@syncended/dsh-automations 0.5.1 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -7
- package/dist/agent-executor.js +2 -2
- package/dist/agent-executor.js.map +1 -1
- package/dist/project-policy.js +4 -4
- package/dist/project-policy.js.map +1 -1
- package/dist/types.d.ts +1 -1
- package/dist/types.d.ts.map +1 -1
- package/docs/architecture.md +4 -4
- package/docs/security.md +2 -2
- package/lib/client.js +906 -251
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
# DeepSeek Harness Automations
|
|
2
2
|
|
|
3
|
-
A DeepSeek Harness plugin for durable, configurable cron jobs. Each occurrence starts a fresh persisted Harness Agent in a selected
|
|
3
|
+
A DeepSeek Harness plugin for durable, configurable cron jobs. Each occurrence starts a fresh persisted Harness Agent in a selected workspace with an explicit model route, agent preset, and permission preset.
|
|
4
4
|
|
|
5
5
|
> **Status:** MVP for `@deepseek-ai/dsh` `0.1.1-rc.2`. The current worker is single-host. Cron admission and run history are durable; an already-started run is deliberately **not** retried after a host crash.
|
|
6
6
|
|
|
7
7
|
## What works
|
|
8
8
|
|
|
9
9
|
- Standard five-field cron expressions with `UTC` or IANA timezones.
|
|
10
|
-
- Per-job
|
|
10
|
+
- Per-job workspace, provider/model, reasoning effort, agent preset, permission preset, and timeout.
|
|
11
11
|
- Enable/disable, Run now, edit, delete, cancel, and recent run history from a full center workspace opened by the main **Automations** sidebar action, or from **Settings → Automations**.
|
|
12
12
|
- Overlap policies:
|
|
13
13
|
- `skip` — record and skip an occurrence while the job has queued/running work.
|
|
@@ -20,7 +20,7 @@ A DeepSeek Harness plugin for durable, configurable cron jobs. Each occurrence s
|
|
|
20
20
|
- Immutable execution snapshots and occurrence keys for replay-safe admission.
|
|
21
21
|
- Extensible executor registry: the MVP ships `agent`; future `workflow` and task-graph executors do not need scheduler changes.
|
|
22
22
|
|
|
23
|
-
The in-box `@deepseek-ai/dsh-schedule` plugin remains the right tool for reminders attached to one live Session. This plugin owns deployment-level jobs that can start a fresh
|
|
23
|
+
The in-box `@deepseek-ai/dsh-schedule` plugin remains the right tool for reminders attached to one live Session. This plugin owns deployment-level jobs that can start a fresh workspace Session while no chat is open.
|
|
24
24
|
|
|
25
25
|
## Install
|
|
26
26
|
|
|
@@ -55,9 +55,9 @@ dsh plugin --profile web remove @syncended/dsh-automations
|
|
|
55
55
|
| Field | Meaning |
|
|
56
56
|
|---|---|
|
|
57
57
|
| Name | Human-readable job name. |
|
|
58
|
-
|
|
|
58
|
+
| Schedule | Choose Minutes, Hourly, Daily, Weekdays, or Weekly and adjust its simple controls. Custom exposes the raw five-field cron (`minute hour day-of-month month day-of-week`) with an inline field guide. |
|
|
59
59
|
| Time zone | Search by city or region in the picker, or enter `UTC` / an IANA name such as `Europe/Berlin`. Current UTC offsets are shown; DST is handled by `cron-parser`. |
|
|
60
|
-
|
|
|
60
|
+
| Workspace | Choose an existing Harness workspace or enter an absolute directory manually. Its canonical filesystem identity becomes the Session cwd and `workspace-write` root. |
|
|
61
61
|
| Prompt | The user message sent to a fresh Harness Agent. |
|
|
62
62
|
| Provider / model | Choose a configured provider in the searchable picker or enter an unlisted adapter route, then choose or enter its model. Leave both blank to resolve the current Harness default at dispatch time. |
|
|
63
63
|
| Reasoning effort | Choose `Default` or an exact-model effort advertised by the adapter. If capability lookup is unavailable, common IDs are shown as advisory fallbacks; custom IDs remain editable and are validated when the run starts. |
|
|
@@ -66,7 +66,7 @@ dsh plugin --profile web remove @syncended/dsh-automations
|
|
|
66
66
|
| Timeout | Wall-clock run limit. Cancellation is cooperative through the Agent loop. |
|
|
67
67
|
| Overlap / misfire | Admission behavior described above. |
|
|
68
68
|
|
|
69
|
-
A
|
|
69
|
+
The form groups common settings into **Task**, **Schedule**, and **Agent & access**. Job ID, timeout, overlap, and misfire stay available in the collapsed **Advanced** section. A paused job may still be started with **Run now**.
