@undefineds.co/xpod 0.4.19 → 0.4.25

package/dist/api/runtime.js

@@ -4,12 +4,14 @@ exports.OFFICIAL_CLOUD_IDENTITY_ORIGIN = void 0;
 exports.autoProvisionFirstRunLocal = autoProvisionFirstRunLocal;
 exports.resolveTunnelIngressPort = resolveTunnelIngressPort;
 exports.startApiService = startApiService;
+const ensureSupportedBun_1 = require("../runtime/compat/ensureSupportedBun");
 const awilix_1 = require("awilix");
 const global_logger_factory_1 = require("global-logger-factory");
 const ConfigurableLoggerFactory_1 = require("../logging/ConfigurableLoggerFactory");
 const log_file_1 = require("../logging/log-file");
 const container_1 = require("./container");
 const routes_1 = require("./container/routes");
+const background_service_supervisor_1 = require("./background-service-supervisor");
 const OpenAuthMiddleware_1 = require("./middleware/OpenAuthMiddleware");
 const EmbeddedInngestService_1 = require("./runs/EmbeddedInngestService");
 const LocalProvisionState_1 = require("../provision/LocalProvisionState");
@@ -364,6 +366,13 @@ function resolveTunnelIngressPort(env = process.env) {
     }
     return 3000;
 }
+/**
+ * 后台服务由 supervisor 接管（审计 N18）。
+ *
+ * 此前每个服务只 start 一次，失败只写日志：开机时断网、provider 抖动的隧道会一直躺着，
+ * 跑着跑着死掉的也没人发现。现在启动失败按退避重试，起来之后按间隔复查存活。
+ */
+const backgroundSupervisors = [];
 async function startBackgroundServices(container, logger) {
     try {
         const localNetworkManager = container.resolve('localNetworkManager', { allowUnregistered: true });
@@ -377,8 +386,18 @@ async function startBackgroundServices(container, logger) {
     try {
         const ddnsManager = container.resolve('ddnsManager', { allowUnregistered: true });
         if (ddnsManager) {
-            await ddnsManager.start();
-            logger.info('DDNS Manager started');
+            const supervisor = new background_service_supervisor_1.BackgroundServiceSupervisor({
+                name: 'ddns',
+                start: async () => {
+                    await ddnsManager.start();
+                },
+                stop: async () => {
+                    ddnsManager.stop?.();
+                },
+                logger,
+            });
+            backgroundSupervisors.push(supervisor);
+            supervisor.start();
         }
     }
     catch (error) {
@@ -388,13 +407,25 @@ async function startBackgroundServices(container, logger) {
         const localTunnelProvider = container.resolve('localTunnelProvider', { allowUnregistered: true });
         if (localTunnelProvider) {
             logger.info('Starting local tunnel provider...');
-            const config = await localTunnelProvider.setup({
-                subdomain: 'local',
-                localPort: resolveTunnelIngressPort(),
-                localProtocol: 'http',
+            const supervisor = new background_service_supervisor_1.BackgroundServiceSupervisor({
+                name: `tunnel:${String(localTunnelProvider.name ?? 'local')}`,
+                start: async () => {
+                    const config = await localTunnelProvider.setup({
+                        subdomain: 'local',
+                        localPort: resolveTunnelIngressPort(),
+                        localProtocol: 'http',
+                    });
+                    await localTunnelProvider.start(config);
+                },
+                stop: async () => {
+                    await localTunnelProvider.stop?.();
+                },
+                // 隧道进程退出后 provider 自己知道状态，supervisor 据此重启。
+                isRunning: () => Boolean(localTunnelProvider.getStatus?.().running),
+                logger,
             });
-            await localTunnelProvider.start(config);
-            logger.info('Local tunnel provider started');
+            backgroundSupervisors.push(supervisor);
+            supervisor.start();
         }
     }
     catch (error) {
@@ -402,12 +433,10 @@ async function startBackgroundServices(container, logger) {
     }
 }
 async function stopBackgroundServices(container) {
-    try {
-        const ddnsManager = container.resolve('ddnsManager', { allowUnregistered: true });
-        ddnsManager?.stop();
-    }
-    catch {
-        // ignore shutdown errors
+    // 先停监督器：否则一次关停会被自己排的重试撤销（ddns/tunnel 的 stop 由它们负责调用）。
+    while (backgroundSupervisors.length > 0) {
+        const supervisor = backgroundSupervisors.pop();
+        await supervisor?.stop();
     }
     try {
         const localNetworkManager = container.resolve('localNetworkManager', { allowUnregistered: true });
@@ -416,13 +445,8 @@ async function stopBackgroundServices(container) {
     catch {
         // ignore shutdown errors
     }
-    try {
-        const localTunnelProvider = container.resolve('localTunnelProvider', { allowUnregistered: true });
-        await localTunnelProvider?.stop();
-    }
-    catch {
-        // ignore shutdown errors
-    }
+    // The tunnel provider's stop is owned by its supervisor above; stopping it twice would kill
+    // the same process twice and make the shutdown path look like it did more than it did.
 }
 async function stopApiRuntimeServices(container) {
     try {
@@ -467,6 +491,11 @@ async function startEmbeddedInngestService(config, logger) {
         signingKey: config.inngest?.signingKey,
         binaryPath: config.inngest?.binaryPath,
         sqliteDir: config.inngest?.sqliteDir,
+        // Unix-socket transport cannot name a TCP callback address; the service
+        // derives a private loopback bridge and signs it with the Gateway marker.
+        socketPath: config.socketPath,
+        gatewayAdminProxyAuthSecret: config.gatewayAdminProxyAuthSecret,
+        runtimeHost: config.runtimeHost,
     });
     const runtimeConfig = await service.start();
     if (runtimeConfig.enabled) {
@@ -478,6 +507,7 @@ async function startEmbeddedInngestService(config, logger) {
     return { service, runtimeConfig };
 }
 async function startApiService(options = {}) {
+    (0, ensureSupportedBun_1.ensureSupportedBun)();
     if (options.initializeLogger !== false) {
         initApiLogger();
     }

