@skaile/workspaces 3.16.1 → 3.17.0

package/dist/{chunk-OEK2ACRR.js → chunk-KCI7DAKE.js}

@@ -1,18 +1,18 @@
-import { WorkspacePlugin } from './chunk-EVQDXN27.js';
+import { WorkspacePlugin } from './chunk-2XGFQKNJ.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
-import { resolveFlowPath } from './chunk-4J24AU4Q.js';
+import { resolveFlowPath } from './chunk-HEKLK4NG.js';
 import { findAiAssetsRoot, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-VC2MWHRH.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-EXT2LNST.js';
 import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-5KSIVLOX.js';
-import { EventNormalizer } from './chunk-5FCBPIOK.js';
+import { EventNormalizer } from './chunk-PBRMY64S.js';
 import { SUPPORTED_CLOUDS, probeResumeTranscript, CLOUD_SECRET_ENV_KEYS } from './chunk-3NCGSSCU.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver } from './chunk-NIUG3MIH.js';
+import { createDriver } from './chunk-FRER2PEN.js';
 import { loadFlow } from './chunk-BQMRUH7J.js';
 import { parseFlowDefinition } from './chunk-HY6CIKFH.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
-import { PROTOCOL_VERSION } from './chunk-2KBA5OO2.js';
+import { PROTOCOL_VERSION } from './chunk-BCOGOM6F.js';
 import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-CIPK5JMJ.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { resolveRuntimeAssets } from './chunk-OIDFK7SG.js';
@@ -29,7 +29,7 @@ import fs4, { readFile, stat, rm, unlink, mkdir, writeFile, readdir, rename } fr
 import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } from 'path';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, watch, chmodSync, rmSync } from 'fs';
 import { homedir } from 'os';
-import * as z5 from 'zod';
+import * as z6 from 'zod';
 import { z } from 'zod';
 import { createHash, randomUUID } from 'crypto';
 import { execFile } from 'child_process';
@@ -190,11 +190,11 @@ var MarkdownStreamer = class {
   }
 };
 function defineCapability(args) {
-  const inputSchema = z5.toJSONSchema(args.input, {
+  const inputSchema = z6.toJSONSchema(args.input, {
     target: "draft-07",
     io: "input"
   });
-  const outputSchema = args.output ? z5.toJSONSchema(args.output, {
+  const outputSchema = args.output ? z6.toJSONSchema(args.output, {
     target: "draft-07",
     io: "output"
   }) : void 0;
@@ -545,7 +545,7 @@ function registerCompositionCapabilities(registry, entries) {
       scope: "session",
       kind: "query",
       userInvokable: false,
-      input: z5.strictObject({}),
+      input: z6.strictObject({}),
       handler: async (_args, ctx) => {
         ctx.log.info("loading composed asset content", {
           ref: entry.ref,
@@ -2206,10 +2206,10 @@ function keywordSearch(capabilities, query, limit) {
   return scored.slice(0, limit).map((x) => x.cap);
 }
 function builtinCapabilities(registry) {
-  const listFilterSchema = z5.strictObject({
-    side: z5.enum(["client", "agent"]).optional(),
-    originKind: z5.enum(["framework", "client", "agent", "flow", "skill", "mcp", "connector", "mount"]).optional(),
-    scope: z5.enum(["session", "turn"]).optional()
+  const listFilterSchema = z6.strictObject({
+    side: z6.enum(["client", "agent"]).optional(),
+    originKind: z6.enum(["framework", "client", "agent", "flow", "skill", "mcp", "connector", "mount"]).optional(),
+    scope: z6.enum(["session", "turn"]).optional()
   });
   return [
     defineCapability({
@@ -2235,9 +2235,9 @@ function builtinCapabilities(registry) {
       origin: { kind: "framework" },
       kind: "query",
       userInvokable: false,
-      input: z5.strictObject({
-        query: z5.string(),
-        limit: z5.number().int().positive().optional()
+      input: z6.strictObject({
+        query: z6.string(),
+        limit: z6.number().int().positive().optional()
       }),
       handler: async ({ query, limit }) => keywordSearch(registry.list(), query, limit ?? 10)
     }),
@@ -2249,7 +2249,7 @@ function builtinCapabilities(registry) {
       origin: { kind: "framework" },
