@xrkseek/harness 0.4.2 → 0.4.4

package/node_modules/@xrkseek/server-host/dist/index.js

@@ -3,14 +3,16 @@ import { createMemorySessionStore, createPersistentSessionStore, createSessionDr
 import { createProviderRegistry } from "@xrkseek/llm-registry";
 import { loadPolicyRulesetFile } from "@xrkseek/policy";
 import { flattenText, isHumanUserMessageSource } from "@xrkseek/protocol";
-import { consolidateCuratedMemoryPhase1, createCuratedMemoryStore, } from "@xrkseek/exec-memory";
+import { effectiveSandboxMode, shouldConfineSandbox, } from "@xrkseek/protocol";
+import { consolidateCuratedMemoryPhase1, consolidateCuratedMemoryPhase2, createCuratedMemoryStore, } from "@xrkseek/exec-memory";
 import { resolveSecretStore } from "@xrkseek/secrets";
 import { hostSettingsPath, defaultSpillDir, resolveXrkHome } from "@xrkseek/server-config";
 import { installOutboundHttpProxy } from "./http-proxy.js";
 import { mountInvariantsFailFast } from "./invariants-fail-fast.js";
 import { watchPolicyFile } from "./policy-file-watch.js";
+import { createA2aInboundPublicHandler } from "./a2a-inbound-public.js";
 import { applyXrkProductBootPolicy, chainPublicHandlers, ensureDshCompatHostPlugin, createLiveHostPluginsPublicHandler, createHttpServer, createXrkPluginPublicHandler, createSidebarPublicHandler, prewarmDshCompatAdapters, shutdownDshCompatServices, applyHostPackageByName, stopHostPackageFiber, listHostAppliedPackages, invokeDshCompatRpc, attachDshCompatUpgrades, DSH_SETTINGS_NAMESPACES, DSH_SETTINGS_DEFAULTS, runPluginMutate, ensureXrkPlatformClientBootEntries, injectBootIntoHtml, injectMobileAccessShellIntoHtml, loadBootManifestFromWebDist, mergeWebBootManifests, resolveWebBootManifest, createXrkWalletPort, createMobileAccessGateChecker, createMobileAccessGateHandler, loadSidebarPrefs, } from "@xrkseek/server-http";
-import { attachFaceUpgrades, bindSubagentTools, bindSessionQueryTools, createFaceRuntime, effectiveHostApiKey, isLoopbackAddress, peekSettingsYamlSection, publishRemoteEvent, createSessionRoutingLlm, liveRouteAllowsImageInput, resolveSessionCwd, canonicalAgentPresetId, resolveAgentPresetProfile, DEFAULT_MAX_DEPTH, DEFAULT_MAX_ACTIVE_CHILDREN, tryHandleFaceHttp, isPluginSoftDisabledAt, readDisabledPluginIdsAt, readManagedPackageIndexAt, reconcileManagedProcessPlugins, snapshotSessionWorkspace, } from "@xrkseek/server-face";
+import { attachFaceUpgrades, bindSubagentTools, bindSessionQueryTools, createFaceRuntime, effectiveHostApiKey, isLoopbackAddress, listCredentialSlots, peekSettingsYamlSection, publishRemoteEvent, createSessionRoutingLlm, liveRouteAllowsImageInput, resolveSessionCwd, canonicalAgentPresetId, resolveAgentPresetProfile, DEFAULT_MAX_DEPTH, DEFAULT_MAX_ACTIVE_CHILDREN, tryHandleFaceHttp, isPluginSoftDisabledAt, readDisabledPluginIdsAt, readManagedPackageIndexAt, reconcileManagedProcessPlugins, snapshotSessionWorkspace, } from "@xrkseek/server-face";
 import { createPluginLoader, composeHostPolicyEngine, wireCompositionChannels, wireCompositionLlm, collectChannelPluginRegistrations, } from "@xrkseek/server-loader";
 import { existsSync } from "node:fs";
 import { access } from "node:fs/promises";
@@ -35,14 +37,26 @@ import { createMcpDeferredDispose } from "./mcp-deferred-dispose.js";
 import { createStandingToolRegistry } from "./standing-tools.js";
 import { createDefaultPtyAccess } from "@xrkseek/exec-pty";
 import { createLocalShell } from "@xrkseek/exec-shell";
-import { createBrowserRuntimeRegistry } from "@xrkseek/exec-web";