package/dist/api/service/provider-http-transport.d.ts

@@ -1,4 +1,4 @@
-import { Dispatcher as UndiciDispatcher } from 'undici';
+import { Dispatcher as UndiciDispatcher } from 'undici/index.js';
 import { type ProviderAddressResolver } from './provider-http-policy';
 export type { ProviderAddressResolver, ProviderResolvedAddress } from './provider-http-policy';
 export declare function normalizeProviderProxyUrl(value: string | undefined | null): string | undefined;
@@ -19,6 +19,17 @@ export interface ProviderHttpTransportOptions {
     allowedPrivateOrigins?: string[];
     systemProxy?: string;
 }
+export interface ProviderHttpRequestOptions {
+    url: string;
+    method?: string;
+    headers?: HeadersInit;
+    body?: BodyInit | null;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    proxy?: string;
+    redirect?: 'manual' | 'error';
+    allowPrivateNetwork?: boolean;
+}
 export declare class ProviderHttpTransport {
     private readonly fetch;
     private readonly resolver;
@@ -26,6 +37,8 @@ export declare class ProviderHttpTransport {
     private readonly allowedPrivateOrigins;
     private readonly systemProxy?;
     constructor(options?: ProviderHttpTransportOptions);
+    /** A single policy-checked request; the caller owns HTTP status handling and body consumption. */
+    request(options: ProviderHttpRequestOptions): Promise<Response>;
     postJson(options: {
         url: string;
         apiKey: string;

