@themoltnet/pi-runtime 0.11.0 → 0.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +126 -21
- package/dist/index.js +1247 -794
- package/package.json +8 -8
package/dist/index.js
CHANGED
|
@@ -1,23 +1,239 @@
|
|
|
1
|
+
import { createHash } from "node:crypto";
|
|
2
|
+
import * as ed from "@noble/ed25519";
|
|
3
|
+
import { createHash as createHash$1 } from "crypto";
|
|
4
|
+
import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, buildTaskUserPrompt, createHostCapabilityRouter, defineHostCapability, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
|
|
5
|
+
import { Type } from "typebox";
|
|
1
6
|
import { execFileSync } from "node:child_process";
|
|
2
|
-
import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync,
|
|
7
|
+
import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
|
|
3
8
|
import { mkdir, realpath, stat } from "node:fs/promises";
|
|
4
9
|
import path, { isAbsolute, join, relative, resolve, sep } from "node:path";
|
|
5
10
|
import { pipeline } from "node:stream/promises";
|
|
6
|
-
import { Type } from "@earendil-works/pi-ai";
|
|
11
|
+
import { Type as Type$1 } from "@earendil-works/pi-ai";
|
|
7
12
|
import { AuthStorage, DEFAULT_MAX_BYTES, DefaultResourceLoader, ModelRegistry, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, formatSize, parseFrontmatter, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
|
|
8
|
-
import {
|
|
9
|
-
import {
|
|
13
|
+
import { sha256 } from "@noble/hashes/sha2";
|
|
14
|
+
import { base32 } from "multiformats/bases/base32";
|
|
10
15
|
import { CID } from "multiformats/cid";
|
|
16
|
+
import * as raw from "multiformats/codecs/raw";
|
|
17
|
+
import { create } from "multiformats/hashes/digest";
|
|
18
|
+
import { BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_TASK_CONTEXT_MOUNT, GuestEnvironmentBoundaryError, activateAgentEnv, activateAgentEnv as activateAgentEnv$1, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, ensureSnapshot, ensureSnapshot as ensureSnapshot$1, execManagedCommand, findMainWorktree, findMainWorktree as findMainWorktree$1, isResolvedPathInsideRoot, isResolvedPathInsideRoot as isResolvedPathInsideRoot$1, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resumeVm as resumeVm$1 } from "@themoltnet/sandbox-gondolin";
|
|
19
|
+
import { SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
|
|
11
20
|
import * as json from "multiformats/codecs/json";
|
|
12
|
-
import { sha256 } from "multiformats/hashes/sha2";
|
|
13
|
-
import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, buildTaskUserPrompt, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
|
|
21
|
+
import { sha256 as sha256$1 } from "multiformats/hashes/sha2";
|
|
14
22
|
import { connect } from "@themoltnet/sdk/node";
|
|
15
23
|
import { ShellCommandAnalyzer } from "@themoltnet/shell-command-analyzer";
|
|
16
24
|
import { homedir } from "node:os";
|
|
17
25
|
import { VmCheckpoint } from "@earendil-works/gondolin";
|
|
18
|
-
import { Type as Type$1 } from "typebox";
|
|
19
|
-
import { createHash } from "node:crypto";
|
|
20
26
|
import { Value } from "typebox/value";
|
|
27
|
+
//#region ../crypto-service/src/ssh.ts
|
|
28
|
+
/**
|
|
29
|
+
* SSH key format conversion for MoltNet Ed25519 keys
|
|
30
|
+
*
|
|
31
|
+
* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
|
|
32
|
+
* for use with git commit signing and SSH authentication.
|
|
33
|
+
*/
|
|
34
|
+
if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
|
|
35
|
+
const hash = createHash$1("sha512");
|
|
36
|
+
m.forEach((msg) => hash.update(msg));
|
|
37
|
+
return hash.digest();
|
|
38
|
+
};
|
|
39
|
+
var SSH_ED25519_KEY_TYPE = "ssh-ed25519";
|
|
40
|
+
/**
|
|
41
|
+
* Encode a 32-bit unsigned integer in big-endian format.
|
|
42
|
+
*/
|
|
43
|
+
function encodeUInt32(n) {
|
|
44
|
+
const buf = Buffer.alloc(4);
|
|
45
|
+
buf.writeUInt32BE(n, 0);
|
|
46
|
+
return buf;
|
|
47
|
+
}
|
|
48
|
+
/**
|
|
49
|
+
* Encode a byte sequence as an SSH string (uint32 length prefix + data).
|
|
50
|
+
*/
|
|
51
|
+
function encodeSSHString(data) {
|
|
52
|
+
const buf = typeof data === "string" ? Buffer.from(data) : data;
|
|
53
|
+
return Buffer.concat([encodeUInt32(buf.length), buf]);
|
|
54
|
+
}
|
|
55
|
+
/**
|
|
56
|
+
* Convert a MoltNet public key to SSH public key format.
|
|
57
|
+
*
|
|
58
|
+
* @param moltnetPublicKey - Key in `ed25519:<base64>` format
|
|
59
|
+
* @returns SSH public key string: `ssh-ed25519 <base64>`
|
|
60
|
+
* @throws Error if the key format is invalid or the key is not 32 bytes
|
|
61
|
+
*/
|
|
62
|
+
function toSSHPublicKey(moltnetPublicKey) {
|
|
63
|
+
const match = moltnetPublicKey.match(/^ed25519:(.+)$/);
|
|
64
|
+
if (!match) throw new Error("Invalid MoltNet public key format: expected \"ed25519:<base64>\"");
|
|
65
|
+
const pubkeyBytes = Buffer.from(match[1], "base64");
|
|
66
|
+
if (pubkeyBytes.length !== 32) throw new Error(`Invalid Ed25519 public key length: expected 32 bytes, got ${pubkeyBytes.length}`);
|
|
67
|
+
return `${SSH_ED25519_KEY_TYPE} ${Buffer.concat([encodeSSHString(SSH_ED25519_KEY_TYPE), encodeSSHString(pubkeyBytes)]).toString("base64")}`;
|
|
68
|
+
}
|
|
69
|
+
//#endregion
|
|
70
|
+
//#region ../crypto-service/src/agent-signing.ts
|
|
71
|
+
/** Git `user.signingKey` literal: git signs through ssh-agent, no key file. */
|
|
72
|
+
function sshPublicKeyLiteral(publicKey) {
|
|
73
|
+
return `key::${toSSHPublicKey(publicKey)}`;
|
|
74
|
+
}
|
|
75
|
+
/** One `allowed_signers` line restricted to commit/tag signatures. */
|
|
76
|
+
function allowedSignersLine(identity) {
|
|
77
|
+
return `${identity.gitEmail} namespaces="git" ${toSSHPublicKey(identity.publicKey)}`;
|
|
78
|
+
}
|
|
79
|
+
/**
|
|
80
|
+
* A gitconfig that carries identity and verification settings only: no key
|
|
81
|
+
* paths, no credential helper, nothing a guest could exfiltrate.
|
|
82
|
+
*/
|
|
83
|
+
function nonSecretGitconfig(identity, paths) {
|
|
84
|
+
return [
|
|
85
|
+
"[user]",
|
|
86
|
+
`\tname = ${identity.gitName}`,
|
|
87
|
+
`\temail = ${identity.gitEmail}`,
|
|
88
|
+
`\tsigningKey = ${sshPublicKeyLiteral(identity.publicKey)}`,
|
|
89
|
+
"[gpg]",
|
|
90
|
+
" format = ssh",
|
|
91
|
+
"[gpg \"ssh\"]",
|
|
92
|
+
`\tallowedSignersFile = ${paths.allowedSignersFile}`,
|
|
93
|
+
"[url \"https://github.com/\"]",
|
|
94
|
+
" insteadOf = git@github.com:",
|
|
95
|
+
"[safe]",
|
|
96
|
+
`\tdirectory = ${paths.mountPath}`,
|
|
97
|
+
""
|
|
98
|
+
].join("\n");
|
|
99
|
+
}
|
|
100
|
+
//#endregion
|
|
101
|
+
//#region src/host-capabilities/agent-signing.ts
|
|
102
|
+
var GUEST_SIGNER_SOCKET = "/run/moltnet/signer.sock";
|
|
103
|
+
var GUEST_GITCONFIG_PATH = "/home/agent/.config/moltnet/gitconfig";
|
|
104
|
+
var GUEST_ALLOWED_SIGNERS_PATH = "/home/agent/.config/moltnet/allowed_signers";
|
|
105
|
+
var UUID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
|
|
106
|
+
function isSigner(value) {
|
|
107
|
+
return typeof value === "object" && value !== null && typeof value.signGitCommit === "function" && typeof value.signDiaryEntry === "function";
|
|
108
|
+
}
|
|
109
|
+
function requireSigner(ctx) {
|
|
110
|
+
const signer = ctx.injected.signer;
|
|
111
|
+
if (!isSigner(signer)) {
|
|
112
|
+
const error = /* @__PURE__ */ new Error("no signer injected into this session");
|
|
113
|
+
error.name = "SignerUnavailable";
|
|
114
|
+
throw error;
|
|
115
|
+
}
|
|
116
|
+
return signer;
|
|
117
|
+
}
|
|
118
|
+
function digestBase64(value) {
|
|
119
|
+
return `sha256:${createHash("sha256").update(Buffer.from(value, "base64")).digest("hex").slice(0, 16)}`;
|
|
120
|
+
}
|
|
121
|
+
/**
|
|
122
|
+
* Stock signing capability: the guest keeps `git commit -S` and
|
|
123
|
+
* `moltnet entry create-signed`; signatures are produced on the host through
|
|
124
|
+
* the injected `AgentSigningCapability`. The guest receives only the signer
|
|
125
|
+
* origin, an ssh-agent socket served by the CLI, and a non-secret gitconfig.
|
|
126
|
+
*/
|
|
127
|
+
var agentSigningCapability = defineHostCapability({
|
|
128
|
+
name: "agent-signing",
|
|
129
|
+
operations: {
|
|
130
|
+
"sign-git-commit": {
|
|
131
|
+
request: Type.Object({ sshsig: Type.String({
|
|
132
|
+
minLength: 1,
|
|
133
|
+
maxLength: 8192
|
|
134
|
+
}) }, { additionalProperties: false }),
|
|
135
|
+
response: Type.Object({ signature: Type.String() }),
|
|
136
|
+
maxBodyBytes: 12 * 1024,
|
|
137
|
+
async handle(input, ctx) {
|
|
138
|
+
const { signature } = await requireSigner(ctx).signGitCommit({ sshsig: new Uint8Array(Buffer.from(input.sshsig, "base64")) });
|
|
139
|
+
return { signature: Buffer.from(signature).toString("base64") };
|
|
140
|
+
},
|
|
141
|
+
evidence: (input) => ({ sshsigDigest: digestBase64(input.sshsig) })
|
|
142
|
+
},
|
|
143
|
+
"sign-diary-entry": {
|
|
144
|
+
request: Type.Object({ signingRequestId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }),
|
|
145
|
+
response: Type.Object({ signingRequestId: Type.String() }),
|
|
146
|
+
maxBodyBytes: 1024,
|
|
147
|
+
handle: (input, ctx) => requireSigner(ctx).signDiaryEntry(input),
|
|
148
|
+
evidence: (input) => ({ signingRequestId: input.signingRequestId })
|
|
149
|
+
}
|
|
150
|
+
},
|
|
151
|
+
guest: {
|
|
152
|
+
env: {
|
|
153
|
+
MOLTNET_SIGNER_URL: "${origin}",
|
|
154
|
+
SSH_AUTH_SOCK: GUEST_SIGNER_SOCKET,
|
|
155
|
+
GIT_CONFIG_GLOBAL: GUEST_GITCONFIG_PATH
|
|
156
|
+
},
|
|
157
|
+
files: [{
|
|
158
|
+
path: GUEST_GITCONFIG_PATH,
|
|
159
|
+
mode: 420,
|
|
160
|
+
content: (identity, { mountPath }) => nonSecretGitconfig(identity, {
|
|
161
|
+
allowedSignersFile: GUEST_ALLOWED_SIGNERS_PATH,
|
|
162
|
+
mountPath
|
|
163
|
+
})
|
|
164
|
+
}, {
|
|
165
|
+
path: GUEST_ALLOWED_SIGNERS_PATH,
|
|
166
|
+
mode: 420,
|
|
167
|
+
content: (identity) => `${allowedSignersLine(identity)}\n`
|
|
168
|
+
}],
|
|
169
|
+
services: [{
|
|
170
|
+
id: "signer-agent",
|
|
171
|
+
command: [
|
|
172
|
+
"moltnet",
|
|
173
|
+
"capability",
|
|
174
|
+
"serve",
|
|
175
|
+
"agent-signing",
|
|
176
|
+
"--adapter",
|
|
177
|
+
"ssh-agent",
|
|
178
|
+
"--socket",
|
|
179
|
+
GUEST_SIGNER_SOCKET
|
|
180
|
+
],
|
|
181
|
+
readiness: {
|
|
182
|
+
path: GUEST_SIGNER_SOCKET,
|
|
183
|
+
timeoutMs: 8e3
|
|
184
|
+
}
|
|
185
|
+
}]
|
|
186
|
+
}
|
|
187
|
+
});
|
|
188
|
+
//#endregion
|
|
189
|
+
//#region ../crypto-service/src/content-cid.ts
|
|
190
|
+
/**
|
|
191
|
+
* Content CID — Canonical content hashing for diary entries
|
|
192
|
+
*
|
|
193
|
+
* Produces CIDv1 content identifiers (sha2-256, raw codec, base32lower)
|
|
194
|
+
* for immutable diary entry signing.
|
|
195
|
+
*
|
|
196
|
+
* Canonical input follows RFC 8785 (JCS — JSON Canonicalization Scheme):
|
|
197
|
+
* deterministic JSON with sorted keys, then hashed. JSON string escaping
|
|
198
|
+
* naturally prevents field delimiter collision.
|
|
199
|
+
*/
|
|
200
|
+
/** SHA-256 multicodec code per multihash table */
|
|
201
|
+
var SHA2_256_CODE = 18;
|
|
202
|
+
/**
|
|
203
|
+
* Build the canonical JSON input for content hashing.
|
|
204
|
+
*
|
|
205
|
+
* Uses JSON with sorted keys (RFC 8785 style) to avoid field delimiter
|
|
206
|
+
* collision. Nulls are normalized: null title → empty string, null tags → [].
|
|
207
|
+
* Tags are sorted for determinism.
|
|
208
|
+
*/
|
|
209
|
+
function buildCanonicalInput(entryType, title, content, tags) {
|
|
210
|
+
const canonical = {
|
|
211
|
+
c: content,
|
|
212
|
+
t: title ?? "",
|
|
213
|
+
tags: tags ? [...tags].sort() : [],
|
|
214
|
+
type: entryType,
|
|
215
|
+
v: "moltnet:diary:v1"
|
|
216
|
+
};
|
|
217
|
+
return JSON.stringify(canonical);
|
|
218
|
+
}
|
|
219
|
+
/**
|
|
220
|
+
* Compute the raw SHA-256 hash of canonical diary entry content.
|
|
221
|
+
*/
|
|
222
|
+
function computeCanonicalHash(entryType, title, content, tags) {
|
|
223
|
+
const input = buildCanonicalInput(entryType, title, content, tags);
|
|
224
|
+
return sha256(new TextEncoder().encode(input));
|
|
225
|
+
}
|
|
226
|
+
/**
|
|
227
|
+
* Compute a CIDv1 content identifier for a diary entry.
|
|
228
|
+
*
|
|
229
|
+
* Format: CIDv1 with sha2-256 hash, raw codec, base32lower multibase.
|
|
230
|
+
* Example output: "bafkreig..."
|
|
231
|
+
*/
|
|
232
|
+
function computeContentCid(entryType, title, content, tags) {
|
|
233
|
+
const digest = create(SHA2_256_CODE, computeCanonicalHash(entryType, title, content, tags));
|
|
234
|
+
return CID.createV1(raw.code, digest).toString(base32);
|
|
235
|
+
}
|
|
236
|
+
//#endregion
|
|
21
237
|
//#region src/moltnet/render-phase6.ts
|
|
22
238
|
function slugToTitle(value) {
|
|
23
239
|
return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
|
|
@@ -279,9 +495,9 @@ function createMoltNetTools(config) {
|
|
|
279
495
|
name: "moltnet_pack_get",
|
|
280
496
|
label: "Get MoltNet Pack",
|
|
281
497
|
description: "Get a context pack by ID. Optionally expand included entries.",
|
|
282
|
-
parameters: Type.Object({
|
|
283
|
-
packId: Type.String({ description: "Context pack ID" }),
|
|
284
|
-
expandEntries: Type.Optional(Type.Boolean({ description: "Include full expanded entries" }))
|
|
498
|
+
parameters: Type$1.Object({
|
|
499
|
+
packId: Type$1.String({ description: "Context pack ID" }),
|
|
500
|
+
expandEntries: Type$1.Optional(Type$1.Boolean({ description: "Include full expanded entries" }))
|
|
285
501
|
}),
|
|
286
502
|
async execute(_id, params) {
|
|
287
503
|
const { agent } = ensureConnected(config);
|
|
@@ -299,14 +515,14 @@ function createMoltNetTools(config) {
|
|
|
299
515
|
name: "moltnet_pack_create",
|
|
300
516
|
label: "Create MoltNet Pack",
|
|
301
517
|
description: "Persist a curated context pack. Entries are caller-ranked (lower rank = more prominent). Recipe/prompt/selection_rationale belong in params. Defaults to pinned=false — packs in the attribution pipeline are ephemeral unless the caller explicitly opts in.",
|
|
302
|
-
parameters: Type.Object({
|
|
303
|
-
entries: Type.Array(Type.Object({
|
|
304
|
-
entryId: Type.String({ description: "Diary entry UUID" }),
|
|
305
|
-
rank: Type.Number({ description: "Rank (1..N, lower = more prominent)" })
|
|
518
|
+
parameters: Type$1.Object({
|
|
519
|
+
entries: Type$1.Array(Type$1.Object({
|
|
520
|
+
entryId: Type$1.String({ description: "Diary entry UUID" }),
|
|
521
|
+
rank: Type$1.Number({ description: "Rank (1..N, lower = more prominent)" })
|
|
306
522
|
}), { description: "Selected entries with their ranks" }),
|
|
307
|
-
params: Type.Optional(Type.Record(Type.String(), Type.Unknown(), { description: "Free-form recipe parameters (recipe name, prompt, selection rationale, etc.)" })),
|
|
308
|
-
tokenBudget: Type.Optional(Type.Number({ description: "Soft token budget recorded on the pack (optional)" })),
|
|
309
|
-
pinned: Type.Optional(Type.Boolean({ description: "Pin the pack against retention policy (default false)" }))
|
|
523
|
+
params: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Unknown(), { description: "Free-form recipe parameters (recipe name, prompt, selection rationale, etc.)" })),
|
|
524
|
+
tokenBudget: Type$1.Optional(Type$1.Number({ description: "Soft token budget recorded on the pack (optional)" })),
|
|
525
|
+
pinned: Type$1.Optional(Type$1.Boolean({ description: "Pin the pack against retention policy (default false)" }))
|
|
310
526
|
}),
|
|
311
527
|
async execute(_id, params) {
|
|
312
528
|
const { agent, diaryId } = ensureConnected(config);
|
|
@@ -330,10 +546,10 @@ function createMoltNetTools(config) {
|
|
|
330
546
|
name: "moltnet_pack_provenance",
|
|
331
547
|
label: "Get MoltNet Pack Provenance",
|
|
332
548
|
description: "Get the provenance graph for a context pack by ID or CID.",
|
|
333
|
-
parameters: Type.Object({
|
|
334
|
-
packId: Type.Optional(Type.String({ description: "Context pack ID" })),
|
|
335
|
-
packCid: Type.Optional(Type.String({ description: "Context pack CID" })),
|
|
336
|
-
depth: Type.Optional(Type.Number({ description: "Supersession ancestry depth to include (default 2)" }))
|
|
549
|
+
parameters: Type$1.Object({
|
|
550
|
+
packId: Type$1.Optional(Type$1.String({ description: "Context pack ID" })),
|
|
551
|
+
packCid: Type$1.Optional(Type$1.String({ description: "Context pack CID" })),
|
|
552
|
+
depth: Type$1.Optional(Type$1.Number({ description: "Supersession ancestry depth to include (default 2)" }))
|
|
337
553
|
}),
|
|
338
554
|
async execute(_id, params) {
|
|
339
555
|
const { agent } = ensureConnected(config);
|
|
@@ -361,12 +577,12 @@ function createMoltNetTools(config) {
|
|
|
361
577
|
name: "moltnet_pack_render",
|
|
362
578
|
label: "Render MoltNet Pack",
|
|
363
579
|
description: "Fetch a pack with entries, transform it into docs, then preview or persist the rendered pack.",
|
|
364
|
-
parameters: Type.Object({
|
|
365
|
-
packId: Type.String({ description: "Context pack ID" }),
|
|
366
|
-
renderMethod: Type.Optional(Type.String({ description: "Render method label. Defaults to pi:pack-to-docs-v1" })),
|
|
367
|
-
markdown: Type.Optional(Type.String({ description: "Optional caller-authored markdown override" })),
|
|
368
|
-
preview: Type.Optional(Type.Boolean({ description: "Preview without persisting (default false)" })),
|
|
369
|
-
pinned: Type.Optional(Type.Boolean({ description: "Persist the rendered pack as pinned (default false)" }))
|
|
580
|
+
parameters: Type$1.Object({
|
|
581
|
+
packId: Type$1.String({ description: "Context pack ID" }),
|
|
582
|
+
renderMethod: Type$1.Optional(Type$1.String({ description: "Render method label. Defaults to pi:pack-to-docs-v1" })),
|
|
583
|
+
markdown: Type$1.Optional(Type$1.String({ description: "Optional caller-authored markdown override" })),
|
|
584
|
+
preview: Type$1.Optional(Type$1.Boolean({ description: "Preview without persisting (default false)" })),
|
|
585
|
+
pinned: Type$1.Optional(Type$1.Boolean({ description: "Persist the rendered pack as pinned (default false)" }))
|
|
370
586
|
}),
|
|
371
587
|
async execute(_id, params) {
|
|
372
588
|
const { agent } = ensureConnected(config);
|
|
@@ -394,11 +610,11 @@ function createMoltNetTools(config) {
|
|
|
394
610
|
name: "moltnet_rendered_pack_list",
|
|
395
611
|
label: "List MoltNet Rendered Packs",
|
|
396
612
|
description: "List rendered packs for the current MoltNet diary, optionally filtered by source pack or render method.",
|
|
397
|
-
parameters: Type.Object({
|
|
398
|
-
sourcePackId: Type.Optional(Type.String({ description: "Filter by source pack ID" })),
|
|
399
|
-
renderMethod: Type.Optional(Type.String({ description: "Filter by render method" })),
|
|
400
|
-
limit: Type.Optional(Type.Number({ description: "Max results (default 10)" })),
|
|
401
|
-
offset: Type.Optional(Type.Number({ description: "Offset for pagination (default 0)" }))
|
|
613
|
+
parameters: Type$1.Object({
|
|
614
|
+
sourcePackId: Type$1.Optional(Type$1.String({ description: "Filter by source pack ID" })),
|
|
615
|
+
renderMethod: Type$1.Optional(Type$1.String({ description: "Filter by render method" })),
|
|
616
|
+
limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 10)" })),
|
|
617
|
+
offset: Type$1.Optional(Type$1.Number({ description: "Offset for pagination (default 0)" }))
|
|
402
618
|
}),
|
|
403
619
|
async execute(_id, params) {
|
|
404
620
|
const { agent, diaryId } = ensureConnected(config);
|
|
@@ -421,7 +637,7 @@ function createMoltNetTools(config) {
|
|
|
421
637
|
name: "moltnet_rendered_pack_get",
|
|
422
638
|
label: "Get MoltNet Rendered Pack",
|
|
423
639
|
description: "Get a rendered pack by ID.",
|
|
424
|
-
parameters: Type.Object({ renderedPackId: Type.String({ description: "Rendered pack ID" }) }),
|
|
640
|
+
parameters: Type$1.Object({ renderedPackId: Type$1.String({ description: "Rendered pack ID" }) }),
|
|
425
641
|
async execute(_id, params) {
|
|
426
642
|
const { agent } = ensureConnected(config);
|
|
427
643
|
const rendered = await agent.packs.getRendered(params.renderedPackId);
|
|
@@ -438,14 +654,14 @@ function createMoltNetTools(config) {
|
|
|
438
654
|
name: "moltnet_diary_tags",
|
|
439
655
|
label: "List MoltNet Diary Tags",
|
|
440
656
|
description: "Inventory tags on the current diary with entry counts. Cheap reconnaissance before committing to a search or list — use it to discover scope prefixes and cluster sizes. Optional prefix/minCount/entryTypes filters narrow the result.",
|
|
441
|
-
parameters: Type.Object({
|
|
442
|
-
prefix: Type.Optional(Type.String({ description: "Filter to tags starting with this prefix (e.g. \"scope:\")" })),
|
|
443
|
-
minCount: Type.Optional(Type.Number({ description: "Exclude tags with fewer than this many entries" })),
|
|
444
|
-
entryTypes: Type.Optional(Type.Array(Type.Union([
|
|
445
|
-
Type.Literal("episodic"),
|
|
446
|
-
Type.Literal("semantic"),
|
|
447
|
-
Type.Literal("procedural"),
|
|
448
|
-
Type.Literal("reflection")
|
|
657
|
+
parameters: Type$1.Object({
|
|
658
|
+
prefix: Type$1.Optional(Type$1.String({ description: "Filter to tags starting with this prefix (e.g. \"scope:\")" })),
|
|
659
|
+
minCount: Type$1.Optional(Type$1.Number({ description: "Exclude tags with fewer than this many entries" })),
|
|
660
|
+
entryTypes: Type$1.Optional(Type$1.Array(Type$1.Union([
|
|
661
|
+
Type$1.Literal("episodic"),
|
|
662
|
+
Type$1.Literal("semantic"),
|
|
663
|
+
Type$1.Literal("procedural"),
|
|
664
|
+
Type$1.Literal("reflection")
|
|
449
665
|
]), { description: "Scope the tag count to these entry types" }))
|
|
450
666
|
}),
|
|
451
667
|
async execute(_id, params) {
|
|
@@ -468,30 +684,30 @@ function createMoltNetTools(config) {
|
|
|
468
684
|
name: "moltnet_list_entries",
|
|
469
685
|
label: "List MoltNet Diary Entries",
|
|
470
686
|
description: "List entries from the MoltNet diary. When `entryIds` is provided, batch-fetches those specific entries (max 50) and returns full fields including entryType, contentSignature, and contentHash for signature checks. Otherwise returns recent entries with a content preview, filtered by any combination of tags (AND), excludeTags (NONE), entryType, and the taskFilter shorthand which expands into the right `task:*` tags.",
|
|
471
|
-
parameters: Type.Object({
|
|
472
|
-
limit: Type.Optional(Type.Number({ description: "Max entries to return (default 10)" })),
|
|
473
|
-
tags: Type.Optional(Type.Array(Type.String({
|
|
687
|
+
parameters: Type$1.Object({
|
|
688
|
+
limit: Type$1.Optional(Type$1.Number({ description: "Max entries to return (default 10)" })),
|
|
689
|
+
tags: Type$1.Optional(Type$1.Array(Type$1.String({
|
|
474
690
|
minLength: 1,
|
|
475
691
|
maxLength: DIARY_TAG_MAX_LENGTH$1
|
|
476
692
|
}), {
|
|
477
693
|
description: "Tags filter — entry must have ALL listed tags (AND). Max 20.",
|
|
478
694
|
maxItems: 20
|
|
479
695
|
})),
|
|
480
|
-
excludeTags: Type.Optional(Type.Array(Type.String({
|
|
696
|
+
excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
|
|
481
697
|
minLength: 1,
|
|
482
698
|
maxLength: DIARY_TAG_MAX_LENGTH$1
|
|
483
699
|
}), {
|
|
484
700
|
description: "Tags to exclude — entry must have NONE of these. Max 20.",
|
|
485
701
|
maxItems: 20
|
|
486
702
|
})),
|
|
487
|
-