       kind: "query",
       userInvokable: false,
-      input: z5.strictObject({ name: z5.string() }),
+      input: z6.strictObject({ name: z6.string() }),
       handler: async ({ name }) => {
         const cap = registry.resolve(name);
         if (!cap) return null;
@@ -2832,6 +2832,59 @@ async function handleMountResourceRequest(command, manager, emit) {
     });
   }
 }
+var identifier = z6.string().min(1).max(4096);
+var timestamp = z6.iso.datetime({ offset: true });
+var common = {
+  configId: identifier,
+  credentialVersion: z6.number().int().nonnegative().safe(),
+  mintedAt: timestamp
+};
+var subscription = z6.strictObject({
+  ...common,
+  kind: z6.literal("codex-subscription"),
+  accessToken: z6.string().min(1).max(65536),
+  chatgptAccountId: identifier,
+  chatgptPlanType: identifier.optional(),
+  expiresAt: timestamp
+});
+var delivery = z6.discriminatedUnion("kind", [
+  subscription,
+  z6.strictObject({
+    ...common,
+    kind: z6.literal("openai-api-key"),
+    apiKey: z6.string().min(1).max(65536)
+  })
+]);
+function parseCodexCredential(value, now = Date.now()) {
+  const parsed = delivery.safeParse(value);
+  if (!parsed.success) throw new Error("Invalid managed AI credential");
+  const credential = parsed.data;
+  const mintedAt = Date.parse(credential.mintedAt);
+  if (mintedAt > now || credential.kind === "codex-subscription" && (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))
+    throw new Error("Invalid managed AI credential timestamps");
+  return credential;
+}
+function validateCodexInit(cmd, supported, previous) {
+  const requirements = cmd.requiredRuntimeFeatures;
+  if (requirements !== void 0 && (!Array.isArray(requirements) || requirements.some((item) => typeof item !== "string" || !supported.includes(item))))
+    throw new Error("Unsupported runtime: required features are unavailable");
+  const profile = cmd.resolvedConfig.agentConfig;
+  const managed = profile?.driver === "codex" && (profile.authMode !== void 0 || requirements?.includes("codex-app-server-v1"));
+  if ((managed || cmd.credentials.ai !== void 0) && !supported.includes("codex-app-server-v1"))
+    throw new Error("Unsupported runtime: codex-app-server-v1 is unavailable");
+  if (!managed && cmd.credentials.ai === void 0) return;
+  if (previous && ["containerId", "sessionId", "projectId", "ownerUserId"].some(
+    (key) => previous[key] !== cmd.identity[key]
+  ))
+    throw new Error("Invalid managed AI session identity");
+  if (!managed || profile?.provider !== "openai" || !["subscription", "api-key"].includes(profile.authMode ?? ""))
+    throw new Error("Invalid managed OpenAI profile");
+  const credential = parseCodexCredential(cmd.credentials.ai);
+  if (credential.configId !== cmd.resolvedConfig.aiProviderConfigId || profile.authMode === "subscription" !== (credential.kind === "codex-subscription"))
+    throw new Error("Invalid managed AI credential binding");
+  if (cmd.secrets && Object.keys(cmd.secrets).some((key) => /openai|codex/i.test(key)))
+    throw new Error("Conflicting managed AI credential delivery");
+}
 var MINT_RETRY_MAX_ATTEMPTS = 3;
 var MINT_RETRY_BASE_DELAY_MS = 2e3;
 var MINT_RETRY_MAX_DELAY_MS = 5e3;
@@ -4376,54 +4429,54 @@ function notImplemented(name) {
     message: `${name} handler not configured`
   };
 }
-var requiredUnknown = z5.unknown().refine(() => true);
-var preMintedTokenSchema = z5.object({
-  token: z5.string(),
-  expiresAt: z5.string().nullable().optional()
+var requiredUnknown = z6.unknown().refine(() => true);
+var preMintedTokenSchema = z6.object({
+  token: z6.string(),
+  expiresAt: z6.string().nullable().optional()
 }).optional();
-var mountDeclarationInput = z5.strictObject({
+var mountDeclarationInput = z6.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema,
   // The platform attaches a workspace-migration directive on add_mount; the
   // handler ignores it for now (replace-workspace hot-migration is a follow-up).
   // Accepted here so a real platform add_mount payload validates.
