@wildo-ai/external-connectors-models 1.1.4 → 1.1.6

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { ExternalProvider_OperationContextSchema, } from "../core/operations.external-connectors-models.schemas.js";
-import { APPLICATION_ENVIRONMENT, ExternalProvider_ExchangeProtocol_Configuration_BaseSchema, ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Profile_BaseSchema, ExternalProvider_ExchangeProtocol_Status_BaseSchema, } from "../core/commons.external-connectors-models.schemas.js";
+import { APPLICATION_ENVIRONMENT, ExternalProvider_ExchangeProtocol_Configuration_BaseSchema, ExternalProvider_ExchangeProtocol_Kind, } from "../core/commons.external-connectors-models.schemas.js";
 //===============================================================
 // Agent Client Protocol (ACP)
 // --------
@@ -99,17 +99,9 @@ export var AgentClientProtocol_WorkingDirectoryPolicy;
  * what lets an application say "no session started from this profile may ever
  * skip the permission gate" independently of what any individual run requests.
  *
- * Ordering is meaningful and increasing over all FIVE members: PROMPT_ALWAYS <
- * AUTO_ACCEPT_READS < AUTO_ACCEPT_EDITS < AUTO_ACCEPT_READS_AND_EDITS <
- * UNRESTRICTED. Compare through {@link agentClientProtocolPermissionCeilingRank}
- * rather than by string, so the ordering has one definition.
- *
- * Read that order as a CLAMP — how much is pre-approved without a human — and never
- * as containment. The ceilings are kind-SETS and are deliberately not nested:
- * AUTO_ACCEPT_EDITS outranks AUTO_ACCEPT_READS and still refuses `fetch`, which is
- * exactly why AUTO_ACCEPT_READS_AND_EDITS had to be added rather than being implied
- * by the higher rank. Each member's own docstring states the set it admits, and the
- * rank function carries the full argument for why containment is the wrong reading.
+ * Policies describe admitted tool-kind sets, not nested levels. Invocation overrides
+ * intersect those sets with the profile: READS and EDITS have an empty intersection.
+ * The rank helper is a presentation ordering only and must not select authority.
  */
 /** @wildo_source:part:start acp.permission-ceiling facet:layer:config facet:audience:app-developer */
 export var AgentClientProtocol_PermissionCeiling;
@@ -208,23 +200,11 @@ export var AgentClientProtocol_PermissionCeiling;
 })(AgentClientProtocol_PermissionCeiling || (AgentClientProtocol_PermissionCeiling = {}));
 /** @wildo_source:part:end acp.permission-ceiling */
 /**
- * Increasing rank for {@link AgentClientProtocol_PermissionCeiling}; the single ordering definition.
- *
- * ## It is a CLAMP order, not a subset lattice — and that distinction is load-bearing
- *
- * Rank answers one question: how much is pre-approved without a human. It is used to LOWER a
- * request that asks for more autonomy than its profile allows, never to reason about which
- * permissions contain which.
+ * Stable presentation order for {@link AgentClientProtocol_PermissionCeiling}.
  *
- * The sets are deliberately NOT nested. {@link AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_EDITS}
- * (rank 2) admits the mutating kinds and still refuses `fetch`, while
- * {@link AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_READS} (rank 1) admits `fetch` and refuses
- * every mutating kind. Reading rank as containment would say the higher ceiling must also admit
- * `fetch` — and making that true would hand every coding agent network access as a side effect of
- * building a research lane. That is a change to the coding lane's posture and it needs its own
- * evidence, not a corollary. Clamping still behaves correctly: a coding profile lowered to
- * AUTO_ACCEPT_READS may fetch and may not edit, which is exactly what asking for less autonomy in
- * the read direction should mean.
+ * Never use this rank to authorize or clamp a request. READS and EDITS admit disjoint
+ * tool-kind sets; choosing the numerically lower one can grant operations forbidden
+ * by the profile. Dispatch computes their intersection instead.
  */
 export function agentClientProtocolPermissionCeilingRank(ceiling) {
     switch (ceiling) {
@@ -240,17 +220,57 @@ export function agentClientProtocolPermissionCeilingRank(ceiling) {
             return 4;
     }
 }
+/**
+ * How a coding agent's host-login status command reports "signed in".
+ *
+ * An ACP agent that is not signed in still completes `initialize` and `session/new`; it fails the
+ * first `session/prompt` (Claude's adapter 0.81.1: JSON-RPC `-32000 Authentication required`,
+ * reproduced 2026-09-25). So the handshake proves nothing about the login, and a real prompt spends
+ * a turn. Every agent's own CLI can answer without either — `claude auth status --json`,
+ * `codex login status`, `opencode auth list` — but each answers in its own way, which is this enum.