entryType: Type.Optional(Type.String({ description: "Filter by entry type (procedural, semantic, episodic, reflection)." })),
|
|
488
|
-
taskFilter: Type.Optional(Type.Object({
|
|
489
|
-
taskId: Type.Optional(Type.String()),
|
|
490
|
-
taskType: Type.Optional(Type.String()),
|
|
491
|
-
correlationId: Type.Optional(Type.String()),
|
|
492
|
-
attemptN: Type.Optional(Type.Number())
|
|
703
|
+
entryType: Type$1.Optional(Type$1.String({ description: "Filter by entry type (procedural, semantic, episodic, reflection)." })),
|
|
704
|
+
taskFilter: Type$1.Optional(Type$1.Object({
|
|
705
|
+
taskId: Type$1.Optional(Type$1.String()),
|
|
706
|
+
taskType: Type$1.Optional(Type$1.String()),
|
|
707
|
+
correlationId: Type$1.Optional(Type$1.String()),
|
|
708
|
+
attemptN: Type$1.Optional(Type$1.Number())
|
|
493
709
|
}, { description: "Shorthand: any combination compiles to the matching task:* tags (task:id:<id>, task:type:<type>, task:correlation:<id>, task:attempt:<n>) and is merged into the tags filter." })),
|
|
494
|
-
entryIds: Type.Optional(Type.Array(Type.String(), {
|
|
710
|
+
entryIds: Type$1.Optional(Type$1.Array(Type$1.String(), {
|
|
495
711
|
description: "Batch-fetch specific entries by UUID (max 50). Overrides every other filter.",
|
|
496
712
|
maxItems: 50
|
|
497
713
|
}))
|
|
@@ -543,7 +759,7 @@ function createMoltNetTools(config) {
|
|
|
543
759
|
name: "moltnet_get_entry",
|
|
544
760
|
label: "Get MoltNet Diary Entry",
|
|
545
761
|
description: "Get the full content of a specific diary entry by ID.",
|
|
546
|
-
parameters: Type.Object({ entryId: Type.String({ description: "The entry ID to fetch" }) }),
|
|
762
|
+
parameters: Type$1.Object({ entryId: Type$1.String({ description: "The entry ID to fetch" }) }),
|
|
547
763
|
async execute(_id, params) {
|
|
548
764
|
const { agent } = ensureConnected(config);
|
|
549
765
|
const entry = await agent.entries.get(params.entryId);
|
|
@@ -567,32 +783,32 @@ function createMoltNetTools(config) {
|
|
|
567
783
|
name: "moltnet_search_entries",
|
|
568
784
|
label: "Search MoltNet Diary Entries",
|
|
569
785
|
description: "Hybrid (semantic + lexical) search over diary entries. Use proactively before non-trivial investigation, code changes, review, or episodic incident capture so prior decisions and recurring failures surface before you act. Do not search randomly: pass taskFilter for task/correlation-local searches and tags or entryTypes for broader prior-knowledge searches. Optional tags / excludeTags / entryTypes filters AND with the query; the taskFilter shorthand expands into task:* provenance tags so `taskFilter: { taskType: \"fulfill_brief\" }` returns only entries from fulfill_brief attempts. Filters apply server-side before ranking.",
|
|
570
|
-
parameters: Type.Object({
|
|
571
|
-
query: Type.String({ description: "Natural language search query" }),
|
|
572
|
-
limit: Type.Optional(Type.Number({ description: "Max results (default 5)" })),
|
|
573
|
-
tags: Type.Optional(Type.Array(Type.String({
|
|
786
|
+
parameters: Type$1.Object({
|
|
787
|
+
query: Type$1.String({ description: "Natural language search query" }),
|
|
788
|
+
limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 5)" })),
|
|
789
|
+
tags: Type$1.Optional(Type$1.Array(Type$1.String({
|
|
574
790
|
minLength: 1,
|
|
575
791
|
maxLength: DIARY_TAG_MAX_LENGTH$1
|
|
576
792
|
}), {
|
|
577
793
|
description: "Entry must have ALL listed tags (AND). Max 20.",
|
|
578
794
|
maxItems: 20
|
|
579
795
|
})),
|
|
580
|
-
excludeTags: Type.Optional(Type.Array(Type.String({
|
|
796
|
+
excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
|
|
581
797
|
minLength: 1,
|
|
582
798
|
maxLength: DIARY_TAG_MAX_LENGTH$1
|
|
583
799
|
}), {
|
|
584
800
|
description: "Entry must have NONE of these tags. Max 20.",
|
|
585
801
|
maxItems: 20
|
|
586
802
|
})),
|
|
587
|
-
entryTypes: Type.Optional(Type.Array(Type.String(), {
|
|
803
|
+
entryTypes: Type$1.Optional(Type$1.Array(Type$1.String(), {
|
|
588
804
|
description: "Restrict to these entry types (procedural, semantic, episodic, reflection). Max 4.",
|
|
589
805
|
maxItems: 4
|
|
590
806
|
})),
|
|
591
|
-
taskFilter: Type.Optional(Type.Object({
|
|
592
|
-
taskId: Type.Optional(Type.String()),
|
|
593
|
-
taskType: Type.Optional(Type.String()),
|
|
594
|
-
correlationId: Type.Optional(Type.String()),
|
|
595
|
-
attemptN: Type.Optional(Type.Number())
|
|
807
|
+
taskFilter: Type$1.Optional(Type$1.Object({
|
|
808
|
+
taskId: Type$1.Optional(Type$1.String()),
|
|
809
|
+
taskType: Type$1.Optional(Type$1.String()),
|
|
810
|
+
correlationId: Type$1.Optional(Type$1.String()),
|
|
811
|
+
attemptN: Type$1.Optional(Type$1.Number())
|
|
596
812
|
}, { description: "Shorthand: any combination compiles to the matching task:* tags and is merged into the tags filter." }))
|
|
597
813
|
}),
|
|
598
814
|
async execute(_id, params) {
|
|
@@ -626,21 +842,24 @@ function createMoltNetTools(config) {
|
|
|
626
842
|
name: "moltnet_create_entry",
|
|
627
843
|
label: "Create MoltNet Diary Entry",
|
|
628
844
|
description: "Create a new diary entry to record decisions, findings, incidents, or reflections. Before creating an episodic incident entry, first call moltnet_search_entries with the title/root-cause/error/watch-for terms plus taskFilter, tags, or entryTypes filters, then reference close matches instead of creating an isolated duplicate. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected. Use this tool — NOT `moltnet entry create` / `moltnet entry create-signed` via bash. The CLI path bypasses task-tag auto-injection and leaves entries invisible to taskFilter queries.",
|
|
629
|
-
parameters: Type.Object({
|
|
630
|
-
title: Type.String({ description: "Entry title (concise, descriptive)" }),
|
|
631
|
-
content: Type.String({ description: "Entry content (markdown)" }),
|
|
632
|
-
tags: Type.Optional(Type.Array(Type.String(), { description: "Tags for categorization" })),
|
|
633
|
-
importance: Type.Optional(Type.Number({ description: "Importance 1-10 (default 5)" })),
|
|
634
|
-
entryType: Type.Optional(Type.Union([
|
|
635
|
-
Type.Literal("episodic"),
|
|
636
|
-
Type.Literal("semantic"),
|
|
637
|
-
Type.Literal("procedural"),
|
|
638
|
-
Type.Literal("reflection")
|
|
845
|
+
parameters: Type$1.Object({
|
|
846
|
+
title: Type$1.String({ description: "Entry title (concise, descriptive)" }),
|
|
847
|
+
content: Type$1.String({ description: "Entry content (markdown)" }),
|
|
848
|
+
tags: Type$1.Optional(Type$1.Array(Type$1.String(), { description: "Tags for categorization" })),
|
|
849
|
+
importance: Type$1.Optional(Type$1.Number({ description: "Importance 1-10 (default 5)" })),
|
|
850
|
+
entryType: Type$1.Optional(Type$1.Union([
|
|
851
|
+
Type$1.Literal("episodic"),
|
|
852
|
+
Type$1.Literal("semantic"),
|
|
853
|
+
Type$1.Literal("procedural"),
|
|
854
|
+
Type$1.Literal("reflection")
|
|
639
855
|
], { description: "Entry type. Use episodic for incidents, workarounds, bugs, or recurrence evidence; defaults to semantic." })),
|
|
640
|
-
diaryId: Type.Optional(Type.String({ description: "Explicit diary id. During an active task, must match the task diary or the call is rejected. Outside a task, overrides the env-derived diary." }))
|
|
856
|
+
diaryId: Type$1.Optional(Type$1.String({ description: "Explicit diary id. During an active task, must match the task diary or the call is rejected. Outside a task, overrides the env-derived diary." })),
|
|
857
|
+
signed: Type$1.Optional(Type$1.Boolean({ description: "Create a content-signed (immutable) entry. The signature is produced on the trusted host through the agent-signing capability; fails when the runtime does not expose it." }))
|
|
641
858
|
}),
|
|
642
859
|
async execute(_id, params) {
|
|
643
860
|
const { agent, diaryId: envDiaryId } = ensureConnected(config);
|
|
861
|
+
const signer = params.signed ? config.getSigner?.() ?? null : null;
|
|
862
|
+
if (params.signed && !signer) throw new Error("entries_create: signed entries require the agent-signing capability; create an unsigned entry or run under a runtime that declares it.");
|
|
644
863
|
const taskCtx = config.getTaskContext?.() ?? null;
|
|
645
864
|
let targetDiaryId;
|
|
646
865
|
let autoTags = [];
|
|
@@ -658,12 +877,23 @@ function createMoltNetTools(config) {
|
|
|
658
877
|
const mergedTags = autoTags.length ? [...autoTags, ...userTags.filter((t) => !autoTags.includes(t))] : userTags;
|
|
659
878
|
let entry;
|
|
660
879
|
try {
|
|
880
|
+
let signingRequestId;
|
|
881
|
+
if (signer) {
|
|
882
|
+
const contentCid = computeContentCid(params.entryType ?? "semantic", params.title, params.content, mergedTags);
|
|
883
|
+
const request = await agent.crypto.signingRequests.create({
|
|
884
|
+
message: contentCid,
|
|
885
|
+
verificationMethod: "agent-ed25519"
|
|
886
|
+
});
|
|
887
|
+
await signer.signDiaryEntry({ signingRequestId: request.id });
|
|
888
|
+
signingRequestId = request.id;
|
|
889
|
+
}
|
|
661
890
|
entry = await agent.entries.create(targetDiaryId, {
|
|
662
891
|
title: params.title,
|
|
663
892
|
content: params.content,
|
|
664
893
|
tags: mergedTags,
|
|
665
894
|
importance: params.importance ?? 5,
|
|
666
|
-
...params.entryType ? { entryType: params.entryType } : {}
|
|
895
|
+
...params.entryType ? { entryType: params.entryType } : {},
|
|
896
|
+
...signingRequestId ? { signingRequestId } : {}
|
|
667
897
|
});
|
|
668
898
|
} catch (error) {
|
|
669
899
|
const message = error instanceof Error ? error.message : String(error);
|
|
@@ -687,7 +917,8 @@ function createMoltNetTools(config) {
|
|
|
687
917
|
diaryId: targetDiaryId,
|
|
688
918
|
entryType: entry.entryType,
|
|
689
919
|
importance: entry.importance,
|
|
690
|
-
tags: mergedTags
|
|
920
|
+
tags: mergedTags,
|
|
921
|
+
signed: signer !== null
|
|
691
922
|
}, null, 2)
|
|
692
923
|
}],
|
|
693
924
|
details: {}
|
|
@@ -698,7 +929,7 @@ function createMoltNetTools(config) {
|
|
|
698
929
|
name: "moltnet_get_task",
|
|
699
930
|
label: "Get MoltNet Task",
|
|
700
931
|
description: "Fetch a task by ID — the row, including taskType, status, acceptedAttemptN, references, input, timeouts. Use this when you need to inspect another task (e.g. an assess_brief judging a fulfill_brief: fetch the target task here, then list its attempts via moltnet_list_task_attempts to read the producer's output and decide what to investigate).",
|
|
701
|
-
parameters: Type.Object({ taskId: Type.String({ description: "Task ID (UUID)." }) }),
|
|
932
|
+
parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
|
|
702
933
|
async execute(_id, params) {
|
|
703
934
|
const { agent } = ensureConnected(config);
|
|
704
935
|
const task = await agent.tasks.get(params.taskId);
|
|
@@ -715,7 +946,7 @@ function createMoltNetTools(config) {
|
|
|
715
946
|
name: "moltnet_list_task_attempts",
|
|
716
947
|
label: "List MoltNet Task Attempts",
|
|
717
948
|
description: "List every attempt made on a task, in attempt-number order. Each attempt carries the claimed agent, status, output, outputCid, and timing. The accepted attempt (whose attemptN matches the parent task's acceptedAttemptN) is the canonical one — its `output` is what consumers should reason against. Earlier failed or timed_out attempts are kept for audit but should not drive downstream decisions.",
|
|
718
|
-
parameters: Type.Object({ taskId: Type.String({ description: "Task ID (UUID)." }) }),
|
|
949
|
+
parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
|
|
719
950
|
async execute(_id, params) {
|
|
720
951
|
const { agent } = ensureConnected(config);
|
|
721
952
|
const attempts = await agent.tasks.listAttempts(params.taskId);
|
|
@@ -732,17 +963,17 @@ function createMoltNetTools(config) {
|
|
|
732
963
|
name: "moltnet_list_task_messages",
|
|
733
964
|
label: "List MoltNet Task Attempt Messages",
|
|
734
965
|
description: "List messages for a specific task attempt. Use this when you need the turn-by-turn execution record behind an accepted attempt — tool calls, text deltas, and error/info events that do not appear in the attempt output alone.",
|
|
735
|
-
parameters: Type.Object({
|
|
736
|
-
taskId: Type.String({ description: "Task ID (UUID)." }),
|
|
737
|
-
attemptN: Type.Integer({
|
|
966
|
+
parameters: Type$1.Object({
|
|
967
|
+
taskId: Type$1.String({ description: "Task ID (UUID)." }),
|
|
968
|
+
attemptN: Type$1.Integer({
|
|
738
969
|
minimum: 1,
|
|
739
970
|
description: "Attempt number to inspect."
|
|
740
971
|
}),
|
|
741
|
-
afterSeq: Type.Optional(Type.Integer({
|
|
972
|
+
afterSeq: Type$1.Optional(Type$1.Integer({
|
|
742
973
|
minimum: 0,
|
|
743
974
|
description: "Optional cursor: only return messages with seq > afterSeq."
|
|
744
975
|
})),
|
|
745
|
-
limit: Type.Optional(Type.Integer({
|
|
976
|
+
limit: Type$1.Optional(Type$1.Integer({
|
|
746
977
|
minimum: 1,
|
|
747
978
|
maximum: 500,
|
|
748
979
|
description: "Optional maximum messages to return. Defaults to the API value."
|
|
@@ -767,12 +998,12 @@ function createMoltNetTools(config) {
|
|
|
767
998
|
name: "moltnet_upload_task_artifact",
|
|
768
999
|
label: "Upload MoltNet Task Artifact",
|
|
769
1000
|
description: "Upload a file from the current task workspace as an immutable task artifact. Only available during an active task attempt; the tool attaches the artifact to the active taskId/attemptN and returns metadata including cid, sizeBytes, kind, and title. Use this for large logs, reports, build outputs, screenshots, generated files, or other bytes that should be referenced by CID instead of pasted into structured task output.",
|
|
770
|
-
parameters: Type.Object({
|
|
771
|
-
filePath: Type.String({ description: "Path to a file under the current task workspace. Relative paths are resolved from the workspace root." }),
|
|
772
|
-
kind: Type.String({ description: "Artifact category, e.g. log, report, patch, screenshot, bundle, dataset, trace." }),
|
|
773
|
-
title: Type.String({ description: "Human-readable artifact title, usually the file name." }),
|
|
774
|
-
contentType: Type.Optional(Type.String({ description: "MIME type. Defaults to application/octet-stream when omitted." })),
|
|
775
|
-
contentEncoding: Type.Optional(Type.String({ description: "Optional content encoding if the file is already encoded, e.g. gzip." }))
|
|
1001
|
+
parameters: Type$1.Object({
|
|
1002
|
+
filePath: Type$1.String({ description: "Path to a file under the current task workspace. Relative paths are resolved from the workspace root." }),
|
|
1003
|
+
kind: Type$1.String({ description: "Artifact category, e.g. log, report, patch, screenshot, bundle, dataset, trace." }),
|
|
1004
|
+
title: Type$1.String({ description: "Human-readable artifact title, usually the file name." }),
|
|
1005
|
+
contentType: Type$1.Optional(Type$1.String({ description: "MIME type. Defaults to application/octet-stream when omitted." })),
|
|
1006
|
+
contentEncoding: Type$1.Optional(Type$1.String({ description: "Optional content encoding if the file is already encoded, e.g. gzip." }))
|
|
776
1007
|
}),
|
|
777
1008
|
async execute(_id, params) {
|
|
778
1009
|
const { agent, teamId } = ensureConnected(config);
|
|
@@ -807,14 +1038,14 @@ function createMoltNetTools(config) {
|
|
|
807
1038
|
name: "moltnet_list_task_artifacts",
|
|
808
1039
|
label: "List MoltNet Task Artifacts",
|
|
809
1040
|
description: "List immutable artifacts attached to a task, including each artifact CID, attempt number, kind, title, content type, size, uploader, and creation time. Use this when judging or continuing work that references task artifacts.",
|
|
810
|
-
parameters: Type.Object({
|
|
811
|
-
taskId: Type.Optional(Type.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
|
|
812
|
-
limit: Type.Optional(Type.Integer({
|
|
1041
|
+
parameters: Type$1.Object({
|
|
1042
|
+
taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
|
|
1043
|
+
limit: Type$1.Optional(Type$1.Integer({
|
|
813
1044
|
minimum: 1,
|
|
814
1045
|
maximum: 100,
|
|
815
1046
|
description: "Maximum artifacts to return. Defaults to the server page size."
|
|
816
1047
|
})),
|
|
817
|
-
cursor: Type.Optional(Type.String({ description: "Pagination cursor returned by a previous moltnet_list_task_artifacts call." }))
|
|
1048
|
+
cursor: Type$1.Optional(Type$1.String({ description: "Pagination cursor returned by a previous moltnet_list_task_artifacts call." }))
|
|
818
1049
|
}),
|
|
819
1050
|
async execute(_id, params) {
|
|
820
1051
|
const { agent, teamId } = ensureConnected(config);
|
|
@@ -838,17 +1069,17 @@ function createMoltNetTools(config) {
|
|
|
838
1069
|
name: "moltnet_download_task_artifact",
|
|
839
1070
|
label: "Download MoltNet Task Artifact",
|
|
840
1071
|
description: "Download immutable task artifact bytes by taskId and CID into a new file in the current task workspace. Use moltnet_list_task_artifacts first to choose the correct CID. Omit attemptN for a bound input artifact; pass it only to require an artifact from one exact task attempt.",
|
|
841
|
-
parameters: Type.Object({
|
|
842
|
-
taskId: Type.Optional(Type.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
|
|
843
|
-
attemptN: Type.Optional(Type.Integer({
|
|
1072
|
+
parameters: Type$1.Object({
|
|
1073
|
+
taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
|
|
1074
|
+
attemptN: Type$1.Optional(Type$1.Integer({
|
|
844
1075
|
minimum: 1,
|
|
845
1076
|
description: "Attempt number that produced the artifact. Omit for bound input artifacts, which have no producing attempt."
|
|
846
1077
|
})),
|
|
847
|
-
cid: Type.String({
|
|
1078
|
+
cid: Type$1.String({
|
|
848
1079
|
minLength: 1,
|
|
849
1080
|
description: "Artifact CID returned by moltnet_list_task_artifacts."
|
|
850
1081
|
}),
|
|
851
|
-
outputPath: Type.String({ description: "New file path under the current task workspace. The tool refuses to overwrite existing files." })
|
|
1082
|
+
outputPath: Type$1.String({ description: "New file path under the current task workspace. The tool refuses to overwrite existing files." })
|
|
852
1083
|
}),
|
|
853
1084
|
async execute(_id, params) {
|
|
854
1085
|
const { agent, teamId } = ensureConnected(config);
|
|
@@ -890,7 +1121,7 @@ function createMoltNetTools(config) {
|
|
|
890
1121
|
name: "moltnet_review_session_errors",
|
|
891
1122
|
label: "Review Session Tool Errors",
|
|
892
1123
|
description: "Review tool failures buffered during this session (isError=true results). Use this to decide whether any failures are worth persisting as a diary entry via moltnet_create_entry. Most failures are transient (denied prompts, empty greps, mid-iteration typecheck errors) and should NOT be written to the diary — only persist incidents that represent a real finding (root cause identified, non-obvious workaround, recurring pattern). Pass clear=true to drop the buffer after reviewing.",
|
|
893
|
-
parameters: Type.Object({ clear: Type.Optional(Type.Boolean({ description: "If true, empty the buffer after returning it. Use once you have decided whether to persist." })) }),
|
|
1124
|
+
parameters: Type$1.Object({ clear: Type$1.Optional(Type$1.Boolean({ description: "If true, empty the buffer after returning it. Use once you have decided whether to persist." })) }),
|
|
894
1125
|
async execute(_id, params) {
|
|
895
1126
|
const errors = config.getSessionErrors();
|
|
896
1127
|
const payload = {
|
|
@@ -942,11 +1173,11 @@ function createMoltNetTools(config) {
|
|
|
942
1173
|
defineTool({
|
|
943
1174
|
name: "moltnet_host_exec",
|
|
944
1175
|
label: "Run command on host (escape hatch — requires user approval)",
|
|
945
|
-
description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool; use that, not this escape hatch. Credentials are not generally injected into the guest. A runtime may expose an opaque HTTP placeholder that the host proxy can use only for declared destinations; otherwise authenticated operations are unavailable. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass only non-secret additional vars via the `env` parameter. Every invocation is logged as an auditable host execution.",
|
|
946
|
-
parameters: Type.Object({
|
|
947
|
-
executable: Type.String({ description: "Executable to run (git | gh | moltnet)" }),
|
|
948
|
-
args: Type.Array(Type.String(), { description: "Arguments to pass to the executable" }),
|
|
949
|
-
env: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Additional non-secret environment variables for this invocation. Merged on top of the minimal base env." }))
|
|
1176
|
+
description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool; use that, not this escape hatch. Credentials are not generally injected into the guest. A runtime may expose an opaque HTTP placeholder that the host proxy can use only for declared destinations, and commit signing is brokered through the `agent-signing` host capability when declared; otherwise authenticated operations are unavailable. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass only non-secret additional vars via the `env` parameter. Every invocation is logged as an auditable host execution.",
|
|
1177
|
+
parameters: Type$1.Object({
|
|
1178
|
+
executable: Type$1.String({ description: "Executable to run (git | gh | moltnet)" }),
|
|
1179
|
+
args: Type$1.Array(Type$1.String(), { description: "Arguments to pass to the executable" }),
|
|
1180
|
+
env: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.String(), { description: "Additional non-secret environment variables for this invocation. Merged on top of the minimal base env." }))
|
|
950
1181
|
}),
|
|
951
1182
|
async execute(_id, params, _signal, _onUpdate, ctx) {
|
|
952
1183
|
if (!HOST_EXEC_ALLOWED.has(params.executable)) throw new Error(`host_exec: '${params.executable}' is not in the allowed list (${[...HOST_EXEC_ALLOWED].join(", ")}). Extend HOST_EXEC_ALLOWED only after explicit security review.`);
|
|
@@ -1299,7 +1530,7 @@ async function resolvePersistentSessionManager(args) {
|
|
|
1299
1530
|
*/
|
|
1300
1531
|
async function computeJsonCid(value) {
|
|
1301
1532
|
const bytes = json.encode(value);
|
|
1302
|
-
const hash = await sha256.digest(bytes);
|
|
1533
|
+
const hash = await sha256$1.digest(bytes);
|
|
1303
1534
|
return CID.create(1, json.code, hash).toString();
|
|
1304
1535
|
}
|
|
1305
1536
|
//#endregion
|
|
@@ -1323,7 +1554,7 @@ var CONTEXT_BINDINGS = [
|
|
|
1323
1554
|
];
|
|
1324
1555
|
/** Maximum UTF-16 code units accepted in one ContextRef content field. */
|
|
1325
1556
|
var CONTEXT_REF_MAX_CONTENT_LENGTH = 65536;
|
|
1326
|
-
var ContextBinding = Type
|
|
1557
|
+
var ContextBinding = Type.Unsafe(Type.Union(CONTEXT_BINDINGS.map((binding) => Type.Literal(binding)), { $id: "ContextBinding" }));
|
|
1327
1558
|
/**
|
|
1328
1559
|
* One context entry. Bytes are inlined: the proposer chose them, and the
|
|
1329
1560
|
* task's `inputCid` already pins the entire input — including
|
|
@@ -1346,14 +1577,14 @@ var ContextBinding = Type$1.Unsafe(Type$1.Union(CONTEXT_BINDINGS.map((binding) =
|
|
|
1346
1577
|
* short example skills, not the kind of skill the eval
|
|
1347
1578
|
* substrate is dogfooded on (#943, #823).