package/dist/api/service/provider-http-transport.js

@@ -8,7 +8,7 @@ exports.closeProviderDispatcher = closeProviderDispatcher;
 exports.parseSseStream = parseSseStream;
 const node_net_1 = require("node:net");
 const node_child_process_1 = require("node:child_process");
-const undici_1 = require("undici");
+const index_js_1 = require("undici/index.js");
 const provider_http_policy_1 = require("./provider-http-policy");
 function normalizeProviderProxyUrl(value) {
     if (value === undefined || value === null || !value.trim())
@@ -61,6 +61,8 @@ function discoverSystemProviderProxy() {
 /** @internal Runtime compatibility for Bun's inert undici dispatcher shim. */
 async function closeProviderDispatcher(dispatcher) {
     const compatible = dispatcher;
+    if (compatible.destroyed)
+        return;
     if (typeof compatible.close === 'function') {
         await compatible.close();
         return;
@@ -70,7 +72,7 @@ async function closeProviderDispatcher(dispatcher) {
     }
 }
 function createPinnedConnector(resolver, allowPrivateNetwork) {
-    const connector = (0, undici_1.buildConnector)({});
+    const connector = (0, index_js_1.buildConnector)({});
     return (options, callback) => {
         const originalHostname = options.hostname;
         const hostname = stripIpv6Brackets(originalHostname);
@@ -96,28 +98,77 @@ function createPinnedConnector(resolver, allowPrivateNetwork) {
     };
 }
 function createPinnedAgent(resolution, resolver) {
-    return new undici_1.Agent({
+    return new index_js_1.Agent({
         connect: createPinnedConnector(resolver, resolution.allowPrivateNetwork),
     });
 }
-function createPinnedProxyAgent(resolution, resolver) {
+function createPinnedProxyAgent(resolution, resolver, target) {
     const proxyConnector = createPinnedConnector(resolver, resolution.allowPrivateNetwork);
-    return new undici_1.ProxyAgent({
+    const agent = new index_js_1.ProxyAgent({
         uri: resolution.url.href,
-        clientFactory: (origin, options) => new undici_1.Client(origin, {
+        requestTls: target ? { servername: stripIpv6Brackets(target.hostname) } : undefined,
+        clientFactory: (origin, options) => new index_js_1.Client(origin, {
             ...options,
             connect: proxyConnector,
         }),
     });
+    if (!target)
+        return agent;
+    // fetch removes Host before dispatch. Restore the checked origin's identity
+    // inside the tunnel while its request URL keeps the destination IP pinned.
+    return agent.compose((dispatch) => (options, handler) => {
+        const headers = options.headers;
+        const entries = Array.isArray(headers)
+            ? headers.reduce((pairs, value, index) => {
+                if (index % 2 === 0)
+                    pairs.push([value, headers[index + 1]]);
+                return pairs;
+            }, [])
+            : headers && Symbol.iterator in headers ? [...headers] : Object.entries(headers ?? {});
+        return dispatch({ ...options, headers: { ...Object.fromEntries(entries), host: target.url.host } }, handler);
+    });
 }
 class ProviderHttpTransport {
     constructor(options = {}) {
-        this.fetch = options.fetch ?? fetch;
+        // The bare undici import is an inert Bun built-in shim. Its package entry
+        // and fetch implementation are required for DNS-pinned dispatchers on Bun.
+        this.fetch = options.fetch ?? (process.versions.bun ? index_js_1.fetch : fetch);
         this.resolver = options.resolver ?? provider_http_policy_1.defaultProviderAddressResolver;
         this.timeoutMs = options.timeoutMs ?? provider_http_policy_1.DEFAULT_PROVIDER_HTTP_TIMEOUT_MS;
         this.allowedPrivateOrigins = new Set((options.allowedPrivateOrigins ?? []).map((value) => new URL(value).origin));
         this.systemProxy = normalizeProviderProxyUrl(options.systemProxy);
     }
+    /** A single policy-checked request; the caller owns HTTP status handling and body consumption. */
+    async request(options) {
+        const redirect = options.redirect ?? 'manual';
+        if (redirect !== 'manual' && redirect !== 'error')
+            throw new Error('invalid_provider_redirect_policy');
+        const { signal, cleanup } = createProviderRequestSignal(options.signal, options.timeoutMs ?? this.timeoutMs);
+        let request;
+        try {
+            signal.throwIfAborted();
+            request = await this.prepareRequest(options.url, options.proxy, options.allowPrivateNetwork, signal);
+            const response = await request.fetch(options.url, {
+                method: options.method,
+                headers: options.headers,
+                body: options.body,
+                signal,
+                redirect,
+            }, cleanup);
+            if (!response.body) {
+                cleanup();
+                await closeProviderDispatcher(request.dispatcher);
+                return response;
+            }
+            return process.versions.bun ? response : bindProviderResponseSignal(response, signal, request.dispatcher, cleanup);
+        }
+        catch (error) {
+            cleanup();
+            if (request)
+                await closeProviderDispatcher(request.dispatcher);
+            throw error;
+        }
+    }
     async postJson(options) {
         const request = await this.prepareRequest(options.url, options.proxy, options.allowPrivateNetwork);
         const headers = new Headers(options.headers);
@@ -156,14 +207,18 @@ class ProviderHttpTransport {
                 body: JSON.stringify(options.body),
                 signal,
                 redirect: 'manual',
-            });
+            }, cleanup);
         }
         catch (error) {
             cleanup();
             await closeProviderDispatcher(request.dispatcher);
             throw error;
         }
-        cleanup();
+        if (process.versions.bun && response.ok && response.body) {
+            return response;
+        }
+        if (!process.versions.bun)
+            cleanup();
         if (!response.ok) {
             try {
                 const errorText = await readResponseTextLimit(response, provider_http_policy_1.PROVIDER_ERROR_BODY_LIMIT_BYTES);
@@ -174,9 +229,11 @@ class ProviderHttpTransport {
                 throw error;
             }
             finally {
+                cleanup();
                 await closeProviderDispatcher(request.dispatcher);
             }
         }
+        cleanup();
         return response;
     }
     async *postSse(options) {
@@ -236,31 +293,118 @@ class ProviderHttpTransport {
             await closeProviderDispatcher(request.dispatcher);
         }
     }
-    async resolveTarget(url, allowPrivateNetwork, allowConfiguredPrivateOrigin = true) {
