@skaile/workspaces 4.8.0 → 4.9.1

package/dist/{chunk-TCANYRAF.js → chunk-2DGIAWKU.js}

@@ -1,31 +1,31 @@
-import { WorkspacePlugin } from './chunk-GKP22MGV.js';
-import { buildWorkspaceToolDefs } from './chunk-UKFLK6V2.js';
+import { WorkspacePlugin } from './chunk-5DHAVCKW.js';
+import { buildWorkspaceToolDefs } from './chunk-I7SQIWYX.js';
 import { findAiAssetsRoot } from './chunk-7IRJ4K4F.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-45LLHKQ2.js';
-import { resolveFlowPath } from './chunk-74QHEAUT.js';
+import { resolveFlowPath } from './chunk-T4IXZOG2.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-RRX33TOZ.js';
-import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-DYT3AQBM.js';
-import { EventNormalizer } from './chunk-U4LC6PLI.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-JBKXLCMG.js';
+import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-JUZJUKWM.js';
+import { EventNormalizer } from './chunk-HA3XJN65.js';
 import { probeResumeTranscript } from './chunk-OUJVFZWJ.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { dispatchCapability } from './chunk-3GKBSHUG.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv } from './chunk-5GYFYGVW.js';
-import { loadFlow } from './chunk-AZSRDONR.js';
+import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-WQ5BCHQS.js';
+import { loadFlow } from './chunk-SJYOKKYO.js';
 import { parseFlowDefinition } from './chunk-REYJKU7T.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
 import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-QAH24E5U.js';
-import { resolveSettings, loadProviderRegistry } from './chunk-BCXZ74DM.js';
-import { resolveRuntimeAssets } from './chunk-SU5LVG6T.js';
+import { resolveSettings, loadProviderRegistry } from './chunk-5WNQPXEG.js';
+import { resolveRuntimeAssets } from './chunk-UM4LDXV5.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, unstageSkill } from './chunk-HKOC273F.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-P2G6XSJ3.js';
 import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-MKZOK4JU.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink } from './chunk-FTG7CRFD.js';
-import { registryEntries, resolveEntryBaseUrl } from './chunk-ILG4BXYE.js';
+import { registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-ILG4BXYE.js';
 import { getLogStore, registerLogStore, resetLogStore, createLogger, isUnwritableStreamError, markStreamBroken, isBrokenPipeError } from './chunk-W4IPN3DD.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
@@ -4355,6 +4355,49 @@ async function detachStagedSkill(deps, name) {
     };
   }
 }
+async function pathState(path5) {
+  try {
+    await withFsDeadline(`lstat ${path5}`, () => lstat(path5));
+    return "present";
+  } catch (err) {
+    return err?.code === "ENOENT" ? "absent" : "unknown";
+  }
+}
+async function removeUnlistedStagedSkills(deps, skillsDir) {
+  const allowed = await readSkillAllowList(deps.projectDir);
+  if (!allowed) return [];
+  const root = join(deps.projectDir, skillsDir);
+  const entries = await tryWithFsDeadline(
+    `readdir ${root}`,
+    () => readdir(root, { withFileTypes: true }),
+    []
+  );
+  const removed = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || allowed.has(entry.name)) continue;
+    try {
+      const dir = join(root, entry.name);
+      if (await pathState(join(deps.projectDir, ".skaile/assets/skill", entry.name)) !== "absent") {
+        continue;
+      }
+      const knownStaged = await isStillOurs(deps.stagedSkillDirs.get(entry.name), dir);
+      if (!knownStaged && !await isStagedSkillMarkerFor(dir, entry.name).catch(() => false))
+        continue;
