@tangle-network/create-agent-app 0.47.3 → 0.47.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/create-agent-app",
-  "version": "0.47.3",
+  "version": "0.47.4",
   "description": "Create a tested Tangle agent application with either a tool loop or a complete chat interface.",
   "keywords": [
     "tangle",

package/template-chat/CUSTOMIZE.md

@@ -45,11 +45,12 @@ Discovery: **Where does this app live and what may it spend?**
 - [ ] `wrangler d1 create <name>` → paste `database_id` into `wrangler.toml`.
 - [ ] Copy `.dev.vars.example` → `.dev.vars`; fill `BETTER_AUTH_SECRET`,
       `TANGLE_API_KEY`, `SANDBOX_API_KEY`, `SANDBOX_GATEWAY_URL`.
-- [ ] `pnpm db:migrate:local` — applies both migrations (auth, chat, turn
-      buffer, API keys, usage, and request limits).
+- [ ] `pnpm db:migrate:local` — applies migrations for auth, chat, turn
+      buffer, API keys, usage, request limits, and spending reservations.
       The e2e test executes these same files, so they cannot drift from the schema.
 - [ ] Existing generated app: copy and apply `0002_agent_gateway.sql`.
       Never edit its already-applied `0001_init.sql`.
+- [ ] Apply `0003_gateway_reservations.sql` when adopting the gateway reservation lifecycle.
 - [ ] Existing app only: add `sandbox_prewarm_claims` in a new migration.
       Do not edit an applied `0001_init.sql`; Wrangler will not run it again.
 - [ ] R2 stays commented out unless the product stores artifacts.
@@ -64,6 +65,9 @@ Discovery: **Does a real message round-trip through a real box?**
 - [ ] Kill the tab mid-turn, reopen the thread — the persisted row is intact
       (the turn keeps running server-side and buffers for replay).
 - [ ] Create a key through the signed-in `/api/keys` route.
+      Finite-cap keys require backend enforcement of per-turn spending limits.
+      The current remote chat adapter rejects capped execution before compute.
+      Explicitly uncapped keys use the existing chat path.
 - [ ] Call `/v1/agents/<slug>/chat/completions` with that key.
       Open the returned `X-Tangle-Thread-Url` and confirm it shows the same durable conversation.
 

package/template-chat/_package.json

@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "@tangle-network/agent-app": "__AGENT_APP_VERSION__",
-    "@tangle-network/agent-gateway": "0.9.0",
+    "@tangle-network/agent-gateway": "0.10.0",
     "@tangle-network/agent-interface": "2.3.0",
     "@tangle-network/agent-runtime": "0.192.2",
     "@tangle-network/sandbox": "0.37.0",

package/template-chat/migrations/0003_gateway_reservations.sql

@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS agent_api_key_reservation (
+  request_id TEXT PRIMARY KEY,
+  key_id TEXT NOT NULL,
+  reserved_cents BIGINT NOT NULL,
+  state TEXT NOT NULL,
+  created_at BIGINT NOT NULL,
+  FOREIGN KEY (key_id) REFERENCES agent_api_key(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_agent_api_key_reservation_key
+  ON agent_api_key_reservation (key_id);

package/template-chat/src/gateway.ts

@@ -97,6 +97,7 @@ export function buildGatewayApp(
       : null,
     verifyApiKey: verifyKey,
     claimApiKeyRequest: createApiKeyRequestClaim(apiKeys),
+    apiKeyReservationLifecycle: apiKeys.reservations,
     apiKeyPrefix: 'ak_',
     conversationMode: 'thread',
     // A2A task control remains off until the shared gateway owns durable

package/template-chat/tests/chat-turn.e2e.test.ts

@@ -61,6 +61,7 @@ const MIGRATIONS = readdirSync(MIGRATIONS_DIR)
   .map((name) => join(MIGRATIONS_DIR, name))
 const BASE_MIGRATION = join(MIGRATIONS_DIR, '0001_init.sql')
 const GATEWAY_MIGRATION = join(MIGRATIONS_DIR, '0002_agent_gateway.sql')
+const RESERVATION_MIGRATION = join(MIGRATIONS_DIR, '0003_gateway_reservations.sql')
 
 /** The real migration, executed against a real SQLite database. Every query
  *  the test makes afterwards runs over THESE tables — schema drift between
@@ -412,7 +413,8 @@ describe('e2e: fake sandbox producer → streamed turn → persisted transcript'
   })
 
   it('the migration carries every agent-gateway SQL store statement', () => {
-    const migration = readFileSync(GATEWAY_MIGRATION, 'utf8')
+    const migration = [GATEWAY_MIGRATION, RESERVATION_MIGRATION]
+      .map((path) => readFileSync(path, 'utf8')).join('\n')
     const normalize = (sql: string) => sql.replace(/\s+/g, ' ').replace(/;$/, '').trim()
     const statements = [
       ...sqlApiKeyStoreSchemaStatements(),
@@ -440,6 +442,30 @@ describe('e2e: fake sandbox producer → streamed turn → persisted transcript'
     ])
   })
 
+  it('rejects capped remote execution before starting a chat turn', async () => {
+    let starts = 0
+    const { workerFetch, sql, cookie } = await createHarness(() => {
+      starts += 1
+      return createSandboxChatProducer({ events: feed(RAW_TURN_EVENTS), model: MODEL })
+    })
+    const keyResponse = await workerFetch(post('/api/keys', cookie, {
+      name: 'bounded caller', spendingLimitCents: 100_000,
+    }))
+    expect(keyResponse.status).toBe(201)
+    const { key } = (await keyResponse.json()) as { key: string }
+    const response = await workerFetch(new Request(`${BASE}/v1/agents/${appSlug}/chat/completions`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ messages: [{ role: 'user', content: 'Read my lease' }], stream: true }),
+    }))
+    expect(response.status, await response.clone().text()).toBe(200)
+    expect(await response.text()).toContain('api_key.execution_budget_unsupported')
+    expect(starts).toBe(0)
+    expect(await sql.query('SELECT state FROM agent_api_key_reservation'))
+      .toEqual([{ state: 'released' }])
+    expect(await sql.query('SELECT cost_cents FROM agent_api_key_usage')).toEqual([])
+  })
+
   it('shares one owned thread across OpenAI-compatible API calls', async () => {
     const { app, workerFetch, sql, cookie, gatewayBuilds, settle } = await createHarness()
     const cardResponse = await workerFetch(new Request(