () => preMintedSecrets ?? null,
-          driverPicksUpToolsLive,
-          emitResourcesAvailable,
-          log,
-          getProjectDir: () => opts.projectDir
-        }),
+        ...resourceCaps,
+        ...mcpHandlers,
+        // attach_instance routes by kind: connectors take the materialize-then-
+        // connect path; everything else stays on the MCP attach path.
+        attachInstance: async (input) => {
+          if (input.kind === "connector") {
+            return attachConnectorInstance(input.name);
+          }
+          return mcpHandlers.attachInstance ? mcpHandlers.attachInstance(input) : {
+            ok: false,
+            code: "not_implemented",
+            message: "attach_instance handler not configured"
+          };
+        },
         // setLogLevel left undefined (the cap self-falls-back to getLogStore);
         // setState remains a stub (not resource hot-plug).
         lifecycle: buildLifecycleHandler({
@@ -5272,5 +5340,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-DAEYSPOC.js.map
-//# sourceMappingURL=chunk-DAEYSPOC.js.map
+//# sourceMappingURL=chunk-OW32SQU3.js.map
+//# sourceMappingURL=chunk-OW32SQU3.js.map