@skaile/workspaces 4.11.0 → 4.13.0

package/dist/{chunk-S2MT6SDZ.js → chunk-KTSV5TDX.js}

@@ -1,32 +1,32 @@
-import { WorkspacePlugin } from './chunk-7SNYWCQS.js';
-import { buildWorkspaceToolDefs } from './chunk-IGGHUTOW.js';
-import { findAiAssetsRoot } from './chunk-7IRJ4K4F.js';
+import { WorkspacePlugin } from './chunk-WIQDBNMF.js';
+import { buildWorkspaceToolDefs } from './chunk-HZBRHZPI.js';
+import { findAiAssetsRoot } from './chunk-7IH3RKKK.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
-import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-2HUQUTJ3.js';
-import { resolveFlowPath } from './chunk-AT2TJEWG.js';
-import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-GXACG5ZE.js';
-import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-MMLXSVQ3.js';
-import { EventNormalizer } from './chunk-VLXODO37.js';
-import { probeResumeTranscript } from './chunk-OUJVFZWJ.js';
+import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-PE3A6FFW.js';
+import { resolveFlowPath } from './chunk-65VAYFIJ.js';
+import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-Q6NDQ6BH.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-N6XJGVSK.js';
+import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-UOJW2DOZ.js';
+import { EventNormalizer } from './chunk-IQFSXFYG.js';
+import { probeResumeTranscript } from './chunk-4SIMGJIU.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-35PMOWAD.js';
+import { dispatchCapability } from './chunk-CPIAQTYM.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-3T5DRUNZ.js';
-import { loadFlow } from './chunk-O3DHAGBO.js';
-import { parseFlowDefinition } from './chunk-REYJKU7T.js';
-import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
+import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-PQF3NDQH.js';
+import { loadFlow } from './chunk-A2T4WIZL.js';
+import { parseFlowDefinition } from './chunk-ALLCAFHQ.js';
+import { renderStimulusPrompt } from './chunk-RQLL7L72.js';
 import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-O64WU6WS.js';
-import { resolveSettings, loadProviderRegistry } from './chunk-JECDED7B.js';
-import { resolveRuntimeAssets } from './chunk-WILO77HE.js';
+import { resolveSettings, loadProviderRegistry } from './chunk-7NRF7BQB.js';
+import { resolveRuntimeAssets } from './chunk-NXTLDFLA.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-HO4UO25I.js';
-import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-MKZOK4JU.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-QWGSKDD7.js';
+import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-2FBPAR2V.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
-import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-3HKYCT2M.js';
-import { registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-ILG4BXYE.js';
-import { getLogStore, registerLogStore, createLogger, resetLogStore, isUnwritableStreamError, markStreamBroken, isBrokenPipeError } from './chunk-W4IPN3DD.js';
+import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-JMKB7IB4.js';
+import { registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-GZZPKAV5.js';
+import { getLogStore, registerLogStore, createLogger, resetLogStore, isUnwritableStreamError, markStreamBroken, isBrokenPipeError, redactCredentials } from './chunk-BOFL7GIF.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
 import path5, { join, resolve, relative, sep, isAbsolute, basename, dirname } from 'path';
@@ -114,8 +114,6 @@ function bootstrapRunnerLogStore(opts) {
   const cfg = resolveLogStoreConfig({
     sessionId: opts.sessionId,
     workspacePath: opts.projectDir,
-    // The skaile.yaml `logging:` block is loosely typed at the workspace-config
-    // layer; the resolver validates `mode` / `level` strings at runtime.