+    async resolveTarget(url, allowPrivateNetwork, allowConfiguredPrivateOrigin = true, resolver = this.resolver) {
         const configuredOriginAllowed = allowConfiguredPrivateOrigin
             && this.allowedPrivateOrigins.has(new URL(url).origin);
         return (0, provider_http_policy_1.resolveProviderTarget)({
             url,
             allowPrivateNetwork: configuredOriginAllowed || allowPrivateNetwork,
-            resolver: this.resolver,
+            resolver,
         });
     }
-    async prepareRequest(url, proxy, allowPrivateNetwork) {
-        const targetResolution = await this.resolveTarget(url, allowPrivateNetwork);
+    async prepareRequest(url, proxy, allowPrivateNetwork, signal) {
+        const resolver = signal
+            ? (hostname) => awaitProviderSignal(() => this.resolver(hostname), signal)
+            : this.resolver;
+        const targetResolution = await this.resolveTarget(url, allowPrivateNetwork, true, resolver);
         const normalizedProxy = normalizeProviderProxyUrl(proxy) ?? this.systemProxy;
-        const trustedLocalSystemProxy = proxy === undefined
-            && normalizedProxy !== undefined
+        const trustedLocalSystemProxy = normalizedProxy !== undefined
             && normalizedProxy === this.systemProxy;
+        const pinProxyTarget = Boolean(process.versions.bun || signal);
         const dispatcher = normalizedProxy
-            ? createPinnedProxyAgent(await this.resolveTarget(normalizedProxy, trustedLocalSystemProxy, false), this.resolver)
-            : createPinnedAgent(targetResolution, this.resolver);
+            ? createPinnedProxyAgent(await this.resolveTarget(normalizedProxy, trustedLocalSystemProxy, false, resolver), resolver, pinProxyTarget ? targetResolution : undefined)
+            : createPinnedAgent(targetResolution, resolver);
         return {
             dispatcher,
-            fetch: (input, init) => this.fetch(input, { ...init, dispatcher }),
+            fetch: async (input, init, onBodyFinish) => {
+                if (pinProxyTarget && normalizedProxy) {
+                    // A proxy must connect to the checked IP, not resolve the original name
+                    // again. Retain the origin identity for HTTP and TLS inside the tunnel.
+                    const target = await this.resolveTarget(url, allowPrivateNetwork, true, resolver);
+                    const pinnedUrl = new URL(target.url.href);
+                    const address = stripIpv6Brackets(target.addresses[0].address);
+                    pinnedUrl.hostname = (0, node_net_1.isIP)(address) === 6 ? `[${address}]` : address;
+                    const response = await this.fetch(pinnedUrl.href, { ...init, dispatcher });
+                    return process.versions.bun ? bindProviderResponseSignal(response, init?.signal, dispatcher, onBodyFinish) : response;
+                }
+                const response = await this.fetch(input, { ...init, dispatcher });
+                return process.versions.bun ? bindProviderResponseSignal(response, init?.signal, dispatcher, onBodyFinish) : response;
+            },
         };
     }
 }
 exports.ProviderHttpTransport = ProviderHttpTransport;
+function awaitProviderSignal(operation, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        if (signal.aborted) {
+            abort();
+            return;
+        }
+        signal.addEventListener('abort', abort, { once: true });
+        void Promise.resolve().then(() => {
+            signal.throwIfAborted();
+            return operation();
+        }).then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+    });
+}
+// Tie raw response consumption to the request lifetime. Bun also needs an
+// explicit body abort because undici's Node readability check misses its streams.
+function bindProviderResponseSignal(response, signal, dispatcher, onFinish) {
+    if (!response.body || !signal)
+        return response;
+    const reader = response.body.getReader();
+    let abort;
+    const cleanup = () => {
+        signal.removeEventListener('abort', abort);
+        onFinish?.();
+    };
+    const cancel = async (reason) => {
+        cleanup();
+        await Promise.all([
+            reader.cancel(reason).catch((error) => {
+                // Cancelling a stream that has already errored rejects with that same
+                // terminal error. Preserve it; propagate any distinct cleanup failure.
+                if (error !== reason)
+                    throw error;
+            }),
+            dispatcher.destroy(),
+        ]);
+    };
+    const body = new ReadableStream({
+        start(controller) {
+            abort = () => {
+                void cancel(signal.reason).then(() => controller.error(signal.reason), (error) => controller.error(error));
+            };
+            signal.addEventListener('abort', abort, { once: true });
+            if (signal.aborted)
+                abort();
+        },
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (signal.aborted)
+                    return;
+                if (done) {
+                    cleanup();
+                    if (onFinish)
+                        await closeProviderDispatcher(dispatcher);
+                    controller.close();
+                    reader.releaseLock();
+                }
+                else {
+                    controller.enqueue(value);
+                }
+            }
+            catch (error) {
+                await cancel(error);
+                controller.error(error);
+            }
+        },
+        cancel,
+    });
+    return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+}
 function stripIpv6Brackets(value) {
     return value.startsWith('[') && value.endsWith(']') ? value.slice(1, -1) : value;
 }
@@ -289,11 +433,14 @@ async function readResponseTextLimit(response, limitBytes) {
     const reader = response.body.getReader();
     const chunks = [];
     let total = 0;
+    let completed = false;
     try {
         while (total < limitBytes) {
             const { done, value } = await reader.read();
-            if (done)
+            if (done) {
+                completed = true;
                 break;
+            }
             const remaining = limitBytes - total;
             const chunk = value.byteLength > remaining ? value.slice(0, remaining) : value;
             chunks.push(chunk);
@@ -303,7 +450,13 @@ async function readResponseTextLimit(response, limitBytes) {
         }
     }
     finally {
-        reader.releaseLock();
+        try {
+            if (!completed)
+                await reader.cancel();
+        }
+        finally {
+            reader.releaseLock();
+        }
     }
     return new TextDecoder().decode(concatUint8Arrays(chunks, total));
 }