-  migration: z5.unknown().optional()
+  migration: z6.unknown().optional()
 });
-var connectorDeclarationInput = z5.strictObject({
+var connectorDeclarationInput = z6.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema
 });
-var addMcpServerInputSchema = z5.strictObject({
+var addMcpServerInputSchema = z6.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema
 });
-var attachInstanceInputSchema = z5.strictObject({
-  kind: z5.string(),
-  name: z5.string(),
+var attachInstanceInputSchema = z6.strictObject({
+  kind: z6.string(),
+  name: z6.string(),
   preMintedToken: preMintedTokenSchema
 });
-var removeResourceInput = z5.strictObject({
-  id: z5.string()
+var removeResourceInput = z6.strictObject({
+  id: z6.string()
 });
-var updateCredentialInput = z5.strictObject({
-  kind: z5.enum(["mount", "connector"]),
-  id: z5.string(),
+var updateCredentialInput = z6.strictObject({
+  kind: z6.enum(["mount", "connector"]),
+  id: z6.string(),
   // `CredentialMint` is a discriminated union from `@skaile/workspaces/types`.
   // We accept it as `z.unknown()` here because Zod can't easily mirror
   // a discriminated TypeScript union without duplicating the schema —
   // the platform side has already validated the shape before sending.
   mint: requiredUnknown
 });
-var setLogLevelInput = z5.strictObject({
-  level: z5.enum(["silent", "error", "warn", "info", "debug", "trace"])
+var setLogLevelInput = z6.strictObject({
+  level: z6.enum(["silent", "error", "warn", "info", "debug", "trace"])
 });
-var setStateInput = z5.strictObject({
-  store: z5.string(),
-  key: z5.string(),
+var setStateInput = z6.strictObject({
+  store: z6.string(),
+  key: z6.string(),
   value: requiredUnknown
 });
-var lifecycleInput = z5.strictObject({
-  phase: z5.enum(["hibernate", "close", "compact"])
+var lifecycleInput = z6.strictObject({
+  phase: z6.enum(["hibernate", "close", "compact"])
 });
 var VALID_LOG_STORE_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 function buildRunnerCapabilities(handlers) {
@@ -5432,6 +5485,7 @@ async function startAgentServer(opts) {
     instance: sessionId
   });
   const log = (line) => serverLog.info(line);
+  const logPhase = (phase, startedAt, data) => serverLog.info(`[serve] phase ${phase}`, { ...data, phase, elapsedMs: Date.now() - startedAt });
   const exitOnBrokenPipe = opts.exitOnBrokenPipe ?? false;
   const stopOutputWatch = watchOutputStream({ exitOnBrokenPipe });
   let teardownProcessHandlers = stopOutputWatch;
@@ -6478,8 +6532,15 @@ async function startAgentServer(opts) {
   }
   async function recreateAgentSessionInner(overrides) {
     const disposedManager = agentSession.resourceManager;
+    const disposeStartedAt = Date.now();
     await agentSession.dispose();
+    const createStartedAt = Date.now();
     agentSession = await createAgentSession({ ...sessionConfig, ...overrides });
+    logPhase("session_rebuild", disposeStartedAt, {
+      disposeMs: createStartedAt - disposeStartedAt,
+      createMs: Date.now() - createStartedAt,
+      resuming: !!overrides.resumeSessionId
+    });
     emitSystemPromptComposed(agentSession, sendEvent);
     swapDriver();
     rebuildCompactionOrchestrator();
@@ -6711,7 +6772,9 @@ async function startAgentServer(opts) {
       }))
     });
   }
+  let runtimeRejected = false;
   async function handleSessionInit(cmd) {
+    const initReceivedAt = Date.now();
     if (cmd.protocolVersion.major !== PROTOCOL_VERSION.major) {
       log(
         `[serve] incompatible protocol: agent=${PROTOCOL_VERSION.major} platform=${cmd.protocolVersion.major}`
@@ -6726,6 +6789,22 @@ async function startAgentServer(opts) {
       disposeLogStore();
       return;
     }
+    try {
+      validateCodexInit(cmd, [], runtimeIdentity ?? void 0);
+    } catch {
+      runtimeRejected = true;
+      sendEvent({
+        type: "error",
+        fatal: true,
+        category: "config",
+        message: "Unsupported runtime: managed Codex initialization is unavailable or invalid"
+      });
+      await cleanup();
+      teardownProcessHandlers();
+      disposeLogStore();
+      await transport.close();