|
|
1348
1579
|
*/
|
|
1349
|
-
var ContextRef = Type
|
|
1350
|
-
slug: Type
|
|
1580
|
+
var ContextRef = Type.Object({
|
|
1581
|
+
slug: Type.String({
|
|
1351
1582
|
minLength: 1,
|
|
1352
1583
|
maxLength: 64,
|
|
1353
1584
|
pattern: "^[a-zA-Z0-9_-]+$"
|
|
1354
1585
|
}),
|
|
1355
1586
|
binding: ContextBinding,
|
|
1356
|
-
content: Type
|
|
1587
|
+
content: Type.String({
|
|
1357
1588
|
minLength: 1,
|
|
1358
1589
|
maxLength: CONTEXT_REF_MAX_CONTENT_LENGTH
|
|
1359
1590
|
})
|
|
@@ -1362,7 +1593,7 @@ var ContextRef = Type$1.Object({
|
|
|
1362
1593
|
additionalProperties: false
|
|
1363
1594
|
});
|
|
1364
1595
|
/** Reusable input fragment for any task type. Soft cap at 5 items. */
|
|
1365
|
-
var TaskContext = Type
|
|
1596
|
+
var TaskContext = Type.Array(ContextRef, {
|
|
1366
1597
|
$id: "TaskContext",
|
|
1367
1598
|
maxItems: 5
|
|
1368
1599
|
});
|
|
@@ -1379,37 +1610,37 @@ var TaskContext = Type$1.Array(ContextRef, {
|
|
|
1379
1610
|
* The REST API exposes a single shape regardless of scope; the team header
|
|
1380
1611
|
* gates which rows are returned.
|
|
1381
1612
|
*/
|
|
1382
|
-
var RuntimeModelProvider = Type
|
|
1613
|
+
var RuntimeModelProvider = Type.String({
|
|
1383
1614
|
minLength: 1,
|
|
1384
1615
|
maxLength: 100,
|
|
1385
1616
|
pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$"
|
|
1386
1617
|
});
|
|
1387
|
-
var RuntimeModelName = Type
|
|
1618
|
+
var RuntimeModelName = Type.String({
|
|
1388
1619
|
minLength: 1,
|
|
1389
1620
|
maxLength: 200,
|
|
1390
1621
|
pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$"
|
|
1391
1622
|
});
|
|
1392
|
-
var RuntimeModelCapabilities = Type
|
|
1623
|
+
var RuntimeModelCapabilities = Type.Record(Type.String({
|
|
1393
1624
|
minLength: 1,
|
|
1394
1625
|
maxLength: 64
|
|
1395
|
-
}), Type
|
|
1396
|
-
Type
|
|
1397
|
-
Type
|
|
1398
|
-
Type
|
|
1626
|
+
}), Type.Union([
|
|
1627
|
+
Type.Boolean(),
|
|
1628
|
+
Type.Number(),
|
|
1629
|
+
Type.String({ maxLength: 256 })
|
|
1399
1630
|
]));
|
|
1400
|
-
Type
|
|
1401
|
-
id: Type
|
|
1402
|
-
teamId: Type
|
|
1631
|
+
Type.Object({
|
|
1632
|
+
id: Type.String({ format: "uuid" }),
|
|
1633
|
+
teamId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
1403
1634
|
provider: RuntimeModelProvider,
|
|
1404
1635
|
model: RuntimeModelName,
|
|
1405
|
-
displayName: Type
|
|
1406
|
-
description: Type
|
|
1636
|
+
displayName: Type.Union([Type.String({ maxLength: 200 }), Type.Null()]),
|
|
1637
|
+
description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
|
|
1407
1638
|
capabilities: RuntimeModelCapabilities,
|
|
1408
|
-
isActive: Type
|
|
1409
|
-
createdByAgentId: Type
|
|
1410
|
-
createdByHumanId: Type
|
|
1411
|
-
createdAt: Type
|
|
1412
|
-
updatedAt: Type
|
|
1639
|
+
isActive: Type.Boolean(),
|
|
1640
|
+
createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
1641
|
+
createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
1642
|
+
createdAt: Type.String({ format: "date-time" }),
|
|
1643
|
+
updatedAt: Type.String({ format: "date-time" })
|
|
1413
1644
|
}, {
|
|
1414
1645
|
$id: "RuntimeModel",
|
|
1415
1646
|
additionalProperties: false
|
|
@@ -1426,12 +1657,12 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
|
|
|
1426
1657
|
},
|
|
1427
1658
|
"accountable-delivery-v1": {
|
|
1428
1659
|
binding: "prompt_prefix",
|
|
1429
|
-
content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature; never describe an entry as signed
|
|
1660
|
+
content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature unless you pass `signed: true` while the runtime kernel declares the `agent-signing` host capability; never describe an entry as signed otherwise.\n- When the runtime kernel declares `agent-signing`, sign commits normally with `git commit -S`: the signature is brokered to the trusted host through `SSH_AUTH_SOCK` and no private key exists in the guest. Without that capability commits are unsigned; do not disable signing the runtime provides, and never try to obtain a key from host configuration.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
|
|
1430
1661
|
slug: "accountable-delivery-v1"
|
|
1431
1662
|
},
|
|
1432
1663
|
"judgment-diary-v1": {
|
|
1433
1664
|
binding: "prompt_prefix",
|
|
1434
|
-
content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless the
|
|
1665
|
+
content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless you created the entry with `signed: true` under a runtime that declares the `agent-signing` host capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
|
|
1435
1666
|
slug: "judgment-diary-v1"
|
|
1436
1667
|
},
|
|
1437
1668
|
"proactive-memory-v1": {
|
|
@@ -1446,7 +1677,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
|
|
|
1446
1677
|
},
|
|
1447
1678
|
"task-diary-discipline-v1": {
|
|
1448
1679
|
binding: "prompt_prefix",
|
|
1449
|
-
content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. Those paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
|
|
1680
|
+
content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. For a content-signed entry pass `signed: true` to the custom tool instead; it signs on the trusted host. Those shell paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
|
|
1450
1681
|
slug: "task-diary-discipline-v1"
|
|
1451
1682
|
},
|
|
1452
1683
|
"verification-and-artifacts-v1": {
|
|
@@ -1528,68 +1759,68 @@ Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPE
|
|
|
1528
1759
|
//#endregion
|
|
1529
1760
|
//#region ../models/src/preview-sign.ts
|
|
1530
1761
|
function schemaRef$1(schema, id) {
|
|
1531
|
-
return Type
|
|
1762
|
+
return Type.Unsafe(Type.Ref(id));
|
|
1532
1763
|
}
|
|
1533
|
-
var PreviewSignBase64UrlSchema = Type
|
|
1764
|
+
var PreviewSignBase64UrlSchema = Type.String({
|
|
1534
1765
|
$id: "PreviewSignBase64Url",
|
|
1535
1766
|
minLength: 1,
|
|
1536
1767
|
maxLength: 5462,
|
|
1537
1768
|
pattern: "^[A-Za-z0-9_-]+$"
|
|
1538
1769
|
});
|
|
1539
|
-
var PreviewSignSha256Base64UrlSchema = Type
|
|
1770
|
+
var PreviewSignSha256Base64UrlSchema = Type.String({
|
|
1540
1771
|
$id: "PreviewSignSha256Base64Url",
|
|
1541
1772
|
minLength: 43,
|
|
1542
1773
|
maxLength: 43,
|
|
1543
1774
|
pattern: "^[A-Za-z0-9_-]+$"
|
|
1544
1775
|
});
|
|
1545
|
-
var PreviewSignP256DerSignatureBase64UrlSchema = Type
|
|
1776
|
+
var PreviewSignP256DerSignatureBase64UrlSchema = Type.String({
|
|
1546
1777
|
$id: "PreviewSignP256DerSignatureBase64Url",
|
|
1547
1778
|
minLength: 11,
|
|
1548
1779
|
maxLength: 96,
|
|
1549
1780
|
pattern: "^[A-Za-z0-9_-]+$"
|
|
1550
1781
|
});
|
|
1551
|
-
var PreviewSignEs256PublicKeySchema = Type
|
|
1552
|
-
kty: Type
|
|
1553
|
-
algorithm: Type
|
|
1554
|
-
curve: Type
|
|
1782
|
+
var PreviewSignEs256PublicKeySchema = Type.Object({
|
|
1783
|
+
kty: Type.Literal(2),
|
|
1784
|
+
algorithm: Type.Literal(-7),
|
|
1785
|
+
curve: Type.Literal(1),
|
|
1555
1786
|
x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
|
|
1556
1787
|
y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
|
|
1557
1788
|
}, {
|
|
1558
1789
|
$id: "PreviewSignEs256PublicKey",
|
|
1559
1790
|
additionalProperties: false
|
|
1560
1791
|
});
|
|
1561
|
-
var PreviewSignEcdhEsHkdf256PublicKeySchema = Type
|
|
1562
|
-
kty: Type
|
|
1563
|
-
algorithm: Type
|
|
1564
|
-
curve: Type
|
|
1792
|
+
var PreviewSignEcdhEsHkdf256PublicKeySchema = Type.Object({
|
|
1793
|
+
kty: Type.Literal(2),
|
|
1794
|
+
algorithm: Type.Literal(-25),
|
|
1795
|
+
curve: Type.Literal(1),
|
|
1565
1796
|
x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
|
|
1566
1797
|
y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
|
|
1567
1798
|
}, {
|
|
1568
1799
|
$id: "PreviewSignEcdhEsHkdf256PublicKey",
|
|
1569
1800
|
additionalProperties: false
|
|
1570
1801
|
});
|
|
1571
|
-
var PreviewSignEsp256PublicKeySchema = Type
|
|
1572
|
-
kty: Type
|
|
1573
|
-
algorithm: Type
|
|
1574
|
-
curve: Type
|
|
1802
|
+
var PreviewSignEsp256PublicKeySchema = Type.Object({
|
|
1803
|
+
kty: Type.Literal(2),
|
|
1804
|
+
algorithm: Type.Literal(-9),
|
|
1805
|
+
curve: Type.Literal(1),
|
|
1575
1806
|
x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
|
|
1576
1807
|
y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
|
|
1577
1808
|
}, {
|
|
1578
1809
|
$id: "PreviewSignEsp256PublicKey",
|
|
1579
1810
|
additionalProperties: false
|
|
1580
1811
|
});
|
|
1581
|
-
var PreviewSignArkgSeedPublicKeySchema = Type
|
|
1582
|
-
kty: Type
|
|
1583
|
-
algorithm: Type
|
|
1584
|
-
derivedAlgorithm: Type
|
|
1812
|
+
var PreviewSignArkgSeedPublicKeySchema = Type.Object({
|
|
1813
|
+
kty: Type.Literal(-65537),
|
|
1814
|
+
algorithm: Type.Literal(-65700),
|
|
1815
|
+
derivedAlgorithm: Type.Literal(-9),
|
|
1585
1816
|
blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
|
|
1586
1817
|
kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
|
|
1587
1818
|
}, {
|
|
1588
1819
|
$id: "PreviewSignArkgSeedPublicKey",
|
|
1589
1820
|
additionalProperties: false
|
|
1590
1821
|
});
|
|
1591
|
-
var PreviewSignPublicMaterialSchema = Type
|
|
1592
|
-
version: Type
|
|
1822
|
+
var PreviewSignPublicMaterialSchema = Type.Object({
|
|
1823
|
+
version: Type.Literal(1),
|
|
1593
1824
|
outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
|
|
1594
1825
|
outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
|
|
1595
1826
|
previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
|
|
@@ -1598,9 +1829,9 @@ var PreviewSignPublicMaterialSchema = Type$1.Object({
|
|
|
1598
1829
|
$id: "PreviewSignPublicMaterial",
|
|
1599
1830
|
additionalProperties: false
|
|
1600
1831
|
});
|
|
1601
|
-
var PreviewSignChallengeSchema = Type
|
|
1602
|
-
verificationMethod: Type
|
|
1603
|
-
version: Type
|
|
1832
|
+
var PreviewSignChallengeSchema = Type.Object({
|
|
1833
|
+
verificationMethod: Type.Literal("human-hardware-previewsign"),
|
|
1834
|
+
version: Type.Literal(1),
|
|
1604
1835
|
envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
|
|
1605
1836
|
digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
|
|
1606
1837
|
additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
|
|
@@ -1611,23 +1842,23 @@ var PreviewSignChallengeSchema = Type$1.Object({
|
|
|
1611
1842
|
$id: "PreviewSignChallenge",
|
|
1612
1843
|
additionalProperties: false
|
|
1613
1844
|
});
|
|
1614
|
-
var PreviewSignChallengeValueSchema = Type
|
|
1615
|
-
verificationMethod: Type
|
|
1845
|
+
var PreviewSignChallengeValueSchema = Type.Object({
|
|
1846
|
+
verificationMethod: Type.Literal("human-hardware-previewsign"),
|
|
1616
1847
|
value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
|
|
1617
1848
|
}, {
|
|
1618
1849
|
$id: "PreviewSignChallengeValue",
|
|
1619
1850
|
additionalProperties: false
|
|
1620
1851
|
});
|
|
1621
|
-
var PreviewSignChallengeOperationSchema = Type
|
|
1622
|
-
var PreviewSignReceiptSchema = Type
|
|
1623
|
-
version: Type
|
|
1852
|
+
var PreviewSignChallengeOperationSchema = Type.Union([Type.Literal("credential-registration"), Type.Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
|
|
1853
|
+
var PreviewSignReceiptSchema = Type.Object({
|
|
1854
|
+
version: Type.Literal(1),
|
|
1624
1855
|
signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
|
|
1625
1856
|
}, {
|
|
1626
1857
|
$id: "PreviewSignReceipt",
|
|
1627
1858
|
additionalProperties: false
|
|
1628
1859
|
});
|
|
1629
|
-
var PreviewSignReceiptValueSchema = Type
|
|
1630
|
-
verificationMethod: Type
|
|
1860
|
+
var PreviewSignReceiptValueSchema = Type.Object({
|
|
1861
|
+
verificationMethod: Type.Literal("human-hardware-previewsign"),
|
|
1631
1862
|
value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
|
|
1632
1863
|
}, {
|
|
1633
1864
|
$id: "PreviewSignReceiptValue",
|
|
@@ -1664,22 +1895,22 @@ var VERIFICATION_METHOD = {
|
|
|
1664
1895
|
VERIFICATION_METHOD.AgentEd25519, VERIFICATION_METHOD.HumanHardwarePreviewSign;
|
|
1665
1896
|
//#endregion
|
|
1666
1897
|
//#region ../models/src/schemas.ts
|
|
1667
|
-
var UuidSchema = Type
|
|
1898
|
+
var UuidSchema = Type.String({
|
|
1668
1899
|
format: "uuid",
|
|
1669
1900
|
description: "UUID v4 identifier"
|
|
1670
1901
|
});
|
|
1671
|
-
var TimestampSchema = Type
|
|
1902
|
+
var TimestampSchema = Type.String({
|
|
1672
1903
|
format: "date-time",
|
|
1673
1904
|
description: "ISO 8601 timestamp"
|
|
1674
1905
|
});
|
|
1675
|
-
var verificationMethodLiterals = [Type
|
|
1676
|
-
Type
|
|
1906
|
+
var verificationMethodLiterals = [Type.Literal(VERIFICATION_METHOD.AgentEd25519), Type.Literal(VERIFICATION_METHOD.HumanHardwarePreviewSign)];
|
|
1907
|
+
Type.Union(verificationMethodLiterals, { description: "Stable signing verification method identifier" });
|
|
1677
1908
|
var visibilityLiterals = [
|
|
1678
|
-
Type
|
|
1679
|
-
Type
|
|
1680
|
-
Type
|
|
1909
|
+
Type.Literal("private"),
|
|
1910
|
+
Type.Literal("moltnet"),
|
|
1911
|
+
Type.Literal("public")
|
|
1681
1912
|
];
|
|
1682
|
-
Type
|
|
1913
|
+
Type.Union(visibilityLiterals, { description: "Entry visibility level" });
|
|
1683
1914
|
var ENTRY_TYPE_VALUES = [
|
|
1684
1915
|
"episodic",
|
|
1685
1916
|
"semantic",
|
|
@@ -1687,362 +1918,384 @@ var ENTRY_TYPE_VALUES = [
|
|
|
1687
1918
|
"reflection"
|
|
1688
1919
|
];
|
|
1689
1920
|
var entryTypeLiterals = [
|
|
1690
|
-
Type
|
|
1691
|
-
Type
|
|
1692
|
-
Type
|
|
1693
|
-
Type
|
|
1921
|
+
Type.Literal("episodic"),
|
|
1922
|
+
Type.Literal("semantic"),
|
|
1923
|
+
Type.Literal("procedural"),
|
|
1924
|
+
Type.Literal("reflection")
|
|
1694
1925
|
];
|
|
1695
|
-
var EntryTypeSchema = Type
|
|
1926
|
+
var EntryTypeSchema = Type.Union(entryTypeLiterals, { description: "Entry memory type" });
|
|
1696
1927
|
/** Regex fragment matching a single entry type value. */
|
|
1697
1928
|
var ENTRY_TYPE_PATTERN = `(${ENTRY_TYPE_VALUES.join("|")})`;
|
|
1698
1929
|
`${ENTRY_TYPE_PATTERN}${ENTRY_TYPE_PATTERN}`, ENTRY_TYPE_VALUES.length - 1;
|
|
1699
|
-
var PublicKeySchema = Type
|
|
1930
|
+
var PublicKeySchema = Type.String({
|
|
1700
1931
|
pattern: "^ed25519:[A-Za-z0-9+/=]+$",
|
|
1701
1932
|
description: "Ed25519 public key with prefix"
|
|
1702
1933
|
});
|
|
1703
|
-
var FingerprintSchema = Type
|
|
1934
|
+
var FingerprintSchema = Type.String({
|
|
1704
1935
|
pattern: "^[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}$",
|
|
1705
1936
|
description: "Key fingerprint (A1B2-C3D4-E5F6-G7H8)"
|
|
1706
1937
|
});
|
|
1707
|
-
Type
|
|
1708
|
-
title: Type
|
|
1709
|
-
content: Type
|
|
1938
|
+
Type.Object({
|
|
1939
|
+
title: Type.Optional(Type.String({ maxLength: 255 })),
|
|
1940
|
+
content: Type.String({
|
|
1710
1941
|
minLength: 1,
|
|
1711
1942
|
maxLength: 1e5
|
|
1712
1943
|
}),
|
|
1713
|
-
tags: Type
|
|
1944
|
+
tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
|
|
1714
1945
|
});
|
|
1715
|
-
Type
|
|
1716
|
-
title: Type
|
|
1717
|
-
content: Type
|
|
1946
|
+
Type.Object({
|
|
1947
|
+
title: Type.Optional(Type.String({ maxLength: 255 })),
|
|
1948
|
+
content: Type.Optional(Type.String({
|
|
1718
1949
|
minLength: 1,
|
|
1719
1950
|
maxLength: 1e5
|
|
1720
1951
|
})),
|
|
1721
|
-
tags: Type
|
|
1952
|
+
tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
|
|
1722
1953
|
});
|
|
1723
|
-
Type
|
|
1724
|
-
query: Type
|
|
1954
|
+
Type.Object({
|
|
1955
|
+
query: Type.Optional(Type.String({
|
|
1725
1956
|
minLength: 1,
|
|
1726
1957
|
maxLength: 500
|
|
1727
1958
|
})),
|
|
1728
|
-
tags: Type
|
|
1959
|
+
tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), {
|
|
1729
1960
|
minItems: 1,
|
|
1730
1961
|
maxItems: 20,
|
|
1731
1962
|
description: "Filter: entry must have ALL specified tags"
|
|
1732
1963
|
})),
|
|
1733
|
-
limit: Type
|
|
1964
|
+
limit: Type.Optional(Type.Number({
|
|
1734
1965
|
minimum: 1,
|
|
1735
1966
|
maximum: 100,
|
|
1736
1967
|
default: 20
|
|
1737
1968
|
})),
|
|
1738
|
-
offset: Type
|
|
1969
|
+
offset: Type.Optional(Type.Number({
|
|
1739
1970
|
minimum: 0,
|
|
1740
1971
|
default: 0
|
|
1741
1972
|
}))
|
|
1742
1973
|
});
|
|
1743
|
-
Type
|
|
1974
|
+
Type.Object({
|
|
1744
1975
|
identityId: UuidSchema,
|
|
1745
1976
|
publicKey: PublicKeySchema,
|
|
1746
1977
|
fingerprint: FingerprintSchema,
|
|
1747
1978
|
createdAt: TimestampSchema
|
|
1748
1979
|
});
|
|
1749
|
-
Type
|
|
1980
|
+
Type.Object({
|
|
1750
1981
|
publicKey: PublicKeySchema,
|
|
1751
1982
|
fingerprint: FingerprintSchema
|
|
1752
1983
|
});
|
|
1753
|
-
Type
|
|
1984
|
+
Type.Object({ message: Type.String({
|
|
1754
1985
|
minLength: 1,
|
|
1755
1986
|
maxLength: 1e4
|
|
1756
1987
|
}) });
|
|
1757
|
-
Type
|
|
1758
|
-
message: Type
|
|
1759
|
-
signature: Type
|
|
1988
|
+
Type.Object({
|
|
1989
|
+
message: Type.String(),
|
|
1990
|
+
signature: Type.String({ description: "Base64 encoded Ed25519 signature" }),
|
|
1760
1991
|
publicKey: PublicKeySchema
|
|
1761
1992
|
});
|
|
1762
|
-
Type
|
|
1763
|
-
message: Type
|
|
1993
|
+
Type.Object({
|
|
1994
|
+
message: Type.String({
|
|
1764
1995
|
minLength: 1,
|
|
1765
1996
|
maxLength: 1e4
|
|
1766
1997
|
}),
|
|
1767
|
-
signature: Type
|
|
1998
|
+
signature: Type.String({ description: "Base64 encoded signature" }),
|
|
1768
1999
|
publicKey: PublicKeySchema
|
|
1769
2000
|
});
|
|
1770
|
-
Type
|
|
1771
|
-
valid: Type
|
|
1772
|
-
signer: Type
|
|
2001
|
+
Type.Object({
|
|
2002
|
+
valid: Type.Boolean(),
|
|
2003
|
+
signer: Type.Optional(Type.Object({ fingerprint: FingerprintSchema }))
|
|
1773
2004
|
});
|
|
1774
|
-
var BaseAuthContextSchema = Type
|
|
2005
|
+
var BaseAuthContextSchema = Type.Object({
|
|
1775
2006
|
identityId: UuidSchema,
|
|
1776
|
-
scopes: Type
|
|
1777
|
-
subjectType: Type
|
|
1778
|
-
currentTeamId: Type
|
|
2007
|
+
scopes: Type.Array(Type.String()),
|
|
2008
|
+
subjectType: Type.Union([Type.Literal("agent"), Type.Literal("human")]),
|
|
2009
|
+
currentTeamId: Type.Union([UuidSchema, Type.Null()])
|
|
1779
2010
|
});
|
|
1780
|
-
var AgentAuthContextSchema = Type
|
|
1781
|
-
subjectType: Type
|
|
2011
|
+
var AgentAuthContextSchema = Type.Intersect([BaseAuthContextSchema, Type.Object({
|
|
2012
|
+
subjectType: Type.Literal("agent"),
|
|
1782
2013
|
publicKey: PublicKeySchema,
|
|
1783
2014
|
fingerprint: FingerprintSchema,
|
|
1784
|
-
clientId: Type
|
|
2015
|
+
clientId: Type.String()
|
|
1785
2016
|
})]);
|
|
1786
|
-
var HumanAuthContextSchema = Type
|
|
1787
|
-
subjectType: Type
|
|
1788
|
-
clientId: Type
|
|
2017
|
+
var HumanAuthContextSchema = Type.Intersect([BaseAuthContextSchema, Type.Object({
|
|
2018
|
+
subjectType: Type.Literal("human"),
|
|
2019
|
+
clientId: Type.Union([Type.String(), Type.Null()])
|
|
1789
2020
|
})]);
|
|
1790
|
-
Type
|
|
1791
|
-
Type
|
|
1792
|
-
success: Type
|
|
1793
|
-
message: Type
|
|
2021
|
+
Type.Union([AgentAuthContextSchema, HumanAuthContextSchema]);
|
|
2022
|
+
Type.Object({
|
|
2023
|
+
success: Type.Boolean(),
|
|
2024
|
+
message: Type.Optional(Type.String())
|
|
1794
2025
|
});
|
|
1795
|
-
Type
|
|
1796
|
-
Type
|
|
2026
|
+
Type.Object({ diaryId: UuidSchema });
|
|
2027
|
+
Type.Object({
|
|
1797
2028
|
diaryId: UuidSchema,
|
|
1798
2029
|
entryId: UuidSchema
|
|
1799
2030
|
});
|
|
1800
|
-
Type
|
|
1801
|
-
Type
|
|
1802
|
-
Type
|
|
2031
|
+
Type.Object({ entryId: UuidSchema });
|
|
2032
|
+
Type.Object({ id: UuidSchema });
|
|
2033
|
+
Type.Object({
|
|
1803
2034
|
publicKey: PublicKeySchema,
|
|
1804
2035
|
fingerprint: FingerprintSchema,
|
|
1805
|
-
proof: Type
|
|
2036
|
+
proof: Type.String({
|
|
1806
2037
|
minLength: 1,
|
|
1807
2038
|
maxLength: 256
|
|
1808
2039
|
}),
|
|
1809
|
-
credentialType: Type
|
|
1810
|
-
agentName: Type
|
|
2040
|
+
credentialType: Type.Literal("oauth2"),
|
|
2041
|
+
agentName: Type.String({
|
|
1811
2042
|
minLength: 1,
|
|
1812
2043
|
maxLength: 34
|
|
1813
2044
|
}),
|
|
1814
|
-
org: Type
|
|
2045
|
+
org: Type.Optional(Type.String({
|
|
1815
2046
|
minLength: 1,
|
|
1816
2047
|
maxLength: 39,
|
|
1817
2048
|
pattern: "^[a-zA-Z0-9-]+$",
|
|
1818
2049
|
description: "GitHub organization name. When provided, the GitHub App will be created under this org instead of the personal account."