package/dist/api/tasks/InngestTaskScheduler.d.ts

@@ -135,7 +135,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: string;
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "step" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "step" | "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {
@@ -313,7 +313,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: string;
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "step" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "step" | "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {
@@ -496,7 +496,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: string;
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "step" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "step" | "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {
@@ -672,7 +672,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: string;
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "step" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "step" | "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {

package/dist/api/tasks/TaskAgentBinding.d.ts

@@ -0,0 +1,14 @@
+import type { TaskCredentialSource } from '../ai-gateway/pod/OwnerPodAccess';
+import type { AuthenticatedRequest } from '../middleware/AuthMiddleware';
+import type { TaskAuthBindingSnapshot } from './TaskAuthBinding';
+/** Program-owned execution identity. No artificial Agent row is written to a user's Pod. */
+export declare const DEFAULT_TASK_AGENT: {
+    readonly iri: "urn:xpod:agent:pi";
+    readonly runner: "pi:pi";
+};
+export interface TaskAgentBinding {
+    assignedTo: string;
+    authBinding: TaskAuthBindingSnapshot;
+}
+/** Resolve only the task layer's prior explicit grant, never the current request's bearer key. */
+export declare function createGrantedTaskAgentResolver(source: Pick<TaskCredentialSource, 'activeFor'>): (request: AuthenticatedRequest) => Promise<TaskAgentBinding | undefined>;

package/dist/api/tasks/TaskAgentBinding.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TASK_AGENT = void 0;
+exports.createGrantedTaskAgentResolver = createGrantedTaskAgentResolver;
+/** Program-owned execution identity. No artificial Agent row is written to a user's Pod. */
+exports.DEFAULT_TASK_AGENT = { iri: 'urn:xpod:agent:pi', runner: 'pi:pi' };
+/** Resolve only the task layer's prior explicit grant, never the current request's bearer key. */
+function createGrantedTaskAgentResolver(source) {
+    return async (request) => {
+        if (request.auth?.type !== 'solid')
+            return undefined;
+        const owner = request.auth.webId;
+        const credential = await source.activeFor(owner);
+        if (!credential)
+            return undefined;
+        return {
+            assignedTo: exports.DEFAULT_TASK_AGENT.iri,
+            authBinding: {
+                id: credential.credentialRef, kind: 'solid-client-credentials', webId: owner,
+                clientId: credential.clientId, status: 'active', createdAt: Math.floor(Date.now() / 1000),
+            },
+        };
+    };
+}
+//# sourceMappingURL=TaskAgentBinding.js.map

