@tomflow/proflow-agent-gateway 0.1.16 → 0.1.18

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tomflow/proflow-agent-gateway
 
+## 0.1.18
+
+### Patch Changes
+
+- Aggregate Browser, Permission, Host-application, Provisioning, Direct Tool, and Gateway observability at stable runtime boundaries, preserving owner truth while enabling one operation-chain diagnosis path without logging sensitive payloads.
+
+## 0.1.17
+
+### Patch Changes
+
+- Close the Real-3 runtime reconciliation, health, browser effect-result boundary, observer pagination, and standalone execution-runtime configuration gaps for final human acceptance.
+
 ## 0.1.16
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -6,7 +6,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.16";
+            moduleVersion: "0.1.18";
             data: {
                 localBaseUrl: string;
                 publicBaseUrl?: string;
@@ -20,7 +20,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.16";
+            readonly moduleVersion: "0.1.18";
         };
         observedEffects: string[];
     }>;
@@ -30,7 +30,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.16";
+            moduleVersion: "0.1.18";
             data: {
                 setupStatus: "BLOCKED" | "READY";
                 runtimeStatus: "RUNNING" | "STOPPED";
@@ -51,7 +51,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.16";
+            moduleVersion: "0.1.18";
             data: {
                 localBaseUrl: string;
                 publicBaseUrl?: string;
@@ -66,7 +66,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.16";
+            moduleVersion: "0.1.18";
             data: {
                 docs: string;
             };
@@ -79,7 +79,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.16";
+            moduleVersion: "0.1.18";
             data: {
                 host: string;
                 port: number;
@@ -90,7 +90,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.16";
+            moduleVersion: "0.1.18";
             ok: false;
             status: "FAILED";
             error: {
@@ -107,7 +107,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.16";
+            readonly moduleVersion: "0.1.18";
         };
         observedEffects: string[];
     } | {
@@ -116,11 +116,11 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.16";
+            readonly moduleVersion: "0.1.18";
         } | {
             contract: "deployment.result.v1";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.16";
+            moduleVersion: "0.1.18";
             ok: false;
             status: "FAILED";
             error: {

package/dist/deployment/adapter.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { appendFile, mkdir } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
 import { deterministicLoopbackPort, readModuleSharedFacts, writeModuleSharedFacts, } from "@tomflow/proflow-module-contract";
 import { descriptor } from "./descriptor.js";
 const services = new Map();
@@ -56,8 +57,8 @@ async function running(context) {
     if (!own)
         return false;
     try {
-        return (await fetch(`${own.localBaseUrl}/ready`, {
-            signal: AbortSignal.timeout(500),
+        return (await fetch(`${own.localBaseUrl}/health`, {
+            signal: AbortSignal.timeout(2_000),
         })).ok;
     }
     catch {
@@ -72,6 +73,20 @@ async function compose(context) {
     const credentialFile = join(deps.stateRoot, "agent", "secrets", "role-credentials.json");
     if (!existsSync(credentialFile))
         throw new Error("Agent role credential store is not materialized by Platform Host");
+    const logPath = join(deps.stateRoot, "logs", "agent-gateway", "events.jsonl");
+    let logTail = Promise.resolve();
+    const log = (entry) => {
+        logTail = logTail
+            .catch(() => undefined)
+            .then(async () => {
+            await mkdir(dirname(logPath), { recursive: true, mode: 0o700 });
+            await appendFile(logPath, `${JSON.stringify(entry)}\n`, {
+                encoding: "utf8",
+                mode: 0o600,
+            });
+        });
+        void logTail;
+    };
     const { createAgentGatewayProcess, parseAgentGatewayProcessConfig } = await import("../src/process.js");
     const listener = new URL(own.localBaseUrl);
     return createAgentGatewayProcess({
@@ -83,6 +98,8 @@ async function compose(context) {
             credentialFile,
             downstreamCredentialFile: deps.downstreamCredentialFile,
         }),
+        log,
+        operationLog: log,
     });
 }
 const failed = (code, message) => ({
@@ -104,7 +121,9 @@ export const behaviorAdapter = {
         }
         return {
             result: base,
-            observedEffects: service ? ["Manage the declared service process"] : [],
+            observedEffects: service
+                ? ["Manage the declared service process"]
+                : [],
         };
     },
     status: async (context) => {
@@ -157,7 +176,9 @@ export const behaviorAdapter = {
         result: {
             ...base,
             data: {
-                docs: readFileSync(new URL(import.meta.url.includes("/dist/") ? "../../DOCS.md" : "../DOCS.md", import.meta.url), "utf8"),
+                docs: readFileSync(new URL(import.meta.url.includes("/dist/")
+                    ? "../../DOCS.md"
+                    : "../DOCS.md", import.meta.url), "utf8"),
             },
         },
         observedEffects: [],
@@ -175,7 +196,9 @@ export const behaviorAdapter = {
         }
         catch (error) {
             return {
-                result: failed("START_FAILED", error instanceof Error ? error.message : "agent-gateway start failed"),
+                result: failed("START_FAILED", error instanceof Error
+                    ? error.message
+                    : "agent-gateway start failed"),
                 observedEffects: [],
             };
         }