+import { createSandboxStack, parseSandboxProduct, } from "@xrkseek/exec-sandbox";
+import { createBrowserRuntimeRegistry, setOutboundAllowlistAuditObserver } from "@xrkseek/exec-web";
 import { createLocalSubprocess } from "@xrkseek/exec-subprocess";
+import { resolveExecEnvironment, } from "@xrkseek/exec-environment";
 import { createSshExecutionWorld, resolveSshConfig, } from "@xrkseek/exec-ssh";
 /** True while an unattended cron agent turn is running — skip cron tools to avoid recursion. */
 const cronAgentDepth = new AsyncLocalStorage();
 export { createHostAgentCache, HOST_PLUGINS_KEY } from "./agent-cache.js";
 export { createStandingToolRegistry } from "./standing-tools.js";
 export { loadMcpToolPlugins, mcpDraftsToSpecs, mcpFingerprint, parseMcpServersEnv, readMcpAllowFromHostSettings, readMcpServersFromHostSettings, reconcileMcpToolPlugins, resetLastGoodHostMcpWireCaches, } from "./mcp-wire.js";
+/**
+ * AbortError with a readable reason. Used by the session drain snapshot race
+ * so a cancellation that interrupts a stuck git/fs call surfaces as a normal
+ * AbortError instead of a bare string or DOMException mismatch.
+ */
+function hostAbortError(reason) {
+    const err = new Error(reason === undefined ? "aborted" : String(reason));
+    err.name = "AbortError";
+    return err;
+}
 function logMcpReconcile(log, label, result) {
     if (!log)
         return;
@@ -99,6 +113,38 @@ function resolveMcpAllowConnect(config, faceAllow) {
         return false;
     return readMcpAllowFromHostSettings(hostSettingsPath());
 }
+/**
+ * `prepareArgv` for the Host-wide shared shell. Resolves the sandbox stack
+ * lazily at spawn time so Face settings (arriving after shell creation) and
+ * per-session `sandboxMode` are honored — `danger-full-access` unlocks, every
+ * other mode confines. This is the production confine path: the harness
+ * preset's own `sharedShell ?? createLocalShell(prepareArgv)` branch would
+ * otherwise run bash completely unsandboxed.
+ */
+export function createHostShellPrepareArgv(options) {
+    let cachedStack;
+    let cachedProductKey = "";
+    return async (argv, cwd, signal, ctx) => {
+        const settings = options.readSandboxSettings();
+        const product = parseSandboxProduct(settings);
+        const productKey = JSON.stringify(product ?? null);
+        if (!cachedStack || cachedProductKey !== productKey) {
+            cachedStack = createSandboxStack({
+                workspaceRoot: options.workspaceRoot,
+                ...(product ? { product } : {}),
+                env: options.env,
+                ...(options.remoteExecution ? { remoteExecution: true } : {}),
+            });
+            cachedProductKey = productKey;
+        }
+        // Per-session unlock: `danger-full-access` runs bash untouched.
+        const mode = options.readSandboxMode(ctx?.ownerSessionId);
+        if (!shouldConfineSandbox(mode))
+            return argv;
+        const confined = await cachedStack.confine(argv, cwd, signal);
+        return confined;
+    };
+}
 export function createHostManager() {
     const instances = new Map();
     let seq = 0;
@@ -299,24 +345,43 @@ export function createHostManager() {
             // Local Host + remote cwd: swap fs/shell (Hermes/DSH provider pattern).
             // Env `XRK_SSH_HOST` CI-bypasses Face; else peek settings.yaml before Face
             // (SSH world must own workspaceRoot before createFaceRuntime).
