@springbrand/agent-runtime 0.2.0-alpha.14 → 0.2.0-alpha.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@springbrand/agent-runtime",
-  "version": "0.2.0-alpha.14",
+  "version": "0.2.0-alpha.16",
   "type": "module",
   "files": [
     "src",

package/src/kernel/bindings.ts

@@ -2,6 +2,7 @@ import type { SkillSource } from "agents/skills";
 import type { ScheduleSpec } from "./receipts";
 import type { RuntimeActivityProjection } from "./state";
 import type { ExecutionLevel } from "../lib/execution-level";
+import type { RuntimeCodeExecutionFactory } from "../tool-registry";
 import type {
   RuntimeEventConfirmation,
   RuntimeLifecycleFact,
@@ -1024,6 +1025,7 @@ export interface RuntimeSkillSourceBinding {
 export interface RuntimeBindings {
   provider: RuntimeProviderPort;
   platform: RuntimePlatformPort;
+  codeExecution?: RuntimeCodeExecutionFactory;
   /** Secret-capability binding; implementations must keep Runtime Grant in closure state. */
   gateway?: RuntimeGatewayPort;
   workspace?: WorkspacePort;

package/src/pi/runtime-adapter/assembly.ts

@@ -208,6 +208,7 @@ const IDEMPOTENT_TOOL_NAMES = new Set([
   "bind_resource",
   "delete",
   "edit",
+  "execute",
   "find",
   "get_time",
   "grep",

package/src/pi/runtime-adapter/execution.ts

@@ -25,6 +25,7 @@ import { PiChunkEncoder } from "../message";
 import type { UIMessageChunk } from "ai";
 import { ChatStreamStalledError } from "agents/chat";
 import {
+  codeExecutionPiToolCandidate,
   compilePiTools,
   createPiToolGovernance,
   normalizeUpdatePlanArguments,
@@ -48,6 +49,7 @@ import {
 import { EXECUTION_LEVELS } from "../../lib/execution-level";
 import { projectToolOutputForModel } from "../../layers/context/budget/gate";
 import type { SpillWorkspace } from "../../lib/artifacts";
+import { toolRegistryFromPiCandidates } from "../../tool-registry";
 
 // #region Single-run Pi bridge
 
@@ -527,7 +529,10 @@ export class PreparedPiTurnAdapter {
       messageId: options.submission.messageId,
       startedAt: options.submission.startedAt,
     });
-    this.candidates = state.candidates.map((candidate) => ({
+    const bindCandidate = (
+      candidate: PiToolCandidate,
+      toolCallIdPrefix?: string,
+    ): PiToolCandidate => ({
       ...candidate,
       tool: {
         ...candidate.tool,
@@ -535,6 +540,9 @@ export class PreparedPiTurnAdapter {
         // 实时运行由 PiCore 调用它，恢复或审批续跑则由 retryTool 进入同一路径。
         // 顺序不能随便调整：门禁先于结果复用，审批可能生成结果，不确定的非幂等工作不能重放。
         execute: async (toolCallId, input, signal, onUpdate) => {
+          if (toolCallIdPrefix) {
+            toolCallId = `${toolCallIdPrefix}:${toolCallId}`;
+          }
           const requiredExecutionLevel = candidate.requiredExecutionLevelForInput
             ? await candidate.requiredExecutionLevelForInput(input)
             : candidate.requiredExecutionLevel;
@@ -667,7 +675,35 @@ export class PreparedPiTurnAdapter {
           );
         },
       },
-    }));
+    });
+    this.candidates = state.candidates.map((candidate) => {
+      if (!candidate.codeExecutionTools) return bindCandidate(candidate);
+      const factory = state.snapshot.bindings.codeExecution;
+      if (!factory) {
+        throw new Error("Prepared Code Mode Tool requires a Runtime factory");
+      }
+      return bindCandidate({
+        ...candidate,
+        tool: {
+          ...candidate.tool,
+          execute: (toolCallId, input, signal, onUpdate) => {
+            const runtimeCandidate = codeExecutionPiToolCandidate(
+              factory.create(toolRegistryFromPiCandidates(
+                candidate.codeExecutionTools!.map((inner) =>
+                  bindCandidate(inner, toolCallId)
+                ),
+              )),
+            );
+            return runtimeCandidate.tool.execute(
+              toolCallId,
+              input,
+              signal,
+              onUpdate,
+            );
+          },
+        },
+      });
+    });
     this.turn = new PiTurnAdapter({
       pi: {
         model: state.snapshot.pi.model,