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "agent-gateway";
     readonly packageName: "@tomflow/proflow-agent-gateway";
-    readonly moduleVersion: "0.1.16";
+    readonly moduleVersion: "0.1.18";
     readonly kind: "service";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";
@@ -21,9 +21,6 @@ export declare const descriptor: {
     }, {
         readonly contractRef: "task-orchestration";
         readonly versionRange: ">=1.0.0 <2.0.0";
-    }, {
-        readonly contractRef: "execution";
-        readonly versionRange: ">=1.0.0 <2.0.0";
     }, {
         readonly contractRef: "platform-host";
         readonly versionRange: ">=1.0.0 <2.0.0";

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "agent-gateway",
     packageName: "@tomflow/proflow-agent-gateway",
-    moduleVersion: "0.1.16",
+    moduleVersion: "0.1.18",
     kind: "service",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",
@@ -26,10 +26,6 @@ export const descriptor = {
             contractRef: "task-orchestration",
             versionRange: ">=1.0.0 <2.0.0",
         },
-        {
-            contractRef: "execution",
-            versionRange: ">=1.0.0 <2.0.0",
-        },
         {
             contractRef: "platform-host",
             versionRange: ">=1.0.0 <2.0.0",

package/dist/src/index.d.ts

@@ -9,6 +9,7 @@ export type GatewayOwnerPorts = {
     authenticateBearer(credential: string): Promise<string>;
     route(operationId: string, authenticatedRoleRef: string, input: unknown, context?: {
         signal: AbortSignal;
+        deadlineAt: string;
         fileMaterializationInputs?: readonly ExternalFileMaterializationInput[];
     }): Promise<unknown>;
     lookupResult?(operationId: string, authenticatedRoleRef: string, input: unknown): Promise<unknown>;

package/dist/src/index.js

@@ -331,11 +331,15 @@ export async function createAgentGateway(options) {
                     canonicalBody.content.length > 0)
                     throw new AgentGatewayError("OPENAI_FILE_INPUT_CONFLICT");
             }
-            const actionSignal = AbortSignal.timeout(options.actionTimeoutMs ?? 45_000);
+            const actionTimeoutMs = Math.min(40_000, options.actionTimeoutMs ?? 40_000);
+            const propagationReserveMs = Math.min(1_500, Math.max(100, Math.floor(actionTimeoutMs / 10)));
+            const deadlineAt = new Date(now() + Math.max(1, actionTimeoutMs - propagationReserveMs)).toISOString();
+            const actionSignal = AbortSignal.timeout(actionTimeoutMs);
             const operation = action.uncertain && options.owners.lookupResult
                 ? options.owners.lookupResult(action.operationId, authenticatedRoleRef, canonicalBody)
                 : options.owners.route(action.operationId, authenticatedRoleRef, canonicalBody, {
                     signal: actionSignal,
+                    deadlineAt,
                     ...(fileMaterializationInputs === undefined
                         ? {}
                         : { fileMaterializationInputs }),

package/dist/src/process.d.ts

@@ -12,6 +12,7 @@ export declare function createAgentGatewayProcess(input: {
     config: AgentGatewayProcessConfig;
     fetch?: typeof globalThis.fetch;
     log?: (entry: Record<string, unknown>) => void;
+    operationLog?: (entry: Record<string, unknown>) => void;
 }): Promise<Readonly<{
     readiness: () => Promise<{
         status: "NOT_READY" | "READY";