+            // Optional HTTP ExecEnvironment (Modal/e2b-style sidecar) when SSH is off.
             let sshWorld;
+            let httpWorld;
             /** Local Host cwd before SSH workspace swap (browse/settings anchor). */
             let localHostRoot;
+            let execWorldKind;
             try {
                 const sshProduct = peekSettingsYamlSection(resolveXrkHome(), "ssh-remote");
                 const sshConfig = resolveSshConfig(process.env, sshProduct);
                 if (sshConfig) {
+                    execWorldKind = "ssh";
                     localHostRoot = config.runtime.workspaceRoot;
                     sshWorld = createSshExecutionWorld({ config: sshConfig });
                     // Tool coordinates are the remote workspace; Face session cwd follows.
                     config.runtime.workspaceRoot =
                         sshWorld.workspaceRoot;
                 }
+                else if (String(process.env.XRK_EXEC_ENVIRONMENT ?? "")
+                    .trim()
+                    .toLowerCase() === "http") {
+                    execWorldKind = "http";
+                    const provider = resolveExecEnvironment({ env: process.env });
+                    httpWorld = await provider.createWorld({
+                        workspaceRoot: config.runtime.workspaceRoot,
+                    });
+                }
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
-                throw new Error(`SSH remote workspace: ${message}`, { cause: err });
+                throw new Error(execWorldKind === "http"
+                    ? `HTTP exec environment: ${message}`
+                    : `SSH remote workspace: ${message}`, { cause: err });
             }
+            // Codex-shaped outbound allowlist audit → Host logger (not MITM).
+            setOutboundAllowlistAuditObserver((ev) => {
+                log?.debug(`web-fetch-allowlist ${ev.decision} ${ev.host} (${ev.source}: ${ev.reason})`);
+            });
             const sharedPty = !sshWorld &&
                 (config.runtime.preset === "harness" ||
                     config.runtime.preset === "server")
@@ -328,8 +393,29 @@ export function createHostManager() {
                 ? createLocalShell({
                     subprocess: sshWorld
                         ? sshWorld.subprocess
-                        : createLocalSubprocess(),
+                        : httpWorld
+                            ? httpWorld.subprocess
+                            : createLocalSubprocess(),
                     defaultCwd: config.runtime.workspaceRoot,
+                    // Host-wide shared registry — sandbox confine resolves lazily so
+                    // Face settings + per-session sandboxMode are read at spawn time,
+                    // not at shell creation (faceBox.runtime arrives later). This is
+                    // the production path the harness preset's `sharedShell ??`
+                    // branch would otherwise bypass entirely.
+                    prepareArgv: createHostShellPrepareArgv({
+                        workspaceRoot: config.runtime.workspaceRoot,
+                        readSandboxSettings: () => {
+                            const rt = faceBox.runtime;
+                            if (!rt)
+                                return undefined;
+                            return rt.settingsNamespaces.view("sandbox").value;
+                        },
+                        readSandboxMode: (sessionId) => effectiveSandboxMode(sessionId
+                            ? readSessionEvents(store, sessionId)
+                            : []),
+                        remoteExecution: sshWorld !== undefined,
+                        env: process.env,
+                    }),
                 })
                 : undefined;
             /** Session-keyed browser pages — survives agent invalidate (Hermes task_id map). */
@@ -338,34 +424,63 @@ export function createHostManager() {
                 : undefined;
             const ensureSession = (sid) => newSession(store, sid).id;
             const faceBox = {};
-            /** Session-end Phase1: fold leftover human notes into MEMORY.md (disk only). */
+            /** Session-end Phase1 (+ optional Phase2 LLM): fold leftover notes into MEMORY.md. */
             const consolidateCuratedMemoryForSession = (sessionId) => {
                 try {
                     const rt = faceBox.runtime;
                     const memEnvRaw = String(process.env.XRK_CURATED_MEMORY ?? "").trim();
                     let enabled = memEnvRaw !== "" ? memEnvRaw !== "0" : true;
+                    let phase2Llm = false;
                     if (memEnvRaw === "" && rt) {
                         const memNs = rt.settingsNamespaces.view("curated-memory")
                             .value;
                         enabled = memNs.enabled !== false;
+                        phase2Llm = memNs.phase2Llm === true;
+                    }
+                    const phase2Env = String(process.env.XRK_CURATED_MEMORY_PHASE2 ?? "").trim();
+                    if (phase2Env === "1" || phase2Env.toLowerCase() === "true") {
+                        phase2Llm = true;
                     }
                     if (!enabled)
                         return;
                     const userTexts = [];
+                    const assistantTexts = [];
                     for (const event of readSessionEvents(store, sessionId)) {
-                        if (event.type !== "user/message")
+                        if (event.type === "user/message") {
+                            if (!isHumanUserMessageSource(event.source))
+                                continue;
+                            const text = flattenText(event.content).trim();
