@tangle-network/sandbox-cli 0.22.102 → 0.22.104

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +198 -3
  2. package/SKILL.md +29 -0
  3. package/dist/graph-native-Cl6SphYB.mjs +1 -0
  4. package/dist/index.mjs +34 -36
  5. package/hub-reference.md +10 -1
  6. package/package.json +12 -9
  7. package/dist/graph-native-af-gs1TS.mjs +0 -1
package/hub-reference.md CHANGED
@@ -69,7 +69,7 @@ human reference instead:
69
69
  for that provider.
70
70
  - `<provider>:<account>`, for example `gmail:alice@example.com`, disambiguates when
71
71
  you hold several connections for one provider (matches `accountDisplay` or
72
- `displayName`).
72
+ `displayName` or the provider's stable `providerAccountId`).
73
73
 
74
74
  A reference resolves against `tangle hub connections`; revoked connections are
75
75
  skipped. If it matches no connection, or more than one, the CLI fails loud and
@@ -80,10 +80,19 @@ use an id when a provider is ambiguous there.
80
80
 
81
81
  ### OAuth Connect
82
82
 
83
+ Discover connectable providers with `tangle hub providers [provider] --json`.
84
+ `tangle hub events [provider] --json` reads the deployment's actual trigger vocabulary and ingress readiness. A callable tool does not imply an event source; absent catalogs and unknown ingress stay explicit. Read current CRM and Google Drive event support there rather than assuming every provider can trigger graphs.
85
+
83
86
  ```bash
84
87
  tangle hub connect github --json
85
88
  ```
86
89
 