package/dist/src/process.js

@@ -18,7 +18,20 @@ const safeDownstreamErrorCodes = new Set([
     "EXECUTION_GENERATION_MISMATCH",
     "EXECUTION_ROLE_SCOPE_MISMATCH",
     "EXECUTION_WORKER_SCOPE_MISMATCH",
+    "ROLE_TOOL_OPERATION_DENIED",
+    "DIRECT_TOOL_INPUT_INVALID",
+    "DIRECT_TOOL_DEADLINE_REQUIRED",
+    "LOCAL_TOOL_BRIDGE_UNAVAILABLE",
+    "LOCAL_TOOL_AUTH_INVALID",
+    "LOCAL_TOOL_INPUT_INVALID",
+    "LOCAL_TOOL_OFFLINE",
+    "LOCAL_TOOL_COMMAND_TIMEOUT",
+    "LOCAL_TOOL_RESULT_UNKNOWN",
+    "LOCAL_TOOL_PROVIDER_UNAVAILABLE",
+    "LOCAL_TOOL_SCOPE_DENIED",
+    "LOCAL_TOOL_COMMAND_FAILED",
 ]);
+const directToolOperationIds = new Set(["localDev", "repomix", "codeGraph"]);
 async function boundedDownstreamErrorCode(response) {
     if (!response.body)
         return null;
@@ -70,6 +83,27 @@ function text(value, name) {
         throw new TypeError(`${name} must be a non-empty string`);
     return value;
 }
+function logErrorCode(error) {
+    const value = error instanceof AgentGatewayError
+        ? error.code
+        : error &&
+            typeof error === "object" &&
+            typeof Reflect.get(error, "message") === "string"
+            ? String(Reflect.get(error, "message"))
+            : "GATEWAY_FAILURE";
+    return /^[A-Z][A-Z0-9_.:-]{0,159}$/.test(value)
+        ? value
+        : "GATEWAY_FAILURE";
+}
+function optionalToolOperation(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        Array.isArray(value) ||
+        typeof Reflect.get(value, "operation") !== "string")
+        return undefined;
+    const operation = String(Reflect.get(value, "operation"));
+    return /^[A-Za-z0-9_.:-]{1,160}$/.test(operation) ? operation : undefined;
+}
 export function parseAgentGatewayProcessConfig(value) {
     const input = record(value, "agent-gateway config");
     const publicBaseUrl = new URL(text(input.publicBaseUrl, "publicBaseUrl"));
@@ -130,11 +164,6 @@ async function readDownstreamCredential(file) {
 export async function createAgentGatewayProcess(input) {
     const fetchImplementation = input.fetch ?? globalThis.fetch;
     const credentialFile = input.config.credentialFile;
-    // Fail-fast at startup so a malformed configured credential store is rejected
-    // before the process advertises readiness. Authentication re-reads the current
-    // store on every attempt below, so a rotated key takes effect without a restart
-    // and a malformed/half-written store fails closed instead of serving a stale
-    // snapshot.
     await readCurrentCredentialStore(credentialFile);
     if (input.config.downstreamCredentialFile)
         await readDownstreamCredential(input.config.downstreamCredentialFile);
@@ -187,6 +216,29 @@ export async function createAgentGatewayProcess(input) {
         }
         return response.json();
     };
+    const emitOperation = (inputEvent) => {
+        const toolOperation = directToolOperationIds.has(inputEvent.operationId)
+            ? optionalToolOperation(inputEvent.value)
+            : undefined;
+        input.operationLog?.({
+            contract: "proflow.operation-boundary.v1",
+            timestamp: new Date().toISOString(),
+            source: "agent-gateway",
+            component: "agent-gateway-ingress",
+            event: inputEvent.mode === "LOOKUP"
+                ? "GATEWAY_ACTION_LOOKUP"
+                : "GATEWAY_ACTION",
+            boundary: directToolOperationIds.has(inputEvent.operationId)
+                ? "TOOL_INVOCATION"
+                : "ACTION",
+            status: inputEvent.status,
+            operationId: inputEvent.operationId,
+            roleRef: inputEvent.roleRef,
+            ...(toolOperation ? { toolOperation } : {}),
+            ...(inputEvent.errorCode ? { errorCode: inputEvent.errorCode } : {}),
+            durationMs: inputEvent.durationMs,
+        });
+    };
     const gateway = await createAgentGateway({
         host: input.config.host,
         port: input.config.port,
@@ -199,22 +251,68 @@ export async function createAgentGatewayProcess(input) {
                         return roleRef;
                 throw new Error("AUTHENTICATION_FAILED");
             },
-            route(operationId, authenticatedRoleRef, value, context) {
-                return downstream(`/actions/${encodeURIComponent(operationId)}`, {
-                    authenticatedRoleRef,
-                    input: value,
-                    ...(context?.fileMaterializationInputs === undefined
-                        ? {}
-                        : {
-                            fileMaterializationInputs: context.fileMaterializationInputs,
-                        }),
-                }, context?.signal);
+            async route(operationId, authenticatedRoleRef, value, context) {
+                const started = performance.now();