|
|
70
70
|
|
|
71
71
|
## Plugin configuration
|
|
72
72
|
|
|
@@ -101,7 +101,7 @@ This is not exactly-once execution. Exactly-once external side effects require i
|
|
|
101
101
|
## Security
|
|
102
102
|
|
|
103
103
|
- State files are replaced atomically with mode `0600`; created directories use `0700`.
|
|
104
|
-
-
|
|
104
|
+
- Workspace paths are resolved through `realpath`; optional allowed roots are checked against that canonical identity.
|
|
105
105
|
- Background work uses a normal DSH permission preset. `workspace-write` cannot silently widen itself; unattended approval failures remain fail-closed.
|
|
106
106
|
- `danger-full-access` is intentionally available only when the job author selects a configured preset that grants it.
|
|
107
107
|
- The management API requires JSON plus a custom same-origin mutation header. It inherits the trust boundary of the DSH Web server, which has no standalone authentication layer.
|
package/dist/agent-executor.js
CHANGED
|
@@ -58,9 +58,9 @@ function failureFromReason(reason) {
|
|
|
58
58
|
async function assertCanonicalDirectory(cwd) {
|
|
59
59
|
const [metadata, canonical] = await Promise.all([stat(cwd), realpath(cwd)]);
|
|
60
60
|
if (!metadata.isDirectory())
|
|
61
|
-
throw new AgentRunError(`
|
|
61
|
+
throw new AgentRunError(`Workspace path is not a directory: ${cwd}`, 'PROJECT_NOT_DIRECTORY');
|
|
62
62
|
if (canonical !== cwd) {
|
|
63
|
-
throw new AgentRunError(`
|
|
63
|
+
throw new AgentRunError(`Workspace path no longer resolves to its saved filesystem identity: expected ${cwd}, found ${canonical}`, 'PROJECT_IDENTITY_CHANGED');
|
|
64
64
|
}
|
|
65
65
|
}
|
|
66
66
|
function resolveSelection(ctx, run) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agent-executor.js","sourceRoot":"","sources":["../src/agent-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAKjD,OAAO,EAAE,qBAAqB,EAAuB,MAAM,wBAAwB,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAyC,MAAM,0BAA0B,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAA2D,MAAM,YAAY,CAAA;AAE1G,MAAM,aAAc,SAAQ,KAAK;IACtB,IAAI,CAAQ;IAErB,YAAY,OAAe,EAAE,IAAY,EAAE,OAAsB;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAOD,SAAS,SAAS,CAAC,MAA+B,EAAE,QAAgB;IAClE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,MAAiC,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,GAAG,GAAG,QAAQ;YAAE,SAAQ;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAA;YACd,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;iBACtC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;iBACxC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;iBAC1B,IAAI,CAAC,EAAE,CAAC,CAAA;YACX,IAAI,MAAM,KAAK,EAAE;gBAAE,IAAI,GAAG,MAAM,CAAA;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;IAC3D,CAAC;IACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAiC;IAC1D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,aAAa,CAAC,8CAA8C,EAAE,sBAAsB,CAAC,CAAA;IAC1H,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,aAAa,CAAC,6BAA6B,EAAE,cAAc,CAAC,CAAA;IACtG,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,aAAa,CAAC,2CAA2C,EAAE,iBAAiB,CAAC,CAAA;IAC1H,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,aAAa,CAAC,6BAA6B,EAAE,cAAc,CAAC,CAAA;IACtG,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,aAAa,CAAC,0DAA0D,EAAE,kBAAkB,CAAC,CAAA;IAC3I,OAAO,IAAI,aAAa,CAAC,4CAA4C,MAAM,CAAE,MAA2B,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;AACpI,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,GAAW;IACjD,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,
|
|
1
|
+
{"version":3,"file":"agent-executor.js","sourceRoot":"","sources":["../src/agent-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAKjD,OAAO,EAAE,qBAAqB,EAAuB,MAAM,wBAAwB,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAyC,MAAM,0BAA0B,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAA2D,MAAM,YAAY,CAAA;AAE1G,MAAM,aAAc,SAAQ,KAAK;IACtB,IAAI,CAAQ;IAErB,YAAY,OAAe,EAAE,IAAY,EAAE,OAAsB;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAOD,SAAS,SAAS,CAAC,MAA+B,EAAE,QAAgB;IAClE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,MAAiC,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,GAAG,GAAG,QAAQ;YAAE,SAAQ;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAA;YACd,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;iBACtC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;iBACxC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;iBAC1B,IAAI,CAAC,EAAE,CAAC,CAAA;YACX,IAAI,MAAM,KAAK,EAAE;gBAAE,IAAI,GAAG,MAAM,CAAA;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;IAC3D,CAAC;IACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAiC;IAC1D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,aAAa,CAAC,8CAA8C,EAAE,sBAAsB,CAAC,CAAA;IAC1H,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,aAAa,CAAC,6BAA6B,EAAE,cAAc,CAAC,CAAA;IACtG,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,aAAa,CAAC,2CAA2C,EAAE,iBAAiB,CAAC,CAAA;IAC1H,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,aAAa,CAAC,6BAA6B,EAAE,cAAc,CAAC,CAAA;IACtG,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,aAAa,CAAC,0DAA0D,EAAE,kBAAkB,CAAC,CAAA;IAC3I,OAAO,IAAI,aAAa,CAAC,4CAA4C,MAAM,CAAE,MAA2B,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;AACpI,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,GAAW;IACjD,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