+                            if (text)
+                                userTexts.push(text);
                             continue;
-                        if (!isHumanUserMessageSource(event.source))
-                            continue;
-                        const text = flattenText(event.content).trim();
-                        if (text)
-                            userTexts.push(text);
+                        }
+                        if (event.type === "assistant/message") {
+                            const text = flattenText(event.content ?? "").trim();
+                            if (text)
+                                assistantTexts.push(text);
+                        }
                     }
                     if (userTexts.length === 0)
                         return;
-                    void consolidateCuratedMemoryPhase1(createCuratedMemoryStore(), {
-                        userTexts,
-                    });
+                    const memStore = createCuratedMemoryStore();
+                    void (async () => {
+                        await consolidateCuratedMemoryPhase1(memStore, { userTexts });
+                        if (!phase2Llm)
+                            return;
+                        const llm = llmResolverBox.resolve?.(sessionId);
+                        if (!llm?.chat)
+                            return;
+                        await consolidateCuratedMemoryPhase2(memStore, {
+                            userTexts,
+                            assistantTexts,
+                            complete: async (prompt) => {
+                                const out = await llm.chat({
+                                    messages: [{ role: "user", content: prompt }],
+                                });
+                                return String(out.content ?? "");
+                            },
+                        });
+                    })();
                 }
                 catch {
                     /* best-effort — Host stop / archive must continue */
@@ -429,6 +544,26 @@ export function createHostManager() {
                                 remoteExecution: true,
                                 codeRuntime: sshWorld.codeRuntime,
                             }
+                            : httpWorld
+                                ? { fs: httpWorld.fs }
+                                : {}),
+                        ...(faceBox.runtime
+                            ? {
+                                browserVault: {
+                                    list() {
+                                        return listCredentialSlots(faceBox.runtime)
+                                            .filter((s) => s.configured)
+                                            .map((s) => ({
+                                            handle: s.id,
+                                            label: s.label,
+                                            kind: "credential",
+                                        }));
+                                    },
+                                    peek(handle) {
+                                        return faceBox.runtime?.credentials.peek(handle);
+                                    },
+                                },
+                            }
                             : {}),
                         ...(llmResolverBox.resolve
                             ? { resolveLlm: llmResolverBox.resolve }
@@ -439,6 +574,16 @@ export function createHostManager() {
                         ...(pluginSettings.maxSteps !== undefined
                             ? { maxSteps: pluginSettings.maxSteps }
                             : {}),
+                        ...(pluginSettings.autoContinueOnMaxTokens !== undefined
+                            ? {
+                                autoContinueOnMaxTokens: pluginSettings.autoContinueOnMaxTokens,
+                            }
+                            : {}),
+                        ...(pluginSettings.autoContinueMaxRounds !== undefined
+                            ? {
+                                autoContinueMaxRounds: pluginSettings.autoContinueMaxRounds,
+                            }
+                            : {}),
                         ...(pluginSettings.toolOrder !== undefined
                             ? { toolOrder: pluginSettings.toolOrder }
                             : {}),
@@ -459,6 +604,9 @@ export function createHostManager() {
                                 toolResultMaxInlineBytes: pluginSettings.toolResultMaxInlineBytes,
                             }
                             : {}),
+                        ...(pluginSettings.guardianFragments !== undefined
+                            ? { guardianFragments: pluginSettings.guardianFragments }
+                            : {}),
                         ...(pluginSettings.locale
                             ? { locale: pluginSettings.locale }
                             : {}),
@@ -569,6 +717,17 @@ export function createHostManager() {
             };
             const hub = createSessionDrainHub({
                 createDrain: (sessionId) => async ({ signal }) => {
+                    const snapshot = () => {
+                        const face = faceBox.runtime;
+                        // Best-effort and self-bounded: snapshotSessionWorkspace races its
+                        // own deadline (SNAPSHOT_TIMEOUT_MS), so a hung git/fs call
+                        // degrades to "no checkpoint" instead of blocking the turn. The
+                        // drain loop's abort check covers cancellation; no shared state
+                        // here, so no signal listener bookkeeping is needed.
