@tangle-network/cli-agent-registry 0.0.0-stage → 0.15.0

package/dist/specs.d.mts

@@ -0,0 +1,72 @@
+import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-DRmLR1e0.mjs";
+import { _ as harnessModelSupportFor, h as cliAgentClaimEnvVarNames, l as CliAgentSpec, m as canonicalModelSlug, s as CliAgentModelWire, v as harnessModelWire } from "./spec-CcvTM7-j.mjs";
+import { agentProfileSchema } from "@tangle-network/agent-interface";
+
+//#region src/specs.d.ts
+/**
+ * Env var naming a sandbox's selected backend. Stamped into every create env
+ * by the orchestrator (`buildSidecarContainerConfig`); read by the sidecar's
+ * backend resolution (`resolveConfiguredBackend`) and by the host-agent's
+ * warm-claim env selection to pick which spec's env vars the rebind delivers.
+ */
+declare const AGENT_BACKEND_ENV_VAR = "AGENT_BACKEND";
+/** Salted proxy model key. The name OPENCODE_MODEL_API_KEY is load-bearing; do not rename it. */
+declare const MANAGED_MODEL_KEY_ENV_VAR = "OPENCODE_MODEL_API_KEY";
+/** Name of the box env var holding a caller-owned provider key. A name, never a secret. */
+declare const MANAGED_MODEL_KEY_NAME_ENV_VAR = "OPENCODE_MODEL_API_KEY_ENV";
+/**
+ * Env var names declared across ALL registered harness specs, grouped by
+ * their `CliAgentEnvVars` role. The ONE derivation every allowlist that must
+ * track "what env names can a backend legitimately use" builds from — the
+ * FC kernel-cmdline whitelist, the egress secret handling, the sidecar
+ * terminal scrub, the SSH env forward, and the rebind union below. Deriving
+ * from roles (not one flat set) lets each consumer apply its own security
+ * policy per role: apiKey and oauthToken names are secret channels.
+ * Native subscription tokens stay out of warm-claim delivery.
+ */
+declare function cliAgentEnvVarNamesByRole(): {
+  apiKey: ReadonlySet<string>;
+  oauthToken: ReadonlySet<string>;
+  model: ReadonlySet<string>;
+  baseUrl: ReadonlySet<string>;
+  authMode: ReadonlySet<string>;
+  authFiles: ReadonlySet<string>;
+  extras: ReadonlySet<string>;
+};
+/**
+ * Union of every spec's `hostPassthroughEnvVars` — the operator tuning names
+ * a host process (orchestrator system env, host-agent process env) may
+ * forward into containers. Request/caller env always keeps precedence at the
+ * host-agent boundary; the orchestrator system-env channel stays
+ * operator-authoritative. Replaces the old `OPENCODE_*` prefix forward,
+ * which leaked ANY stray host var with that prefix (model tuple and key
+ * included) into every tenant.
+ */
+declare function cliAgentHostPassthroughEnvVarNames(): ReadonlySet<string>;
+/**
+ * Union of every env var name a warm-claim rebind may deliver, across all
+ * registered harnesses. The ONE source both sides of the rebind derive from:
+ * the host-agent selects its delivery from it and the sidecar rebind route
+ * carves it out of the loader-control rejection, so the two can never drift
+ * into "host delivers a name the sidecar 400s" — which silently cold-paths
+ * every warm claim of that backend. Includes each spec's apiKey name because
+ * acceptance is a superset of delivery: the HOST decides which key names are
+ * safe to send (egress proxy-swap-covered only), while the sidecar must not
+ * reject a name a valid host may deliver.
+ */
+declare function claimDeliverableEnvVarNames(): ReadonlySet<string>;
+/**
+ * claude-code is the only provider that demotes uid + forces HOME=/home/agent
+ * when the sidecar runs as root. All other CLIs inherit the sidecar HOME.
+ */
+declare const CLI_AGENT_SPECS: readonly CliAgentSpec[];
+declare function getSpec(name: string): CliAgentSpec | undefined;
+/**
+ * The directory, relative to a session's storage path, where a backend's
+ * message log lives: the one value adapters, the sidecar and the parked
+ * export read. Throws for a backend whose spec names none.
+ */
+declare function messageStorageDirOf(name: string): string;
+//#endregion
+export { AGENT_BACKEND_ENV_VAR, ALL_BACKEND_TYPES, BACKEND_TYPE, type BackendType, CLI_AGENT_SPECS, type CliAgentModelWire, type CliAgentSpec, MANAGED_MODEL_KEY_ENV_VAR, MANAGED_MODEL_KEY_NAME_ENV_VAR, agentProfileSchema, backendTypeSchema, canonicalModelSlug, claimDeliverableEnvVarNames, cliAgentClaimEnvVarNames, cliAgentEnvVarNamesByRole, cliAgentHostPassthroughEnvVarNames, getSpec, harnessModelSupportFor, harnessModelWire, isBackendType, messageStorageDirOf, parseBackendType };
+//# sourceMappingURL=specs.d.mts.map