+ */
+export var AgentClientProtocol_HostLoginSignal;
+(function (AgentClientProtocol_HostLoginSignal) {
+    /** Signed in exactly when the status command exits 0. */
+    AgentClientProtocol_HostLoginSignal["EXIT_CODE_ZERO"] = "exit_code_zero";
+    /** Signed in when the command prints JSON whose named field is `true`. */
+    AgentClientProtocol_HostLoginSignal["JSON_BOOLEAN_FIELD"] = "json_boolean_field";
+    /** Signed in when the command exits 0 and its output does NOT match a pattern (e.g. `0 credentials`). */
+    AgentClientProtocol_HostLoginSignal["OUTPUT_EXCLUDES"] = "output_excludes";
+})(AgentClientProtocol_HostLoginSignal || (AgentClientProtocol_HostLoginSignal = {}));
+/**
+ * What a host-login probe found for one coding agent.
+ *
+ * Four states, because the remedies differ: NOT_INSTALLED needs an install, SIGNED_OUT a login, and
+ * UNKNOWN (the status command ran and its answer could not be read, or timed out) must never be
+ * reported as either — reading it as SIGNED_IN dispatches a run that fails mid-turn, reading it as
+ * SIGNED_OUT sends a signed-in operator to log in again.
+ */
+export var CodingAgentHostLoginState;
+(function (CodingAgentHostLoginState) {
+    CodingAgentHostLoginState["SIGNED_IN"] = "signed_in";
+    CodingAgentHostLoginState["SIGNED_OUT"] = "signed_out";
+    CodingAgentHostLoginState["NOT_INSTALLED"] = "not_installed";
+    CodingAgentHostLoginState["UNKNOWN"] = "unknown";
+})(CodingAgentHostLoginState || (CodingAgentHostLoginState = {}));
+/**
+ * How a dispatch refused because the coding agent's operator is not signed in begins — thrown by the
+ * engine before an ACP session opens, and recognised by the companion as the HOST's failure (not the
+ * task's), so a signed-out host does not spend a task's attempt budget. One constant for both sides.
+ */
+export const CODING_AGENT_NOT_SIGNED_IN_MESSAGE_PREFIX = 'The coding agent is not signed in on this host';
 /**
  * Whether THIS agent raises `session/request_permission` before it mutates —
  * the one property that decides whether Wildo's in-flight guards can fire at all.
  *
  * # Why a permission ceiling needs this to mean anything
  *
- * Both of Wildo's in-flight controls are enforced in the CLIENT's ANSWER to a
+ * For agent-owned I/O, Wildo's in-flight controls are enforced in the CLIENT's ANSWER to a
  * permission request: {@link AgentClientProtocol_PermissionCeiling} decides the
  * tool KIND, and the dispatch's location predicate decides the PATHS. Neither is
  * a sandbox, an interposed filesystem, or a syscall filter — they are answers.
- * So an agent that writes without asking is bound by neither, and the ceiling
+ * Client-hosted writes independently check both controls. An agent doing its OWN I/O
+ * without asking is bound by neither, and the ceiling
  * an application authored is a LABEL rather than a guarantee.
  *
  * That is not hypothetical and it is not a fault in the agents. MEASURED with
@@ -610,51 +630,6 @@ export const AgentClientProtocol_ExecutionProfileSchema = z.object({
     }
 });
 /** @wildo_source:part:end acp.execution-profile */
-/**
- * Transport capability metadata for an ACP-speaking provider.
- *
- * Note how little is declared here compared with a one-shot CLI contract, and
- * why: ACP agents advertise their own capabilities, session modes and available
- * commands during `initialize` and `session/new`. Re-declaring any of that in
- * authored configuration would create a second source of truth that drifts the
- * first time the agent is upgraded. What remains is what the HOST must know
- * before it opens a connection.
- */
-export const AgentClientProtocol_ProfileSchema = ExternalProvider_ExchangeProtocol_Profile_BaseSchema.extend({
-    supportedRunnerHosts: z.array(z.enum(AgentClientProtocol_RunnerHost)).default([
-        AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,
-    ]),
-    /**
-     * The ACP major versions this provider is known to speak.
-     *
-     * ACP negotiates a single integer at `initialize`: the client offers its
-     * latest, the agent answers with that or its own. This list is what the
-     * runner is willing to accept in that answer — an agent that returns anything
-     * else is refused rather than spoken to hopefully.
-     */
-    supportedProtocolVersions: z.array(z.number().int().positive()).min(1).default([1]),
-    /**
-     * The semantic operations this transport can execute truthfully.
-     *
-     * Kept as strings to avoid a circular runtime import with the operation
-     * family that consumes this protocol — the same reason the CLI contract this
-     * replaces did so.
-     */
-    supportedOperationKeys: z.array(z.string().min(1)).min(1),
-    /**
-     * The semantic models valid on this transport.
-     *
-     * The agent also advertises its own model options per session; this list is
-     * the authored subset an application is willing to select from, and it is
-     * what a requested model is validated against before a session is opened.