     yamlBlock: opts.yamlBlock
   });
   const store = createLogStoreFromConfig(cfg);
@@ -1115,6 +1113,20 @@ function registerCodexFlowTools(registry, manager, connectorId) {
   if (!tools.length) throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
   return registerCodexToolDefinitions(registry, "flow", tools);
 }
+
+// runner/src/log-content.ts
+var LOG_CONTENT_ENV = "SKAILE_LOG_CONTENT";
+function isContentLoggingEnabled(env = process.env) {
+  return env[LOG_CONTENT_ENV] === "1";
+}
+function payloadBytes(value) {
+  try {
+    const json = JSON.stringify(value);
+    return json === void 0 ? 0 : Buffer.byteLength(json, "utf8");
+  } catch {
+    return null;
+  }
+}
 async function agentDefinitionExists(agentDir) {
   try {
     await fs4.access(path5.join(agentDir, "agent.yaml"));
@@ -2815,9 +2827,8 @@ function buildSystemPromptSections(parts) {
   return systemPromptSections;
 }
 function logAssembledSystemPrompt(systemPrompt, log) {
-  if (process.env.SKAILE_LOG_SYSTEM_PROMPT !== "0") {
-    const length = systemPrompt?.length ?? 0;
-    log.debug("assembled system prompt", { length });
+  log.debug("assembled system prompt", { length: systemPrompt?.length ?? 0 });
+  if (isContentLoggingEnabled()) {
     log.debug("system prompt content", { content: systemPrompt ?? "(empty)" });
   }
 }
@@ -3058,6 +3069,24 @@ var APP_CAPABILITY_PREFIX = "app.";
 function capabilityLogInstance(cap) {
   return cap.origin.kind === "app" ? `${cap.origin.appId}.${cap.name}` : cap.name;
 }
+function failureOutcome(err, signal) {
+  const name = err instanceof Error ? err.name : void 0;
+  if (name === "AbortError") return "aborted";
+  if (name === "ZodError") return "invalid_input";
+  if (signal?.aborted && name === void 0) return "aborted";
+  return "error";
+}
+var ERROR_IDENTIFIER = /^[A-Za-z0-9_.:-]{1,64}$/;
+function errorMetadata(err) {
+  if (typeof err !== "object" || err === null) return {};
+  const out = {};
+  const name = err.name;
+  if (typeof name === "string" && ERROR_IDENTIFIER.test(name)) out.errorName = name;
+  const code = err.code;
+  if (typeof code === "number" && Number.isFinite(code)) out.errorCode = code;
+  else if (typeof code === "string" && ERROR_IDENTIFIER.test(code)) out.errorCode = code;
+  return out;
+}
 var ORIGIN_PROMPT_ORDER = [
   "framework",
   "client",
@@ -3285,10 +3314,21 @@ var CapabilityRegistry = class {
    * `info "invoking"` and `info "ok"` (or `error "failed"`) under the
    * `capability:<origin>:<name>` slice for every call.
    *
+   * The rows carry metadata only — call id, duration, outcome, error name and
+   * code, input/output size in bytes — never the input, output or error
+   * message: those hold user content and secrets, and the rows reach
+   * `logs.db`, the live stream and the platform's central store. The thrown
+   * error still reaches the caller unchanged. `SKAILE_LOG_CONTENT=1` adds the
+   * content back on a developer machine (see `log-content.ts`).
+   *
+   * `baseCtx.callId` (the bridge's dispatch call id) correlates the rows; a random id is
+   * used when the caller has none.
+   *
    * @throws when the capability is unknown or the input fails validation
    */
   async invoke(name, input, baseCtx) {
-    baseCtx.signal?.throwIfAborted();
+    const { callId: givenCallId, ...handlerCtx } = baseCtx;
+    handlerCtx.signal?.throwIfAborted();
     const cap = this.resolve(name);
     if (!cap) {
       throw new Error(`Unknown capability: ${name}`);
@@ -3298,14 +3338,34 @@ var CapabilityRegistry = class {
       subkind: cap.origin.kind,
       instance: capabilityLogInstance(cap)
     });
-    log.info("invoking", { input });
+    const callId = givenCallId ?? randomUUID();
+    const withContent = isContentLoggingEnabled();
+    const startedAt = performance.now();
+    const durationMs = () => Math.round(performance.now() - startedAt);
+    const bytes = (value) => getLogStore()?.isEnabled("info") ?? true ? payloadBytes(value) : null;
+    log.info("invoking", {
+      callId,
+      inputBytes: bytes(input),
+      ...withContent ? { input } : {}
+    });
     try {
       const validated = cap.inputZod.parse(input);
-      const result = await cap.handler(validated, { ...baseCtx, log });
-      log.info("ok", { output: result });
+      const result = await cap.handler(validated, { ...handlerCtx, log });
+      log.info("ok", {