+                        if (!face || signal.aborted)
+                            return Promise.resolve();
+                        return snapshotSessionWorkspace(face, sessionId).then(() => undefined);
+                    };
                     try {
                         const agent = await resolveAgent(sessionId);
                         // Delivery queue rule (docs/session-delivery.md §3):
@@ -576,14 +735,11 @@ export function createHostManager() {
                         // without promoting further inbox items. Loop until inbox empty.
                         while (agent.pendingAdmits().length > 0) {
                             if (signal.aborted) {
-                                throw new DOMException("aborted", "AbortError");
+                                throw hostAbortError(signal.reason);
                             }
                             // Worktree snapshot before tools mutate files (Hermes-style
                             // checkpoint). Best-effort — never blocks the turn.
-                            const face = faceBox.runtime;
-                            if (face) {
-                                await snapshotSessionWorkspace(face, sessionId);
-                            }
+                            await snapshot();
                             const result = await agent.continueTurn({ signal });
                             lastDrainResult.set(sessionId, result);
                         }
@@ -626,16 +782,36 @@ export function createHostManager() {
                     }
                     return cronAgentDepth.run(true, async () => {
                         const session = store.create();
-                        const agent = await resolveAgent(session.id);
-                        const result = await agent.continueTurn({
-                            text: `[cron ${job.id}${job.name ? ` ${job.name}` : ""}]\n${run.prompt}`,
-                            ...(signal ? { signal } : {}),
-                        });
-                        return {
-                            ok: true,
-                            output: result.text,
-                            sessionId: session.id,
-                        };
+                        try {
+                            const agent = await resolveAgent(session.id);
+                            const result = await agent.continueTurn({
+                                text: `[cron ${job.id}${job.name ? ` ${job.name}` : ""}]\n${run.prompt}`,
+                                ...(signal ? { signal } : {}),
+                            });
+                            return {
+                                ok: true,
+                                output: result.text,
+                                sessionId: session.id,
+                            };
+                        }
+                        finally {
+                            // Ephemeral cron sessions must not retain AgentHandle in agentCache
+                            // (each composition is heavy; ticker would OOM over hours).
+                            lastDrainResult.delete(session.id);
+                            hub.forget(session.id);
+                            try {
+                                await faceBox.runtime?.onSessionFinalize?.(session.id);
+                            }
+                            catch {
+                                // best-effort memory/browser cleanup
+                            }
+                            if (faceBox.runtime?.invalidateAgent) {
+                                await faceBox.runtime.invalidateAgent(session.id);
+                            }
+                            else {
+                                await agentCache.invalidate(session.id);
+                            }
+                        }
                     });
                 },
                 onError: (err) => {
@@ -870,7 +1046,7 @@ export function createHostManager() {
                     : {}),
                 drain: {
                     wake: (sessionId) => drain.wake(sessionId),
-                    cancel: (sessionId) => drain.cancel(sessionId),
+                    cancel: (sessionId, opts) => drain.cancel(sessionId, opts),
                     isActive: (sessionId) => drain.isActive(sessionId),
                     run: (sessionId) => hub.run(sessionId),
                 },
@@ -951,6 +1127,14 @@ export function createHostManager() {
                     loop.maxSteps > 0
                     ? Math.floor(loop.maxSteps)
                     : undefined;
+                const autoContinueOnMaxTokens = loop.autoContinueOnMaxTokens === true;
+                const autoContinueMaxRoundsRaw = loop.autoContinueMaxRounds;
+                const autoContinueMaxRounds = typeof autoContinueMaxRoundsRaw === "number" &&
+                    Number.isFinite(autoContinueMaxRoundsRaw) &&
+                    autoContinueMaxRoundsRaw >= 1 &&
+                    autoContinueMaxRoundsRaw <= 10