,sCAAsC,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAA;IAC1H,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CACrB,gFAAgF,GAAG,WAAW,SAAS,EAAE,EACzG,0BAA0B,CAC3B,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,GAAqC;IAC3E,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAA;IACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAA;IAC9C,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,KAAK,SAAS;QAC7D,CAAC,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS;YAChC,CAAC,CAAC,OAAO,CAAC,eAAe;YACzB,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,OAAO;QACL,QAAQ;QACR,KAAK;QACL,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,OAAO,CAAA;IACN,GAAG,CAAS;IACZ,aAAa,CAAe;IAE7C,YAAY,GAAY,EAAE,aAA4B;QACpD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAkC;QAC9C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAA;QACxC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACvE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAA;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CAAC,iBAAiB,MAAM,CAAC,EAAE,gBAAgB,MAAM,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;QAC3G,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAC9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAC1C,SAAS;YACT,IAAI,EAAE;gBACJ,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,WAAW,EAAE,MAAM,CAAC,EAAE;aACvB;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB;YACD,MAAM;YACN,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;gBACtD,qBAAqB,CAAC,QAAQ,EAAE;oBAC9B,OAAO,EAAE,SAAS;oBAClB,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAA;gBACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;gBAC5B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,oBAAoB,CAAC,CAAA;gBAC3G,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAA;YAC3E,CAAC;SACF,CAAC,CAAA;QAEF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;QACxB,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,KAAK,CAAC,MAAM,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;aAC1F,CAAC,CAAA;QACJ,CAAC,CAAA;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9C,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAA;YACvC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;YACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAA;YAClC,KAAK,CAAC,QAAQ,CACZ,iBAAiB,CAAC;gBAChB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;qBAC/B;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,oBAAoB;iBAC7B;aACF,CAAC,CACH,CAAA;YACD,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;YACtB,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAA;YACvC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YACzD,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,WAAW;gBAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjF,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;aACzD,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC3C,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACnE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;CACF"}
|
package/dist/project-policy.js
CHANGED
|
@@ -33,16 +33,16 @@ export class ProjectPolicy {
|
|
|
33
33
|
const roots = [];
|
|
34
34
|
for (const configured of configuredRoots) {
|
|
35
35
|
const path = resolve(expandHomePath(configured));
|
|
36
|
-
roots.push(await canonicalDirectory(path, 'allowed
|
|
36
|
+
roots.push(await canonicalDirectory(path, 'allowed workspace root'));
|
|
37
37
|
}
|
|
38
38
|
return new ProjectPolicy([...new Set(roots)]);
|
|
39
39
|
}
|
|
40
40
|
async authorize(cwd) {
|
|
41
41
|
if (!isAbsolute(cwd))
|
|
42
|
-
throw new AutomationInputError('
|
|
43
|
-
const canonical = await canonicalDirectory(cwd, '
|
|
42
|
+
throw new AutomationInputError('workspace path must be absolute');
|
|
43
|
+
const canonical = await canonicalDirectory(cwd, 'workspace path');
|
|
44
44
|
if (this.roots.length > 0 && !this.roots.some((root) => isWithin(root, canonical))) {
|
|
45
|
-
throw new AutomationInputError(`
|
|
45
|
+
throw new AutomationInputError(`workspace path is outside allowedProjectRoots: ${canonical}`, 'PROJECT_NOT_ALLOWED', 403);
|
|
46
46
|
}
|
|
47
47
|
return canonical;
|
|
48
48
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"project-policy.js","sourceRoot":"","sources":["../src/project-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACrE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAC3D,IAAI,QAAQ,CAAA;IACZ,IAAI,SAAS,CAAA;IACb,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,oCAAoC,IAAI,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE;YAC7G,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,wBAAwB,IAAI,EAAE,EAAE,uBAAuB,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,aAAa;IACP,KAAK,CAAU;IAEhC,YAAoB,KAAe;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAkC;QACpD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;YAChD,KAAK,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,
|
|
1
|
+