package/src/pi/tool/compiler.ts

@@ -46,6 +46,8 @@ export interface PiToolInteractionSpec {
 export interface PiToolCandidate {
   readonly owner: string;
   readonly tool: AgentTool<any, any>;
+  /** @internal Tools hidden behind this Code Mode candidate. */
+  readonly codeExecutionTools?: readonly PiToolCandidate[];
   /** Conservative maximum used in the stable Runtime descriptor. */
   readonly requiredExecutionLevel: ExecutionLevel;
   /** Trusted parameter-level policy, evaluated before approval or dispatch. */

package/src/pi/tool/core.ts

@@ -108,12 +108,12 @@ const executeParameters = Type.Object({
 const CODEMODE_EXECUTE_TIMEOUT_MS = 60_000;
 
 /**
- * 把 Cloudflare Codemode Runtime handle 包装为高风险 Pi 代码执行工具候选项。
+ * 把 Cloudflare Codemode Runtime handle 包装为 Pi 代码执行工具候选项。
  *
  * Tool Surface 收到 Host 已组装的 Code Execution Port 后调用，
  * 模型再通过 `execute` 运行代码。
  *
- * Codemode 代码可访问出站网络和已配置 connector，因此必须保留 high 档和 codemode source 标记，不能降级成普通本地计算工具。
+ * Code Mode 作为一个完整的 safe 工具对外暴露，内部能力不再单独提权。
  */
 export function codeExecutionPiToolCandidate(
   runtime: RuntimeCodeExecutionPort,
@@ -159,7 +159,7 @@ export function codeExecutionPiToolCandidate(
   };
   return {
     owner: "core:codemode",
-    requiredExecutionLevel: "high",
+    requiredExecutionLevel: "safe",
     outputBudget: { kind: "structure" },
     source: "codemode",
     summary: "Run JavaScript with network and configured connector access",

package/src/runtime-assembler.ts

@@ -252,12 +252,16 @@ async function createToolSurface(
             candidate.interaction ||
             typeof candidate.tool.execute !== "function",
         );
+        const codeExecutionTools = Object.freeze([...mergeable]);
         return Object.freeze([
-          Object.freeze(codeExecutionPiToolCandidate(
-            input.codeExecution.create(
-              toolRegistryFromPiCandidates(mergeable),
+          Object.freeze({
+            ...codeExecutionPiToolCandidate(
+              input.codeExecution.create(
+                toolRegistryFromPiCandidates(codeExecutionTools),
+              ),
             ),
-          )),
+            codeExecutionTools,
+          }),
           ...direct,
         ]);
       },
@@ -528,6 +532,7 @@ class RuntimeBuilder {
     const bindings: RuntimeBindings = Object.freeze({
       provider,
       platform: Object.freeze({ ...this.platform }),
+      ...(this.codeExecution ? { codeExecution: this.codeExecution } : {}),
       ...(this.gateway ? { gateway: this.gateway } : {}),
       ...(this.workspace ? { workspace: this.workspace } : {}),
       ...(this.memoryProfile.enabled && this.memory

package/src/tool-registry.ts

@@ -8,6 +8,7 @@ import type {
 import type { RuntimeExtensionConfig } from "./kernel/extensions";
 import type { RuntimeDegradation } from "./kernel/degradation";
 import type { PiToolCandidate } from "./pi/tool/compiler";
+import { validateToolArguments } from "@earendil-works/pi-ai";
 
 /** Tool Surface 筛选策略（不含 Manifest deny 列表）。 */
 export interface ToolSurfaceSelectionPolicy {
@@ -94,9 +95,15 @@ export function piCandidateToToolSpec(candidate: PiToolCandidate): ToolSpec {
       if (typeof execute !== "function") {
         throw new Error(`Tool "${name}" is not executable`);
       }
+      const validated = validateToolArguments(candidate.tool, {
+        type: "toolCall",
+        id: ctx.toolCallId,
+        name,
+        arguments: input as Record<string, unknown>,
+      });
       const result = await execute(
         ctx.toolCallId,
-        input,
+        validated,
         ctx.signal,
         undefined,
       );