@skaile/workspaces 4.9.0 → 4.9.2

package/dist/{chunk-LOCIJAS3.js → chunk-6YIFJW2I.js}

@@ -1,31 +1,31 @@
-import { WorkspacePlugin } from './chunk-D6FPKO62.js';
-import { buildWorkspaceToolDefs } from './chunk-I7SQIWYX.js';
+import { WorkspacePlugin } from './chunk-5OZVZI2E.js';
+import { buildWorkspaceToolDefs } from './chunk-CJCZIWW6.js';
 import { findAiAssetsRoot } from './chunk-7IRJ4K4F.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-45LLHKQ2.js';
-import { resolveFlowPath } from './chunk-V62CAMBD.js';
+import { resolveFlowPath } from './chunk-BZBRCPEB.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-2FDOV5JG.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-5YB4GYMB.js';
 import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-JUZJUKWM.js';
-import { EventNormalizer } from './chunk-HA3XJN65.js';
+import { EventNormalizer } from './chunk-6DN6U2CK.js';
 import { probeResumeTranscript } from './chunk-OUJVFZWJ.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { dispatchCapability } from './chunk-3GKBSHUG.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv } from './chunk-WQ5BCHQS.js';
-import { loadFlow } from './chunk-SJYOKKYO.js';
+import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-QBH7PC4D.js';
+import { loadFlow } from './chunk-AOE4KOMJ.js';
 import { parseFlowDefinition } from './chunk-REYJKU7T.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
 import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-QAH24E5U.js';
-import { resolveSettings, loadProviderRegistry } from './chunk-5WNQPXEG.js';
+import { resolveSettings, loadProviderRegistry } from './chunk-GFU367UH.js';
 import { resolveRuntimeAssets } from './chunk-UM4LDXV5.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-P2G6XSJ3.js';
 import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-MKZOK4JU.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink } from './chunk-FTG7CRFD.js';
-import { registryEntries, resolveEntryBaseUrl } from './chunk-ILG4BXYE.js';
+import { registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-ILG4BXYE.js';
 import { getLogStore, registerLogStore, resetLogStore, createLogger, isUnwritableStreamError, markStreamBroken, isBrokenPipeError } from './chunk-W4IPN3DD.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
@@ -5203,6 +5203,67 @@ async function dispatchRefreshToExposedGitMounts(manager, log) {
   );
 }
 var CLAUDE_CODE_CREDENTIALS_KEY = "CLAUDE_CODE_CREDENTIALS_JSON";
+var DEFAULT_CLAUDE_AI_OAUTH_SCOPES = ["user:inference", "user:profile"];
+function selectClaudeCodeCredentialsSecret(secrets, selection) {
+  const legacy = secrets[CLAUDE_CODE_CREDENTIALS_KEY];
+  if (legacy) return { key: CLAUDE_CODE_CREDENTIALS_KEY, value: legacy };
+  if (!selection?.registry) return void 0;
+  if (selection.driver && selection.driver !== "claude-sdk") return void 0;
+  const entries = registryEntries(selection.registry).map(
+    ([id, entry2]) => [id, { ...entry2, kind: entryKind(entry2) }]
+  );
+  const registry = Object.fromEntries(entries);
+  const named = selection.modelRef?.trim();
+  const selected = named ? parseModelRef(named, registry) : void 0;
+  const providerId = named && entries.some(([id]) => id === named) ? named : selected?.providerId ?? entries.find(
+    ([, entry2]) => (entry2.kind === "llm" || entry2.kind === "embed") && isEntryEnabled(entry2)
+  )?.[0];
+  const entry = entries.find(([id]) => id === providerId)?.[1];
+  if (!entry || !isClaudeSubscriptionEndpoint(entry)) return void 0;
+  if (entry.credential?.kind !== "oauth" || !entry.credential.ref) return void 0;
+  const ref = parseCredentialRef(entry.credential.ref);
+  if (ref?.form !== "platform") return void 0;
+  const value = secrets[ref.configId];
+  return value ? { key: ref.configId, value } : void 0;
+}
+function entryKind(entry) {
+  return entry.kind ?? (entry.preset ? AI_PROVIDER_PRESETS[entry.preset]?.kind : void 0);
+}
+function isClaudeSubscriptionEndpoint(entry) {
+  if (entryKind(entry) !== "llm") return false;
+  const preset = entry.preset ? AI_PROVIDER_PRESETS[entry.preset] : void 0;
+  const surface = entry.surface ?? preset?.surface;
+  const transport = entry.transport ?? preset?.transport ?? "direct";
+  return surface === "anthropic-messages" && transport === "direct";
+}
+function claudeAiOauthScopesState(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return "unparseable";