+      const result = await unstageSkill(deps.projectDir, skillsDir, entry.name, {
+        knownStaged,
+        keepAsset: true
+      });
+      if ("reason" in result || !result.removedStaged) continue;
+      deps.stagedSkillDirs.delete(result.name);
+      removed.push(result.name);
+    } catch (err) {
+      deps.log(
+        `[serve] could not remove unlisted skill "${entry.name}" (left in place): ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  return removed;
+}
 
 // runner/src/flow-turn-dispatch.ts
 var FLOW_TURN_COMPACTION_TIMEOUT = "Flow turn abandoned: a compaction held the driver";
@@ -5160,6 +5203,67 @@ async function dispatchRefreshToExposedGitMounts(manager, log) {
   );
 }
 var CLAUDE_CODE_CREDENTIALS_KEY = "CLAUDE_CODE_CREDENTIALS_JSON";
+var DEFAULT_CLAUDE_AI_OAUTH_SCOPES = ["user:inference", "user:profile"];
+function selectClaudeCodeCredentialsSecret(secrets, selection) {
+  const legacy = secrets[CLAUDE_CODE_CREDENTIALS_KEY];
+  if (legacy) return { key: CLAUDE_CODE_CREDENTIALS_KEY, value: legacy };
+  if (!selection?.registry) return void 0;
+  if (selection.driver && selection.driver !== "claude-sdk") return void 0;
+  const entries = registryEntries(selection.registry).map(
+    ([id, entry2]) => [id, { ...entry2, kind: entryKind(entry2) }]
+  );
+  const registry = Object.fromEntries(entries);
+  const named = selection.modelRef?.trim();
+  const selected = named ? parseModelRef(named, registry) : void 0;
+  const providerId = named && entries.some(([id]) => id === named) ? named : selected?.providerId ?? entries.find(
+    ([, entry2]) => (entry2.kind === "llm" || entry2.kind === "embed") && isEntryEnabled(entry2)
+  )?.[0];
+  const entry = entries.find(([id]) => id === providerId)?.[1];
+  if (!entry || !isClaudeSubscriptionEndpoint(entry)) return void 0;
+  if (entry.credential?.kind !== "oauth" || !entry.credential.ref) return void 0;
+  const ref = parseCredentialRef(entry.credential.ref);
+  if (ref?.form !== "platform") return void 0;
+  const value = secrets[ref.configId];
+  return value ? { key: ref.configId, value } : void 0;
+}
+function entryKind(entry) {
+  return entry.kind ?? (entry.preset ? AI_PROVIDER_PRESETS[entry.preset]?.kind : void 0);
+}
+function isClaudeSubscriptionEndpoint(entry) {
+  if (entryKind(entry) !== "llm") return false;
+  const preset = entry.preset ? AI_PROVIDER_PRESETS[entry.preset] : void 0;
+  const surface = entry.surface ?? preset?.surface;
+  const transport = entry.transport ?? preset?.transport ?? "direct";
+  return surface === "anthropic-messages" && transport === "direct";
+}
+function claudeAiOauthScopesState(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return "unparseable";
+  }
+  if (!parsed || typeof parsed !== "object") return "unparseable";
+  const scopes = parsed.claudeAiOauth?.scopes;
+  return Array.isArray(scopes) && scopes.length > 0 ? "ok" : "missing";
+}
+async function writeProvisionedClaudeCodeCredentials(home, source, warn) {
+  const state = claudeAiOauthScopesState(source.value);
+  if (state === "missing") {
+    warn(
+      "Claude Code credentials blob has no claudeAiOauth.scopes \u2014 Claude Code will report 'Not logged in'; re-capture or rotate the seat",
+      { key: source.key }
+    );
+  } else if (state === "unparseable") {
+    warn(
+      "Claude Code credentials blob is not a JSON object \u2014 Claude Code cannot read it; the platform sent malformed material for this secret",
+      { key: source.key }
+    );
+  }
+  return writeClaudeCodeCredentialsFile(home, source.value);
+}
+var credentialsLog;
+var scopesRepairLogged = /* @__PURE__ */ new Set();
 async function writeClaudeCodeCredentialsFile(home, json) {