package/dist/specs.mjs

@@ -0,0 +1,3 @@
+import { a as parseBackendType, i as isBackendType, n as BACKEND_TYPE, r as backendTypeSchema, t as ALL_BACKEND_TYPES } from "./backend-types-CNo_Zj_K.mjs";
+import { a as agentProfileSchema, c as cliAgentHostPassthroughEnvVarNames, d as canonicalModelSlug, f as cliAgentClaimEnvVarNames, h as harnessModelWire, i as MANAGED_MODEL_KEY_NAME_ENV_VAR, l as getSpec, m as harnessModelSupportFor, n as CLI_AGENT_SPECS, o as claimDeliverableEnvVarNames, r as MANAGED_MODEL_KEY_ENV_VAR, s as cliAgentEnvVarNamesByRole, t as AGENT_BACKEND_ENV_VAR, u as messageStorageDirOf } from "./specs-BBF55TnM.mjs";
+export { AGENT_BACKEND_ENV_VAR, ALL_BACKEND_TYPES, BACKEND_TYPE, CLI_AGENT_SPECS, MANAGED_MODEL_KEY_ENV_VAR, MANAGED_MODEL_KEY_NAME_ENV_VAR, agentProfileSchema, backendTypeSchema, canonicalModelSlug, claimDeliverableEnvVarNames, cliAgentClaimEnvVarNames, cliAgentEnvVarNamesByRole, cliAgentHostPassthroughEnvVarNames, getSpec, harnessModelSupportFor, harnessModelWire, isBackendType, messageStorageDirOf, parseBackendType };

package/package.json

@@ -1,6 +1,90 @@
 {
   "name": "@tangle-network/cli-agent-registry",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.15.0",
+  "type": "module",
+  "exports": {
+    "./cli-backend-auth-env": {
+      "types": "./dist/cli-backend-auth-env.d.mts",
+      "import": "./dist/cli-backend-auth-env.mjs"
+    },
+    "./cli-auth-bundle": {
+      "types": "./dist/cli-auth-bundle.d.mts",
+      "import": "./dist/cli-auth-bundle.mjs"
+    },
+    ".": {
+      "import": "./dist/index.mjs",
+      "types": "./dist/index.d.mts"
+    },
+    "./specs": {
+      "import": "./dist/specs.mjs",
+      "types": "./dist/specs.d.mts"
+    },
+    "./servable-models": {
+      "import": "./dist/servable-models.mjs",
+      "types": "./dist/servable-models.d.mts"
+    },
+    "./backend-types": {
+      "import": "./dist/backend-types.mjs",
+      "types": "./dist/backend-types.d.mts"
+    },
+    "./default-backend": {
+      "import": "./dist/default-backend.mjs",
+      "types": "./dist/default-backend.d.mts"
+    },
+    "./local-cli-auth": {
+      "import": "./dist/local-cli-auth.mjs",
+      "types": "./dist/local-cli-auth.d.mts"
+    },
+    "./session-contract": {
+      "import": "./dist/session-contract.mjs",
+      "types": "./dist/session-contract.d.mts"
+    },
+    "./native-session-contracts": {
+      "import": "./dist/native-session-contracts.mjs",
+      "types": "./dist/native-session-contracts.d.mts"
+    },
+    "./cli-auth-placeholder": {
+      "types": "./dist/cli-auth-placeholder.d.mts",
+      "import": "./dist/cli-auth-placeholder.mjs"
+    },
+    "./host-contracts": {
+      "types": "./dist/host-contracts.d.mts",
+      "import": "./dist/host-contracts.mjs"
+    },
+    "./host-contracts.json": "./dist/host-contracts.json"
+  },
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "dependencies": {
+    "@tangle-network/agent-interface": "^5.10.13",
+    "zod": "4.6.6"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.9",
+    "tsdown": "^0.21.10",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.12",
+    "@tangle-network/runtime-contracts": "0.20.0",
+    "@repo/airgap-guard": "0.0.0"
+  },
+  "tangleRelease": {
+    "sourceSha": "4f0c9345ec23e3dd680cc869ca18da47afd0af48",
+    "mergedAt": "2026-11-02T07:39:16-08:00"
+  },
+  "scripts": {
+    "build": "tsdown && node scripts/export-host-contracts.mjs --write",
+    "dev": "tsdown --watch",
+    "check-types": "node ../../scripts/tsc-native.mjs --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "export:host-contracts": "node scripts/export-host-contracts.mjs --write"
+  }
 }