@skaile/workspaces 4.14.0 → 4.16.0

package/dist/{chunk-ZISHZRG6.js → chunk-JZ52Y3ZR.js}

@@ -1,27 +1,27 @@
-import { WorkspacePlugin } from './chunk-IM7S4A5E.js';
-import { buildWorkspaceToolDefs } from './chunk-ZXPIKQAN.js';
+import { WorkspacePlugin } from './chunk-MHAH5HDX.js';
+import { buildWorkspaceToolDefs } from './chunk-PQE2MYB6.js';
 import { findAiAssetsRoot } from './chunk-7IH3RKKK.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-PE3A6FFW.js';
-import { resolveFlowPath } from './chunk-7CO3MYNN.js';
+import { resolveFlowPath } from './chunk-CPJRS7ZC.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-Q6NDQ6BH.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-JN2TH5YB.js';
-import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-UOJW2DOZ.js';
-import { EventNormalizer } from './chunk-W64ZXABT.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-MDRV5EWH.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-MC2MF4U5.js';
+import { EventNormalizer } from './chunk-TEQDWOBS.js';
 import { probeResumeTranscript } from './chunk-4SIMGJIU.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { dispatchCapability } from './chunk-TOXPRXAK.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-LQMALDDB.js';
-import { loadFlow } from './chunk-A2T4WIZL.js';
+import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-CJGNYHPG.js';
+import { loadFlow } from './chunk-KTCMBEEB.js';
 import { parseFlowDefinition } from './chunk-ALLCAFHQ.js';
 import { renderStimulusPrompt } from './chunk-RQLL7L72.js';
 import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-QQ3G5N7X.js';
-import { resolveSettings, loadProviderRegistry } from './chunk-7NRF7BQB.js';
-import { resolveRuntimeAssets } from './chunk-NXTLDFLA.js';
+import { resolveSettings, loadProviderRegistry } from './chunk-UWU572Q6.js';
+import { resolveRuntimeAssets } from './chunk-5RHPNNWP.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-QWGSKDD7.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-DF7C3KZK.js';
 import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-2FBPAR2V.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-JMKB7IB4.js';
@@ -2157,6 +2157,67 @@ function buildMcpPromptSection(declarations, connected) {
   return lines.join("\n").trimEnd();
 }
 
+// runner/src/s3-presign-client.ts
+var S3_PRESIGN_CAPABILITY = "host.s3_presign";
+function buildS3Presigner(deps) {
+  return async (request) => {
+    let raw;
+    try {
+      raw = await deps.invokeRemote(S3_PRESIGN_CAPABILITY, request);
+    } catch (err) {
+      return {
+        ok: false,
+        code: "backend-error",
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+    const result = parsePresignResult(raw, request.op);
+    if (!result) {
+      deps.log?.(
+        `[serve] ${S3_PRESIGN_CAPABILITY} returned a malformed answer (mount=${request.mountId}, op=${request.op})`
+      );
+      return { ok: false, code: "backend-error", message: "malformed presign answer from host" };
+    }
+    if (!result.ok) {
+      deps.log?.(
+        `[serve] ${S3_PRESIGN_CAPABILITY} refused (mount=${request.mountId}, op=${request.op}, code=${result.code})`
+      );
+    }
+    return result;
+  };
+}
+function parsePresignResult(raw, op) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const r = raw;
+  if (r.ok === false) {
+    return {
+      ok: false,
+      code: typeof r.code === "string" ? r.code : "backend-error",
+      message: typeof r.message === "string" ? r.message : "presign refused"