   const claudeDir = join(home, ".claude");
   await mkdir(claudeDir, { recursive: true, mode: 448 });
@@ -5204,6 +5308,17 @@ async function mergeAndRewriteCredentialsFile(home, accessToken, expiresAt) {
   const oauthBlock = merged.claudeAiOauth ?? {};
   oauthBlock.accessToken = accessToken;
   if (expiresAt) oauthBlock.expiresAt = expiresAt;
+  if (!Array.isArray(oauthBlock.scopes) || oauthBlock.scopes.length === 0) {
+    oauthBlock.scopes = [...DEFAULT_CLAUDE_AI_OAUTH_SCOPES];
+    if (!scopesRepairLogged.has(credPath)) {
+      scopesRepairLogged.add(credPath);
+      credentialsLog ??= createLogger({ kind: "runner", subkind: "credentials" });
+      credentialsLog.info("added default scopes to a claudeAiOauth block that had none", {
+        path: credPath,
+        scopes: DEFAULT_CLAUDE_AI_OAUTH_SCOPES
+      });
+    }
+  }
   merged.claudeAiOauth = oauthBlock;
   merged.accessToken = accessToken;
   return writeClaudeCodeCredentialsFile(home, JSON.stringify(merged));
@@ -7057,9 +7172,13 @@ async function startAgentServer(opts) {
   const stageDeclaredSkills = createCoalescedTask(
     withSkillFsLock,
     async (skillsDir, declared) => {
-      const names = await stageMaterializedSkills(opts.projectDir, skillsDir, { declared });
+      const removed = await removeUnlistedStagedSkills(
+        { projectDir: opts.projectDir, stagedSkillDirs, log },
+        skillsDir
+      );
+      const names = declared.length > 0 ? await stageMaterializedSkills(opts.projectDir, skillsDir, { declared }) : [];
       await recordStagedSkills(stagedSkillDirs, opts.projectDir, skillsDir, names);
-      return names;
+      return { removed, staged: names };
     }
   );
   await restageMaterializedSkills(false);
@@ -7075,17 +7194,26 @@ async function startAgentServer(opts) {
           return [];
         }
       });
-      if (declared.length === 0) return;
       const previouslyStaged = new Set(stagedSkillDirs.keys());
-      const staged = await stageDeclaredSkills(skillsDir, declared);
+      const { removed, staged } = await stageDeclaredSkills(skillsDir, declared);
       const newlyStaged = staged.filter((s) => !previouslyStaged.has(s));
-      if (newlyStaged.length === 0) return;
-      log(`[serve] staged ${newlyStaged.length} materialized skill(s): ${newlyStaged.join(", ")}`);
-      if (allowRestart && driverStarted) {
-        await restartDriverForSkillChanges(
-          newlyStaged.map((s) => ({ name: s, action: "add" }))
+      if (removed.length > 0) {
+        log(
+          `[serve] removed ${removed.length} skill(s) the host no longer allows: ${removed.join(", ")}`
+        );
+      }
+      if (newlyStaged.length > 0) {
+        log(
+          `[serve] staged ${newlyStaged.length} materialized skill(s): ${newlyStaged.join(", ")}`
         );
       }
+      if (removed.length === 0 && newlyStaged.length === 0) return;
+      if (allowRestart && driverStarted) {
+        await restartDriverForSkillChanges([
+          ...removed.map((s) => ({ name: s, action: "remove" })),
+          ...newlyStaged.map((s) => ({ name: s, action: "add" }))
+        ]);
+      }
     } catch (err) {
       log(
         `[serve] restageMaterializedSkills failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`
@@ -7709,17 +7837,21 @@ async function startAgentServer(opts) {
       capabilityRegistry.register(stub, "client");
     }
   }
-  async function provisionInitSecrets(secrets) {
+  async function provisionInitSecrets(secrets, selection) {
     let initialAiCredentialExpiresAt = null;
     if (secrets) {
-      const ccdValue = secrets[CLAUDE_CODE_CREDENTIALS_KEY];
-      if (ccdValue) {
