@tangle-network/cli-agent-registry 0.0.0-stage → 0.14.0

package/dist/cli-backend-auth-env.d.mts

@@ -0,0 +1,6 @@
+//#region src/cli-backend-auth-env.d.ts
+/** The narrow credential leg shared by the host and sidecar rebind boundary. */
+declare function assertCliBackendAuthEnv(backendType: string | undefined, authEnv: Readonly<Record<string, string>>): void;
+//#endregion
+export { assertCliBackendAuthEnv };
+//# sourceMappingURL=cli-backend-auth-env.d.mts.map

package/dist/cli-backend-auth-env.mjs

@@ -0,0 +1,44 @@
+import { l as getSpec } from "./specs-Bbiay_8K.mjs";
+import { CLI_AUTH_REFERENCE_ENV_VAR, cliAuthFilesSchema, cliAuthReferenceSchema, resolveCliAuthReference } from "./cli-auth-bundle.mjs";
+import { n as isSafeEnvVarName, t as isForbiddenEnvVarName } from "./harness-DIdVNSwl.mjs";
+//#region src/cli-backend-auth-env.ts
+/** The narrow credential leg shared by the host and sidecar rebind boundary. */
+function assertCliBackendAuthEnv(backendType, authEnv) {
+	if (Object.keys(authEnv).length === 0) return;
+	const spec = backendType ? getSpec(backendType) : void 0;
+	if (!spec) throw new Error("Credential delivery requires a registered backend");
+	const allowed = new Set([
+		spec.envVars.apiKey,
+		spec.envVars.oauthToken,
+		spec.envVars.authFiles
+	].filter((name) => name !== void 0));
+	const rawReference = authEnv[CLI_AUTH_REFERENCE_ENV_VAR];
+	if (rawReference !== void 0) {
+		let parsed;
+		try {
+			parsed = JSON.parse(rawReference);
+		} catch {
+			throw new Error("Invalid native credential reference");
+		}
+		const result = cliAuthReferenceSchema.safeParse(parsed);
+		if (!result.success || !isSafeEnvVarName(result.data.secretEnv) || isForbiddenEnvVarName(result.data.secretEnv)) throw new Error("Invalid native credential reference");
+		allowed.add(CLI_AUTH_REFERENCE_ENV_VAR);
+		allowed.add(result.data.secretEnv);
+		resolveCliAuthReference(spec.name, { cliAuth: result.data }, authEnv);
+	}
+	for (const [name, value] of Object.entries(authEnv)) if (!allowed.has(name) || value.includes("\0")) throw new Error("Invalid backend credential environment");
+	const files = spec.envVars.authFiles && authEnv[spec.envVars.authFiles];
+	if (files !== void 0 && files !== "") {
+		let parsed;
+		try {
+			parsed = JSON.parse(files);
+		} catch {
+			throw new Error("Invalid backend auth files");
+		}
+		if (!(Array.isArray(parsed) && parsed.length === 0) && !cliAuthFilesSchema.safeParse(parsed).success) throw new Error("Invalid backend auth files");
+	}
+}
+//#endregion
+export { assertCliBackendAuthEnv };
+
+//# sourceMappingURL=cli-backend-auth-env.mjs.map

package/dist/default-backend.d.mts

@@ -0,0 +1,24 @@
+import { r as BackendType } from "./backend-types-CJH-wHS3.mjs";
+//#region src/default-backend.d.ts
+/**
+ * Platform-wide default agent backend, read from `DEFAULT_AGENT_BACKEND`.
+ *
+ * Every "no backend type was supplied" path resolves
+ * through — request bodies, container labels, session records, env-driven
+ * boot. Deployment config (env files, Dockerfile ENV, test setup) names the
+ * default exactly once; code never carries a vendor literal.
+ *
+ * Fail-closed: throws when the variable is unset or names an unregistered
+ * backend. A silent literal here would weld one vendor backend into the
+ * platform and mask misconfigured deployments.
+ *
+ * Published as its own `./default-backend` entry: it pulls only `./specs.js`
+ * (data-only), so Cloudflare Worker / edge bundles can consume it without the
+ * Node-only barrel (adapter bindings, local CLI auth). Workers have no
+ * `process.env` — they MUST pass their bindings record explicitly; the
+ * `process.env` default only fires when the argument is omitted.
+ */
+declare function resolveDefaultBackend(env?: Record<string, string | undefined>): BackendType;
+//#endregion
+export { resolveDefaultBackend };
+//# sourceMappingURL=default-backend.d.mts.map