90
+ Repeat `--scope <scope>` to request a narrower OAuth grant within the host's allowed scopes. For API-key providers, use `tangle hub connect <provider> --key-env <variable>` with the key in that environment variable. Optional `--metadata <json>` carries the provider's setup fields. The key is sent to Hub's credential vault and never printed.
91
+
92
+ Graph nodes may use `needs: [{ provider: gmail, account: research, capabilities: [gmail.list_messages], alias: mail }]`. The account matches the provider's stable account ID or its displayed account name. Both local and cloud runs bind it to the current owner's connection; a bare provider is refused when ambiguous. A string need such as `needs: [gmail]` retains all tools of its host binding.
93
+
94
+ Custom MCP remains the canonical `profile.mcp` declaration. `graph run --mcp-policy <file>` admits it with a separate host-owned JSON policy such as `{"allowLocalMcp":true,"allowedMcpHosts":["tools.example.test"]}`. The defaults deny stdio and remote MCP; hooks remain refused. The policy is retained with a local run or cloud deployment revision and cannot change on resume. Executables and scripts must exist in the run's workspace or selected sandbox environment. Hub connections provide credential-backed tools. The local Bridge refuses custom MCP secret references until its private secret resolver is wired; never put tokens in graph source.
95
+
87
96
  ```json
88
97
  {
89
98
  "provider": "github",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tangle-network/sandbox-cli",
3
- "version": "0.22.102",
3
+ "version": "0.22.104",
4
4
  "description": "CLI for Tangle Sandbox operations",
5
5
  "type": "module",
6
6
  "engines": {
@@ -23,13 +23,13 @@
23
23
  "@tangle-network/agent-eval": "1.0.29",
24
24
  "@tangle-network/agent-interface": "^5.10.23",
25
25
  "@tangle-network/agent-provider-cli-bridge": "2.0.12",
26
- "@tangle-network/agent-runtime": "^9.0.3",
26
+ "@tangle-network/agent-runtime": "^9.0.10",
27
27
  "@tangle-network/harness-sessions": "^1.0.2",
28
- "@tangle-network/hub-sdk": "1.0.29",
29
- "@tangle-network/sandbox": "^1.0.387",
28
+ "@tangle-network/hub-sdk": "1.0.30",
29
+ "@tangle-network/sandbox": "^1.0.390",
30
30
  "@tangle-network/sdk-cli-runner": "^0.3.12",
31
31
  "chalk": "^5.6.2",
32
- "cli-bridge": "https://github.com/drewstone/cli-bridge/archive/6c215f6912dc65ab6145d4102fee744d7fd09b79.tar.gz",
32
+ "cli-bridge": "https://codeload.github.com/drewstone/cli-bridge/tar.gz/3f8b6f8777d04509641109f8b16ae450621f844b",
33
33
  "commander": "12.1.0",
34
34
  "dotenv": "17.2.3",
35
35
  "ora": "^9.4.1",
@@ -37,7 +37,8 @@
37
37
  "viem": "^2.57.10",
38
38
  "ws": "^8.22.0",
39
39
  "yaml": "^2.9.1",
40
- "zod": "4.6.7"
40
+ "zod": "4.6.7",
41
+ "@tangle-network/agent-knowledge": "23.0.2"
41
42
  },
42
43
  "devDependencies": {
43
44
  "@drewstone/agent-record": "https://github.com/drewstone/agent-record/releases/download/v1.0.10/drewstone-agent-record-1.0.10.tgz",
@@ -60,7 +61,9 @@
60
61
  "typescript": "^6.0.3",
61
62
  "vitest": "^4.1.12",
62
63
  "@repo/shared": "0.0.0",
63
- "@tangle-network/runtime-contracts": "0.20.0"
64
+ "@tangle-network/runtime-contracts": "0.20.0",
65
+ "@repo/knowledge-host": "0.0.0",
66
+ "@tangle-network/sdk-session-persistence": "0.7.0"
64
67
  },
65
68
  "publishConfig": {
66
69
  "access": "public",
@@ -84,8 +87,8 @@
84
87
  "author": "Tangle Network",
85
88
  "license": "MIT",
86
89
  "tangleRelease": {
87
- "sourceSha": "56ae015666ae718e5f0bce91fd311c921a669dda",
88
- "mergedAt": "2026-11-11T13:54:49-08:00"
90
+ "sourceSha": "86d1de4cbf9f518a6b6029280b87eddb6346ba57",
91
+ "mergedAt": "2026-11-12T14:00:09-08:00"
89
92
  },
90
93
  "scripts": {
91
94
  "build": "tsdown",
package/dist/graph-native-af-gs1TS.mjs DELETED
@@ -1 +0,0 @@
1
- import{constants as e}from"node:fs";import{isAbsolute as t,join as n,relative as r}from"node:path";import{z as i}from"zod";import{open as a,opendir as o,realpath as s}from"node:fs/promises";import*as c from"@tangle-network/agent-runtime/kernel";import{CODEX_HOME_RULE as l,codexRefForFile as u,readSessionInput as d,storeGlob as f,withinPath as p}from"@tangle-network/harness-sessions";const m=i.object({harness:i.literal(`codex`),root:i.string().refine(t),basis:i.literal(`host-jail`),nativeSessionId:i.string().min(1),runId:i.string().min(1),requestDigest:i.string().regex(/^sha256:[a-f0-9]{64}$/)}),h=i.object({externalId:i.string(),internalId:i.string(),backend:i.literal(`codex`),cwd:i.string(),metadata:i.object({effective_native_store:m,agent_profile_binding:i.object({effectiveProfileDigest:i.string()})})});async function g(e,t){let i=[],a=l.sessionDirs.map(t=>n(e,t)),d=f(l.rollout),m=0;for(;a.length;){t.throwIfAborted();let l=a.shift();if(l===void 0)break;let f;try{f=await s(l)}catch(e){if(e.code===`ENOENT`)continue;throw e}if(!p(f,e))throw Error(`Native inventory escaped its attested store`);let h=await o(f);for await(let o of h){if(t.throwIfAborted(),++m>c.HARNESS_TRANSCRIPT_READ_LIMITS.maxFiles)throw Error(`Native inventory exceeds the capture bound`);let s=n(h.path,o.name);o.isDirectory()?a.push(s):o.isFile()&&d.test(o.name)&&i.push({path:r(e,s),nativeSessionId:u(s).nativeSessionId})}}return i}function _(t){return async r=>{if(r.harness!==`codex`)return{status:`unavailable`,reason:`unknown-harness`,skipped:[{path:r.harness,reason:`Native transcript capture is not configured for this harness`}]};let o=await fetch(`${t.bridgeUrl}/v1/sessions?session_id=${encodeURIComponent(r.sessionId)}&backend=${r.harness}`,{headers:{authorization:`Bearer ${t.bridgeBearer}`},signal:r.signal});if(!o.ok)throw Error(`Bridge session lookup failed (HTTP ${o.status})`);let l=i.object({data:i.tuple([h])}).parse(await o.json()).data[0],u=l.metadata.effective_native_store,f=await s(u.root);if(l.externalId!==r.sessionId||l.internalId!==u.nativeSessionId||l.cwd!==t.cwd||r.cwd!==t.cwd||l.metadata.agent_profile_binding.effectiveProfileDigest!==r.profileDigest||f!==u.root||!p(f,n(t.cwd,`.agent-home`))||!r.runs.some(e=>e.runId===u.runId&&e.requestDigest===u.requestDigest))throw Error(`Bridge native binding does not match this execution`);return c.captureBoundHarnessTranscript({harness:r.harness,binding:{kind:`bridge`,sessionId:r.sessionId,nativeSessionId:u.nativeSessionId,profileDigest:r.profileDigest,runs:r.runs,...r.node===void 0?{}:{node:r.node}},nativeSessionId:u.nativeSessionId,files:await g(f,r.signal),signal:r.signal,parse:(e,t)=>d(r.harness,{text:e},{nativeSessionId:t.nativeSessionId,label:t.path},{corruption:`strict`}),read:async(t,r)=>{let i=await s(n(f,t.path));if(!p(i,f))throw Error(`Native session escaped its attested store`);let o=await a(i,e.O_RDONLY|e.O_NOFOLLOW);try{let e=await o.stat();if(!e.isFile()||e.size>c.HARNESS_TRANSCRIPT_READ_LIMITS.maxFileBytes)throw Error(`Native session is not a bounded regular file`);r?.throwIfAborted();let t=await o.readFile();return r?.throwIfAborted(),t}finally{await o.close()}}})}}const v=async(e,t)=>{if(e.harness!==`codex`||e.binding?.kind!==`bridge`)throw Error(`Native transcript reader is not configured for this capture`);return(await c.readBoundHarnessSessions({nativeSessionId:e.binding.nativeSessionId,files:e.files.map(e=>({path:e.path,nativeSessionId:u(e.path).nativeSessionId,byteLength:e.bytes})),read:async t=>{let n=e.files.find(e=>e.path===t.path);if(!n)throw Error(`Retained native file is absent`);return Buffer.from(n.content,`utf8`)},parse:(e,t)=>d(`codex`,{text:e},{nativeSessionId:t.nativeSessionId,label:t.path},{corruption:`strict`}),signal:t})).sessions};export{_ as graphNativeCapture,v as readGraphSessions};