{"version":3,"file":"project-policy.js","sourceRoot":"","sources":["../src/project-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACrE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAC3D,IAAI,QAAQ,CAAA;IACZ,IAAI,SAAS,CAAA;IACb,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,oCAAoC,IAAI,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE;YAC7G,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,wBAAwB,IAAI,EAAE,EAAE,uBAAuB,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,aAAa;IACP,KAAK,CAAU;IAEhC,YAAoB,KAAe;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAkC;QACpD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;YAChD,KAAK,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,IAAI,aAAa,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,iCAAiC,CAAC,CAAA;QACvF,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,oBAAoB,CAC5B,kDAAkD,SAAS,EAAE,EAC7D,qBAAqB,EACrB,GAAG,CACJ,CAAA;QACH,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF"}
|
package/dist/types.d.ts
CHANGED
|
@@ -12,7 +12,7 @@ export interface CronSchedule {
|
|
|
12
12
|
timezone: string;
|
|
13
13
|
}
|
|
14
14
|
export interface AgentExecutionSpec {
|
|
15
|
-
/** Absolute
|
|
15
|
+
/** Absolute workspace directory and immutable Session cwd/root. */
|
|
16
16
|
cwd: string;
|
|
17
17
|
/** Omitted provider and model resolve from the current Harness default at dispatch time. */
|
|
18
18
|
provider?: string;
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAA;AAC9C,eAAO,MAAM,oBAAoB,EAAG,4BAAqC,CAAA;AAEzE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;AACtD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,CAAA;AAC/C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAA;AACjD,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,SAAS,GACT,WAAW,GACX,QAAQ,GACR,WAAW,GACX,WAAW,GACX,SAAS,GACT,aAAa,CAAA;AAEjB,MAAM,WAAW,YAAY;IAC3B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAA;IACZ,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAA;AAC9C,eAAO,MAAM,oBAAoB,EAAG,4BAAqC,CAAA;AAEzE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;AACtD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,CAAA;AAC/C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAA;AACjD,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,SAAS,GACT,WAAW,GACX,QAAQ,GACR,WAAW,GACX,WAAW,GACX,SAAS,GACT,aAAa,CAAA;AAEjB,MAAM,WAAW,YAAY;IAC3B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAA;IACZ,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;IACX,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAA;IACxB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,aAAa,CAAA;IACtB,OAAO,EAAE,aAAa,CAAA;CACvB;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,YAAY,CAAA;IACtB,IAAI,EAAE,aAAa,CAAA;IACnB,SAAS,EAAE,kBAAkB,CAAA;IAC7B,QAAQ,EAAE,kBAAkB,CAAA;CAC7B;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,iBAAiB,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,aAAa,CAAA;IACnE,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,OAAO,oBAAoB,CAAA;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACnC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,aAAa,EAAE,CAAA;IACrB,IAAI,EAAE,aAAa,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,iBAAiB,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,iBAAiB,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,aAAa,CAAA;IAClB,MAAM,EAAE,WAAW,CAAA;IACnB,oEAAoE;IACpE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChD;AAED,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACpD,OAAO,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACxE;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,IAAI,IAAI,CAAA;IACX,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA;IAChF,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,GAAG,IAAI,CAAA;CAC1D;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,KAAK,CAAC;YACb,EAAE,EAAE,MAAM,CAAA;YACV,IAAI,EAAE,MAAM,CAAA;YACZ,WAAW,CAAC,EAAE,MAAM,CAAA;SACrB,CAAC,CAAA;QACF,aAAa,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,KAAK,CAAC;YACZ,EAAE,EAAE,MAAM,CAAA;YACV,IAAI,EAAE,MAAM,CAAA;YACZ,WAAW,CAAC,EAAE,MAAM,CAAA;SACrB,CAAC,CAAA;KACH,CAAC,CAAA;IACF,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,YAAY,EAAE,KAAK,CAAC;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAA;IAC5C,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACjE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC7E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1F,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9D,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,CAAA;IACnC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC5E,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAAA;CAC3D;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,WAAW,EAAE,oBAAoB,CAAA;KAClC;CACF;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG;IAAE,WAAW,EAAE,oBAAoB,CAAA;CAAE,CAAA"}
|
package/docs/architecture.md
CHANGED
|
@@ -32,11 +32,11 @@ Sidebar / Center workspace / Settings UI / HTTP API
|
|
|
32
32
|
|
|
33
33
|
The same automation page is available through Settings and a dedicated center workspace. `settings.section` keeps configuration available inside Settings; `sidebar.footer.action` activates a temporary, higher-priority `conversation` entry that replaces the current center occupant. This provides a split-screen-like full-center experience while using the single-slot election directly rather than Split Screen's internal view contributions. Closing Automations disposes its entry immediately, revealing whichever center surface was previously active. A small client-only disclosure store coordinates the sidebar trigger and dynamic registration; neither surface owns scheduler state, and both read the same package HTTP API.