|
|
1819
2050
|
}))
|
|
1820
2051
|
});
|
|
1821
|
-
Type
|
|
1822
|
-
workflowId: Type
|
|
1823
|
-
manifestFormUrl: Type
|
|
2052
|
+
Type.Object({
|
|
2053
|
+
workflowId: Type.String(),
|
|
2054
|
+
manifestFormUrl: Type.String()
|
|
1824
2055
|
});
|
|
1825
|
-
Type
|
|
1826
|
-
status: Type
|
|
1827
|
-
Type
|
|
1828
|
-
Type
|
|
1829
|
-
Type
|
|
1830
|
-
Type
|
|
1831
|
-
Type
|
|
2056
|
+
Type.Object({
|
|
2057
|
+
status: Type.Union([
|
|
2058
|
+
Type.Literal("awaiting_github"),
|
|
2059
|
+
Type.Literal("github_code_ready"),
|
|
2060
|
+
Type.Literal("awaiting_installation"),
|
|
2061
|
+
Type.Literal("completed"),
|
|
2062
|
+
Type.Literal("failed")
|
|
1832
2063
|
]),
|
|
1833
|
-
githubCode: Type
|
|
1834
|
-
identityId: Type
|
|
1835
|
-
clientId: Type
|
|
1836
|
-
clientSecret: Type
|
|
1837
|
-
installationId: Type
|
|
2064
|
+
githubCode: Type.Optional(Type.String({ description: "GitHub manifest code sealed to the onboarding agent public key." })),
|
|
2065
|
+
identityId: Type.Optional(Type.String()),
|
|
2066
|
+
clientId: Type.Optional(Type.String()),
|
|
2067
|
+
clientSecret: Type.Optional(Type.String({ description: "OAuth2 client secret sealed to the onboarding agent public key." })),
|
|
2068
|
+
installationId: Type.Optional(Type.String())
|
|
1838
2069
|
});
|
|
1839
|
-
Type
|
|
1840
|
-
wf: Type
|
|
2070
|
+
Type.Object({
|
|
2071
|
+
wf: Type.String({
|
|
1841
2072
|
minLength: 1,
|
|
1842
2073
|
description: "Workflow ID baked into setup_url"
|
|
1843
2074
|
}),
|
|
1844
|
-
installation_id: Type
|
|
1845
|
-
setup_action: Type
|
|
2075
|
+
installation_id: Type.String({ minLength: 1 }),
|
|
2076
|
+
setup_action: Type.Optional(Type.String())
|
|
1846
2077
|
});
|
|
1847
|
-
Type
|
|
1848
|
-
Type
|
|
2078
|
+
Type.Object({ id: UuidSchema });
|
|
2079
|
+
Type.Object({
|
|
1849
2080
|
id: UuidSchema,
|
|
1850
2081
|
subjectId: UuidSchema
|
|
1851
2082
|
});
|
|
1852
|
-
Type
|
|
2083
|
+
Type.Object({
|
|
1853
2084
|
id: UuidSchema,
|
|
1854
2085
|
inviteId: UuidSchema
|
|
1855
2086
|
});
|
|
1856
|
-
Type
|
|
2087
|
+
Type.Object({ name: Type.String({
|
|
1857
2088
|
minLength: 1,
|
|
1858
2089
|
maxLength: 255
|
|
1859
2090
|
}) });
|
|
1860
|
-
Type
|
|
1861
|
-
role: Type
|
|
1862
|
-
|
|
2091
|
+
Type.Object({
|
|
2092
|
+
role: Type.Optional(Type.Union([
|
|
2093
|
+
Type.Literal("manager"),
|
|
2094
|
+
Type.Literal("executor"),
|
|
2095
|
+
Type.Literal("member")
|
|
2096
|
+
])),
|
|
2097
|
+
maxUses: Type.Optional(Type.Integer({
|
|
1863
2098
|
minimum: 1,
|
|
1864
2099
|
default: 1
|
|
1865
2100
|
})),
|
|
1866
|
-
expiresInHours: Type
|
|
2101
|
+
expiresInHours: Type.Optional(Type.Integer({
|
|
1867
2102
|
minimum: 1,
|
|
1868
2103
|
maximum: 720,
|
|
1869
2104
|
default: 168
|
|
1870
2105
|
}))
|
|
1871
2106
|
});
|
|
1872
|
-
Type
|
|
1873
|
-
Type
|
|
1874
|
-
|
|
1875
|
-
Type
|
|
1876
|
-
Type
|
|
1877
|
-
|
|
2107
|
+
Type.Object({ code: Type.String({ minLength: 1 }) });
|
|
2108
|
+
Type.Object({ role: Type.Union([
|
|
2109
|
+
Type.Literal("manager"),
|
|
2110
|
+
Type.Literal("executor"),
|
|
2111
|
+
Type.Literal("member")
|
|
2112
|
+
]) });
|
|
2113
|
+
var TeamRoleSchema = Type.Union([
|
|
2114
|
+
Type.Literal("owner"),
|
|
2115
|
+
Type.Literal("manager"),
|
|
2116
|
+
Type.Literal("executor"),
|
|
2117
|
+
Type.Literal("member")
|
|
1878
2118
|
]);
|
|
1879
|
-
Type
|
|
2119
|
+
Type.Object({
|
|
1880
2120
|
id: UuidSchema,
|
|
1881
|
-
name: Type
|
|
2121
|
+
name: Type.String()
|
|
1882
2122
|
});
|
|
1883
|
-
var DateTimeUnsafe = Type
|
|
1884
|
-
Type
|
|
2123
|
+
var DateTimeUnsafe = Type.Unsafe(Type.String({ format: "date-time" }));
|
|
2124
|
+
Type.Object({
|
|
1885
2125
|
id: UuidSchema,
|
|
1886
|
-
code: Type
|
|
1887
|
-
role: Type
|
|
1888
|
-
|
|
1889
|
-
|
|
2126
|
+
code: Type.String(),
|
|
2127
|
+
role: Type.Union([
|
|
2128
|
+
Type.Literal("manager"),
|
|
2129
|
+
Type.Literal("executor"),
|
|
2130
|
+
Type.Literal("member")
|
|
2131
|
+
]),
|
|
2132
|
+
maxUses: Type.Integer(),
|
|
2133
|
+
useCount: Type.Integer(),
|
|
1890
2134
|
expiresAt: DateTimeUnsafe,
|
|
1891
2135
|
createdAt: DateTimeUnsafe
|
|
1892
2136
|
});
|
|
1893
|
-
var TeamMemberSchema = Type
|
|
2137
|
+
var TeamMemberSchema = Type.Object({
|
|
1894
2138
|
subjectId: UuidSchema,
|
|
1895
|
-
subjectType: Type
|
|
2139
|
+
subjectType: Type.Union([Type.Literal("agent"), Type.Literal("human")]),
|
|
1896
2140
|
role: TeamRoleSchema,
|
|
1897
|
-
displayName: Type
|
|
1898
|
-
fingerprint: Type
|
|
1899
|
-
email: Type
|
|
2141
|
+
displayName: Type.String(),
|
|
2142
|
+
fingerprint: Type.Optional(Type.String()),
|
|
2143
|
+
email: Type.Optional(Type.String())
|
|
1900
2144
|
});
|
|
1901
|
-
Type
|
|
2145
|
+
Type.Object({
|
|
1902
2146
|
id: UuidSchema,
|
|
1903
|
-
name: Type
|
|
1904
|
-
personal: Type
|
|
1905
|
-
status: Type
|
|
2147
|
+
name: Type.String(),
|
|
2148
|
+
personal: Type.Boolean(),
|
|
2149
|
+
status: Type.String(),
|
|
1906
2150
|
role: TeamRoleSchema
|
|
1907
2151
|
});
|
|
1908
|
-
Type
|
|
2152
|
+
Type.Object({
|
|
1909
2153
|
id: UuidSchema,
|
|
1910
|
-
name: Type
|
|
1911
|
-
status: Type
|
|
1912
|
-
personal: Type
|
|
2154
|
+
name: Type.String(),
|
|
2155
|
+
status: Type.String(),
|
|
2156
|
+
personal: Type.Boolean(),
|
|
1913
2157
|
createdAt: DateTimeUnsafe,
|
|
1914
2158
|
updatedAt: DateTimeUnsafe,
|
|
1915
|
-
members: Type
|
|
2159
|
+
members: Type.Array(TeamMemberSchema)
|
|
1916
2160
|
});
|
|
1917
|
-
Type
|
|
2161
|
+
Type.Object({
|
|
1918
2162
|
teamId: UuidSchema,
|
|
1919
|
-
role: Type
|
|
2163
|
+
role: Type.Union([
|
|
2164
|
+
Type.Literal("manager"),
|
|
2165
|
+
Type.Literal("executor"),
|
|
2166
|
+
Type.Literal("member")
|
|
2167
|
+
])
|
|
1920
2168
|
});
|
|
1921
|
-
Type
|
|
1922
|
-
updated: Type
|
|
1923
|
-
role: Type
|
|
2169
|
+
Type.Object({
|
|
2170
|
+
updated: Type.Boolean(),
|
|
2171
|
+
role: Type.Union([
|
|
2172
|
+
Type.Literal("manager"),
|
|
2173
|
+
Type.Literal("executor"),
|
|
2174
|
+
Type.Literal("member")
|
|
2175
|
+
])
|
|
1924
2176
|
});
|
|
1925
|
-
Type
|
|
1926
|
-
Type
|
|
1927
|
-
var FoundingMemberSchema = Type
|
|
2177
|
+
Type.Object({ deleted: Type.Boolean() });
|
|
2178
|
+
Type.Object({ removed: Type.Boolean() });
|
|
2179
|
+
var FoundingMemberSchema = Type.Object({
|
|
1928
2180
|
subjectId: UuidSchema,
|
|
1929
|
-
subjectNs: Type
|
|
1930
|
-
role: Type
|
|
1931
|
-
Type
|
|
1932
|
-
Type
|
|
1933
|
-
Type
|
|
2181
|
+
subjectNs: Type.Union([Type.Literal("Agent"), Type.Literal("Human")]),
|
|
2182
|
+
role: Type.Union([
|
|
2183
|
+
Type.Literal("owner"),
|
|
2184
|
+
Type.Literal("manager"),
|
|
2185
|
+
Type.Literal("executor"),
|
|
2186
|
+
Type.Literal("member")
|
|
1934
2187
|
])
|
|
1935
2188
|
});
|
|
1936
|
-
Type
|
|
1937
|
-
name: Type
|
|
2189
|
+
Type.Object({
|
|
2190
|
+
name: Type.String({
|
|
1938
2191
|
minLength: 1,
|
|
1939
2192
|
maxLength: 255
|
|
1940
2193
|
}),
|
|
1941
|
-
foundingMembers: Type
|
|
2194
|
+
foundingMembers: Type.Optional(Type.Array(FoundingMemberSchema, { minItems: 1 }))
|
|
1942
2195
|
});
|
|
1943
|
-
Type
|
|
2196
|
+
Type.Object({
|
|
1944
2197
|
id: UuidSchema,
|
|
1945
|
-
name: Type
|
|
1946
|
-
status: Type
|
|
1947
|
-
workflowId: Type
|
|
2198
|
+
name: Type.String(),
|
|
2199
|
+
status: Type.String(),
|
|
2200
|
+
workflowId: Type.Optional(Type.String())
|
|
1948
2201
|
});
|
|
1949
|
-
Type
|
|
1950
|
-
Type
|
|
1951
|
-
accepted: Type
|
|
1952
|
-
teamStatus: Type
|
|
2202
|
+
Type.Object({});
|
|
2203
|
+
Type.Object({
|
|
2204
|
+
accepted: Type.Boolean(),
|
|
2205
|
+
teamStatus: Type.String()
|
|
1953
2206
|
});
|
|
1954
|
-
Type
|
|
1955
|
-
Type
|
|
1956
|
-
var TransferResponseSchema = Type
|
|
2207
|
+
Type.Object({ destinationTeamId: UuidSchema });
|
|
2208
|
+
Type.Object({ transferId: UuidSchema });
|
|
2209
|
+
var TransferResponseSchema = Type.Object({
|
|
1957
2210
|
id: UuidSchema,
|
|
1958
2211
|
diaryId: UuidSchema,
|
|
1959
2212
|
sourceTeamId: UuidSchema,
|
|
1960
2213
|
destinationTeamId: UuidSchema,
|
|
1961
|
-
status: Type
|
|
2214
|
+
status: Type.String(),
|
|
1962
2215
|
initiatedBy: UuidSchema,
|
|
1963
|
-
expiresAt: Type
|
|
1964
|
-
createdAt: Type
|
|
2216
|
+
expiresAt: Type.Unsafe(Type.String({ format: "date-time" })),
|
|
2217
|
+
createdAt: Type.Unsafe(Type.String({ format: "date-time" }))
|
|
1965
2218
|
});
|
|
1966
|
-
Type
|
|
1967
|
-
Type
|
|
1968
|
-
Type
|
|
2219
|
+
Type.Object({ items: Type.Array(TransferResponseSchema) });
|
|
2220
|
+
Type.Object({ groupId: UuidSchema });
|
|
2221
|
+
Type.Object({
|
|
1969
2222
|
groupId: UuidSchema,
|
|
1970
2223
|
subjectId: UuidSchema
|
|
1971
2224
|
});
|
|
1972
|
-
Type
|
|
2225
|
+
Type.Object({ name: Type.String({
|
|
1973
2226
|
minLength: 1,
|
|
1974
2227
|
maxLength: 255
|
|
1975
2228
|
}) });
|
|
1976
|
-
Type
|
|
2229
|
+
Type.Object({
|
|
1977
2230
|
subjectId: UuidSchema,
|
|
1978
|
-
subjectNs: Type
|
|
2231
|
+
subjectNs: Type.Optional(Type.Union([Type.Literal("Agent"), Type.Literal("Human")]))
|
|
1979
2232
|
});
|
|
1980
|
-
Type
|
|
2233
|
+
Type.Object({
|
|
1981
2234
|
id: UuidSchema,
|
|
1982
|
-
name: Type
|
|
2235
|
+
name: Type.String(),
|
|
1983
2236
|
teamId: UuidSchema
|
|
1984
2237
|
});
|
|
1985
|
-
var GroupMemberResponseSchema = Type
|
|
2238
|
+
var GroupMemberResponseSchema = Type.Object({
|
|
1986
2239
|
subjectId: UuidSchema,
|
|
1987
|
-
subjectNs: Type
|
|
2240
|
+
subjectNs: Type.String()
|
|
1988
2241
|
});
|
|
1989
|
-
Type
|
|
2242
|
+
Type.Object({
|
|
1990
2243
|
id: UuidSchema,
|
|
1991
|
-
name: Type
|
|
2244
|
+
name: Type.String(),
|
|
1992
2245
|
teamId: UuidSchema,
|
|
1993
2246
|
createdAt: DateTimeUnsafe,
|
|
1994
|
-
members: Type
|
|
2247
|
+
members: Type.Array(GroupMemberResponseSchema)
|
|
1995
2248
|
});
|
|
1996
|
-
var DiaryGrantRoleSchema = Type
|
|
1997
|
-
var GrantSubjectNsSchema = Type
|
|
1998
|
-
Type
|
|
1999
|
-
Type
|
|
2000
|
-
Type
|
|
2249
|
+
var DiaryGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
|
|
2250
|
+
var GrantSubjectNsSchema = Type.Union([
|
|
2251
|
+
Type.Literal("Agent"),
|
|
2252
|
+
Type.Literal("Human"),
|
|
2253
|
+
Type.Literal("Group")
|
|
2001
2254
|
]);
|
|
2002
|
-
Type
|
|
2255
|
+
Type.Object({
|
|
2003
2256
|
subjectId: UuidSchema,
|
|
2004
2257
|
subjectNs: GrantSubjectNsSchema,
|
|
2005
2258
|
role: DiaryGrantRoleSchema
|
|
2006
2259
|
});
|
|
2007
|
-
Type
|
|
2260
|
+
Type.Object({
|
|
2008
2261
|
subjectId: UuidSchema,
|
|
2009
2262
|
subjectNs: GrantSubjectNsSchema,
|
|
2010
2263
|
role: DiaryGrantRoleSchema
|
|
2011
2264
|
});
|
|
2012
|
-
var DiaryGrantResponseSchema = Type
|
|
2265
|
+
var DiaryGrantResponseSchema = Type.Object({
|
|
2013
2266
|
subjectId: UuidSchema,
|
|
2014
2267
|
subjectNs: GrantSubjectNsSchema,
|
|
2015
2268
|
role: DiaryGrantRoleSchema
|
|
2016
2269
|
});
|
|
2017
|
-
Type
|
|
2018
|
-
Type
|
|
2019
|
-
var TaskGrantRoleSchema = Type
|
|
2020
|
-
Type
|
|
2270
|
+
Type.Object({ grants: Type.Array(DiaryGrantResponseSchema) });
|
|
2271
|
+
Type.Object({ revoked: Type.Boolean() });
|
|
2272
|
+
var TaskGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
|
|
2273
|
+
Type.Object({
|
|
2021
2274
|
subjectId: UuidSchema,
|
|
2022
2275
|
subjectNs: GrantSubjectNsSchema,
|
|
2023
2276
|
role: TaskGrantRoleSchema
|
|
2024
2277
|
});
|
|
2025
|
-
Type
|
|
2278
|
+
Type.Object({
|
|
2026
2279
|
subjectId: UuidSchema,
|
|
2027
2280
|
subjectNs: GrantSubjectNsSchema,
|
|
2028
2281
|
role: TaskGrantRoleSchema
|
|
2029
2282
|
});
|
|
2030
|
-
var TaskGrantResponseSchema = Type
|
|
2283
|
+
var TaskGrantResponseSchema = Type.Object({
|
|
2031
2284
|
subjectId: UuidSchema,
|
|
2032
2285
|
subjectNs: GrantSubjectNsSchema,
|
|
2033
2286
|
role: TaskGrantRoleSchema
|
|
2034
2287
|
});
|
|
2035
|
-
Type
|
|
2036
|
-
Type
|
|
2288
|
+
Type.Object({ grants: Type.Array(TaskGrantResponseSchema) });
|
|
2289
|
+
Type.Object({ "x-moltnet-team-id": Type.String({
|
|
2037
2290
|
format: "uuid",
|
|
2038
2291
|
description: "Team ID (UUID) that will own the resource. Required."
|
|
2039
2292
|
}) });
|
|
2040
|
-
Type
|
|
2293
|
+
Type.Object({ "x-moltnet-team-id": Type.Optional(Type.String({
|
|
2041
2294
|
format: "uuid",
|
|
2042
2295
|
description: "Team ID (UUID) for scoping the request. Optional."
|
|
2043
2296
|
})) });
|
|
2044
|
-
Type
|
|
2045
|
-
kind: Type
|
|
2297
|
+
Type.Object({
|
|
2298
|
+
kind: Type.Literal("agent"),
|
|
2046
2299
|
identityId: UuidSchema,
|
|
2047
2300
|
fingerprint: FingerprintSchema,
|
|
2048
2301
|
publicKey: PublicKeySchema
|
|
@@ -2050,25 +2303,25 @@ Type$1.Object({
|
|
|
2050
2303
|
$id: "AgentPrincipal",
|
|
2051
2304
|
additionalProperties: false
|
|
2052
2305
|
});
|
|
2053
|
-
Type
|
|
2054
|
-
kind: Type
|
|
2306
|
+
Type.Object({
|
|
2307
|
+
kind: Type.Literal("human"),
|
|
2055
2308
|
humanId: UuidSchema,
|
|
2056
|
-
identityId: Type
|
|
2309
|
+
identityId: Type.Union([UuidSchema, Type.Null()])
|
|
2057
2310
|
}, {
|
|
2058
2311
|
$id: "HumanPrincipal",
|
|
2059
2312
|
additionalProperties: false
|
|
2060
2313
|
});
|
|
2061
|
-
var principalUnionVariants = [Type
|
|
2062
|
-
kind: Type
|
|
2314
|
+
var principalUnionVariants = [Type.Object({
|
|
2315
|
+
kind: Type.Literal("agent"),
|
|
2063
2316
|
identityId: UuidSchema,
|
|
2064
2317
|
fingerprint: FingerprintSchema,
|
|
2065
2318
|
publicKey: PublicKeySchema
|
|
2066
|
-
}, { additionalProperties: false }), Type
|
|
2067
|
-
kind: Type
|
|
2319
|
+
}, { additionalProperties: false }), Type.Object({
|
|
2320
|
+
kind: Type.Literal("human"),
|
|
2068
2321
|
humanId: UuidSchema,
|
|
2069
|
-
identityId: Type
|
|
2322
|
+
identityId: Type.Union([UuidSchema, Type.Null()])
|
|
2070
2323
|
}, { additionalProperties: false })];
|
|
2071
|
-
Type
|
|
2324
|
+
Type.Union(principalUnionVariants, {
|
|
2072
2325
|
$id: "PrincipalIdentity",
|
|
2073
2326
|
discriminator: { propertyName: "kind" }
|
|
2074
2327
|
});
|
|
@@ -2085,50 +2338,50 @@ Type$1.Union(principalUnionVariants, {
|
|
|
2085
2338
|
* Structurally identical to `PrincipalIdentitySchema` (they share the
|
|
2086
2339
|
* variants array); change one, change both.