-     */
-    supportedModels: z.array(z.string().min(1)).min(1),
-    supportedAuthModes: z.array(z.enum(AgentClientProtocol_AuthMode)).default([
-        AgentClientProtocol_AuthMode.NONE,
-        AgentClientProtocol_AuthMode.HOST_MANAGED,
-        AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION,
-    ]),
-});
 export const AgentClientProtocol_ConfigurationSchema = ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.extend({
     defaultExecutionProfileRef: z.string().optional(),
     executionProfiles: z.record(z.string(), AgentClientProtocol_ExecutionProfileSchema),
@@ -667,20 +642,6 @@ export const AgentClientProtocol_ConfigurationSchema = ExternalProvider_Exchange
         });
     }
 });
-export const AgentClientProtocol_StatusSchema = ExternalProvider_ExchangeProtocol_Status_BaseSchema.extend({
-    protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL),
-    /** The version actually agreed at the last `initialize`, when one succeeded. */
-    negotiatedProtocolVersion: z.number().int().positive().optional(),
-    /**
-     * The agent's self-reported identity from its last `initialize` response.
-     *
-     * Recorded because the agent is an independently released dependency: when a
-     * run starts behaving differently, "which build answered" is the first
-     * question, and it is not answerable from anything Wildo authored.
-     */
-    observedAgentName: z.string().optional(),
-    observedAgentVersion: z.string().optional(),
-});
 //===============================================================
 // Coding-agent operation family
 // --------
@@ -806,7 +767,13 @@ export const CodingAgent_SessionSuspensionSchema = z.strictObject({
      * context — a degradation the caller should surface, not hide.
      */
     resumable: z.boolean(),
-    /** When the parked child process will be closed (ISO timestamp). */
+    /**
+     * An INFORMATIONAL freshness bound for the question (ISO timestamp), surfaced to the operator —
+     * never a reaping deadline. No child process is held open while a run is parked (see
+     * `awaitingInputTtlMs`), so there is nothing that closes at this instant. It said "when the parked
+     * child process will be closed" until 2026-09-24, contradicting the contract above it, and a host
+     * read it that way and aborted answerable questions at boot (#1533).
+     */
     parkedUntil: z.string().optional(),
 });
 /**
@@ -945,8 +912,8 @@ export const CodingAgent_RunTaskInputSchema = z.object({
     /**
      * The autonomy this particular run asks for.
      *
-     * CLAMPED, never honoured blindly: the runner takes the lower of this and the
-     * execution profile's `permissionCeiling`. Absent means the profile's ceiling
+     * INTERSECTED, never honoured blindly: dispatch admits only tool kinds shared by
+     * this policy and the execution profile's `permissionCeiling`. Absent means the profile's ceiling
      * — which is itself the safe default — so omitting it can never widen
      * authority, only leave it where the profile put it.
      */
@@ -967,7 +934,8 @@ export const CodingAgent_RunTaskOutputSchema = z.object({
     finalMessage: z.string(),
     stopReason: z.enum(CodingAgent_StopReason),
     /**
-     * Absolute paths the agent REPORTED touching, from its tool-call stream.
+     * Absolute paths the agent REPORTED writing, from its tool-call stream: the locations of its `edit`,
+     * `delete` and `move` tool calls, never those of a read or a search (#1805).
      *
      * A claim, not a record. An agent reports what its own tooling surfaces, and
      * nothing prevents it writing a file it never mentions — measured against
@@ -1094,4 +1062,21 @@ providerConfigurations) {
     }
     return { destinations, profilesWithoutDestinations };
 }
+/**
+ * The ACP tool kinds that WRITE the workspace (#1805) — the one source for "is this tool call a write?".
+ *
+ * A concurrent coding run claims a file only on evidence it wrote it: a writing tool call's locations, or an
+ * ALLOWED permission request for a writing tool. A read or a search reports locations too, and claiming those
+ * committed files a run only read under its name.
+ *
+ * semantic-literal-boundary: ACP's `ToolKind` is the protocol's open string vocabulary, translated here.
+ * spec-cite: ACP v2 schema, `ToolKind` = "read" | "edit" | "delete" | "move" | "search" | "execute" | "think" | "fetch" | "switch_mode" | "other" (types.gen.d.ts, @agentclientprotocol/sdk; protocol docs "Tool Calls — Creating").
+ * `execute` is left out: a shell command may write, but the locations it reports are what it was pointed
+ * at, not what it wrote, and a run that wrote through its shell is exactly the case claims cannot see.
+ */
+export const ACP_WRITING_TOOL_KINDS = new Set(['edit', 'delete', 'move']);
+/** Whether an ACP tool kind writes the workspace; an absent kind is no evidence that it does. */
+export function isWritingAcpToolKind(kind) {
+    return kind !== undefined && ACP_WRITING_TOOL_KINDS.has(kind);
+}
 //# sourceMappingURL=agent-client-protocol.external-connectors-models.schemas.js.map