+    };
+  }
+  if (r.ok !== true || r.op !== op || typeof r.expiresAt !== "string") return null;
+  if (op === "list") {
+    return typeof r.url === "string" ? { ok: true, op, url: r.url, expiresAt: r.expiresAt } : null;
+  }
+  const urls = r.urls;
+  const skipped = r.skipped ?? [];
+  if (!Array.isArray(urls) || !Array.isArray(skipped)) return null;
+  const validUrls = urls.every((u) => typeof u?.key === "string" && typeof u?.url === "string");
+  const validSkipped = skipped.every((s) => typeof s?.key === "string");
+  if (!validUrls || !validSkipped) return null;
+  return {
+    ok: true,
+    op,
+    urls,
+    skipped: skipped.map((s) => ({
+      key: s.key,
+      reason: typeof s.reason === "string" ? s.reason : "unknown"
+    })),
+    expiresAt: r.expiresAt
+  };
+}
+
 // runner/src/resources.ts
 async function buildAgentResources(projectDir, driverType, _onLog, watch, secretProvider, sessionMeta, tokenMediator, preMintedSecrets, deferFilesystemMounts, capabilityRegistry, fallbackConnectorDeclarations, extraMcpDeclarations) {
   const managedProjectMcp = sessionMeta?.managedCodex ? await resolveExternalMcpDeclarations(projectDir, sessionMeta.sessionId, true) : void 0;
@@ -2188,11 +2249,16 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
     }
     if (!sessionMeta?.managedCodex)
       await maybeInstallNpmPeerDeps(runtimeAssets, projectDir, resLog);
-    const diskDeclarations = loadConnectorDeclarations(projectDir);
-    const connectorDeclarations = diskDeclarations.length > 0 ? diskDeclarations : fallbackConnectorDeclarations ?? [];
-    if (diskDeclarations.length === 0 && connectorDeclarations.length > 0) {
-      resLog.info("no disk connector declarations \u2014 using session_init resolvedConfig fallback", {
-        count: connectorDeclarations.length
+    const yamlDeclarations = loadYamlConnectorDeclarations(projectDir);
+    const wireDeclarations = fallbackConnectorDeclarations ?? [];
+    const usesWire = yamlDeclarations.length === 0 && wireDeclarations.length > 0;
+    const connectorDeclarations = withMaterializedConnectorDeclarations(
+      usesWire ? wireDeclarations : yamlDeclarations,
+      projectDir
+    );
+    if (usesWire) {
+      resLog.info("no skaile.yaml connector declarations \u2014 using session_init resolvedConfig", {
+        count: wireDeclarations.length
       });
     }
     let resourceManager = null;
@@ -2206,7 +2272,8 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
         preMintedSecrets,
         deferFilesystemMounts,
         watch,
-        resLog
+        resLog,
+        capabilityRegistry
       );
     }
     const resourcePromptSection = resourceManager ? buildConnectorPromptSection(resourceManager) : "";
@@ -2353,11 +2420,18 @@ function logConnectorReport(results, resLog) {
     }
   }
 }
-async function connectAllConnectors(connectorDeclarations, projectDir, runtimeAssets, secretProvider, tokenMediator, preMintedSecrets, deferFilesystemMounts, watch, resLog) {
+async function connectAllConnectors(connectorDeclarations, projectDir, runtimeAssets, secretProvider, tokenMediator, preMintedSecrets, deferFilesystemMounts, watch, resLog, capabilityRegistry) {
   const resourceManager = new ConnectorManager(projectDir, {
     secrets: secretProvider,
     catalogEntries: runtimeAssets.catalogEntries,
     tokenMediator,
+    // Serve mode only: `auth: backend` S3 mounts read through `host.s3_presign`.