+                    ? Math.floor(autoContinueMaxRoundsRaw)
+                    : undefined;
                 const toolOrderRaw = loop.toolOrder;
                 const toolOrder = Array.isArray(toolOrderRaw) &&
                     toolOrderRaw.length > 0 &&
@@ -982,6 +1166,16 @@ export function createHostManager() {
                     loop.bufferTokens >= 0
                     ? Math.floor(loop.bufferTokens)
                     : undefined;
+                const compactionStrategyRaw = String(loop.compactionStrategy ?? "").trim();
+                const compactionStrategy = compactionStrategyRaw === "prune-summary" ||
+                    compactionStrategyRaw === "prune-only" ||
+                    compactionStrategyRaw === "summary-only" ||
+                    compactionStrategyRaw === "off"
+                    ? compactionStrategyRaw
+                    : undefined;
+                const guardianFragments = typeof loop.guardianFragments === "boolean"
+                    ? loop.guardianFragments
+                    : undefined;
                 const toolResultMaxInlineBytes = typeof loop.toolResultMaxInlineBytes === "number" &&
                     Number.isFinite(loop.toolResultMaxInlineBytes) &&
                     loop.toolResultMaxInlineBytes >= 0
@@ -1197,12 +1391,19 @@ export function createHostManager() {
                 return {
                     ...(maxParallelToolCalls !== undefined ? { maxParallelToolCalls } : {}),
                     ...(maxSteps !== undefined ? { maxSteps } : {}),
+                    ...(autoContinueOnMaxTokens
+                        ? { autoContinueOnMaxTokens: true }
+                        : {}),
+                    ...(autoContinueMaxRounds !== undefined
+                        ? { autoContinueMaxRounds }
+                        : {}),
                     ...(toolOrder !== undefined ? { toolOrder } : {}),
                     ...(toolSettle !== undefined ? { toolSettle } : {}),
                     ...(llmRetryMaxRetries !== undefined ? { llmRetryMaxRetries } : {}),
                     ...(maxRequestTokens !== undefined ||
                         keepTokens !== undefined ||
-                        bufferTokens !== undefined
+                        bufferTokens !== undefined ||
+                        compactionStrategy !== undefined
                         ? {
                             compaction: {
                                 ...(maxRequestTokens !== undefined
@@ -1210,12 +1411,16 @@ export function createHostManager() {
                                     : {}),
                                 ...(keepTokens !== undefined ? { keepTokens } : {}),
                                 ...(bufferTokens !== undefined ? { bufferTokens } : {}),
+                                ...(compactionStrategy !== undefined
+                                    ? { strategy: compactionStrategy }
+                                    : {}),
                             },
                         }
                         : {}),
                     ...(toolResultMaxInlineBytes !== undefined
                         ? { toolResultMaxInlineBytes }
                         : {}),
+                    ...(guardianFragments !== undefined ? { guardianFragments } : {}),
                     ...(maxSubagentDepth !== undefined ? { maxSubagentDepth } : {}),
                     ...(maxActiveSubagents !== undefined ? { maxActiveSubagents } : {}),
                     bashLimits: {
@@ -1349,6 +1554,13 @@ export function createHostManager() {
                         ...(url ? { url } : {}),
                         ...(token ? { token } : {}),
                         ...(collection ? { collection } : {}),
+                        ...(typeof ns.embeddingsUrl === "string" && ns.embeddingsUrl.trim()
+                            ? { embeddingsUrl: ns.embeddingsUrl.trim() }
+                            : {}),
+                        ...(typeof ns.embeddingsModel === "string" &&
+                            ns.embeddingsModel.trim()
+                            ? { embeddingsModel: ns.embeddingsModel.trim() }
+                            : {}),
                     };
                 },
                 tokenLedger: {
@@ -1387,7 +1599,10 @@ export function createHostManager() {
                 ensureSession,
                 resolveAgent,
                 drain,
-                tryHandlePublic: chainPublicHandlers(createMobileAccessGateHandler({ xrkHome: resolveXrkHome() }), createSidebarPublicHandler({
+                tryHandlePublic: chainPublicHandlers(createA2aInboundPublicHandler({
+                    host: config.runtime.host,
+                    port: config.runtime.port,
+                }), createMobileAccessGateHandler({ xrkHome: resolveXrkHome() }), createSidebarPublicHandler({
                     xrkHome: resolveXrkHome(),
                     defaultCwd: faceRuntime.workspaceRoot,
                     resolveSessionCwd: (sessionId) => resolveSessionCwd(faceRuntime, sessionId),