+        callId,
+        outcome: "ok",
+        durationMs: durationMs(),
+        outputBytes: bytes(result),
+        ...withContent ? { output: result } : {}
+      });
       return result;
     } catch (err) {
-      log.error("failed", err);
+      log.error("failed", withContent ? err : void 0, {
+        callId,
+        outcome: failureOutcome(err, handlerCtx.signal),
+        durationMs: durationMs(),
+        ...errorMetadata(err)
+      });
       throw err;
     }
   }
@@ -4833,15 +4893,20 @@ ${opts.focus}`);
 
 // runner/src/compaction/strategy.ts
 var TokenThresholdStrategy = class {
-  thresholdPercent;
+  thresholds;
   minCooldownMs;
+  /** Takes the whole config; the tier keys are read by {@link resolveCompactionThresholdPercent}. */
   constructor(opts) {
-    this.thresholdPercent = opts.thresholdPercent;
+    this.thresholds = { ...opts };
     this.minCooldownMs = opts.minCooldownMs;
   }
   shouldCompact(context) {
+    const thresholdPercent = resolveCompactionThresholdPercent(
+      context.contextWindow,
+      this.thresholds
+    );
     const fillPercent = context.estimatedTokens / context.contextWindow * 100;
-    if (fillPercent < this.thresholdPercent) return false;
+    if (fillPercent < thresholdPercent) return false;
     if (context.timeSinceLastCompaction !== null && context.timeSinceLastCompaction < this.minCooldownMs) {
       return false;
     }
@@ -4937,10 +5002,7 @@ var CompactionOrchestrator = class {
     this.driver = opts.driver;
     this.opts = opts;
     this.config = { ...COMPACTION_DEFAULTS, ...opts.config };
-    this.strategy = new TokenThresholdStrategy({
-      thresholdPercent: this.config.thresholdPercent,
-      minCooldownMs: this.config.minCooldownMs
-    });
+    this.strategy = new TokenThresholdStrategy(this.config);
   }
   /**
    * How full the context window is. Prefers the driver's per-call figure; the
@@ -5639,7 +5701,7 @@ function readCurrentClaudeAccessToken(home) {
 function raiseHookFailures(phase, results, log) {
   const failed = results.filter((r) => !r.ok);
   if (failed.length === 0) return;
-  const cause = (f) => redactUrlAuth(f.error ?? "unknown error");
+  const cause = (f) => redactCredentials(f.error ?? "unknown error");
   for (const f of failed) {
     log(`[lifecycle] ${phase}: connector "${f.id}" failed \u2014 ${cause(f)}`);
   }
@@ -5647,11 +5709,8 @@ function raiseHookFailures(phase, results, log) {
     `${failed.length} connector(s) failed to ${phase}: ${failed.map((f) => `${f.id}: ${cause(f)}`).join("; ")}`
   );
 }
-function redactUrlAuth(text2) {
-  return text2.replace(/\/\/[^/\s]*@/g, "//***@");
-}
 function replyResults(results) {
-  return results.map((r) => r.detail ? { ...r, detail: redactUrlAuth(r.detail) } : r);
+  return results.map((r) => r.detail ? { ...r, detail: redactCredentials(r.detail) } : r);
 }
 function buildLifecycleHandler(deps) {
   const { getCompactionOrchestrator, getResourceManager, log } = deps;
@@ -7314,7 +7373,7 @@ async function startAgentServer(opts) {
         if (!cap) return null;
         return capabilityRegistry.list().find((c) => c.name === name) ?? null;
       },
-      invoke: (name, input, signal) => capabilityRegistry.invoke(name, input, { sessionId, signal }),
+      invoke: (name, input, signal, callId) => capabilityRegistry.invoke(name, input, { sessionId, signal, callId }),
       onToolsChanged: (listener) => capabilityRegistry.onToolsChanged(listener),
       emitRender: (event) => sendEvent(event),
       emitText: (text2) => sendEvent({
@@ -9105,7 +9164,7 @@ async function startAgentServer(opts) {
       await dispatchRunnerCapabilityInvocation(
         { callId: cmd.callId, name: cmd.name, input: cmd.input },
         {
-          invoke: (name, input) => capabilityRegistry.invoke(name, input, { sessionId }),
+          invoke: (name, input) => capabilityRegistry.invoke(name, input, { sessionId, callId: cmd.callId }),
           // `capability_result` is a CapabilityEvent; `sendEvent` and
           // `ServerTransport.send` are typed to AgentEvent alone though both
           // unions ride one wire. Widening that is a consumer-breaking change.
@@ -9410,5 +9469,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-S2MT6SDZ.js.map
-//# sourceMappingURL=chunk-S2MT6SDZ.js.map
+//# sourceMappingURL=chunk-KTSV5TDX.js.map
+//# sourceMappingURL=chunk-KTSV5TDX.js.map