+    ...capabilityRegistry ? {
+      s3Presigner: buildS3Presigner({
+        invokeRemote: (name, input) => capabilityRegistry.invokeRemote(name, input),
+        log: (line) => resLog.warn(line)
+      })
+    } : {},
     preMintedSecrets,
     onStatusChange: watch?.onConnectorStatus
   });
@@ -7313,6 +7387,10 @@ async function startAgentServer(opts) {
     invokeRemote: (name, input) => capabilityRegistry.invokeRemote(name, input),
     log
   });
+  const connectorS3Presigner = buildS3Presigner({
+    invokeRemote: (name, input) => capabilityRegistry.invokeRemote(name, input),
+    log
+  });
   const aiCredentialRefreshScheduler = createAiCredentialRefreshScheduler({
     refresh: async () => {
       const { mint: result } = await aiProviderConfigSwitcher.repull({
@@ -7518,6 +7596,7 @@ async function startAgentServer(opts) {
   let managedInitFingerprint;
   let managedInitComplete = false;
   let appliedWireAgentConfigKey;
+  let wireConnectorDeclarationsApplied = false;
   const stagedSkillDirs = /* @__PURE__ */ new Map();
   const withSkillFsLock = createSerialLock();
   const stageDeclaredSkills = createCoalescedTask(
@@ -7892,7 +7971,8 @@ async function startAgentServer(opts) {
       registerBuiltinConnectors();
       resourceManager = new ConnectorManager(opts.projectDir, {
         catalogEntries: getSessionCatalogEntries(agentSession),
-        tokenMediator: connectorTokenMediator
+        tokenMediator: connectorTokenMediator,
+        s3Presigner: connectorS3Presigner
       });
       log("[serve] created ConnectorManager for flow execution (no other connectors declared)");
     }
@@ -8222,6 +8302,16 @@ async function startAgentServer(opts) {
     }
     return initialAiCredentialExpiresAt;
   }
+  function yamlDeclaresNoConnectors() {
+    try {
+      return loadYamlConnectorDeclarations(opts.projectDir).length === 0;
+    } catch (err) {
+      log(
+        `[serve] session_init: skaile.yaml connectors unreadable, wire connector set not applied: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return false;
+    }
+  }
   async function buildSessionFromInit(secrets, fallbackConnectorDeclarations) {
     const wireRegistry = managedCodex ? void 0 : wireAgentConfig?.registry;
     const credentialEnv = wireRegistry ? registryCredentialEnv(wireRegistry, {
@@ -8251,10 +8341,11 @@ async function startAgentServer(opts) {
       emitResourcesAvailable();
       agentSession.startWatching();
       appliedWireAgentConfigKey = wireAgentConfig ? JSON.stringify(wireAgentConfig) : void 0;
+      wireConnectorDeclarationsApplied = (fallbackConnectorDeclarations?.length ?? 0) > 0;
       log("[serve] session built from session_init envelope");
-    } else if ((fallbackConnectorDeclarations?.length ?? 0) > 0 && !agentSession.resourceManager) {
+    } else if ((fallbackConnectorDeclarations?.length ?? 0) > 0 && !wireConnectorDeclarationsApplied && yamlDeclaresNoConnectors()) {
       log(
-        `[serve] session_init: recreating eagerly-built session to apply ${fallbackConnectorDeclarations.length} wire connector declaration(s) (no disk declarations)`
+        `[serve] session_init: recreating eagerly-built session to apply ${fallbackConnectorDeclarations.length} wire connector declaration(s) (no skaile.yaml declarations)`
       );
       needsWireFallbackRecreate = true;
     }
@@ -8359,7 +8450,8 @@ async function startAgentServer(opts) {
       registerBuiltinConnectors();
       resourceManager = new ConnectorManager(opts.projectDir, {
         catalogEntries: getSessionCatalogEntries(agentSession),
-        tokenMediator: connectorTokenMediator
+        tokenMediator: connectorTokenMediator,
+        s3Presigner: connectorS3Presigner
       });
       log("[serve] created ConnectorManager for sharedState (no connectors were declared)");
       return true;
@@ -8758,6 +8850,7 @@ async function startAgentServer(opts) {
         log("[serve] session_init: consolidated session recreate");
         const recreateStartedAt = Date.now();
         await recreateSessionForInit(pendingResumeSessionId);
+        if (needsWireFallbackRecreate) wireConnectorDeclarationsApplied = true;
         logPhase("session_recreate", recreateStartedAt, {
           resuming: !!pendingResumeSessionId
         });
@@ -9469,5 +9562,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-ZISHZRG6.js.map
-//# sourceMappingURL=chunk-ZISHZRG6.js.map
+//# sourceMappingURL=chunk-JZ52Y3ZR.js.map
+//# sourceMappingURL=chunk-JZ52Y3ZR.js.map