@workerdeck/server 0.22.0 → 0.23.0

package/build/index.d.mts

@@ -1,5 +1,5 @@
 import { IncomingMessage, Server, ServerResponse } from "node:http";
-import { AttachmentInput, BridgeAnswer, BrowserBridgeExecutor, ClaudeAuthProbe, EngineAdapter, EngineSessionOptions, HostToolDefinition, LanguageModel, McpConnection, ParkedExecution, Runner, RunnerSnapshot, SessionRunnerConfig, ToolExecutionResult, ToolExecutor, ToolSet } from "@workerdeck/core";
+import { AttachmentInput, BridgeAnswer, BrowserBridgeExecutor, ClaudeAuthProbe, EngineAdapter, EngineSessionOptions, HostToolDefinition, LanguageModel, McpConnection, ParkedExecution, Runner, RunnerSnapshot, SessionRunnerConfig, ToolExecutionCall, ToolExecutionResult, ToolExecutor, ToolSet } from "@workerdeck/core";
 import { JobQueue, QueueAdapter } from "@workerdeck/queue";
 import { CreateSessionRequest, JobEvent, MessageAttachment, ProfileEngine, ProfileInfo, ProfileUsage, ProviderConfig, SdkSessionSummary, ServerFrame, SessionCapability, SessionInfo, SessionNotification, SessionWebhookConfig } from "@workerdeck/protocol";
 
@@ -907,8 +907,11 @@ type ProviderRunnerOptions = {
    *   when the data is *there* (a document the user is editing) and it should
    *   not travel to the gateway at all. Note the trade: it hands an executor to
    *   the party being sandboxed against, so its results are untrusted input.
+   * - a **function** — selects per call, so `eval_script` can run in-process
+   *   while a custom tool goes to the browser. The function receives the
+   *   {@link ToolExecutionCall} and returns an executor or `'browser'`.
    */
-  executor: ToolExecutor | 'browser';
+  executor: ToolExecutor | 'browser' | ((call: ToolExecutionCall) => ToolExecutor | 'browser');
   /** Capability backends — the same shape {@link createEngineSession} takes.
    * Wiring one only offers it; the profile and request decide the grant. */
   capabilities?: EngineSessionOptions['capabilities']; /** Host tools at explicit trust levels (`@workerdeck/core`'s `withHostTools`). */
@@ -926,6 +929,15 @@ type ProviderRunnerOptions = {
   /** Scratch-filesystem seed for a new session. Ignored on a rehydration, so a
    * parked turn's files are never overwritten. */
   seedVfs?: Record<string, string>;
+  /**
+   * Gate tool execution behind user approval. See
+   * {@link EngineSessionOptions.shouldApprove} — this is a straight pass-through.
+   */
+  shouldApprove?: (call: {
+    toolName: string;
+    input: unknown;
+  }) => boolean; /** Timeout for permission prompts (ms). Default 120 000. */
+  approvalTimeoutMs?: number;
   /** Release per-session resources: the MCP connection, an issued token, a
    * watcher. Runs on close **and on park** — parking releases the same things. */
   onClose?: () => void | Promise<void>;

package/build/index.mjs

@@ -4147,7 +4147,13 @@ function sandboxedProviderProfile(name, provider, options = {}) {
 async function createProviderRunner(ctx, options) {
 	const { config, profile, bridge, restore, id } = ctx;
 	const resolveModel = (modelId) => typeof options.model === "function" ? options.model(modelId) : options.model;
-	const executor = options.executor === "browser" ? { dispatch: (call) => bridge.executorFor(call.sessionId).dispatch(call) } : options.executor;
+	const resolveBridged = () => ({ dispatch: (call) => bridge.executorFor(call.sessionId).dispatch(call) });
+	const resolveExecutor = (raw) => raw === "browser" ? resolveBridged() : raw;
+	const isPerCall = typeof options.executor === "function";
+	const selectExecutor = isPerCall ? (call) => resolveExecutor(options.executor(call)) : () => resolveExecutor(options.executor);
+	const backend = isPerCall ? (call) => {
+		return options.executor(call) === "browser" ? "browser" : "server";
+	} : options.executor === "browser" ? "browser" : "server";
 	return createEngineSession({
 		config: {
 			...config,
@@ -4158,14 +4164,16 @@ async function createProviderRunner(ctx, options) {
 		id,
 		profile,
 		resolveModel: (_profile, c) => resolveModel(c.model),
-		selectExecutor: () => executor,
-		backend: options.executor === "browser" ? "browser" : "server",
+		selectExecutor,
+		backend,
 		capabilities: options.capabilities,
 		tools: options.tools,
 		mcp: options.mcp,
 		mcpTools: options.mcpTools,
 		instructions: options.instructions,
 		executionLimits: options.executionLimits,
+		shouldApprove: options.shouldApprove,
+		approvalTimeoutMs: options.approvalTimeoutMs,
 		seedVfs: options.seedVfs
 	});
 }