|
|
2087
2340
|
*/
|
|
2088
|
-
var PrincipalIdentitySchemaInline = Type
|
|
2341
|
+
var PrincipalIdentitySchemaInline = Type.Union(principalUnionVariants, { discriminator: { propertyName: "kind" } });
|
|
2089
2342
|
//#endregion
|
|
2090
2343
|
//#region ../models/src/problem-details.ts
|
|
2091
|
-
var ProblemCodeSchema = Type
|
|
2092
|
-
Type
|
|
2093
|
-
Type
|
|
2094
|
-
Type
|
|
2095
|
-
Type
|
|
2096
|
-
Type
|
|
2097
|
-
Type
|
|
2098
|
-
Type
|
|
2099
|
-
Type
|
|
2100
|
-
Type
|
|
2101
|
-
Type
|
|
2102
|
-
Type
|
|
2103
|
-
Type
|
|
2104
|
-
Type
|
|
2105
|
-
Type
|
|
2106
|
-
Type
|
|
2107
|
-
Type
|
|
2108
|
-
Type
|
|
2109
|
-
Type
|
|
2110
|
-
Type
|
|
2111
|
-
Type
|
|
2112
|
-
Type
|
|
2113
|
-
Type
|
|
2114
|
-
Type
|
|
2115
|
-
Type
|
|
2116
|
-
Type
|
|
2117
|
-
Type
|
|
2118
|
-
Type
|
|
2119
|
-
Type
|
|
2344
|
+
var ProblemCodeSchema = Type.Union([
|
|
2345
|
+
Type.Literal("UNAUTHORIZED"),
|
|
2346
|
+
Type.Literal("FORBIDDEN"),
|
|
2347
|
+
Type.Literal("NOT_FOUND"),
|
|
2348
|
+
Type.Literal("CONFLICT"),
|
|
2349
|
+
Type.Literal("UNSUPPORTED_MEDIA_TYPE"),
|
|
2350
|
+
Type.Literal("VALIDATION_FAILED"),
|
|
2351
|
+
Type.Literal("INVALID_CHALLENGE"),
|
|
2352
|
+
Type.Literal("INVALID_SIGNATURE"),
|
|
2353
|
+
Type.Literal("RATE_LIMIT_EXCEEDED"),
|
|
2354
|
+
Type.Literal("SERIALIZATION_EXHAUSTED"),
|
|
2355
|
+
Type.Literal("SIGNING_REQUEST_EXPIRED"),
|
|
2356
|
+
Type.Literal("SIGNING_REQUEST_ALREADY_COMPLETED"),
|
|
2357
|
+
Type.Literal("SIGNING_REQUEST_LIMIT_REACHED"),
|
|
2358
|
+
Type.Literal("REGISTRATION_FAILED"),
|
|
2359
|
+
Type.Literal("UPSTREAM_ERROR"),
|
|
2360
|
+
Type.Literal("SERVICE_UNAVAILABLE"),
|
|
2361
|
+
Type.Literal("INTERNAL_SERVER_ERROR"),
|
|
2362
|
+
Type.Literal("TEAM_PERSONAL_IMMUTABLE"),
|
|
2363
|
+
Type.Literal("TEAM_NOT_ACTIVE"),
|
|
2364
|
+
Type.Literal("INVITE_EXPIRED"),
|
|
2365
|
+
Type.Literal("INVITE_EXHAUSTED"),
|
|
2366
|
+
Type.Literal("TEAM_LAST_OWNER"),
|
|
2367
|
+
Type.Literal("TEAM_ALREADY_ACTIVE"),
|
|
2368
|
+
Type.Literal("TEAM_NOT_FOUNDING"),
|
|
2369
|
+
Type.Literal("FOUNDING_ALREADY_ACCEPTED"),
|
|
2370
|
+
Type.Literal("DIARY_TRANSFER_PENDING"),
|
|
2371
|
+
Type.Literal("DIARY_TRANSFER_NOT_FOUND"),
|
|
2372
|
+
Type.Literal("DIARY_TRANSFER_ALREADY_RESOLVED")
|
|
2120
2373
|
]);
|
|
2121
|
-
var ProblemDetailsSchema = Type
|
|
2122
|
-
type: Type
|
|
2123
|
-
title: Type
|
|
2124
|
-
status: Type
|
|
2374
|
+
var ProblemDetailsSchema = Type.Object({
|
|
2375
|
+
type: Type.String({ format: "uri" }),
|
|
2376
|
+
title: Type.String(),
|
|
2377
|
+
status: Type.Integer({
|
|
2125
2378
|
minimum: 100,
|
|
2126
2379
|
maximum: 599
|
|
2127
2380
|
}),
|
|
2128
2381
|
code: ProblemCodeSchema,
|
|
2129
|
-
detail: Type
|
|
2130
|
-
instance: Type
|
|
2131
|
-
retryAfter: Type
|
|
2382
|
+
detail: Type.Optional(Type.String()),
|
|
2383
|
+
instance: Type.Optional(Type.String()),
|
|
2384
|
+
retryAfter: Type.Optional(Type.Integer({
|
|
2132
2385
|
minimum: 0,
|
|
2133
2386
|
description: "Non-negative delay in seconds before retrying, matching the Retry-After response header when present."
|
|
2134
2387
|
}))
|
|
@@ -2136,63 +2389,63 @@ var ProblemDetailsSchema = Type$1.Object({
|
|
|
2136
2389
|
$id: "ProblemDetails",
|
|
2137
2390
|
additionalProperties: true
|
|
2138
2391
|
});
|
|
2139
|
-
Type
|
|
2140
|
-
field: Type
|
|
2141
|
-
message: Type
|
|
2142
|
-
code: Type
|
|
2392
|
+
Type.Object({
|
|
2393
|
+
field: Type.String(),
|
|
2394
|
+
message: Type.String(),
|
|
2395
|
+
code: Type.Optional(Type.String())
|
|
2143
2396
|
}, {
|
|
2144
2397
|
$id: "ValidationError",
|
|
2145
2398
|
additionalProperties: false
|
|
2146
2399
|
});
|
|
2147
|
-
Type
|
|
2148
|
-
resource: Type
|
|
2149
|
-
id: Type
|
|
2150
|
-
keys: Type
|
|
2400
|
+
Type.Object({
|
|
2401
|
+
resource: Type.String(),
|
|
2402
|
+
id: Type.Optional(Type.String({ format: "uuid" })),
|
|
2403
|
+
keys: Type.Optional(Type.Record(Type.String(), Type.String()))
|
|
2151
2404
|
}, {
|
|
2152
2405
|
$id: "ConflictTarget",
|
|
2153
2406
|
additionalProperties: false
|
|
2154
2407
|
});
|
|
2155
|
-
Type
|
|
2156
|
-
constraint: Type
|
|
2157
|
-
target: Type
|
|
2408
|
+
Type.Object({
|
|
2409
|
+
constraint: Type.Optional(Type.String()),
|
|
2410
|
+
target: Type.Optional(Type.Ref("ConflictTarget"))
|
|
2158
2411
|
}, {
|
|
2159
2412
|
$id: "ConflictError",
|
|
2160
2413
|
additionalProperties: false
|
|
2161
2414
|
});
|
|
2162
|
-
var ConflictProblemDetailsSchema = Type
|
|
2163
|
-
Type
|
|
2164
|
-
type: Type
|
|
2165
|
-
severity: Type
|
|
2166
|
-
match: Type
|
|
2415
|
+
var ConflictProblemDetailsSchema = Type.Intersect([ProblemDetailsSchema, Type.Object({ conflict: Type.Ref("ConflictError") })], { $id: "ConflictProblemDetails" });
|
|
2416
|
+
Type.Object({
|
|
2417
|
+
type: Type.String(),
|
|
2418
|
+
severity: Type.Number(),
|
|
2419
|
+
match: Type.String()
|
|
2167
2420
|
}, {
|
|
2168
2421
|
$id: "InjectionThreat",
|
|
2169
2422
|
additionalProperties: false
|
|
2170
2423
|
});
|
|
2171
|
-
Type
|
|
2172
|
-
id: Type
|
|
2173
|
-
threats: Type
|
|
2424
|
+
Type.Intersect([ConflictProblemDetailsSchema, Type.Object({ flagged: Type.Optional(Type.Array(Type.Object({
|
|
2425
|
+
id: Type.String({ format: "uuid" }),
|
|
2426
|
+
threats: Type.Array(Type.Ref("InjectionThreat"))
|
|
2174
2427
|
}, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
|
|
2175
|
-
Type
|
|
2176
|
-
Type
|
|
2177
|
-
Type
|
|
2178
|
-
Type
|
|
2179
|
-
Type
|
|
2428
|
+
Type.Intersect([ProblemDetailsSchema, Type.Object({ errors: Type.Array(Type.Ref("ValidationError")) })], { $id: "ValidationProblemDetails" });
|
|
2429
|
+
Type.Union([
|
|
2430
|
+
Type.Literal("pack"),
|
|
2431
|
+
Type.Literal("entry"),
|
|
2432
|
+
Type.Literal("rendered_pack")
|
|
2180
2433
|
]);
|
|
2181
|
-
var ProvenanceGraphEdgeKindSchema = Type
|
|
2182
|
-
Type
|
|
2183
|
-
Type
|
|
2184
|
-
Type
|
|
2434
|
+
var ProvenanceGraphEdgeKindSchema = Type.Union([
|
|
2435
|
+
Type.Literal("includes"),
|
|
2436
|
+
Type.Literal("supersedes"),
|
|
2437
|
+
Type.Literal("rendered_from")
|
|
2185
2438
|
]);
|
|
2186
|
-
var ProvenanceGraphPackMetaSchema = Type
|
|
2439
|
+
var ProvenanceGraphPackMetaSchema = Type.Object({
|
|
2187
2440
|
packId: UuidSchema,
|
|
2188
2441
|
diaryId: UuidSchema,
|
|
2189
|
-
packCid: Type
|
|
2190
|
-
packType: Type
|
|
2191
|
-
packCodec: Type
|
|
2192
|
-
pinned: Type
|
|
2442
|
+
packCid: Type.String(),
|
|
2443
|
+
packType: Type.String(),
|
|
2444
|
+
packCodec: Type.String(),
|
|
2445
|
+
pinned: Type.Boolean(),
|
|
2193
2446
|
createdAt: TimestampSchema,
|
|
2194
|
-
expiresAt: Type
|
|
2195
|
-
supersedesPackId: Type
|
|
2447
|
+
expiresAt: Type.Union([TimestampSchema, Type.Null()]),
|
|
2448
|
+
supersedesPackId: Type.Union([UuidSchema, Type.Null()])
|
|
2196
2449
|
});
|
|
2197
2450
|
/**
|
|
2198
2451
|
* Discriminated creator embedded inside provenance-node response
|
|
@@ -2202,80 +2455,80 @@ var ProvenanceGraphPackMetaSchema = Type$1.Object({
|
|
|
2202
2455
|
* (`reference "PrincipalIdentity" resolves to more than one schema`).
|
|
2203
2456
|
*/
|
|
2204
2457
|
var ProvenanceGraphCreatorSchema = PrincipalIdentitySchemaInline;
|
|
2205
|
-
var ProvenanceGraphEntryMetaSchema = Type
|
|
2458
|
+
var ProvenanceGraphEntryMetaSchema = Type.Object({
|
|
2206
2459
|
entryId: UuidSchema,
|
|
2207
2460
|
diaryId: UuidSchema,
|
|
2208
2461
|
entryType: EntryTypeSchema,
|
|
2209
|
-
contentHash: Type
|
|
2462
|
+
contentHash: Type.Union([Type.String(), Type.Null()]),
|
|
2210
2463
|
createdAt: TimestampSchema,
|
|
2211
2464
|
updatedAt: TimestampSchema,
|
|
2212
|
-
signed: Type
|
|
2213
|
-
title: Type
|
|
2214
|
-
tags: Type
|
|
2215
|
-
creator: Type
|
|
2465
|
+
signed: Type.Boolean(),
|
|
2466
|
+
title: Type.Union([Type.String(), Type.Null()]),
|
|
2467
|
+
tags: Type.Array(Type.String()),
|
|
2468
|
+
creator: Type.Optional(ProvenanceGraphCreatorSchema)
|
|
2216
2469
|
});
|
|
2217
|
-
var ProvenanceGraphPackNodeSchema = Type
|
|
2218
|
-
id: Type
|
|
2219
|
-
kind: Type
|
|
2220
|
-
label: Type
|
|
2221
|
-
cid: Type
|
|
2222
|
-
meta: Type
|
|
2470
|
+
var ProvenanceGraphPackNodeSchema = Type.Object({
|
|
2471
|
+
id: Type.String(),
|
|
2472
|
+
kind: Type.Literal("pack"),
|
|
2473
|
+
label: Type.String(),
|
|
2474
|
+
cid: Type.Union([Type.String(), Type.Null()]),
|
|
2475
|
+
meta: Type.Intersect([ProvenanceGraphPackMetaSchema, Type.Object({ creator: Type.Optional(ProvenanceGraphCreatorSchema) })])
|
|
2223
2476
|
});
|
|
2224
|
-
var ProvenanceGraphEntryNodeSchema = Type
|
|
2225
|
-
id: Type
|
|
2226
|
-
kind: Type
|
|
2227
|
-
label: Type
|
|
2228
|
-
cid: Type
|
|
2477
|
+
var ProvenanceGraphEntryNodeSchema = Type.Object({
|
|
2478
|
+
id: Type.String(),
|
|
2479
|
+
kind: Type.Literal("entry"),
|
|
2480
|
+
label: Type.String(),
|
|
2481
|
+
cid: Type.Union([Type.String(), Type.Null()]),
|
|
2229
2482
|
meta: ProvenanceGraphEntryMetaSchema
|
|
2230
2483
|
});
|
|
2231
|
-
var ProvenanceGraphRenderedPackMetaSchema = Type
|
|
2484
|
+
var ProvenanceGraphRenderedPackMetaSchema = Type.Object({
|
|
2232
2485
|
renderedPackId: UuidSchema,
|
|
2233
2486
|
sourcePackId: UuidSchema,
|
|
2234
2487
|
diaryId: UuidSchema,
|
|
2235
|
-
packCid: Type
|
|
2236
|
-
renderMethod: Type
|
|
2237
|
-
totalTokens: Type
|
|
2238
|
-
pinned: Type
|
|
2488
|
+
packCid: Type.String(),
|
|
2489
|
+
renderMethod: Type.String(),
|
|
2490
|
+
totalTokens: Type.Number(),
|
|
2491
|
+
pinned: Type.Boolean(),
|
|
2239
2492
|
createdAt: TimestampSchema,
|
|
2240
|
-
expiresAt: Type
|
|
2241
|
-
creator: Type
|
|
2493
|
+
expiresAt: Type.Union([TimestampSchema, Type.Null()]),
|
|
2494
|
+
creator: Type.Optional(ProvenanceGraphCreatorSchema)
|
|
2242
2495
|
});
|
|
2243
|
-
var ProvenanceGraphRenderedPackNodeSchema = Type
|
|
2244
|
-
id: Type
|
|
2245
|
-
kind: Type
|
|
2246
|
-
label: Type
|
|
2247
|
-
cid: Type
|
|
2496
|
+
var ProvenanceGraphRenderedPackNodeSchema = Type.Object({
|
|
2497
|
+
id: Type.String(),
|
|
2498
|
+
kind: Type.Literal("rendered_pack"),
|
|
2499
|
+
label: Type.String(),
|
|
2500
|
+
cid: Type.Union([Type.String(), Type.Null()]),
|
|
2248
2501
|
meta: ProvenanceGraphRenderedPackMetaSchema
|
|
2249
2502
|
});
|
|
2250
|
-
var ProvenanceGraphNodeSchema = Type
|
|
2503
|
+
var ProvenanceGraphNodeSchema = Type.Union([
|
|
2251
2504
|
ProvenanceGraphPackNodeSchema,
|
|
2252
2505
|
ProvenanceGraphEntryNodeSchema,
|
|
2253
2506
|
ProvenanceGraphRenderedPackNodeSchema
|
|
2254
2507
|
]);
|
|
2255
|
-
var ProvenanceGraphEdgeSchema = Type
|
|
2256
|
-
id: Type
|
|
2257
|
-
from: Type
|
|
2258
|
-
to: Type
|
|
2508
|
+
var ProvenanceGraphEdgeSchema = Type.Object({
|
|
2509
|
+
id: Type.String(),
|
|
2510
|
+
from: Type.String(),
|
|
2511
|
+
to: Type.String(),
|
|
2259
2512
|
kind: ProvenanceGraphEdgeKindSchema,
|
|
2260
|
-
label: Type
|
|
2261
|
-
meta: Type
|
|
2262
|
-
Type
|
|
2263
|
-
Type
|
|
2264
|
-
Type
|
|
2265
|
-
Type
|
|
2513
|
+
label: Type.Optional(Type.String()),
|
|
2514
|
+
meta: Type.Optional(Type.Record(Type.String(), Type.Union([
|
|
2515
|
+
Type.String(),
|
|
2516
|
+
Type.Number(),
|
|
2517
|
+
Type.Boolean(),
|
|
2518
|
+
Type.Null()
|
|
2266
2519
|
])))
|
|
2267
2520
|
});
|
|
2268
|
-
var ProvenanceGraphMetadataSchema = Type
|
|
2269
|
-
format: Type
|
|
2521
|
+
var ProvenanceGraphMetadataSchema = Type.Object({
|
|
2522
|
+
format: Type.Literal("moltnet.provenance-graph/v1"),
|
|
2270
2523
|
generatedAt: TimestampSchema,
|
|
2271
|
-
rootNodeId: Type
|
|
2524
|
+
rootNodeId: Type.String(),
|
|
2272
2525
|
rootPackId: UuidSchema,
|
|
2273
|
-
depth: Type
|
|
2526
|
+
depth: Type.Number({ minimum: 0 })
|
|
2274
2527
|
});
|
|
2275
|
-
Type
|
|
2528
|
+
Type.Object({
|
|
2276
2529
|
metadata: ProvenanceGraphMetadataSchema,
|
|
2277
|
-
nodes: Type
|
|
2278
|
-
edges: Type
|
|
2530
|
+
nodes: Type.Array(ProvenanceGraphNodeSchema),
|
|
2531
|
+
edges: Type.Array(ProvenanceGraphEdgeSchema)
|
|
2279
2532
|
}, { $id: "ProvenanceGraph" });
|
|
2280
2533
|
//#endregion
|
|
2281
2534
|
//#region ../models/src/signer-constraint.ts
|
|
@@ -2284,25 +2537,25 @@ var SIGNER_CONSTRAINT_TYPE = {
|
|
|
2284
2537
|
TeamRole: "team-role",
|
|
2285
2538
|
Group: "group"
|
|
2286
2539
|
};
|
|
2287
|
-
Type
|
|
2288
|
-
Type
|
|
2289
|
-
type: Type
|
|
2290
|
-
id: Type
|
|
2540
|
+
Type.Union([
|
|
2541
|
+
Type.Object({
|
|
2542
|
+
type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Human),
|
|
2543
|
+
id: Type.String({ format: "uuid" })
|
|
2291
2544
|
}),
|
|
2292
|
-
Type
|
|
2293
|
-
type: Type
|
|
2545
|
+
Type.Object({
|
|
2546
|
+
type: Type.Literal(SIGNER_CONSTRAINT_TYPE.TeamRole),
|
|
2294
2547
|
id: TeamRoleSchema
|
|
2295
2548
|
}),
|
|
2296
|
-
Type
|
|
2297
|
-
type: Type
|
|
2298
|
-
id: Type
|
|
2549
|
+
Type.Object({
|
|
2550
|
+
type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Group),
|
|
2551
|
+
id: Type.String({ format: "uuid" })
|
|
2299
2552
|
})
|
|
2300
2553
|
]);
|
|
2301
2554
|
//#endregion
|
|
2302
2555
|
//#region ../models/src/signer-protocol.ts
|
|
2303
2556
|
function schemaRef(schema) {
|
|
2304
2557
|
const id = schemaId(schema);
|
|
2305
|
-
return Type
|
|
2558
|
+
return Type.Ref(id);
|
|
2306
2559
|
}
|
|
2307
2560
|
function schemaId(schema) {
|
|
2308
2561
|
const id = schema.$id;
|
|
@@ -2310,111 +2563,111 @@ function schemaId(schema) {
|
|
|
2310
2563
|
return id;
|
|
2311
2564
|
}
|
|
2312
2565
|
var SignerBase64UrlSchema = PreviewSignBase64UrlSchema;
|
|
2313
|
-
var SignerUuidSchema = Type
|
|
2566
|
+
var SignerUuidSchema = Type.String({
|
|
2314
2567
|
$id: "SignerUuid",
|
|
2315
2568
|
pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
|
|
2316
2569
|
});
|
|
2317
|
-
var SignerOperationSchema = Type
|
|
2318
|
-
Type
|
|
2319
|
-
Type
|
|
2320
|
-
Type
|
|
2570
|
+
var SignerOperationSchema = Type.Union([
|
|
2571
|
+
Type.Literal("credential-enrollment"),
|
|
2572
|
+
Type.Literal("credential-registration"),
|
|
2573
|
+
Type.Literal("signing-request")
|
|
2321
2574
|
], { $id: "SignerOperation" });
|
|
2322
2575
|
var SignerChallengeOperationSchema = PreviewSignChallengeOperationSchema;
|
|
2323
2576
|
var SignerPreviewSignPublicMaterialSchema = PreviewSignPublicMaterialSchema;
|
|
2324
2577
|
var SignerPreviewSignChallengeValueSchema = PreviewSignChallengeValueSchema;
|
|
2325
|
-
var SignerProblemSchema = Type
|
|
2326
|
-
code: Type
|
|
2327
|
-
message: Type
|
|
2578
|
+
var SignerProblemSchema = Type.Object({
|
|
2579
|
+
code: Type.String({ minLength: 1 }),
|
|
2580
|
+
message: Type.String({ minLength: 1 })
|
|
2328
2581
|
}, {
|
|
2329
2582
|
$id: "SignerProblem",
|
|
2330
2583
|
additionalProperties: false
|
|
2331
2584
|
});
|
|
2332
|
-
var SignerCeremonyParamsSchema = Type
|
|
2585
|
+
var SignerCeremonyParamsSchema = Type.Object({ ceremonyId: Type.Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
|
|
2333
2586
|
$id: "SignerCeremonyParams",
|
|
2334
2587
|
additionalProperties: false
|
|
2335
2588
|
});
|
|
2336
|
-
var SignerSessionSchema = Type
|
|
2337
|
-
version: Type
|
|
2338
|
-
token: Type
|
|
2339
|
-
expiresAt: Type
|
|
2589
|
+
var SignerSessionSchema = Type.Object({
|
|
2590
|
+
version: Type.Literal(1),
|
|
2591
|
+
token: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
|
|
2592
|
+
expiresAt: Type.String()
|
|
2340
2593
|
}, {
|
|
2341
2594
|
$id: "SignerSession",
|
|
2342
2595
|
additionalProperties: false
|
|
2343
2596
|
});
|
|
2344
|
-
var SignerEnrollmentCeremonyRequestSchema = Type
|
|
2345
|
-
version: Type
|
|
2346
|
-
operation: Type
|
|
2347
|
-
label: Type
|
|
2597
|
+
var SignerEnrollmentCeremonyRequestSchema = Type.Object({
|
|
2598
|
+
version: Type.Literal(1),
|
|
2599
|
+
operation: Type.Literal("credential-enrollment"),
|
|
2600
|
+
label: Type.String({
|
|
2348
2601
|
minLength: 1,
|
|
2349
2602
|
maxLength: 255
|
|
2350
2603
|
}),
|
|
2351
|
-
teamId: Type
|
|
2604
|
+
teamId: Type.Unsafe(schemaRef(SignerUuidSchema))
|
|
2352
2605
|
}, {
|
|
2353
2606
|
$id: "SignerEnrollmentCeremonyRequest",
|
|
2354
2607
|
additionalProperties: false
|
|
2355
2608
|
});
|
|
2356
|
-
var SignerChallengeCeremonyRequestSchema = Type
|
|
2357
|
-
version: Type
|
|
2358
|
-
operation: Type
|
|
2359
|
-
resourceId: Type
|
|
2360
|
-
challenge: Type
|
|
2609
|
+
var SignerChallengeCeremonyRequestSchema = Type.Object({
|
|
2610
|
+
version: Type.Literal(1),
|
|
2611
|
+
operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
|
|
2612
|
+
resourceId: Type.Unsafe(schemaRef(SignerUuidSchema)),
|
|
2613
|
+
challenge: Type.Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
|
|
2361
2614
|
}, {
|
|
2362
2615
|
$id: "SignerChallengeCeremonyRequest",
|
|
2363
2616
|
additionalProperties: false
|
|
2364
2617
|
});
|
|
2365
|
-
var SignerCeremonyRequestSchema = Type
|
|
2366
|
-
var SignerCeremonySchema = Type
|
|
2367
|
-
version: Type
|
|
2368
|
-
id: Type
|
|
2369
|
-
operation: Type
|
|
2370
|
-
approvalUrl: Type
|
|
2371
|
-
expiresAt: Type
|
|
2618
|
+
var SignerCeremonyRequestSchema = Type.Union([Type.Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Type.Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
|
|
2619
|
+
var SignerCeremonySchema = Type.Object({
|
|
2620
|
+
version: Type.Literal(1),
|
|
2621
|
+
id: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
|
|
2622
|
+
operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
|
|
2623
|
+
approvalUrl: Type.String(),
|
|
2624
|
+
expiresAt: Type.String()
|
|
2372
2625
|
}, {
|
|
2373
2626
|
$id: "SignerCeremony",
|
|
2374
2627
|
additionalProperties: false
|
|
2375
2628
|
});
|
|
2376
|
-
var SignerPendingResultSchema = Type
|
|
2377
|
-
version: Type
|
|
2378
|
-
status: Type
|
|
2379
|
-
operation: Type
|
|
2629
|
+
var SignerPendingResultSchema = Type.Object({
|
|
2630
|
+
version: Type.Literal(1),
|
|
2631
|
+
status: Type.Literal("pending"),
|
|
2632
|
+
operation: Type.Unsafe(schemaRef(SignerOperationSchema))
|
|
2380
2633
|
}, {
|
|
2381
2634
|
$id: "SignerPendingResult",
|
|
2382
2635
|
additionalProperties: false
|
|
2383
2636
|
});
|
|
2384
|
-
var SignerEnrollmentResultSchema = Type
|
|
2385
|
-
version: Type
|
|
2386
|
-
status: Type
|
|
2387
|
-
operation: Type
|
|
2388
|
-
publicMaterial: Type
|
|
2637
|
+
var SignerEnrollmentResultSchema = Type.Object({
|
|
2638
|
+
version: Type.Literal(1),
|
|
2639
|
+
status: Type.Literal("completed"),
|
|
2640
|
+
operation: Type.Literal("credential-enrollment"),
|
|
2641
|
+
publicMaterial: Type.Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
|
|
2389
2642
|
}, {
|
|
2390
2643
|
$id: "SignerEnrollmentResult",
|
|
2391
2644
|
additionalProperties: false
|
|
2392
2645
|
});
|
|
2393
2646
|
var SignerReceiptSchema = PreviewSignReceiptValueSchema;
|
|
2394
|
-
var SignerSignatureResultSchema = Type
|
|
2395
|
-
version: Type
|
|
2396
|
-
status: Type
|
|
2397
|
-
operation: Type
|
|
2398
|
-
receipt: Type
|
|
2647
|
+
var SignerSignatureResultSchema = Type.Object({
|
|
2648
|
+
version: Type.Literal(1),
|
|
2649
|
+
status: Type.Literal("completed"),
|
|
2650
|
+
operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
|
|
2651
|
+
receipt: Type.Unsafe(schemaRef(SignerReceiptSchema))
|
|
2399
2652
|
}, {
|
|
2400
2653
|
$id: "SignerSignatureResult",
|
|
2401
2654
|
additionalProperties: false
|
|
2402
2655
|
});
|
|
2403
|
-
var SignerFailedResultSchema = Type
|
|
2404
|
-
version: Type
|
|
2405
|
-
status: Type
|
|
2406
|
-
operation: Type
|
|
2407
|
-
code: Type
|
|
2408
|
-
message: Type
|
|
2656
|
+
var SignerFailedResultSchema = Type.Object({
|
|
2657
|
+
version: Type.Literal(1),
|
|
2658
|
+
status: Type.Literal("failed"),
|
|
2659
|
+
operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
|
|
2660
|
+
code: Type.String(),
|
|
2661
|
+
message: Type.String()
|
|
2409
2662
|
}, {
|
|
2410
2663
|
$id: "SignerFailedResult",
|
|
2411
2664
|
additionalProperties: false
|
|
2412
2665
|
});
|
|
2413
|
-
var SignerCeremonyResultSchema = Type
|
|
2414
|
-
Type
|
|
2415
|
-
Type
|
|
2416
|
-
Type
|
|
2417
|
-
Type
|
|
2666
|
+
var SignerCeremonyResultSchema = Type.Union([
|
|
2667
|
+
Type.Unsafe(schemaRef(SignerPendingResultSchema)),
|
|
2668
|
+
Type.Unsafe(schemaRef(SignerEnrollmentResultSchema)),
|
|
2669
|
+
Type.Unsafe(schemaRef(SignerSignatureResultSchema)),
|
|
2670
|
+
Type.Unsafe(schemaRef(SignerFailedResultSchema))
|
|
2418
2671
|
], { $id: "SignerCeremonyResult" });
|
|
2419
2672
|
({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
|
|
2420
2673
|
//#endregion
|
|
@@ -2425,39 +2678,39 @@ var TOOL_ENFORCEMENT_VALUES = [
|
|
|
2425
2678
|
"enforce"
|
|
2426
2679
|
];
|
|
2427
2680
|
var toolEnforcementLiterals = [
|
|
2428
|
-
Type
|
|
2429
|
-
Type
|
|
2430
|
-
Type
|
|
2681
|
+
Type.Literal(TOOL_ENFORCEMENT_VALUES[0]),
|
|
2682
|
+
Type.Literal(TOOL_ENFORCEMENT_VALUES[1]),
|
|
2683
|
+
Type.Literal(TOOL_ENFORCEMENT_VALUES[2])
|
|
2431
2684
|
];
|
|
2432
|
-
var ToolEnforcementSchema = Type
|
|
2685
|
+
var ToolEnforcementSchema = Type.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
|
|
2433
2686
|
//#endregion
|
|
2434
2687
|
//#region ../runtime-profiles/src/runtime-profiles.ts
|
|
2435
|
-
var RuntimeProfileName = Type
|
|
2688
|
+
var RuntimeProfileName = Type.String({
|
|
2436
2689
|
minLength: 1,
|
|
2437
2690
|
maxLength: 100,
|
|
2438
2691
|
pattern: "^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$"
|
|
2439
2692
|
});
|
|
2440
|
-
var RuntimeProfileEnvName = Type
|
|
2693
|
+
var RuntimeProfileEnvName = Type.String({
|
|
2441
2694
|
minLength: 1,
|
|
2442
2695
|
maxLength: 128,
|
|
2443
2696
|
pattern: "^[A-Z_][A-Z0-9_]*$"
|
|
2444
2697
|
});
|
|
2445
|
-
var RuntimeProfileToolName = Type
|
|
2698
|
+
var RuntimeProfileToolName = Type.String({
|
|
2446
2699
|
minLength: 1,
|
|
2447
2700
|
maxLength: 128,
|
|
2448
2701
|
pattern: "^[a-zA-Z0-9._/-]+$"
|
|
2449
2702
|
});
|
|
2450
2703
|
var RUNTIME_PROFILE_RUNTIME_KIND_PATTERN = "^[a-z][a-z0-9._-]{0,99}$";
|
|
2451
2704
|
var RUNTIME_PROFILE_RUNTIME_KIND_REGEXP = new RegExp(RUNTIME_PROFILE_RUNTIME_KIND_PATTERN);
|
|
2452
|
-
var RuntimeProfileRuntimeKind = Type
|
|
2705
|
+
var RuntimeProfileRuntimeKind = Type.String({
|
|
2453
2706
|
minLength: 1,
|
|
2454
2707
|
maxLength: 100,
|
|
2455
2708
|
pattern: RUNTIME_PROFILE_RUNTIME_KIND_PATTERN
|
|
2456
2709
|
});
|
|
2457
|
-
var RuntimeProfileWorkspaceMode = Type
|
|
2458
|
-
Type
|
|
2459
|
-
Type
|
|
2460
|
-
Type
|
|
2710
|
+
var RuntimeProfileWorkspaceMode = Type.Union([
|
|
2711
|
+
Type.Literal("none"),
|
|
2712
|
+
Type.Literal("shared_mount"),
|
|
2713
|
+
Type.Literal("dedicated_worktree")
|
|
2461
2714
|
]);
|
|
2462
2715
|
/**
|
|
2463
2716
|
* Tool-policy enforcement mode for the profile's runtime `tool_call` gate:
|
|
@@ -2465,63 +2718,63 @@ var RuntimeProfileWorkspaceMode = Type$1.Union([
|
|
|
2465
2718
|
* fail-closed). Read by the daemon via `GET /runtime-profiles/:id/allowed-tools`.