package/dist/api/tasks/TaskAuthBinding.js

@@ -59,7 +59,10 @@ class TaskAuthBindingService {
     async resolveRunContext(bindingId, context) {
         const granted = await this.resolveTaskGrant(bindingId, context);
         if (granted.outcome === 'resolved') {
-            return this.buildContext(granted.binding, granted.clientSecret, context);
+            return {
+                ...this.buildContext(granted.binding, granted.clientSecret, context),
+                taskCredential: { credentialRef: granted.credentialRef, version: granted.version },
+            };
         }
         if (granted.outcome === 'unusable') {
             // The binding names a task-layer grant that no longer applies. Falling back to a stored
@@ -103,6 +106,8 @@ class TaskAuthBindingService {
         }
         return {
             outcome: 'resolved',
+            credentialRef: credential.credentialRef,
+            version: credential.version,
             clientSecret: credential.clientSecret,
             binding: {
                 id: bindingId,
@@ -167,8 +172,17 @@ class TaskAuthBindingService {
         return auth && (0, AuthContext_1.isSolidAuth)(auth) ? auth : undefined;
     }
     defaultBuildContext(binding, clientSecret, context) {
+        const cleanContext = { ...context };
+        // A task grant replaces the caller's transport authority, even for the same owner. Every
+        // request-scoped cache derived from that authority goes with it: the database and fetch
+        // wrappers, and the thread caches the store fills while reading with them.
+        for (const key of Object.keys(cleanContext)) {
+            if (key.startsWith('_cached') || key.startsWith('_thread') || key === 'taskCredential') {
+                delete cleanContext[key];
+            }
+        }
         return {
-            ...context,
+            ...cleanContext,
             userId: typeof context.userId === 'string' ? context.userId : binding.webId,
             auth: {
                 type: 'solid',

package/dist/api/tasks/TaskMaterializer.d.ts

@@ -2,7 +2,7 @@ import type { ChatKitStore, StoreContext } from '../chatkit/store';
 import type { ThreadItem } from '../chatkit/types';
 import type { RunContextRetriever, RunExecutionBackend } from '../runs/RunExecutionBackend';
 import { type RunRecordData, type RunStore } from '../runs/store';
-import { type TaskRecordData } from './store';
+import type { TaskRecordData } from './store';
 import type { AiConnectionsInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionsInvocationKeyIssuer';
 export interface MaterializedTaskRun {
     task: TaskRecordData;
@@ -21,6 +21,7 @@ export declare class TaskMaterializer<TContext = StoreContext> {
     private readonly store;
     private readonly executionBackend;
     private readonly executeRuns;
+    private readonly continuation;
     private readonly contextRetriever?;
     private readonly aiConnectionInvocationKeyIssuer?;
     private readonly requireAiConnectionsInvocationKeyIssuer;
@@ -28,6 +29,8 @@ export declare class TaskMaterializer<TContext = StoreContext> {
     materialize(input: {
         task: TaskRecordData;
         context: TContext;
+        /** Return the persisted Run while the existing runner executes it. */
+        background?: boolean;
         trigger: {
             kind: 'once' | 'interval' | 'cron' | 'event' | 'manual';
             scheduledFor?: number;
@@ -36,6 +39,7 @@ export declare class TaskMaterializer<TContext = StoreContext> {
         };
     }): Promise<MaterializedTaskRun>;
     private withInvocationAiConnections;
+    resumeClientToolOutput(run: RunRecordData, itemId: string, output: string, approval: string, context: TContext): Promise<boolean>;
     private executeRun;
     private retrieveRunContext;
     private ensureThread;
@@ -58,8 +62,5 @@ export declare class TaskMaterializer<TContext = StoreContext> {
     private resolveTaskThreadParentKey;
     private parseThreadResource;
     private extractThreadId;
-    private resolveTaskResource;
-    private resolveRunResource;
-    private resolvePodBaseUrl;
     private hasSaveTask;
 }