@skaile/workspaces 1.5.0 → 1.6.1

package/dist/{chunk-BGIC25VK.js → chunk-M4UKIJ5K.js}

@@ -1,4 +1,4 @@
-import { WorkspacePlugin } from './chunk-RDYOU6N6.js';
+import { WorkspacePlugin } from './chunk-EA73UA42.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { EventNormalizer } from './chunk-HKX5VSWQ.js';
@@ -6,13 +6,13 @@ import { SUPPORTED_CLOUDS, CLOUD_SECRET_ENV_KEYS } from './chunk-ISQWMBKD.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
 import { createDriver } from './chunk-TNSCHS4I.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-DMG6NJH7.js';
-import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, deriveSingleMaterializedConnectorDeclaration } from './chunk-KEQ4GLVM.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-NRWDQBZ7.js';
+import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, deriveSingleMaterializedConnectorDeclaration } from './chunk-OJ7G56I7.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
 import { PROTOCOL_VERSION } from './chunk-PK7Q7MC7.js';
-import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-HY33RMEA.js';
-import { resolveRuntimeAssets } from './chunk-ZBZQC5R7.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, cloudConfigFromProfile, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-UQKYT4V6.js';
+import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-5NZ56R63.js';
+import { resolveRuntimeAssets } from './chunk-7J7LQP6T.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, cloudConfigFromProfile, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-ISA7R7PK.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { getLogStore, resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, registerLogStore, resetLogStore, createLogger } from './chunk-JB35MVBN.js';
@@ -2193,6 +2193,10 @@ function audienceOf(cap) {
 function hasAudience(cap, target) {
   return audienceOf(cap).includes(target);
 }
+var APP_CAPABILITY_PREFIX = "app.";
+function capabilityLogInstance(cap) {
+  return cap.origin.kind === "app" ? `${cap.origin.appId}.${cap.name}` : cap.name;
+}
 var ORIGIN_PROMPT_ORDER = [
   "framework",
   "client",
@@ -2255,9 +2259,14 @@ var CapabilityRegistry = class {
    *
    * Allowed combinations:
    * - source `'agent'`: origins `framework | agent | flow | skill | mcp | connector | mount`
-   * - source `'client'`: origin `client` only
+   *   — never `client`, and never `app` (an in-process registrant must not be
+   *   able to impersonate an embedded app)
+   * - source `'client'`: origins `client` or `app`. The platform gateway is the
+   *   only client peer; it forwards an embedded app's capabilities after binding
+   *   each to the connection it arrived on. The runner cannot verify an `appId`.
    * - source `{ kind: 'app', appId }`: origin `app` only, and the origin's
-   *   `appId` must match the source `appId`
+   *   `appId` must match the source `appId`. For a direct app→runner connection;
+   *   unused today.
    *
    * @param cap - capability to register (typically built via {@link defineCapability})
    * @param source - which side is doing the registration
@@ -2369,10 +2378,16 @@ var CapabilityRegistry = class {
    * hibernation by this method — agent-side ones come back via the
    * skill / flow / connector / mount adapters. Snapshot entries from other
    * origins are skipped on hydrate.
+   *
+   * Embedded-app capabilities carry an `app` origin, so the `client`-origin
+   * check already excludes them; the reserved-prefix skip below is a backstop
+   * against a capability that reaches the registry with a relabelled origin.
    */
   hydrate(snapshot) {
+    let hydrated = 0;
     for (const cap of snapshot) {
       if (cap.origin.kind !== "client") continue;
+      if (cap.name.startsWith(APP_CAPABILITY_PREFIX)) continue;
       const stub = {
         ...cap,
         inputZod: HYDRATED_PASSTHROUGH_ZOD,
@@ -2380,8 +2395,9 @@ var CapabilityRegistry = class {
         handler: HYDRATED_REJECT_HANDLER
       };
       this.byName.set(cap.name, stub);
+      hydrated++;
     }
-    this.logger.info("capability registry hydrated", { count: snapshot.length });
+    this.logger.info("capability registry hydrated", { count: hydrated, total: snapshot.length });
   }
   /**
    * Invoke a registered capability. Validates the input against the Zod
@@ -2399,7 +2415,7 @@ var CapabilityRegistry = class {
     const log = createLogger({
       kind: "capability",
       subkind: cap.origin.kind,
-      instance: cap.name
+      instance: capabilityLogInstance(cap)
     });
     log.info("invoking", { input });
     try {
@@ -2415,7 +2431,7 @@ var CapabilityRegistry = class {
   /** True when `source` is allowed to register the given `origin`. */
   isOriginAllowed(source, origin) {
     if (source === "client") {
-      return origin.kind === "client";
+      return origin.kind === "client" || origin.kind === "app";
     }
     if (source === "agent") {
       return origin.kind !== "client" && origin.kind !== "app";
@@ -5908,6 +5924,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-BGIC25VK.js.map
-//# sourceMappingURL=chunk-BGIC25VK.js.map
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
+//# sourceMappingURL=chunk-M4UKIJ5K.js.map
+//# sourceMappingURL=chunk-M4UKIJ5K.js.map