|
|
2466
2719
|
*/
|
|
2467
2720
|
var RuntimeProfileToolEnforcement = ToolEnforcementSchema;
|
|
2468
|
-
var RuntimeProfileAllowedWorkspaceModes = Type
|
|
2721
|
+
var RuntimeProfileAllowedWorkspaceModes = Type.Array(RuntimeProfileWorkspaceMode, {
|
|
2469
2722
|
minItems: 1,
|
|
2470
2723
|
maxItems: 3,
|
|
2471
2724
|
uniqueItems: true
|
|
2472
2725
|
});
|
|
2473
2726
|
var RuntimeProfileThinkingLevelOptions = [
|
|
2474
|
-
Type
|
|
2475
|
-
Type
|
|
2476
|
-
Type
|
|
2477
|
-
Type
|
|
2478
|
-
Type
|
|
2479
|
-
Type
|
|
2727
|
+
Type.Literal("off"),
|
|
2728
|
+
Type.Literal("minimal"),
|
|
2729
|
+
Type.Literal("low"),
|
|
2730
|
+
Type.Literal("medium"),
|
|
2731
|
+
Type.Literal("high"),
|
|
2732
|
+
Type.Literal("xhigh")
|
|
2480
2733
|
];
|
|
2481
|
-
Type
|
|
2482
|
-
var RuntimeProfileNullableThinkingLevel = Type
|
|
2483
|
-
var RuntimeProfileNullableTemperature = Type
|
|
2734
|
+
Type.Union([...RuntimeProfileThinkingLevelOptions]);
|
|
2735
|
+
var RuntimeProfileNullableThinkingLevel = Type.Union([...RuntimeProfileThinkingLevelOptions, Type.Null()]);
|
|
2736
|
+
var RuntimeProfileNullableTemperature = Type.Union([Type.Null(), Type.Number({
|
|
2484
2737
|
minimum: 0,
|
|
2485
2738
|
maximum: 2
|
|
2486
2739
|
})]);
|
|
2487
|
-
var RuntimeProfileNullableTopP = Type
|
|
2740
|
+
var RuntimeProfileNullableTopP = Type.Union([Type.Null(), Type.Number({
|
|
2488
2741
|
minimum: 0,
|
|
2489
2742
|
maximum: 1
|
|
2490
2743
|
})]);
|
|
2491
|
-
var RuntimeProfileNullableTopK = Type
|
|
2744
|
+
var RuntimeProfileNullableTopK = Type.Union([Type.Integer({
|
|
2492
2745
|
minimum: 1,
|
|
2493
2746
|
maximum: 1e4
|
|
2494
|
-
}), Type
|
|
2495
|
-
var RuntimeProfileNullableMaxOutputTokens = Type
|
|
2747
|
+
}), Type.Null()]);
|
|
2748
|
+
var RuntimeProfileNullableMaxOutputTokens = Type.Union([Type.Integer({
|
|
2496
2749
|
minimum: 1,
|
|
2497
2750
|
maximum: 1e6
|
|
2498
|
-
}), Type
|
|
2499
|
-
var RuntimeProfileAllowedHost = Type
|
|
2751
|
+
}), Type.Null()]);
|
|
2752
|
+
var RuntimeProfileAllowedHost = Type.String({
|
|
2500
2753
|
minLength: 1,
|
|
2501
2754
|
maxLength: 255,
|
|
2502
2755
|
pattern: "^(?:\\*\\.)?(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$"
|
|
2503
2756
|
});
|
|
2504
|
-
var RuntimeProfileSandbox = Type
|
|
2505
|
-
network: Type
|
|
2506
|
-
allowedHosts: Type
|
|
2507
|
-
allowedInternalHosts: Type
|
|
2757
|
+
var RuntimeProfileSandbox = Type.Object({
|
|
2758
|
+
network: Type.Optional(Type.Object({
|
|
2759
|
+
allowedHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 })),
|
|
2760
|
+
allowedInternalHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 }))
|
|
2508
2761
|
}, { additionalProperties: false })),
|
|
2509
|
-
vfs: Type
|
|
2510
|
-
shadow: Type
|
|
2762
|
+
vfs: Type.Optional(Type.Object({
|
|
2763
|
+
shadow: Type.Optional(Type.Array(Type.String({
|
|
2511
2764
|
minLength: 1,
|
|
2512
2765
|
maxLength: 255
|
|
2513
2766
|
}), { maxItems: 100 })),
|
|
2514
|
-
shadowMode: Type
|
|
2767
|
+
shadowMode: Type.Optional(Type.Union([Type.Literal("deny"), Type.Literal("tmpfs")]))
|
|
2515
2768
|
}, { additionalProperties: false })),
|
|
2516
|
-
env: Type
|
|
2517
|
-
hostExec: Type
|
|
2518
|
-
resources: Type
|
|
2519
|
-
memory: Type
|
|
2769
|
+
env: Type.Optional(Type.Record(RuntimeProfileEnvName, Type.String({ maxLength: 4096 }))),
|
|
2770
|
+
hostExec: Type.Optional(Type.Object({ autoApprove: Type.Optional(Type.Literal(false)) }, { additionalProperties: false })),
|
|
2771
|
+
resources: Type.Optional(Type.Object({
|
|
2772
|
+
memory: Type.Optional(Type.String({
|
|
2520
2773
|
minLength: 2,
|
|
2521
2774
|
maxLength: 16,
|
|
2522
2775
|
pattern: "^[0-9]+[KMG]?$"
|
|
2523
2776
|
})),
|
|
2524
|
-
cpus: Type
|
|
2777
|
+
cpus: Type.Optional(Type.Integer({
|
|
2525
2778
|
minimum: 1,
|
|
2526
2779
|
maximum: 32
|
|
2527
2780
|
}))
|
|
@@ -2530,19 +2783,19 @@ var RuntimeProfileSandbox = Type$1.Object({
|
|
|
2530
2783
|
$id: "RuntimeProfileSandbox",
|
|
2531
2784
|
additionalProperties: false
|
|
2532
2785
|
});
|
|
2533
|
-
var RuntimeProfileContext = Type
|
|
2534
|
-
slug: Type
|
|
2786
|
+
var RuntimeProfileContext = Type.Object({
|
|
2787
|
+
slug: Type.String({
|
|
2535
2788
|
minLength: 1,
|
|
2536
2789
|
maxLength: 64,
|
|
2537
2790
|
pattern: "^[a-zA-Z0-9_-]+$"
|
|
2538
2791
|
}),
|
|
2539
|
-
binding: Type
|
|
2540
|
-
Type
|
|
2541
|
-
Type
|
|
2542
|
-
Type
|
|
2543
|
-
Type
|
|
2792
|
+
binding: Type.Union([
|
|
2793
|
+
Type.Literal("skill"),
|
|
2794
|
+
Type.Literal("context_inline"),
|
|
2795
|
+
Type.Literal("prompt_prefix"),
|
|
2796
|
+
Type.Literal("user_inline")
|
|
2544
2797
|
]),
|
|
2545
|
-
content: Type
|
|
2798
|
+
content: Type.String({
|
|
2546
2799
|
minLength: 1,
|
|
2547
2800
|
maxLength: 65536
|
|
2548
2801
|
})
|
|
@@ -2550,40 +2803,40 @@ var RuntimeProfileContext = Type$1.Object({
|
|
|
2550
2803
|
$id: "RuntimeProfileContext",
|
|
2551
2804
|
additionalProperties: false
|
|
2552
2805
|
});
|
|
2553
|
-
Type
|
|
2806
|
+
Type.Object({ profileId: Type.String({ format: "uuid" }) }, {
|
|
2554
2807
|
$id: "RuntimeProfileRef",
|
|
2555
2808
|
additionalProperties: false
|
|
2556
2809
|
});
|
|
2557
|
-
var RuntimeProfileLeaseTtlSec = Type
|
|
2810
|
+
var RuntimeProfileLeaseTtlSec = Type.Integer({
|
|
2558
2811
|
minimum: 1,
|
|
2559
2812
|
maximum: 86400
|
|
2560
2813
|
});
|
|
2561
|
-
var RuntimeProfileHeartbeatIntervalMs = Type
|
|
2814
|
+
var RuntimeProfileHeartbeatIntervalMs = Type.Integer({
|
|
2562
2815
|
minimum: 0,
|
|
2563
2816
|
maximum: 36e5
|
|
2564
2817
|
});
|
|
2565
|
-
var RuntimeProfileMaxBatchSize = Type
|
|
2818
|
+
var RuntimeProfileMaxBatchSize = Type.Integer({
|
|
2566
2819
|
minimum: 1,
|
|
2567
2820
|
maximum: 1e3
|
|
2568
2821
|
});
|
|
2569
|
-
var RuntimeProfileMaxTurns = Type
|
|
2822
|
+
var RuntimeProfileMaxTurns = Type.Integer({
|
|
2570
2823
|
minimum: 0,
|
|
2571
2824
|
maximum: 1e4
|
|
2572
2825
|
});
|
|
2573
|
-
var RuntimeProfileMaxBashTimeouts = Type
|
|
2826
|
+
var RuntimeProfileMaxBashTimeouts = Type.Integer({
|
|
2574
2827
|
minimum: 0,
|
|
2575
2828
|
maximum: 1e3
|
|
2576
2829
|
});
|
|
2577
|
-
Type
|
|
2578
|
-
id: Type
|
|
2579
|
-
teamId: Type
|
|
2830
|
+
Type.Object({
|
|
2831
|
+
id: Type.String({ format: "uuid" }),
|
|
2832
|
+
teamId: Type.String({ format: "uuid" }),
|
|
2580
2833
|
name: RuntimeProfileName,
|
|
2581
|
-
description: Type
|
|
2582
|
-
provider: Type
|
|
2834
|
+
description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
|
|
2835
|
+
provider: Type.String({
|
|
2583
2836
|
minLength: 1,
|
|
2584
2837
|
maxLength: 100
|
|
2585
2838
|
}),
|
|
2586
|
-
model: Type
|
|
2839
|
+
model: Type.String({
|
|
2587
2840
|
minLength: 1,
|
|
2588
2841
|
maxLength: 200
|
|
2589
2842
|
}),
|
|
@@ -2594,15 +2847,15 @@ Type$1.Object({
|
|
|
2594
2847
|
maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
|
|
2595
2848
|
runtimeKind: RuntimeProfileRuntimeKind,
|
|
2596
2849
|
sandbox: RuntimeProfileSandbox,
|
|
2597
|
-
sessionStorageMode: Type
|
|
2598
|
-
workspaceStorageMode: Type
|
|
2599
|
-
defaultWorkspaceMode: Type
|
|
2850
|
+
sessionStorageMode: Type.Literal("local"),
|
|
2851
|
+
workspaceStorageMode: Type.Literal("local"),
|
|
2852
|
+
defaultWorkspaceMode: Type.Union([RuntimeProfileWorkspaceMode, Type.Null()]),
|
|
2600
2853
|
allowedWorkspaceModes: RuntimeProfileAllowedWorkspaceModes,
|
|
2601
|
-
sessionTtlSec: Type
|
|
2854
|
+
sessionTtlSec: Type.Integer({
|
|
2602
2855
|
minimum: 1,
|
|
2603
2856
|
maximum: 86400
|
|
2604
2857
|
}),
|
|
2605
|
-
workspaceTtlSec: Type
|
|
2858
|
+
workspaceTtlSec: Type.Integer({
|
|
2606
2859
|
minimum: 1,
|
|
2607
2860
|
maximum: 86400
|
|
2608
2861
|
}),
|
|
@@ -2612,203 +2865,203 @@ Type$1.Object({
|
|
|
2612
2865
|
maxTurns: RuntimeProfileMaxTurns,
|
|
2613
2866
|
maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
|
|
2614
2867
|
toolEnforcement: RuntimeProfileToolEnforcement,
|
|
2615
|
-
requiredEnv: Type
|
|
2616
|
-
requiredTools: Type
|
|
2617
|
-
requiredExecutables: Type
|
|
2618
|
-
context: Type
|
|
2619
|
-
revision: Type
|
|
2620
|
-
definitionCid: Type
|
|
2868
|
+
requiredEnv: Type.Array(RuntimeProfileEnvName, { maxItems: 100 }),
|
|
2869
|
+
requiredTools: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
|
|
2870
|
+
requiredExecutables: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
|
|
2871
|
+
context: Type.Array(RuntimeProfileContext, { maxItems: 5 }),
|
|
2872
|
+
revision: Type.Integer({ minimum: 1 }),
|
|
2873
|
+
definitionCid: Type.String({
|
|
2621
2874
|
minLength: 1,
|
|
2622
2875
|
maxLength: 100
|
|
2623
2876
|
}),
|
|
2624
|
-
createdByAgentId: Type
|
|
2625
|
-
createdByHumanId: Type
|
|
2626
|
-
createdAt: Type
|
|
2627
|
-
updatedAt: Type
|
|
2877
|
+
createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
2878
|
+
createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
2879
|
+
createdAt: Type.String({ format: "date-time" }),
|
|
2880
|
+
updatedAt: Type.String({ format: "date-time" })
|
|
2628
2881
|
}, {
|
|
2629
2882
|
$id: "RuntimeProfile",
|
|
2630
2883
|
additionalProperties: false
|
|
2631
2884
|
});
|
|
2632
2885
|
//#endregion
|
|
2633
2886
|
//#region ../runtime-profiles/src/runtime-sessions.ts
|
|
2634
|
-
var RuntimeSessionKind = Type
|
|
2635
|
-
Type
|
|
2636
|
-
Type
|
|
2637
|
-
Type
|
|
2887
|
+
var RuntimeSessionKind = Type.Union([
|
|
2888
|
+
Type.Literal("root"),
|
|
2889
|
+
Type.Literal("extend"),
|
|
2890
|
+
Type.Literal("fork")
|
|
2638
2891
|
]);
|
|
2639
|
-
var RuntimeSessionCheckpointKind = Type
|
|
2640
|
-
Type
|
|
2641
|
-
id: Type
|
|
2642
|
-
teamId: Type
|
|
2643
|
-
taskId: Type
|
|
2644
|
-
attemptN: Type
|
|
2645
|
-
sourceSlotId: Type
|
|
2646
|
-
sourceRuntimeProfileId: Type
|
|
2892
|
+
var RuntimeSessionCheckpointKind = Type.Union([Type.Literal("attempt_final")]);
|
|
2893
|
+
Type.Object({
|
|
2894
|
+
id: Type.String({ format: "uuid" }),
|
|
2895
|
+
teamId: Type.String({ format: "uuid" }),
|
|
2896
|
+
taskId: Type.String({ format: "uuid" }),
|
|
2897
|
+
attemptN: Type.Integer({ minimum: 1 }),
|
|
2898
|
+
sourceSlotId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
2899
|
+
sourceRuntimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
2647
2900
|
sessionKind: RuntimeSessionKind,
|
|
2648
|
-
parentSessionId: Type
|
|
2649
|
-
contentType: Type
|
|
2901
|
+
parentSessionId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
2902
|
+
contentType: Type.String({
|
|
2650
2903
|
minLength: 1,
|
|
2651
2904
|
maxLength: 200
|
|
2652
2905
|
}),
|
|
2653
|
-
contentEncoding: Type
|
|
2906
|
+
contentEncoding: Type.Union([Type.String({
|
|
2654
2907
|
minLength: 1,
|
|
2655
2908
|
maxLength: 100
|
|
2656
|
-
}), Type
|
|
2657
|
-
sizeBytes: Type
|
|
2658
|
-
sha256: Type
|
|
2909
|
+
}), Type.Null()]),
|
|
2910
|
+
sizeBytes: Type.Integer({ minimum: 0 }),
|
|
2911
|
+
sha256: Type.String({
|
|
2659
2912
|
minLength: 64,
|
|
2660
2913
|
maxLength: 64
|
|
2661
2914
|
}),
|
|
2662
|
-
storageClass: Type
|
|
2915
|
+
storageClass: Type.String({
|
|
2663
2916
|
minLength: 1,
|
|
2664
2917
|
maxLength: 100
|
|
2665
2918
|
}),
|
|
2666
2919
|
checkpointKind: RuntimeSessionCheckpointKind,
|
|
2667
|
-
uploadedAt: Type
|
|
2920
|
+
uploadedAt: Type.String({ format: "date-time" })
|
|
2668
2921
|
}, { $id: "RuntimeSession" });
|
|
2669
|
-
Type
|
|
2670
|
-
sourceSlotId: Type
|
|
2671
|
-
sourceRuntimeProfileId: Type
|
|
2922
|
+
Type.Object({
|
|
2923
|
+
sourceSlotId: Type.Optional(Type.String({ format: "uuid" })),
|
|
2924
|
+
sourceRuntimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
|
|
2672
2925
|
sessionKind: RuntimeSessionKind,
|
|
2673
|
-
parentSessionId: Type
|
|
2926
|
+
parentSessionId: Type.Optional(Type.String({ format: "uuid" }))
|
|
2674
2927
|
}, {
|
|
2675
2928
|
$id: "UploadRuntimeSessionQuery",
|
|
2676
2929
|
additionalProperties: false
|
|
2677
2930
|
});
|
|
2678
|
-
Type
|
|
2931
|
+
Type.String({
|
|
2679
2932
|
$id: "RuntimeSessionContent",
|
|
2680
2933
|
description: "Runtime session content stream.",
|
|
2681
2934
|
format: "binary"
|
|
2682
2935
|
});
|
|
2683
|
-
Type
|
|
2684
|
-
taskId: Type
|
|
2685
|
-
attemptN: Type
|
|
2936
|
+
Type.Object({
|
|
2937
|
+
taskId: Type.String({ format: "uuid" }),
|
|
2938
|
+
attemptN: Type.Integer({ minimum: 1 })
|
|
2686
2939
|
}, {
|
|
2687
2940
|
$id: "RuntimeSessionAttemptParams",
|
|
2688
2941
|
additionalProperties: false
|
|
2689
2942
|
});
|
|
2690
2943
|
//#endregion
|
|
2691
2944
|
//#region ../runtime-profiles/src/runtime-slots.ts
|
|
2692
|
-
var RuntimeWorkspaceKind = Type
|
|
2693
|
-
Type
|
|
2694
|
-
Type
|
|
2695
|
-
Type
|
|
2945
|
+
var RuntimeWorkspaceKind = Type.Union([
|
|
2946
|
+
Type.Literal("origin"),
|
|
2947
|
+
Type.Literal("fork"),
|
|
2948
|
+
Type.Literal("scratch")
|
|
2696
2949
|
]);
|
|
2697
|
-
var RuntimeSlotState = Type
|
|
2698
|
-
var RuntimeWorkspace = Type
|
|
2699
|
-
id: Type
|
|
2700
|
-
teamId: Type
|
|
2701
|
-
workspaceId: Type
|
|
2702
|
-
worktreePath: Type
|
|
2703
|
-
worktreeBranch: Type
|
|
2950
|
+
var RuntimeSlotState = Type.Union([Type.Literal("active"), Type.Literal("idle")]);
|
|
2951
|
+
var RuntimeWorkspace = Type.Object({
|
|
2952
|
+
id: Type.String({ format: "uuid" }),
|
|
2953
|
+
teamId: Type.String({ format: "uuid" }),
|
|
2954
|
+
workspaceId: Type.String({ minLength: 1 }),
|
|
2955
|
+
worktreePath: Type.String({ minLength: 1 }),
|
|
2956
|
+
worktreeBranch: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
|
|
2704
2957
|
kind: RuntimeWorkspaceKind,
|
|
2705
|
-
createdAtMs: Type
|
|
2706
|
-
lastUsedAtMs: Type
|
|
2958
|
+
createdAtMs: Type.Integer({ minimum: 0 }),
|
|
2959
|
+
lastUsedAtMs: Type.Integer({ minimum: 0 })
|
|
2707
2960
|
}, { $id: "RuntimeWorkspace" });
|
|
2708
|
-
var RuntimeSlot = Type
|
|
2709
|
-
id: Type
|
|
2710
|
-
teamId: Type
|
|
2711
|
-
agentName: Type
|
|
2961
|
+
var RuntimeSlot = Type.Object({
|
|
2962
|
+
id: Type.String({ format: "uuid" }),
|
|
2963
|
+
teamId: Type.String({ format: "uuid" }),
|
|
2964
|
+
agentName: Type.String({
|
|
2712
2965
|
minLength: 1,
|
|
2713
2966
|
maxLength: 100
|
|
2714
2967
|
}),
|
|
2715
|
-
runtimeProfileId: Type
|
|
2716
|
-
provider: Type
|
|
2968
|
+
runtimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
2969
|
+
provider: Type.String({
|
|
2717
2970
|
minLength: 1,
|
|
2718
2971
|
maxLength: 100
|
|
2719
2972
|
}),
|
|
2720
|
-
model: Type
|
|
2973
|
+
model: Type.String({
|
|
2721
2974
|
minLength: 1,
|
|
2722
2975
|
maxLength: 200
|
|
2723
2976
|
}),
|
|
2724
|
-
slotKey: Type
|
|
2725
|
-
taskType: Type
|
|
2977
|
+
slotKey: Type.String({ minLength: 1 }),
|
|
2978
|
+
taskType: Type.String({
|
|
2726
2979
|
minLength: 1,
|
|
2727
2980
|
maxLength: 100
|
|
2728
2981
|
}),
|
|
2729
2982
|
state: RuntimeSlotState,
|
|
2730
|
-
lastTaskId: Type
|
|
2731
|
-
lastAttemptN: Type
|
|
2732
|
-
sessionDir: Type
|
|
2733
|
-
sessionPath: Type
|
|
2734
|
-
workspaceRowId: Type
|
|
2735
|
-
createdAtMs: Type
|
|
2736
|
-
lastUsedAtMs: Type
|
|
2737
|
-
expiresAtMs: Type
|
|
2983
|
+
lastTaskId: Type.String({ format: "uuid" }),
|
|
2984
|
+
lastAttemptN: Type.Integer({ minimum: 1 }),
|
|
2985
|
+
sessionDir: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
|
|
2986
|
+
sessionPath: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
|
|
2987
|
+
workspaceRowId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
|
|
2988
|
+
createdAtMs: Type.Integer({ minimum: 0 }),
|
|
2989
|
+
lastUsedAtMs: Type.Integer({ minimum: 0 }),
|
|
2990
|
+
expiresAtMs: Type.Integer({ minimum: 0 })
|
|
2738
2991
|
}, { $id: "RuntimeSlot" });
|
|
2739
|
-
var ResolvedRuntimeSlot = Type
|
|
2992
|
+
var ResolvedRuntimeSlot = Type.Object({
|
|
2740
2993
|
slot: RuntimeSlot,
|
|
2741
|
-
workspace: Type
|
|
2994
|
+
workspace: Type.Union([RuntimeWorkspace, Type.Null()])
|
|
2742
2995
|
}, { $id: "ResolvedRuntimeSlot" });
|
|
2743
|
-
Type
|
|
2744
|
-
Type
|
|
2745
|
-
agentName: Type
|
|
2996
|
+
Type.Object({ items: Type.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