+  }
+  if (!parsed || typeof parsed !== "object") return "unparseable";
+  const scopes = parsed.claudeAiOauth?.scopes;
+  return Array.isArray(scopes) && scopes.length > 0 ? "ok" : "missing";
+}
+async function writeProvisionedClaudeCodeCredentials(home, source, warn) {
+  const state = claudeAiOauthScopesState(source.value);
+  if (state === "missing") {
+    warn(
+      "Claude Code credentials blob has no claudeAiOauth.scopes \u2014 Claude Code will report 'Not logged in'; re-capture or rotate the seat",
+      { key: source.key }
+    );
+  } else if (state === "unparseable") {
+    warn(
+      "Claude Code credentials blob is not a JSON object \u2014 Claude Code cannot read it; the platform sent malformed material for this secret",
+      { key: source.key }
+    );
+  }
+  return writeClaudeCodeCredentialsFile(home, source.value);
+}
+var credentialsLog;
+var scopesRepairLogged = /* @__PURE__ */ new Set();
 async function writeClaudeCodeCredentialsFile(home, json) {
   const claudeDir = join(home, ".claude");
   await mkdir(claudeDir, { recursive: true, mode: 448 });
@@ -5247,6 +5308,17 @@ async function mergeAndRewriteCredentialsFile(home, accessToken, expiresAt) {
   const oauthBlock = merged.claudeAiOauth ?? {};
   oauthBlock.accessToken = accessToken;
   if (expiresAt) oauthBlock.expiresAt = expiresAt;
+  if (!Array.isArray(oauthBlock.scopes) || oauthBlock.scopes.length === 0) {
+    oauthBlock.scopes = [...DEFAULT_CLAUDE_AI_OAUTH_SCOPES];
+    if (!scopesRepairLogged.has(credPath)) {
+      scopesRepairLogged.add(credPath);
+      credentialsLog ??= createLogger({ kind: "runner", subkind: "credentials" });
+      credentialsLog.info("added default scopes to a claudeAiOauth block that had none", {
+        path: credPath,
+        scopes: DEFAULT_CLAUDE_AI_OAUTH_SCOPES
+      });
+    }
+  }
   merged.claudeAiOauth = oauthBlock;
   merged.accessToken = accessToken;
   return writeClaudeCodeCredentialsFile(home, JSON.stringify(merged));
@@ -5291,13 +5363,20 @@ function readCurrentClaudeAccessToken(home) {
 function raiseHookFailures(phase, results, log) {
   const failed = results.filter((r) => !r.ok);
   if (failed.length === 0) return;
+  const cause = (f) => redactUrlAuth(f.error ?? "unknown error");
   for (const f of failed) {
-    log(`[lifecycle] ${phase}: connector "${f.id}" failed \u2014 ${f.error ?? "unknown error"}`);
+    log(`[lifecycle] ${phase}: connector "${f.id}" failed \u2014 ${cause(f)}`);
   }
   throw new Error(
-    `${failed.length} connector(s) failed to ${phase}: ${failed.map((f) => `${f.id}: ${f.error ?? "unknown error"}`).join("; ")}`
+    `${failed.length} connector(s) failed to ${phase}: ${failed.map((f) => `${f.id}: ${cause(f)}`).join("; ")}`
   );
 }
+function redactUrlAuth(text2) {
+  return text2.replace(/\/\/[^/\s]*@/g, "//***@");
+}
+function replyResults(results) {
+  return results.map((r) => r.detail ? { ...r, detail: redactUrlAuth(r.detail) } : r);
+}
 function buildLifecycleHandler(deps) {
   const { getCompactionOrchestrator, getResourceManager, log } = deps;
   return async ({ phase }) => {
@@ -5306,22 +5385,29 @@ function buildLifecycleHandler(deps) {
         const orchestrator = getCompactionOrchestrator();
         if (orchestrator) await orchestrator.compact("manual");
         else log("[lifecycle] compact: no compaction orchestrator \u2014 skipped");
-        break;
+        return { ok: true };
       }
       case "hibernate": {
         const manager = getResourceManager();
-        if (manager) raiseHookFailures("hibernate", await manager.hibernateAll(), log);
-        else log("[lifecycle] hibernate: no resource manager \u2014 skipped");
-        break;
+        if (!manager) {
+          log("[lifecycle] hibernate: no resource manager \u2014 skipped");
+          return { ok: true };
+        }
+        const results = await manager.hibernateAll();
+        raiseHookFailures("hibernate", results, log);
+        return { ok: true, results: replyResults(results) };
       }
       case "close": {
         const manager = getResourceManager();
-        if (manager) raiseHookFailures("close", await manager.closeAll(), log);
-        else log("[lifecycle] close: no resource manager \u2014 skipped");
-        break;
+        if (!manager) {
+          log("[lifecycle] close: no resource manager \u2014 skipped");