package/dist/default-backend.mjs

@@ -0,0 +1,31 @@
+import { i as isBackendType, t as ALL_BACKEND_TYPES } from "./backend-types-CREj4iOY.mjs";
+import "./specs-Bbiay_8K.mjs";
+//#region src/default-backend.ts
+/**
+* Platform-wide default agent backend, read from `DEFAULT_AGENT_BACKEND`.
+*
+* Every "no backend type was supplied" path resolves
+* through — request bodies, container labels, session records, env-driven
+* boot. Deployment config (env files, Dockerfile ENV, test setup) names the
+* default exactly once; code never carries a vendor literal.
+*
+* Fail-closed: throws when the variable is unset or names an unregistered
+* backend. A silent literal here would weld one vendor backend into the
+* platform and mask misconfigured deployments.
+*
+* Published as its own `./default-backend` entry: it pulls only `./specs.js`
+* (data-only), so Cloudflare Worker / edge bundles can consume it without the
+* Node-only barrel (adapter bindings, local CLI auth). Workers have no
+* `process.env` — they MUST pass their bindings record explicitly; the
+* `process.env` default only fires when the argument is omitted.
+*/
+function resolveDefaultBackend(env = process.env) {
+	const raw = env.DEFAULT_AGENT_BACKEND;
+	if (raw === void 0 || raw === "") throw new Error(`DEFAULT_AGENT_BACKEND is not set. A backend type was omitted and no platform default is configured. Set DEFAULT_AGENT_BACKEND to one of: ${ALL_BACKEND_TYPES.join(", ")}`);
+	if (!isBackendType(raw)) throw new Error(`DEFAULT_AGENT_BACKEND="${raw}" is not a registered backend. Registered backends: ${ALL_BACKEND_TYPES.join(", ")}`);
+	return raw;
+}
+//#endregion
+export { resolveDefaultBackend };
+
+//# sourceMappingURL=default-backend.mjs.map