|
|
2997
|
+
Type.Object({
|
|
2998
|
+
agentName: Type.String({
|
|
2746
2999
|
minLength: 1,
|
|
2747
3000
|
maxLength: 100
|
|
2748
3001
|
}),
|
|
2749
|
-
runtimeProfileId: Type
|
|
2750
|
-
provider: Type
|
|
3002
|
+
runtimeProfileId: Type.String({ format: "uuid" }),
|
|
3003
|
+
provider: Type.String({
|
|
2751
3004
|
minLength: 1,
|
|
2752
3005
|
maxLength: 100
|
|
2753
3006
|
}),
|
|
2754
|
-
model: Type
|
|
3007
|
+
model: Type.String({
|
|
2755
3008
|
minLength: 1,
|
|
2756
3009
|
maxLength: 200
|
|
2757
3010
|
}),
|
|
2758
|
-
slotKey: Type
|
|
2759
|
-
taskType: Type
|
|
3011
|
+
slotKey: Type.String({ minLength: 1 }),
|
|
3012
|
+
taskType: Type.String({
|
|
2760
3013
|
minLength: 1,
|
|
2761
3014
|
maxLength: 100
|
|
2762
3015
|
}),
|
|
2763
|
-
sessionDir: Type
|
|
2764
|
-
sessionPath: Type
|
|
2765
|
-
workspaceId: Type
|
|
2766
|
-
worktreePath: Type
|
|
2767
|
-
worktreeBranch: Type
|
|
2768
|
-
workspaceKind: Type
|
|
2769
|
-
lastTaskId: Type
|
|
2770
|
-
lastAttemptN: Type
|
|
3016
|
+
sessionDir: Type.Optional(Type.String({ minLength: 1 })),
|
|
3017
|
+
sessionPath: Type.Optional(Type.String({ minLength: 1 })),
|
|
3018
|
+
workspaceId: Type.Optional(Type.String({ minLength: 1 })),
|
|
3019
|
+
worktreePath: Type.Optional(Type.String({ minLength: 1 })),
|
|
3020
|
+
worktreeBranch: Type.Optional(Type.String({ minLength: 1 })),
|
|
3021
|
+
workspaceKind: Type.Optional(RuntimeWorkspaceKind),
|
|
3022
|
+
lastTaskId: Type.String({ format: "uuid" }),
|
|
3023
|
+
lastAttemptN: Type.Integer({ minimum: 1 })
|
|
2771
3024
|
}, {
|
|
2772
3025
|
$id: "BeginRuntimeSlotBody",
|
|
2773
3026
|
additionalProperties: false
|
|
2774
3027
|
});
|
|
2775
|
-
Type
|
|
2776
|
-
agentName: Type
|
|
3028
|
+
Type.Object({
|
|
3029
|
+
agentName: Type.String({
|
|
2777
3030
|
minLength: 1,
|
|
2778
3031
|
maxLength: 100
|
|
2779
3032
|
}),
|
|
2780
|
-
runtimeProfileId: Type
|
|
2781
|
-
provider: Type
|
|
3033
|
+
runtimeProfileId: Type.String({ format: "uuid" }),
|
|
3034
|
+
provider: Type.String({
|
|
2782
3035
|
minLength: 1,
|
|
2783
3036
|
maxLength: 100
|
|
2784
3037
|
}),
|
|
2785
|
-
model: Type
|
|
3038
|
+
model: Type.String({
|
|
2786
3039
|
minLength: 1,
|
|
2787
3040
|
maxLength: 200
|
|
2788
3041
|
}),
|
|
2789
|
-
slotKey: Type
|
|
2790
|
-
taskId: Type
|
|
2791
|
-
attemptN: Type
|
|
2792
|
-
sessionPath: Type
|
|
3042
|
+
slotKey: Type.String({ minLength: 1 }),
|
|
3043
|
+
taskId: Type.String({ format: "uuid" }),
|
|
3044
|
+
attemptN: Type.Integer({ minimum: 1 }),
|
|
3045
|
+
sessionPath: Type.Optional(Type.String({ minLength: 1 }))
|
|
2793
3046
|
}, {
|
|
2794
3047
|
$id: "FinishRuntimeSlotBody",
|
|
2795
3048
|
additionalProperties: false
|
|
2796
3049
|
});
|
|
2797
|
-
Type
|
|
2798
|
-
taskId: Type
|
|
2799
|
-
attemptN: Type
|
|
3050
|
+
Type.Object({
|
|
3051
|
+
taskId: Type.String({ format: "uuid" }),
|
|
3052
|
+
attemptN: Type.Integer({ minimum: 1 })
|
|
2800
3053
|
}, {
|
|
2801
3054
|
$id: "FindLatestRuntimeSlotForAttemptQuery",
|
|
2802
3055
|
additionalProperties: false
|
|
2803
3056
|
});
|
|
2804
|
-
Type
|
|
2805
|
-
agentName: Type
|
|
3057
|
+
Type.Object({
|
|
3058
|
+
agentName: Type.Optional(Type.String({
|
|
2806
3059
|
minLength: 1,
|
|
2807
3060
|
maxLength: 100
|
|
2808
3061
|
})),
|
|
2809
|
-
runtimeProfileId: Type
|
|
2810
|
-
state: Type
|
|
2811
|
-
limit: Type
|
|
3062
|
+
runtimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
|
|
3063
|
+
state: Type.Optional(RuntimeSlotState),
|
|
3064
|
+
limit: Type.Optional(Type.Integer({
|
|
2812
3065
|
minimum: 1,
|
|
2813
3066
|
maximum: 200
|
|
2814
3067
|
}))
|
|
@@ -2946,6 +3199,11 @@ function definePiRuntime(options) {
|
|
|
2946
3199
|
secretIds.add(id);
|
|
2947
3200
|
secretEnvNames.add(guestEnv);
|
|
2948
3201
|
}
|
|
3202
|
+
const capabilityNames = /* @__PURE__ */ new Set();
|
|
3203
|
+
for (const capability of options.hostCapabilities ?? []) {
|
|
3204
|
+
if (capabilityNames.has(capability.name)) throw new Error(`Duplicate host capability name "${capability.name}"`);
|
|
3205
|
+
capabilityNames.add(capability.name);
|
|
3206
|
+
}
|
|
2949
3207
|
return Object.freeze({
|
|
2950
3208
|
schemaVersion: PI_RUNTIME_DEFINITION_VERSION,
|
|
2951
3209
|
id: options.id,
|
|
@@ -2953,12 +3211,14 @@ function definePiRuntime(options) {
|
|
|
2953
3211
|
runtimeKind: options.runtimeKind ?? "gondolin_pi",
|
|
2954
3212
|
vm: options.vm,
|
|
2955
3213
|
brokeredHttpSecrets: Object.freeze([...options.brokeredHttpSecrets ?? []]),
|
|
3214
|
+
hostCapabilities: Object.freeze([...options.hostCapabilities ?? []]),
|
|
2956
3215
|
tools: Object.freeze([...options.tools ?? []]),
|
|
2957
3216
|
extensions: Object.freeze([...options.extensions ?? []])
|
|
2958
3217
|
});
|
|
2959
3218
|
}
|
|
2960
3219
|
async function buildPiExecutorManifest(input) {
|
|
2961
3220
|
const brokeredHttpSecrets = input.runtime.brokeredHttpSecrets ?? [];
|
|
3221
|
+
const hostCapabilities = input.runtime.hostCapabilities ?? [];
|
|
2962
3222
|
const descriptors = [...(input.builtInTools ?? []).map((descriptor) => ({
|
|
2963
3223
|
descriptor,
|
|
2964
3224
|
scope: "parent_and_subagents"
|
|
@@ -3006,6 +3266,12 @@ async function buildPiExecutorManifest(input) {
|
|
|
3006
3266
|
ports: [...descriptor.ports ?? [descriptor.protocol === "http" ? 80 : 443]],
|
|
3007
3267
|
required: descriptor.required !== false
|
|
3008
3268
|
})).sort((left, right) => left.id.localeCompare(right.id)) },
|
|
3269
|
+
...hostCapabilities.length > 0 && { hostCapabilities: hostCapabilities.map((capability) => ({
|
|
3270
|
+
name: capability.name,
|
|
3271
|
+
origin: capability.origin,
|
|
3272
|
+
operations: Object.keys(capability.operations).sort(),
|
|
3273
|
+
descriptorCid: capability.descriptorCid
|
|
3274
|
+
})).sort((left, right) => left.name.localeCompare(right.name)) },
|
|
3009
3275
|
tools,
|
|
3010
3276
|
extensions: input.runtime.extensions.map((extension) => ({
|
|
3011
3277
|
id: extension.id,
|
|
@@ -3192,6 +3458,37 @@ function assertRuntimeKind(value) {
|
|
|
3192
3458
|
*/
|
|
3193
3459
|
var DEFAULT_GREP_LIMIT = 100;
|
|
3194
3460
|
var GREP_MAX_FILE_SIZE = "2M";
|
|
3461
|
+
var GondolinVmRetiredError = class extends Error {
|
|
3462
|
+
code = "sandbox_retired";
|
|
3463
|
+
constructor(retirement, options) {
|
|
3464
|
+
super(`Sandbox VM retired after ${retirement.trigger}: ${retirement.reason}`, options);
|
|
3465
|
+
this.retirement = retirement;
|
|
3466
|
+
this.name = "GondolinVmRetiredError";
|
|
3467
|
+
}
|
|
3468
|
+
};
|
|
3469
|
+
function createGondolinToolLifecycle(config = {}) {
|
|
3470
|
+
let retirement = null;
|
|
3471
|
+
return {
|
|
3472
|
+
assertActive() {
|
|
3473
|
+
if (retirement) throw new GondolinVmRetiredError(retirement);
|
|
3474
|
+
},
|
|
3475
|
+
getRetirement: () => retirement,
|
|
3476
|
+
markRetired(next) {
|
|
3477
|
+
if (retirement) return;
|
|
3478
|
+
retirement = next;
|
|
3479
|
+
config.onRetired?.(next);
|
|
3480
|
+
}
|
|
3481
|
+
};
|
|
3482
|
+
}
|
|
3483
|
+
function guardGondolinToolDefinitions(tools, lifecycle) {
|
|
3484
|
+
return tools.map((tool) => ({
|
|
3485
|
+
...tool,
|
|
3486
|
+
execute(...args) {
|
|
3487
|
+
lifecycle.assertActive();
|
|
3488
|
+
return tool.execute(...args);
|
|
3489
|
+
}
|
|
3490
|
+
}));
|
|
3491
|
+
}
|
|
3195
3492
|
function shQuote(s) {
|
|
3196
3493
|
return "'" + s.replace(/'/g, "'\\''") + "'";
|
|
3197
3494
|
}
|
|
@@ -3540,38 +3837,45 @@ async function executeGondolinGrep(vm, localCwd, guestWorkspace, params, signal)
|
|
|
3540
3837
|
details: Object.keys(details).length > 0 ? details : void 0
|
|
3541
3838
|
};
|
|
3542
3839
|
}
|
|
3543
|
-
function createGondolinBashOps(vm, localCwd, guestWorkspace) {
|
|
3840
|
+
function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
|
|
3544
3841
|
return { exec: async (command, cwd, { onData, signal, timeout, env }) => {
|
|
3545
|
-
|
|
3546
|
-
const
|
|
3547
|
-
|
|
3548
|
-
|
|
3549
|
-
|
|
3550
|
-
|
|
3551
|
-
|
|
3552
|
-
|
|
3553
|
-
|
|
3554
|
-
|
|
3555
|
-
|
|
3556
|
-
"
|
|
3557
|
-
|
|
3558
|
-
|
|
3559
|
-
|
|
3560
|
-
|
|
3561
|
-
|
|
3562
|
-
|
|
3563
|
-
|
|
3564
|
-
|
|
3565
|
-
|
|
3566
|
-
|
|
3567
|
-
|
|
3568
|
-
|
|
3569
|
-
|
|
3570
|
-
|
|
3571
|
-
|
|
3572
|
-
|
|
3573
|
-
|
|
3842
|
+
config.lifecycle.assertActive();
|
|
3843
|
+
const result = await execManagedCommand(vm, command, {
|
|
3844
|
+
cwd: toGuestPath(localCwd, cwd, guestWorkspace),
|
|
3845
|
+
signal,
|
|
3846
|
+
timeoutMs: timeout && timeout > 0 ? timeout * 1e3 : void 0,
|
|
3847
|
+
onData
|
|
3848
|
+
});
|
|
3849
|
+
if (result.termination.status === "backend-retired") {
|
|
3850
|
+
const retirement = {
|
|
3851
|
+
backendRetired: true,
|
|
3852
|
+
reason: "backend-retired",
|
|
3853
|
+
trigger: result.timedOut ? "timeout" : "cancellation"
|
|
3854
|
+
};
|
|
3855
|
+
config.lifecycle.markRetired(retirement);
|
|
3856
|
+
try {
|
|
3857
|
+
await config.retireVm(retirement);
|
|
3858
|
+
} catch (error) {
|
|
3859
|
+
throw new GondolinVmRetiredError(retirement, { cause: error });
|
|
3860
|
+
}
|
|
3861
|
+
}
|
|
3862
|
+
if (result.termination.status === "recovery-required") {
|
|
3863
|
+
const retirement = {
|
|
3864
|
+
backendRetired: false,
|
|
3865
|
+
reason: result.termination.reason,
|
|
3866
|
+
trigger: result.timedOut ? "timeout" : "cancellation"
|
|
3867
|
+
};
|
|
3868
|
+
config.lifecycle.markRetired(retirement);
|
|
3869
|
+
try {
|
|
3870
|
+
await config.retireVm(retirement);
|
|
3871
|
+
} catch (error) {
|
|
3872
|
+
throw new GondolinVmRetiredError(retirement, { cause: error });
|
|
3873
|
+
}
|
|
3874
|
+
throw new GondolinVmRetiredError(retirement);
|
|
3574
3875
|
}
|
|
3876
|
+
if (result.timedOut) throw new Error(`timeout:${timeout}`);
|
|
3877
|
+
if (result.cancelled) throw new Error("aborted");
|
|
3878
|
+
return { exitCode: result.exitCode };
|
|
3575
3879
|
} };
|
|
3576
3880
|
}
|
|
3577
3881
|
//#endregion
|
|
@@ -3885,31 +4189,14 @@ function decisionContext(deps) {
|
|
|
3885
4189
|
}
|
|
3886
4190
|
//#endregion
|
|
3887
4191
|
//#region src/vm.ts
|
|
3888
|
-
/** Guest path where Pi expects its auth blob. */
|
|
3889
|
-
var PI_GUEST_AUTH_PATH = "/home/agent/.pi/agent/auth.json";
|
|
3890
4192
|
/**
|
|
3891
|
-
*
|
|
3892
|
-
*
|
|
3893
|
-
*
|
|
3894
|
-
|
|
3895
|
-
function piProviderAuth() {
|
|
3896
|
-
return {
|
|
3897
|
-
guestPath: PI_GUEST_AUTH_PATH,
|
|
3898
|
-
load: () => {
|
|
3899
|
-
const authPath = path.join(resolvePiCodingAgentDir(), "auth.json");
|
|
3900
|
-
return existsSync(authPath) ? readFileSync(authPath, "utf8") : null;
|
|
3901
|
-
}
|
|
3902
|
-
};
|
|
3903
|
-
}
|
|
3904
|
-
/**
|
|
3905
|
-
* Resume a Gondolin VM for a Pi session. Identical to the sandbox package's
|
|
3906
|
-
* `resumeVm`, with Pi's provider auth supplied unless the caller overrides it.
|
|
4193
|
+
* Resume a Gondolin VM for a Pi session. The Pi coding-agent session and its
|
|
4194
|
+
* model calls run host-side (`createAgentSession` reads the host `~/.pi/agent`
|
|
4195
|
+
* auth), so the guest carries no provider auth — it only executes Gondolin
|
|
4196
|
+
* tools via `vm.exec`. This is a thin pass-through to the sandbox package.
|
|
3907
4197
|
*/
|
|
3908
4198
|
function resumeVm(config) {
|
|
3909
|
-
return resumeVm$1(
|
|
3910
|
-
providerAuth: piProviderAuth(),
|
|
3911
|
-
...config
|
|
3912
|
-
});
|
|
4199
|
+
return resumeVm$1(config);
|
|
3913
4200
|
}
|
|
3914
4201
|
//#endregion
|
|
3915
4202
|
//#region src/runtime/capability-discovery.ts
|
|
@@ -4400,6 +4687,8 @@ function buildSandboxCapabilityInstructions(sandbox, policy) {
|
|
|
4400
4687
|
` placeholders in: ${brokeredSecretEnvNames.map((name) => `\`${name}\``).join(", ")}. The host proxy may substitute them only for their`,
|
|
4401
4688
|
" declared destination hosts. Do not print, persist, or move them."
|
|
4402
4689
|
] : [], "- Runtime service endpoints required for task execution may be available", " in addition to the operator-configured hosts above.");
|
|
4690
|
+
const hostCapabilities = [...sandbox.hostCapabilities ?? []].sort((left, right) => left.name.localeCompare(right.name));
|
|
4691
|
+
if (hostCapabilities.length > 0) lines.push("- Host capabilities served by the trusted daemon (attested in the", " executor manifest; every call is policy-checked and evidenced):", ...hostCapabilities.map((capability) => ` - \`${capability.name}\` at ${capability.origin} (${[...capability.operations].sort().join(", ")}).`));
|
|
4403
4692
|
return lines.join("\n");
|
|
4404
4693
|
}
|
|
4405
4694
|
function shellExecutableIsAvailable(policy, sandbox, executable) {
|
|
@@ -4432,7 +4721,14 @@ function buildCredentialInstructions(policy, sandbox) {
|
|
|
4432
4721
|
" requests; it is not a reusable or inspectable token."
|
|
4433
4722
|
] : ["- No brokered GitHub credential is active. Authenticated `gh`", " operations are unavailable; do not mint or recover a host token."]);
|
|
4434
4723
|
}
|
|
4435
|
-
if (gitAvailable)
|
|
4724
|
+
if (gitAvailable) {
|
|
4725
|
+
const signing = (sandbox?.hostCapabilities ?? []).find((capability) => capability.name === "agent-signing");
|
|
4726
|
+
if (!!signing && (!policy || policy.enforcement === "off" || policy.allowedTools.some((name) => name === "capability:agent-signing" || name.startsWith("capability:agent-signing:")))) {
|
|
4727
|
+
lines.push("- Commit signing is brokered: `git commit -S` works normally through", " `SSH_AUTH_SOCK`; the signing key stays on the host. Do not look for,", " export, or recreate a private key in the guest.");
|
|
4728
|
+
lines.push("- For a signed diary entry use the `moltnet_create_entry` tool with", " `signed: true` (it signs on the trusted host). Do not use the", " guest `moltnet entry create-signed` CLI: it has no guest identity", " credentials and its REST calls will fail.");
|
|
4729
|
+
} else if (signing) lines.push("- An `agent-signing` capability is declared but the active policy does", " not grant it. `git commit -S` and signed diary entries will be denied;", " create unsigned commits/entries unless the capability is granted.");
|
|
4730
|
+
else lines.push("- Local Git commands run inside the guest. No signing key or Git", " credential helper is injected; signing and authenticated push", " require an explicitly provided capability.");
|
|
4731
|
+
}
|
|
4436
4732
|
return lines.join("\n");
|
|
4437
4733
|
}
|
|
4438
4734
|
/**
|
|
@@ -4505,12 +4801,12 @@ function recoverableSubagentSubmitParameters(schema) {
|
|
|
4505
4801
|
* - `output_schema` — name of a registered SubagentOutputContract.
|
|
4506
4802
|
* Resolved at call time; unknown names error.
|
|
4507
4803
|
*/
|
|
4508
|
-
var SubagentToolParameters = Type
|
|
4509
|
-
task: Type
|
|
4804
|
+
var SubagentToolParameters = Type.Object({
|
|
4805
|
+
task: Type.String({
|
|
4510
4806
|
minLength: 1,
|
|
4511
4807
|
description: "Natural-language instructions for the subagent. The subagent starts with a fresh conversation and a narrowed system prompt; this is the only context it has from you."
|
|
4512
4808
|
}),
|
|
4513
|
-
output_schema: Type
|
|
4809
|
+
output_schema: Type.String({
|
|
4514
4810
|
minLength: 1,
|
|
4515
4811
|
description: "Name of a registered subagent output contract. The subagent must submit a structured payload via `submit_subagent_output` matching this contract."
|
|
4516
4812
|
})
|
|
@@ -5470,12 +5766,35 @@ var HOST_AUTHENTICATED_HOST_EXEC_REFUSED_ENV = new Set([
|
|
|
5470
5766
|
"MOLTNET_CREDENTIALS_PATH",
|
|
5471
5767
|
"SSH_AUTH_SOCK"
|
|
5472
5768
|
]);
|
|
5473
|
-
|
|
5474
|
-
|
|
5475
|
-
|
|
5476
|
-
|
|
5477
|
-
|
|
5769
|
+
/** `capability:<name>[:<operation>]` entries in the tool allow-set. */
|
|
5770
|
+
function isHostCapabilityGrant(name) {
|
|
5771
|
+
return name.startsWith("capability:");
|
|
5772
|
+
}
|
|
5773
|
+
/**
|
|
5774
|
+
* A signer whose every operation goes through the capability router, so a
|
|
5775
|
+
* tool cannot obtain a host signature the session policy would deny.