|
|
34
34
|
|
|
35
|
-
Interactive chrome uses the ambient `@deepseek-ai/dsh-client-ui-primitives` `Button`, `Menu`, and icon components. Package CSS is limited to the automation-specific layout and composes only public DSH semantic tokens, so theme, menu, focus, and button behavior stay aligned with the host UI.
|
|
35
|
+
Interactive chrome uses the ambient `@deepseek-ai/dsh-client-ui-primitives` `Button`, `Menu`, `Pill`, and icon components. The form separates Task, Schedule, Agent/access, and Advanced concerns; common schedule pills generate canonical five-field cron while Custom keeps the raw expression and field guide available. The Workspace selector subscribes to `ctx.workspaces.list`, projecting the Host's live workspace order while retaining manual absolute-path entry. Package CSS is limited to the automation-specific layout and composes only public DSH semantic tokens, so theme, menu, focus, and button behavior stay aligned with the host UI.
|
|
36
36
|
|
|
37
37
|
### AutomationService
|
|
38
38
|
|
|
39
|
-
Cordis service `ctx.automations`. It owns input validation, canonical
|
|
39
|
+
Cordis service `ctx.automations`. It owns input validation, canonical workspace-path authorization, metadata discovery, the Web route, and the public executor-registration seam.
|
|
40
40
|
|
|
41
41
|
### AutomationStateStore
|
|
42
42
|
|
|
@@ -72,7 +72,7 @@ It never knows how an Agent, workflow, or code task works.
|
|
|
72
72
|
|
|
73
73
|
The `agent` executor:
|
|
74
74
|
|
|
75
|
-
1. re-authorizes the canonical
|
|
75
|
+
1. re-authorizes the canonical workspace path;
|
|
76
76
|
2. resolves the job's agent and permission presets;
|
|
77
77
|
3. resolves the current default model or the pinned provider/model route;
|
|
78
78
|
4. creates a fresh Session and Agent through `ctx.agents.create`;
|
|
@@ -123,7 +123,7 @@ A queued run must not change when a user edits or deletes its source job. The sn
|
|
|
123
123
|
- job id/version and name;
|
|
124
124
|
- schedule/policy values used at admission;
|
|
125
125
|
- prompt and execution settings;
|
|
126
|
-
-
|
|
126
|
+
- workspace/model/preset/permission/timeout values.
|
|
127
127
|
|
|
128
128
|
Deleting a job marks its still-queued runs skipped; already-running work drains against its snapshot.
|
|
129
129
|
|
package/docs/security.md
CHANGED
|
@@ -16,7 +16,7 @@ The custom header forces a cross-origin browser request through CORS preflight,
|
|
|
16
16
|
|
|
17
17
|
## Filesystem authority
|
|
18
18
|
|
|
19
|
-
A job's
|
|
19
|
+
A job's workspace path is canonicalized with `realpath` before storage. `workspace-write` uses that Session cwd as its DSH sandbox root. `allowedProjectRoots`, when configured, are canonicalized and checked with path-segment containment rather than string prefixes.
|
|
20
20
|
|
|
21
21
|
The executor repeats authorization at dispatch, catching deleted paths and symlink retargeting after configuration.
|
|
22
22
|
|
|
@@ -32,7 +32,7 @@ Scheduled Agents are not attached to an interactive browser ownership chain. A p
|
|
|
32
32
|
|
|
33
33
|
## Secrets and persisted data
|
|
34
34
|
|
|
35
|
-
`state.json` contains job prompts,
|
|
35
|
+
`state.json` contains job prompts, workspace paths, model/preset selections, run metadata, and bounded final assistant text. It is atomically replaced with mode `0600`; parent directories created by the plugin use `0700`. Session transcripts are persisted by the configured Harness Session backend and may contain substantially more data.
|
|
36
36
|
|
|
37
37
|
Do not put API keys directly in prompts. Use normal Harness credential providers and environment policy.
|
|
38
38
|
|