+      const source = selectClaudeCodeCredentialsSecret(secrets, selection);
+      if (source) {
         const home = process.env.HOME ?? homedir();
         if (home) {
           try {
-            await writeClaudeCodeCredentialsFile(home, ccdValue);
+            await writeProvisionedClaudeCodeCredentials(
+              home,
+              source,
+              (message, meta) => serverLog.warn(message, meta)
+            );
             log(
-              `[serve] wrote Claude Code credentials file to ${home}/.claude/.credentials.json (mode 0600)`
+              `[serve] wrote Claude Code credentials file to ${home}/.claude/.credentials.json (mode 0600) from ${source.key === CLAUDE_CODE_CREDENTIALS_KEY ? source.key : `registry credential platform:${source.key}`}`
             );
             await guardClaudeAiConnectors(home, serverLog);
           } catch (err) {
@@ -7727,7 +7859,7 @@ async function startAgentServer(opts) {
             log(`[serve] failed to write Claude Code credentials file: ${errMsg}`);
           }
         }
-        initialAiCredentialExpiresAt = extractClaudeAiOauthExpiresAt(ccdValue);
+        initialAiCredentialExpiresAt = extractClaudeAiOauthExpiresAt(source.value);
       }
       const otherSecrets = Object.fromEntries(
         Object.entries(secrets).filter(([k]) => k !== CLAUDE_CODE_CREDENTIALS_KEY)
@@ -8178,8 +8310,6 @@ async function startAgentServer(opts) {
       ...managedHost ? { runtimeFeatures: supportedRuntimeFeatures } : {}
     });
     preMintedSecrets = new PreMintedSecretProvider(cmd.credentials);
-    const initialAiCredentialExpiresAt = await provisionInitSecrets(cmd.secrets);
-    if (managedCodex) secretsProvisioned = true;
     if (cmd.resolvedConfig.aiProviderConfigId) {
       aiProviderConfigId = cmd.resolvedConfig.aiProviderConfigId;
       log(`[serve] stashed aiProviderConfigId=${aiProviderConfigId}`);
@@ -8187,6 +8317,30 @@ async function startAgentServer(opts) {
     }
     const wireCandidate = cmd.resolvedConfig.agentConfig ?? wireAgentConfig;
     wireAgentConfig = managedCodex ? cmd.resolvedConfig.agentConfig : diskProfileHasAgentSettings(profile) ? wireCandidate?.registry ? { registry: wireCandidate.registry } : void 0 : wireCandidate;
+    let credentialsSelection;
+    if (!managedCodex && wireAgentConfig?.registry && cmd.secrets && !cmd.secrets[CLAUDE_CODE_CREDENTIALS_KEY]) {
+      const driver2 = opts.driver ?? wireAgentConfig?.driver;
+      const model = opts.model ?? wireAgentConfig?.model;
+      let settings;
+      try {
+        settings = await resolveSettings(opts.projectDir, { driver: driver2, model });
+      } catch (err) {
+        serverLog.warn(
+          `[serve] credentials selection: settings unreadable: ${err instanceof Error ? err.message : String(err)}`
+        );
+        settings = { driver: driver2 ?? profile?.driver, model: model ?? profile?.model };
+      }
+      credentialsSelection = {
+        driver: settings.driver ?? "omp",
+        registry: wireAgentConfig?.registry,
+        modelRef: wireAgentConfig?.modelRef?.trim() || settings.model?.trim() || void 0
+      };
+    }
+    const initialAiCredentialExpiresAt = await provisionInitSecrets(
+      cmd.secrets,
+      credentialsSelection
+    );
+    if (managedCodex) secretsProvisioned = true;
     if (!managedCodex && aiProviderConfigId && initialAiCredentialExpiresAt) {
       aiCredentialRefreshScheduler.schedule(initialAiCredentialExpiresAt);
     }
@@ -8964,5 +9118,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-TCANYRAF.js.map
-//# sourceMappingURL=chunk-TCANYRAF.js.map
+//# sourceMappingURL=chunk-2DGIAWKU.js.map
+//# sourceMappingURL=chunk-2DGIAWKU.js.map