|
|
5776
|
+
*/
|
|
5777
|
+
function createPolicyCheckedSigner(router, identity) {
|
|
5778
|
+
async function call(operation, input) {
|
|
5779
|
+
const result = await router.invoke("agent-signing", operation, input);
|
|
5780
|
+
if (!result.ok) throw new Error(`agent-signing/${operation} ${result.code}: ${result.message}`);
|
|
5781
|
+
return result.output;
|
|
5478
5782
|
}
|
|
5783
|
+
return {
|
|
5784
|
+
identity,
|
|
5785
|
+
async signDiaryEntry(input) {
|
|
5786
|
+
return call("sign-diary-entry", input);
|
|
5787
|
+
},
|
|
5788
|
+
async signGitCommit(input) {
|
|
5789
|
+
const { signature } = await call("sign-git-commit", { sshsig: Buffer.from(input.sshsig).toString("base64") });
|
|
5790
|
+
return { signature: new Uint8Array(Buffer.from(signature, "base64")) };
|
|
5791
|
+
}
|
|
5792
|
+
};
|
|
5793
|
+
}
|
|
5794
|
+
function resolveHostExecBaseEnv(agentEnv) {
|
|
5795
|
+
const names = new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(agentEnv)]);
|
|
5796
|
+
for (const name of HOST_AUTHENTICATED_HOST_EXEC_REFUSED_ENV) names.delete(name);
|
|
5797
|
+
for (const name of names) if (name.startsWith("MOLTNET_")) names.delete(name);
|
|
5479
5798
|
return names;
|
|
5480
5799
|
}
|
|
5481
5800
|
var noopTurnEventHandler = () => {};
|
|
@@ -5491,13 +5810,16 @@ async function openVmWorkspaceFileForRead(config) {
|
|
|
5491
5810
|
};
|
|
5492
5811
|
}
|
|
5493
5812
|
function createGondolinToolDefinitions(config) {
|
|
5494
|
-
const { vm, cwdPath, guestWorkspace } = config;
|
|
5813
|
+
const { vm, cwdPath, guestWorkspace, lifecycle, retireVm } = config;
|
|
5495
5814
|
const grepTool = createGrepToolDefinition(cwdPath);
|
|
5496
|
-
return [
|
|
5815
|
+
return guardGondolinToolDefinitions([
|
|
5497
5816
|
createReadToolDefinition(cwdPath, { operations: createGondolinReadOps(vm, cwdPath, guestWorkspace) }),
|
|
5498
5817
|
createWriteToolDefinition(cwdPath, { operations: createGondolinWriteOps(vm, cwdPath, guestWorkspace) }),
|
|
5499
5818
|
createEditToolDefinition(cwdPath, { operations: createGondolinEditOps(vm, cwdPath, guestWorkspace) }),
|
|
5500
|
-
createBashToolDefinition(cwdPath, { operations: createGondolinBashOps(vm, cwdPath, guestWorkspace
|
|
5819
|
+
createBashToolDefinition(cwdPath, { operations: createGondolinBashOps(vm, cwdPath, guestWorkspace, {
|
|
5820
|
+
lifecycle,
|
|
5821
|
+
retireVm
|
|
5822
|
+
}) }),
|
|
5501
5823
|
createLsToolDefinition(cwdPath, { operations: createGondolinLsOps(vm, cwdPath, guestWorkspace) }),
|
|
5502
5824
|
createFindToolDefinition(cwdPath, { operations: createGondolinFindOps(vm, cwdPath, guestWorkspace) }),
|
|
5503
5825
|
{
|
|
@@ -5507,7 +5829,52 @@ function createGondolinToolDefinitions(config) {
|
|
|
5507
5829
|
return executeGondolinGrep(vm, cwdPath, guestWorkspace, params, signal);
|
|
5508
5830
|
}
|
|
5509
5831
|
}
|
|
5510
|
-
];
|
|
5832
|
+
], lifecycle);
|
|
5833
|
+
}
|
|
5834
|
+
async function retireManagedGondolinVm(config) {
|
|
5835
|
+
const { managed, retirement, secretEnvNames, release } = config;
|
|
5836
|
+
const recoveryErrors = [];
|
|
5837
|
+
for (const guestEnv of secretEnvNames) try {
|
|
5838
|
+
managed.secretManager.revokeSecret(guestEnv);
|
|
5839
|
+
} catch (error) {
|
|
5840
|
+
recoveryErrors.push(error);
|
|
5841
|
+
}
|
|
5842
|
+
try {
|
|
5843
|
+
if (!retirement.backendRetired) await managed.vm.close();
|
|
5844
|
+
} catch (error) {
|
|
5845
|
+
recoveryErrors.push(error);
|
|
5846
|
+
} finally {
|
|
5847
|
+
release();
|
|
5848
|
+
}
|
|
5849
|
+
if (recoveryErrors.length > 0) throw new AggregateError(recoveryErrors, "Sandbox VM retirement recovery failed");
|
|
5850
|
+
}
|
|
5851
|
+
function createGondolinRetirementCoordinator(config = {}) {
|
|
5852
|
+
let retirement = null;
|
|
5853
|
+
let abortHandler = null;
|
|
5854
|
+
return {
|
|
5855
|
+
lifecycle: createGondolinToolLifecycle({ onRetired(next) {
|
|
5856
|
+
retirement = next;
|
|
5857
|
+
config.onRetired?.(next);
|
|
5858
|
+
abortHandler?.(next);
|
|
5859
|
+
} }),
|
|
5860
|
+
bindAbortHandler(handler) {
|
|
5861
|
+
abortHandler = handler;
|
|
5862
|
+
if (retirement) handler(retirement);
|
|
5863
|
+
},
|
|
5864
|
+
getRetirement: () => retirement
|
|
5865
|
+
};
|
|
5866
|
+
}
|
|
5867
|
+
function guardGondolinExtensionFactories(factories, lifecycle) {
|
|
5868
|
+
return factories.map((factory) => (pi) => {
|
|
5869
|
+
factory(new Proxy(pi, { get(target, property, receiver) {
|
|
5870
|
+
if (property === "registerTool") return (tool) => {
|
|
5871
|
+
const [guardedTool] = guardGondolinToolDefinitions([tool], lifecycle);
|
|
5872
|
+
if (guardedTool) target.registerTool(guardedTool);
|
|
5873
|
+
};
|
|
5874
|
+
const value = Reflect.get(target, property, receiver);
|
|
5875
|
+
return typeof value === "function" ? value.bind(target) : value;
|
|
5876
|
+
} }));
|
|
5877
|
+
});
|
|
5511
5878
|
}
|
|
5512
5879
|
/** Resolve one attempt's host-only HTTP credentials before VM resume. */
|
|
5513
5880
|
async function resolveAttemptBrokeredHttpSecrets(input) {
|
|
@@ -5712,6 +6079,7 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
5712
6079
|
resumeCommands: [...resolvedVmTemplate.resumeCommands]
|
|
5713
6080
|
} : opts.sandboxConfig, executionPlan);
|
|
5714
6081
|
let brokeredSecrets;
|
|
6082
|
+
let capabilityRouter;
|
|
5715
6083
|
try {
|
|
5716
6084
|
const runtimeDefinition = opts.runtimeDefinition;
|
|
5717
6085
|
brokeredSecrets = runtimeDefinition ? await traceRuntimePhase("moltnet.execution.credentials.resolve", { "moltnet.credentials.requirement_count": runtimeDefinition.brokeredHttpSecrets?.length ?? 0 }, () => resolveAttemptBrokeredHttpSecrets({
|
|
@@ -5730,19 +6098,53 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
5730
6098
|
await emitError("credential_resolution", message);
|
|
5731
6099
|
return makeFailedOutput("credential_resolution_failed", message, finalUsage, err instanceof PiBrokeredHttpSecretResolutionError ? err.retryable : false);
|
|
5732
6100
|
}
|
|
6101
|
+
if ((opts.runtimeDefinition?.hostCapabilities?.length ?? 0) > 0 && (!opts.agentIdentity || !opts.moltnetAgent)) {
|
|
6102
|
+
const message = "runtime declares host capabilities but no agent identity and authenticated host Agent were injected";
|
|
6103
|
+
await emitError("host_capabilities", message);
|
|
6104
|
+
return makeFailedOutput("host_capability_context_missing", message, finalUsage, false);
|
|
6105
|
+
}
|
|
5733
6106
|
try {
|
|
5734
6107
|
brokeredSecretEnvNames = (brokeredSecrets ?? []).filter(({ value }) => value !== void 0 && value !== "").map(({ guestEnv }) => guestEnv).sort();
|
|
6108
|
+
const hostCapabilities = opts.runtimeDefinition?.hostCapabilities ?? [];
|
|
6109
|
+
if (hostCapabilities.length > 0) capabilityRouter = createHostCapabilityRouter({
|
|
6110
|
+
capabilities: hostCapabilities,
|
|
6111
|
+
context: {
|
|
6112
|
+
taskId: task.id,
|
|
6113
|
+
attemptN: claimedTask.attemptN,
|
|
6114
|
+
teamId: task.teamId ?? "",
|
|
6115
|
+
agent: opts.moltnetAgent,
|
|
6116
|
+
identity: opts.agentIdentity
|
|
6117
|
+
},
|
|
6118
|
+
injected: { ...opts.hostCapabilitySigner && { signer: opts.hostCapabilitySigner } },
|
|
6119
|
+
paths: { mountPath },
|
|
6120
|
+
logger: opts.hostCapabilityLogger ?? opts.toolPolicyLogger ?? {
|
|
6121
|
+
info: (obj, msg) => console.error(JSON.stringify({
|
|
6122
|
+
level: "info",
|
|
6123
|
+
msg,
|
|
6124
|
+
...obj
|
|
6125
|
+
})),
|
|
6126
|
+
warn: (obj, msg) => console.error(JSON.stringify({
|
|
6127
|
+
level: "warn",
|
|
6128
|
+
msg,
|
|
6129
|
+
...obj
|
|
6130
|
+
}))
|
|
6131
|
+
},
|
|
6132
|
+
signal: reporter.cancelSignal
|
|
6133
|
+
});
|
|
5735
6134
|
managed = await traceRuntimePhase("moltnet.execution.vm.resume", { "moltnet.workspace.mode": preparedWorkspace.mode }, () => (opts.resumeVm ?? resumeVm)({
|
|
5736
6135
|
checkpointPath,
|
|
5737
6136
|
agentName: opts.agentName,
|
|
5738
6137
|
agentRootDir,
|
|
5739
|
-
guestCredentialMode: opts.guestCredentialMode,
|
|
5740
6138
|
mountPath,
|
|
5741
6139
|
workspaceMode: preparedWorkspace.mode,
|
|
5742
6140
|
extraAllowedHosts: opts.extraAllowedHosts,
|
|
5743
6141
|
sandboxConfig: effectiveSandboxConfig,
|
|
5744
6142
|
forwardEnv: opts.forwardEnv,
|
|
5745
6143
|
brokeredSecrets,
|
|
6144
|
+
...capabilityRouter && {
|
|
6145
|
+
hostOrigins: capabilityRouter.origins,
|
|
6146
|
+
guestProjection: capabilityRouter.guestProjection
|
|
6147
|
+
},
|
|
5746
6148
|
onDiagnostic: opts.onVmDiagnostic,
|
|
5747
6149
|
signal: reporter.cancelSignal
|
|
5748
6150
|
}));
|
|
@@ -5760,6 +6162,23 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
5760
6162
|
activateAgentEnv$1(managed.credentials.agentEnv, agentRootDir);
|
|
5761
6163
|
const activeWorkspace = preparedWorkspace;
|
|
5762
6164
|
const activeManaged = managed;
|
|
6165
|
+
const sandboxRetirementEvents = [];
|
|
6166
|
+
const sandboxRetirementCoordinator = createGondolinRetirementCoordinator({ onRetired(retirement) {
|
|
6167
|
+
const details = {
|
|
6168
|
+
event: "sandbox_vm_retired",
|
|
6169
|
+
taskId: task.id,
|
|
6170
|
+
attemptN,
|
|
6171
|
+
vmId: activeManaged.vm.id,
|
|
6172
|
+
outcome: retirement.backendRetired ? "retired" : "retirement_failed",
|
|
6173
|
+
...retirement
|
|
6174
|
+
};
|
|
6175
|
+
process.stderr.write(`${JSON.stringify(details)}\n`);
|
|
6176
|
+
sandboxRetirementEvents.push(emitError("sandbox_retirement", `Sandbox VM retired after ${retirement.trigger}`, details).catch((error) => {
|
|
6177
|
+
const message = error instanceof Error ? error.message : String(error);
|
|
6178
|
+
process.stderr.write(`[sandbox] failed to emit retirement event: ${message}\n`);
|
|
6179
|
+
}));
|
|
6180
|
+
} });
|
|
6181
|
+
const gondolinLifecycle = sandboxRetirementCoordinator.lifecycle;
|
|
5763
6182
|
const getMoltNetAgent = createMoltNetAgentResolver({
|
|
5764
6183
|
moltnetAgent: opts.moltnetAgent,
|
|
5765
6184
|
configDir: managed.agentDir
|
|
@@ -5875,7 +6294,20 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
5875
6294
|
const gondolinCustomTools = createGondolinToolDefinitions({
|
|
5876
6295
|
vm: managed.vm,
|
|
5877
6296
|
cwdPath,
|
|
5878
|
-
guestWorkspace: managed.guestWorkspace
|
|
6297
|
+
guestWorkspace: managed.guestWorkspace,
|
|
6298
|
+
lifecycle: gondolinLifecycle,
|
|
6299
|
+
retireVm: async (retirement) => {
|
|
6300
|
+
const recoveringManaged = managed;
|
|
6301
|
+
if (!recoveringManaged) return;
|
|
6302
|
+
await retireManagedGondolinVm({
|
|
6303
|
+
managed: recoveringManaged,
|
|
6304
|
+
retirement,
|
|
6305
|
+
secretEnvNames: brokeredSecretEnvNames,
|
|
6306
|
+
release: () => {
|
|
6307
|
+
if (managed === recoveringManaged) managed = null;
|
|
6308
|
+
}
|
|
6309
|
+
});
|
|
6310
|
+
}
|
|
5879
6311
|
});
|
|
5880
6312
|
const submitCompletion = createSubmitCompletionCoordinator({
|
|
5881
6313
|
onDrained: () => session?.abort(),
|
|
@@ -5896,18 +6328,22 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
5896
6328
|
const moltnetAgent = await getMoltNetAgent();
|
|
5897
6329
|
const moltnetTools = createMoltNetTools({
|
|
5898
6330
|
getAgent: () => moltnetAgent,
|
|
6331
|
+
getSigner: () => capabilityRouter && opts.agentIdentity ? createPolicyCheckedSigner(capabilityRouter, opts.agentIdentity) : null,
|
|
5899
6332
|
getDiaryId: () => diaryId,
|
|
5900
6333
|
getTeamId: () => taskTeamId,
|
|
5901
6334
|
getSessionErrors: () => [],
|
|
5902
6335
|
clearSessionErrors: () => {},
|
|
5903
6336
|
getHostCwd: () => cwdPath,
|
|
5904
|
-
openWorkspaceFileForRead: (filePath) =>
|
|
5905
|
-
|
|
5906
|
-
|
|
5907
|
-
|
|
5908
|
-
|
|
5909
|
-
|
|
5910
|
-
|
|
6337
|
+
openWorkspaceFileForRead: (filePath) => {
|
|
6338
|
+
gondolinLifecycle.assertActive();
|
|
6339
|
+
return openVmWorkspaceFileForRead({
|
|
6340
|
+
vm: activeManaged.vm,
|
|
6341
|
+
cwdPath,
|
|
6342
|
+
guestWorkspace: activeManaged.guestWorkspace,
|
|
6343
|
+
filePath
|
|
6344
|
+
});
|
|
6345
|
+
},
|
|
6346
|
+
hostExecBaseEnv: resolveHostExecBaseEnv(managed.credentials.agentEnv),
|
|
5911
6347
|
hostExecAutoApprove: opts.hostExecAutoApprove ?? opts.sandboxConfig?.hostExec?.autoApprove ?? false,
|
|
5912
6348
|
getTaskContext: () => ({
|
|
5913
6349
|
taskId: task.id,
|
|
@@ -5971,6 +6407,13 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
5971
6407
|
}));
|
|
5972
6408
|
}
|
|
5973
6409
|
}
|
|
6410
|
+
capabilityRouter?.setPolicy(resolvedToolPolicy ? {
|
|
6411
|
+
enforcement: resolvedToolPolicy.enforcement,
|
|
6412
|
+
allowedTools: resolvedToolPolicy.allowedTools
|
|
6413
|
+
} : {
|
|
6414
|
+
enforcement: "off",
|
|
6415
|
+
allowedTools: /* @__PURE__ */ new Set()
|
|
6416
|
+
});
|
|
5974
6417
|
const runtimeToolContext = {
|
|
5975
6418
|
agent: moltnetAgent,
|
|
5976
6419
|
claimedTask,
|
|
@@ -5979,30 +6422,30 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
5979
6422
|
cwdPath,
|
|
5980
6423
|
guestWorkspace: managed.guestWorkspace
|
|
5981
6424
|
};
|
|
5982
|
-
const runtimeParentTools = opts.runtimeDefinition ? await materializePiTools({
|
|
6425
|
+
const runtimeParentTools = opts.runtimeDefinition ? guardGondolinToolDefinitions(await materializePiTools({
|
|
5983
6426
|
runtime: opts.runtimeDefinition,
|
|
5984
6427
|
context: runtimeToolContext,
|
|
5985
6428
|
target: "parent",
|
|
5986
6429
|
policy: resolvedToolPolicy
|
|
5987
|
-
}) : [];
|
|
5988
|
-
const runtimeSubagentTools = opts.runtimeDefinition ? await materializePiTools({
|
|
6430
|
+
}), gondolinLifecycle) : [];
|
|
6431
|
+
const runtimeSubagentTools = opts.runtimeDefinition ? guardGondolinToolDefinitions(await materializePiTools({
|
|
5989
6432
|
runtime: opts.runtimeDefinition,
|
|
5990
6433
|
context: runtimeToolContext,
|
|
5991
6434
|
target: "subagent",
|
|
5992
6435
|
policy: resolvedToolPolicy
|
|
5993
|
-
}) : [];
|
|
5994
|
-
const runtimeParentExtensions = opts.runtimeDefinition ? await materializePiExtensions({
|
|
6436
|
+
}), gondolinLifecycle) : [];
|
|
6437
|
+
const runtimeParentExtensions = opts.runtimeDefinition ? guardGondolinExtensionFactories(await materializePiExtensions({
|
|
5995
6438
|
runtime: opts.runtimeDefinition,
|
|
5996
6439
|
context: runtimeToolContext,
|
|
5997
6440
|
target: "parent",
|
|
5998
6441
|
policy: resolvedToolPolicy
|
|
5999
|
-
}) : [];
|
|
6000
|
-
const runtimeSubagentExtensions = opts.runtimeDefinition ? await materializePiExtensions({
|
|
6442
|
+
}), gondolinLifecycle) : [];
|
|
6443
|
+
const runtimeSubagentExtensions = opts.runtimeDefinition ? guardGondolinExtensionFactories(await materializePiExtensions({
|
|
6001
6444
|
runtime: opts.runtimeDefinition,
|
|
6002
6445
|
context: runtimeToolContext,
|
|
6003
6446
|
target: "subagent",
|
|
6004
6447
|
policy: resolvedToolPolicy
|
|
6005
|
-
}) : [];
|
|
6448
|
+
}), gondolinLifecycle) : [];
|
|
6006
6449
|
const visibleBaseTools = filterModelVisibleTools([...gondolinCustomTools, ...moltnetTools], resolvedToolPolicy);
|
|
6007
6450
|
const taskHasSubagents = taskTypeUsesSubagents(task.taskType);
|
|
6008
6451
|
const visibleParentToolNames = modelVisiblePiToolNames({
|
|
@@ -6016,7 +6459,10 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
6016
6459
|
policy: resolvedToolPolicy
|
|
6017
6460
|
});
|
|
6018
6461
|
const capabilityProjection = projectRuntimeCapabilities({
|
|
6019
|
-
policy: resolvedToolPolicy
|
|
6462
|
+
policy: resolvedToolPolicy && {
|
|
6463
|
+
...resolvedToolPolicy,
|
|
6464
|
+
allowedTools: new Set([...resolvedToolPolicy.allowedTools].filter((name) => !isHostCapabilityGrant(name)))
|
|
6465
|
+
},
|
|
6020
6466
|
visibleToolNames: visibleParentToolNames,
|
|
6021
6467
|
unavailableShellCommands: unavailableRuntimeShellCommands
|
|
6022
6468
|
});
|
|
@@ -6051,7 +6497,8 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
6051
6497
|
verifiedExecutables: verifiedGuestExecutables,
|
|
6052
6498
|
allowedHosts: [...effectiveSandboxConfig?.network?.allowedHosts ?? [], ...opts.extraAllowedHosts ?? []],
|
|
6053
6499
|
allowedInternalHosts: effectiveSandboxConfig?.network?.allowedInternalHosts ?? [],
|
|
6054
|
-
brokeredSecretEnvNames
|
|
6500
|
+
brokeredSecretEnvNames,
|
|
6501
|
+
...capabilityRouter && { hostCapabilities: capabilityRouter.manifest }
|
|
6055
6502
|
},
|
|
6056
6503
|
toolPolicy: capabilityProjection.instructorPolicy
|
|
6057
6504
|
});
|
|
@@ -6089,12 +6536,12 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
6089
6536
|
});
|
|
6090
6537
|
parentSubagentTools.push(subagentHandle.tool);
|
|
6091
6538
|
}
|
|
6092
|
-
const parentTools = [
|
|
6539
|
+
const parentTools = guardGondolinToolDefinitions([
|
|
6093
6540
|
...visibleBaseTools,
|
|
6094
6541
|
...runtimeParentTools,
|
|
6095
6542
|
...submitTools,
|
|
6096
6543
|
...parentSubagentTools
|
|
6097
|
-
];
|
|
6544
|
+
], gondolinLifecycle);
|
|
6098
6545
|
session = await traceRuntimePhase("moltnet.execution.session.create", {
|
|
6099
6546
|
"gen_ai.provider.name": opts.provider,
|
|
6100
6547
|
"gen_ai.request.model": opts.model
|
|
@@ -6187,6 +6634,9 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
6187
6634
|
message
|
|
6188
6635
|
}));
|
|
6189
6636
|
};
|
|
6637
|
+
sandboxRetirementCoordinator.bindAbortHandler((retirement) => {
|
|
6638
|
+
triggerCapAbort("sandbox_retired", `Sandbox VM retired after ${retirement.trigger}: ${retirement.reason}.`);
|
|
6639
|
+
});
|
|
6190
6640
|
session.subscribe(makeSessionEventHandler({
|
|
6191
6641
|
state: turnState,
|
|
6192
6642
|
usage,
|
|
@@ -6256,7 +6706,7 @@ async function executePiTask(claimedTask, reporter, opts) {
|
|
|
6256
6706
|
event: "subagent_summary",
|
|
6257
6707
|
callCount: subagentHandle.getCallCount()
|
|
6258
6708
|
});
|
|
6259
|
-
await Promise.all(recordingPromise);
|
|
6709
|
+
await Promise.all([...recordingPromise, ...sandboxRetirementEvents]);
|
|
6260
6710
|
const cancelled = reporter.cancelSignal.aborted;
|
|
6261
6711
|
let parsedOutput = null;
|
|
6262
6712
|
let parsedOutputCid = null;
|
|
@@ -6667,7 +7117,10 @@ async function cleanupAttempt(deps) {
|
|
|
6667
7117
|
log(`executePiTask: reporter.close() failed for task ${deps.taskId} attempt ${deps.attemptN}: ${detail}`);
|
|
6668
7118
|
}
|
|
6669
7119
|
}
|
|
6670
|
-
if (deps.managed)
|
|
7120
|
+
if (deps.managed) {
|
|
7121
|
+
await deps.managed.services?.stop().catch(() => void 0);
|
|
7122
|
+
await deps.managed.vm.close();
|
|
7123
|
+
}
|
|
6671
7124
|
if (deps.workspace) try {
|
|
6672
7125
|
deps.workspace.cleanup();
|
|
6673
7126
|
} catch (err) {
|
|
@@ -7024,4 +7477,4 @@ function describeToolErrorMessage(result) {
|
|
|
7024
7477
|
}
|
|
7025
7478
|
}
|
|
7026
7479
|
//#endregion
|
|
7027
|
-
export { BrokeredHttpSecretBoundaryError, DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS, GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION,
|
|
7480
|
+
export { BrokeredHttpSecretBoundaryError, DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS, GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GUEST_ALLOWED_SIGNERS_PATH, GUEST_GITCONFIG_PATH, GUEST_SIGNER_SOCKET, GondolinVmRetiredError, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_RUNTIME_DEFINITION_VERSION, PiBrokeredHttpSecretResolutionError, activateAgentEnv, agentSigningCapability, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinToolLifecycle, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiBrokeredHttpSecret, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, guardGondolinToolDefinitions, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiBrokeredHttpSecrets, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, prepareBrokeredHttpSecrets, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };
|