+                try {
+                    const result = await downstream(`/actions/${encodeURIComponent(operationId)}`, {
+                        authenticatedRoleRef,
+                        input: value,
+                        deadlineAt: context?.deadlineAt,
+                        ...(context?.fileMaterializationInputs === undefined
+                            ? {}
+                            : {
+                                fileMaterializationInputs: context.fileMaterializationInputs,
+                            }),
+                    }, context?.signal);
+                    emitOperation({
+                        mode: "ROUTE",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "SUCCEEDED",
+                        durationMs: performance.now() - started,
+                    });
+                    return result;
+                }
+                catch (error) {
+                    emitOperation({
+                        mode: "ROUTE",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "FAILED",
+                        errorCode: logErrorCode(error),
+                        durationMs: performance.now() - started,
+                    });
+                    throw error;
+                }
             },
-            lookupResult(operationId, authenticatedRoleRef, value) {
-                return downstream(`/actions/${encodeURIComponent(operationId)}/result`, {
-                    authenticatedRoleRef,
-                    input: value,
-                });
+            async lookupResult(operationId, authenticatedRoleRef, value) {
+                const started = performance.now();
+                try {
+                    const result = await downstream(`/actions/${encodeURIComponent(operationId)}/result`, { authenticatedRoleRef, input: value });
+                    emitOperation({
+                        mode: "LOOKUP",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "SUCCEEDED",
+                        durationMs: performance.now() - started,
+                    });
+                    return result;
+                }
+                catch (error) {
+                    emitOperation({
+                        mode: "LOOKUP",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "FAILED",
+                        errorCode: logErrorCode(error),
+                        durationMs: performance.now() - started,
+                    });
+                    throw error;
+                }
             },
             async readiness() {
                 try {
@@ -247,6 +345,7 @@ export async function createAgentGatewayProcess(input) {
             timestamp: new Date().toISOString(),
             component: "agent-gateway-process",
             event: "SERVICE_STARTED",
+            status: "SUCCEEDED",
             ...address,
         });
         return address;
@@ -257,6 +356,7 @@ export async function createAgentGatewayProcess(input) {
             timestamp: new Date().toISOString(),
             component: "agent-gateway-process",
             event: "SERVICE_STOPPED",
+            status: "SUCCEEDED",
         });
     };
     return Object.freeze({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-agent-gateway",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -28,15 +28,14 @@
     "@tomflow/proflow-module-contract": "^0.1.13"
   },
   "devDependencies": {
-    "@tomflow/proflow-agent-runtime": "^0.1.13",
+    "@tomflow/proflow-agent-runtime": "^0.1.17",
+    "@tomflow/proflow-execution-browser-extension": "^0.1.58",
+    "@tomflow/proflow-execution-runtime": "^0.1.19",
+    "@tomflow/proflow-platform-host": "^0.1.28",
     "@tomflow/proflow-deployment-conformance": "^0.1.13",
-    "@tomflow/proflow-execution-browser-extension": "^0.1.45",
-    "@tomflow/proflow-execution-runtime": "^0.1.18",
-    "@tomflow/proflow-task-orchestration": "^0.1.11",
-    "@tomflow/proflow-task-store-sqlite": "^0.1.11",
     "@tomflow/proflow-task-migration-runner": "^0.1.11",
-    "@tomflow/proflow-execution-local": "^0.1.15",
-    "@tomflow/proflow-platform-host": "^0.1.19"
+    "@tomflow/proflow-task-orchestration": "^0.1.11",
+    "@tomflow/proflow-task-store-sqlite": "^0.1.12"
   },
   "description": "The sole Custom GPT Actions HTTP ingress and OpenAI transport anti-corruption layer.",
   "keywords": [

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "agent-gateway",
 	"packageName": "@tomflow/proflow-agent-gateway",
-	"moduleVersion": "0.1.16",
+	"moduleVersion": "0.1.18",
 	"kind": "service",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",
@@ -26,10 +26,6 @@
 			"contractRef": "task-orchestration",
 			"versionRange": ">=1.0.0 <2.0.0"
 		},
-		{
-			"contractRef": "execution",
-			"versionRange": ">=1.0.0 <2.0.0"
-		},
 		{
 			"contractRef": "platform-host",
 			"versionRange": ">=1.0.0 <2.0.0"