+          return { ok: true };
+        }
+        const results = await manager.closeAll();
+        raiseHookFailures("close", results, log);
+        return { ok: true, results: replyResults(results) };
       }
     }
-    return { ok: true };
   };
 }
 function asDeclaration(declaration) {
@@ -7765,17 +7851,21 @@ async function startAgentServer(opts) {
       capabilityRegistry.register(stub, "client");
     }
   }
-  async function provisionInitSecrets(secrets) {
+  async function provisionInitSecrets(secrets, selection) {
     let initialAiCredentialExpiresAt = null;
     if (secrets) {
-      const ccdValue = secrets[CLAUDE_CODE_CREDENTIALS_KEY];
-      if (ccdValue) {
+      const source = selectClaudeCodeCredentialsSecret(secrets, selection);
+      if (source) {
         const home = process.env.HOME ?? homedir();
         if (home) {
           try {
-            await writeClaudeCodeCredentialsFile(home, ccdValue);
+            await writeProvisionedClaudeCodeCredentials(
+              home,
+              source,
+              (message, meta) => serverLog.warn(message, meta)
+            );
             log(
-              `[serve] wrote Claude Code credentials file to ${home}/.claude/.credentials.json (mode 0600)`
+              `[serve] wrote Claude Code credentials file to ${home}/.claude/.credentials.json (mode 0600) from ${source.key === CLAUDE_CODE_CREDENTIALS_KEY ? source.key : `registry credential platform:${source.key}`}`
             );
             await guardClaudeAiConnectors(home, serverLog);
           } catch (err) {
@@ -7783,7 +7873,7 @@ async function startAgentServer(opts) {
             log(`[serve] failed to write Claude Code credentials file: ${errMsg}`);
           }
         }
-        initialAiCredentialExpiresAt = extractClaudeAiOauthExpiresAt(ccdValue);
+        initialAiCredentialExpiresAt = extractClaudeAiOauthExpiresAt(source.value);
       }
       const otherSecrets = Object.fromEntries(
         Object.entries(secrets).filter(([k]) => k !== CLAUDE_CODE_CREDENTIALS_KEY)
@@ -8234,8 +8324,6 @@ async function startAgentServer(opts) {
       ...managedHost ? { runtimeFeatures: supportedRuntimeFeatures } : {}
     });
     preMintedSecrets = new PreMintedSecretProvider(cmd.credentials);
-    const initialAiCredentialExpiresAt = await provisionInitSecrets(cmd.secrets);
-    if (managedCodex) secretsProvisioned = true;
     if (cmd.resolvedConfig.aiProviderConfigId) {
       aiProviderConfigId = cmd.resolvedConfig.aiProviderConfigId;
       log(`[serve] stashed aiProviderConfigId=${aiProviderConfigId}`);
@@ -8243,6 +8331,30 @@ async function startAgentServer(opts) {
     }
     const wireCandidate = cmd.resolvedConfig.agentConfig ?? wireAgentConfig;
     wireAgentConfig = managedCodex ? cmd.resolvedConfig.agentConfig : diskProfileHasAgentSettings(profile) ? wireCandidate?.registry ? { registry: wireCandidate.registry } : void 0 : wireCandidate;
+    let credentialsSelection;
+    if (!managedCodex && wireAgentConfig?.registry && cmd.secrets && !cmd.secrets[CLAUDE_CODE_CREDENTIALS_KEY]) {
+      const driver2 = opts.driver ?? wireAgentConfig?.driver;
+      const model = opts.model ?? wireAgentConfig?.model;
+      let settings;
+      try {
+        settings = await resolveSettings(opts.projectDir, { driver: driver2, model });
+      } catch (err) {
+        serverLog.warn(
+          `[serve] credentials selection: settings unreadable: ${err instanceof Error ? err.message : String(err)}`
+        );
+        settings = { driver: driver2 ?? profile?.driver, model: model ?? profile?.model };
+      }
+      credentialsSelection = {
+        driver: settings.driver ?? "omp",
+        registry: wireAgentConfig?.registry,
+        modelRef: wireAgentConfig?.modelRef?.trim() || settings.model?.trim() || void 0
+      };
+    }
+    const initialAiCredentialExpiresAt = await provisionInitSecrets(
+      cmd.secrets,
+      credentialsSelection
+    );
+    if (managedCodex) secretsProvisioned = true;
     if (!managedCodex && aiProviderConfigId && initialAiCredentialExpiresAt) {
       aiCredentialRefreshScheduler.schedule(initialAiCredentialExpiresAt);
     }
@@ -9020,5 +9132,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-LOCIJAS3.js.map
-//# sourceMappingURL=chunk-LOCIJAS3.js.map
+//# sourceMappingURL=chunk-6YIFJW2I.js.map
+//# sourceMappingURL=chunk-6YIFJW2I.js.map