+      return;
+    }
     if (runtimeIdentity && runtimeIdentity.containerId !== cmd.identity.containerId) {
       log(
         `[serve] session_init_mismatch: expected=${runtimeIdentity.containerId} received=${cmd.identity.containerId}`
@@ -6760,7 +6839,11 @@ async function startAgentServer(opts) {
       ...resumeProbe ? { resumeProbe } : {}
     });
     const buildSession = async () => {
+      const firstBuildStartedAt = Date.now();
       const { needsWireFallbackRecreate, needsWireAgentConfigRecreate } = await buildSessionFromInit(cmd.secrets, resolvedConfigToDeclarations(cmd.resolvedConfig));
+      logPhase("session_build", firstBuildStartedAt, {
+        resumeRequested: !!cmd.resume?.sessionId
+      });
       const cfg = {
         aiResources: cmd.resolvedConfig.aiResources,
         subagents: cmd.resolvedConfig.subagents,
@@ -6801,7 +6884,11 @@ async function startAgentServer(opts) {
       }
       if (pendingResumeSessionId || cfg.subagents || needsWireFallbackRecreate || needsWireAgentConfigRecreate) {
         log("[serve] session_init: consolidated session recreate");
+        const recreateStartedAt = Date.now();
         await recreateSessionForInit(pendingResumeSessionId);
+        logPhase("session_recreate", recreateStartedAt, {
+          resuming: !!pendingResumeSessionId
+        });
       }
       if (cfg.sharedState) {
         const handled = await applyInitSharedState(cfg.sharedState);
@@ -6810,10 +6897,15 @@ async function startAgentServer(opts) {
       if (cfg.aiResources) {
         await applyInitAiResources(cfg.aiResources);
       }
+      logPhase("session_ready", initReceivedAt, {
+        ready: true,
+        resumeRequested: !!cmd.resume?.sessionId
+      });
       resolveSessionReady();
     };
     void buildSession().catch((err) => {
       const errMsg = err instanceof Error ? err.message : String(err);
+      logPhase("session_ready", initReceivedAt, { ready: false });
       log(`[serve] session_init failed to build session: ${errMsg}`);
       sendEvent({ type: "error", message: errMsg, fatal: true });
       rejectSessionReady(err instanceof Error ? err : new Error(errMsg));
@@ -6822,7 +6914,10 @@ async function startAgentServer(opts) {
   const awaitCompactionIdle = (what) => guardTurnAgainstCompaction({ gate: compactionGate, what, log, sendEvent });
   async function handlePrompt(cmd) {
     if (cmd.messageId) sendEvent({ type: "prompt_ack", messageId: cmd.messageId });
-    if (!await awaitSessionReadyOrFail()) return;
+    const promptReceivedAt = Date.now();
+    const sessionIsReady = await awaitSessionReadyOrFail();
+    logPhase("prompt_gate_wait", promptReceivedAt, { ready: sessionIsReady });
+    if (!sessionIsReady) return;
     if (!secretsProvisioned) {
       log("[serve] prompt received before secrets provisioned \u2014 rejecting");
       sendEvent({
@@ -6862,13 +6957,18 @@ async function startAgentServer(opts) {
       }
       return;
     }
+    const driverStartStartedAt = Date.now();
+    let driverStartOk = false;
     try {
       await ensureDriverStarted();
+      driverStartOk = true;
     } catch (err) {
       const errMsg = err instanceof Error ? err.message : String(err);
       log(`[serve] driver start failed: ${errMsg}`);
       sendEvent({ type: "error", message: `Driver start failed: ${errMsg}`, fatal: true });
       return;
+    } finally {
+      logPhase("driver_start", driverStartStartedAt, { ok: driverStartOk });
     }
     sendEvent({ type: "status", phase: "thinking" });
     const endTurn = driverSwapGate.beginTurn();
@@ -7129,6 +7229,7 @@ async function startAgentServer(opts) {
     }
   }
   async function handleCommand(cmd) {
+    if (runtimeRejected) return;
     const inbound = cmd;
     if (isCredentialRotatedSignal(cmd)) {
       await handleCredentialRotatedSignal({
@@ -7426,5 +7527,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickRepointedManager, planFlowMutate, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-OEK2ACRR.js.map
-//# sourceMappingURL=chunk-OEK2ACRR.js.map
+//# sourceMappingURL=chunk-KCI7DAKE.js.map
+//# sourceMappingURL=chunk-KCI7DAKE.js.map