package/dist/harness-DIdVNSwl.mjs

@@ -0,0 +1,167 @@
+import { o as HARNESS_WARM_TRANSPORT_ENV } from "./native-session-contracts-DWFzgoye.mjs";
+import "./backend-types-CREj4iOY.mjs";
+import { z } from "zod";
+/**
+* Strip the per-sandbox salt, returning the shared base token. The reverse
+* lookup (token -> secret env var name) keys on the base, so a salted token must
+* be reduced here before lookup. An unsalted token (no separator) is returned
+* as-is.
+*/
+function baseProxyToken(token) {
+	const i = token.indexOf(".");
+	return i === -1 ? token : token.slice(0, i);
+}
+/**
+* The dummy model credential the egress proxy swaps for each env var a box
+* may carry. A box holds only these, salted per sandbox; the real keys stay
+* with the egress proxy. Host-side proxy configuration adds the non-model
+* tokens.
+*/
+const MODEL_PROXY_TOKENS = {
+	OPENCODE_MODEL_API_KEY: "proxy-model-token",
+	OPENAI_API_KEY: "proxy-openai-token",
+	ANTHROPIC_API_KEY: "proxy-anthropic-token",
+	OPENROUTER_API_KEY: "proxy-openrouter-token",
+	TANGLE_INFERENCE_KEY: "proxy-openai-token",
+	ZAI_API_KEY: "proxy-zai-token",
+	ZHIPU_API_KEY: "proxy-zai-token"
+};
+new Set(Object.values(MODEL_PROXY_TOKENS));
+new Set([
+	...Object.keys(MODEL_PROXY_TOKENS),
+	"TANGLE_API_KEY",
+	"GITHUB_TOKEN",
+	"GH_TOKEN"
+]);
+/**
+* Fixed proxy slot names. The egress layer keys every secret it holds by an
+* env-var-shaped name, and its persistence and recovery paths list those
+* names; a declaration takes the slot at its index, so a sandbox with
+* declarations needs no name the layer has not already listed.
+*/
+function declaredSecretSlotEnvVar(index) {
+	return `TANGLE_DECLARED_SLOT_${index}`;
+}
+/** The base placeholder for the slot at `index`; the box holds it salted. */
+function declaredSecretBaseToken(index) {
+	return `proxy-declared-${index}-token`;
+}
+/** Every slot name mapped to its base placeholder. */
+function declaredSecretSlotTokens() {
+	const slots = {};
+	for (let index = 0; index < 16; index++) slots[declaredSecretSlotEnvVar(index)] = declaredSecretBaseToken(index);
+	return slots;
+}
+//#endregion
+//#region ../runtime-contracts/dist/runtime-environment.js
+const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isSafeEnvVarName(name) {
+	if (typeof name !== "string") return false;
+	if (name.length === 0 || name.length > 256) return false;
+	return SAFE_ENV_VAR_NAME_RE.test(name);
+}
+const FORBIDDEN_ENV_VAR_NAMES = new Set([
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"DYLD_INSERT_LIBRARIES",
+	"DYLD_LIBRARY_PATH",
+	"DYLD_FALLBACK_LIBRARY_PATH",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"PATH",
+	"NIX_BIN_PATH",
+	"EGRESS_EDGE_POOL_ENABLED",
+	"EDGE_BIND_ID",
+	"PRIVACY_EGRESS",
+	"LOG_REDACT",
+	"IFS",
+	"BASH_ENV",
+	"ENV",
+	"SHELL",
+	"SHELLOPTS",
+	"PROMPT_COMMAND",
+	"HOME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_STATE_HOME",
+	"XDG_RUNTIME_DIR",
+	"HTTPS_PROXY",
+	"HTTP_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"https_proxy",
+	"http_proxy",
+	"all_proxy",
+	"no_proxy",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"HOSTNAME",
+	"CONTAINER_ID",
+	"AGENT_WORKSPACE_ROOT",
+	"WORKSPACE_PATH",
+	"STORAGE_PATH",
+	"WORKSPACE_FILE_API_ROOT_ONLY",
+	"WORKSPACE_ALLOWED_ABSOLUTE_PATHS",
+	"TANGLE_PLAN_CALLBACK_ALLOWED_ORIGINS"
+]);
+const FORBIDDEN_ENV_VAR_PREFIXES = [
+	"SIDECAR_",
+	"ORCHESTRATOR_",
+	"AGENT_INTERNAL_",
+	"SANDBOX_DEV_",
+	"AGENT_SUBPROCESS_",
+	"TEE_ATTESTATION_"
+];
+const RUNTIME_CALLER_ALLOWED_ENV_NAMES = new Set(["SIDECAR_CAPABILITIES", "SIDECAR_PLATFORM_CONTROL_RUNTIME"]);
+new Set(Object.values(HARNESS_WARM_TRANSPORT_ENV).flatMap(({ warmServer, prewarm }) => [warmServer, prewarm]));
+function isForbiddenEnvVarName(name) {
+	if (RUNTIME_CALLER_ALLOWED_ENV_NAMES.has(name)) return false;
+	if (FORBIDDEN_ENV_VAR_NAMES.has(name)) return true;
+	for (const prefix of FORBIDDEN_ENV_VAR_PREFIXES) if (name.startsWith(prefix)) return true;
+	return false;
+}
+/**
+* Env record schema that enforces POSIX env-var name shape (via
+* {@link isSafeEnvVarName}) on every key. Suitable for env that flows
+* into a container the caller owns (user code), where names like
+* `PATH`, `NODE_OPTIONS`, `LD_PRELOAD`, or `HTTPS_PROXY` are legitimate
+* because the user controls the resulting process environment.
+*
+* Callers that merge env into the runtime's OWN process.env (sidecar
+* `/config/env`, orchestrator `/sidecars/start`, project provisioning)
+* MUST additionally reject the process-control blocklist via
+* {@link isForbiddenEnvVarName} — see
+* `apps/orchestrator/src/routes/sidecars.ts` and
+* `apps/sidecar/src/routes/agents-config.ts` for the canonical shape.
+*/
+const safeEnvRecordSchema = z.record(z.string(), z.string()).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
+/** Names only: the caller must keep a separate source and pass values to resume({ env }). */
+const sandboxEnvRecoverySchema = z.object({ callerResupplies: z.array(z.string().max(256).refine(isSafeEnvVarName, { message: "invalid env var name" })).max(128).refine((keys) => new Set(keys).size === keys.length, { message: "callerResupplies must contain unique keys" }) }).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	dryRun: z.boolean().optional()
+}).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	eligibleCallerResupplyKeys: z.array(z.string()),
+	requiredOnColdResumeKeys: z.array(z.string()),
+	automaticCredentialRecovery: z.literal(false),
+	dryRun: z.boolean()
+}).strict();
+safeEnvRecordSchema.refine((value) => Object.keys(value).every((key) => !isForbiddenEnvVarName(key) && !key.startsWith("SIDECAR_")), { message: "runtime-owned env var name cannot be set by callers" });
+//#endregion
+export { baseProxyToken as i, isSafeEnvVarName as n, declaredSecretSlotTokens as r, isForbiddenEnvVarName as t };
+
+//# sourceMappingURL=harness-DIdVNSwl.mjs.map