@zanii/blackbox 0.7.0 → 0.8.0

package/README.md

@@ -83,6 +83,11 @@ verifyAnswerCredential(credential, lines, bodies, packs); // { ok, problems }: t
 
 The same checks run offline as pure functions: `toolHallucinations`, `groundingFindings`, `factsIn`, `loadReferencePacks`, `answerRisk`, `detectorAccuracy`.
 
+## New in 0.8.0
+
+- `blackbox drain --close` (and `drainSpools({close: true})` / `drain_spools(close=True)`): after shipping what a stopped agent left behind, each session is closed as `abandoned`.
+- Works with gateway v0.10: alerts signed as Standard Webhooks, tenant keys that expire, more identity-provider algorithms (PS256, ES384, EdDSA).
+
 ## New in 0.7.0
 
 - Any number of serverless functions or workers can write one session at the same moment: a joined session sends its events unnumbered, each with an id, and a v0.9+ gateway numbers them in arrival order (a resend adds nothing).

package/dist/cli.js

@@ -33,7 +33,8 @@ const USAGE = `usage (spec/cli.md):
   blackbox erase <session_id>
   blackbox approvals <session_id>
   blackbox decide <session_id> <approval_id> approve|reject [--note <text>]
-  blackbox drain [--spool-dir <dir>]   (ships what a stopped agent left in its spool)
+  blackbox drain [--spool-dir <dir>] [--close]   (ships what a stopped agent left in its spool;
+                                                 --close then closes each session as abandoned)
   blackbox analyze <bundle.json> [--bodies <dir>] [--prices <file>]
   blackbox verify-certificate <certificate.json> [--did <did:key:…>]
   blackbox investigate <bundle.json> [--bodies <dir>] [--directives <file>] [--identity <file>] [--proofs] [--out <prefix>]
@@ -1102,7 +1103,7 @@ async function tailCommand(rest) {
 }
 /** Audit K5: ships what stopped agents left in the spool (BLACKBOX_URL; no key: the kept tokens). */
 async function drainCommand(rest) {
-    const { flags, positional } = parse(rest, []);
+    const { flags, positional } = parse(rest, ["--close"]);
     const url = process.env.BLACKBOX_URL;
     if (positional.length || !url)
         return usage();
@@ -1110,6 +1111,7 @@ async function drainCommand(rest) {
     const results = await drainSpools({
         url,
         ...(flags["spool-dir"] ? { spoolDir: flags["spool-dir"] } : {}),
+        ...(flags.close ? { close: true } : {}),
     });
     process.stdout.write(`${JSON.stringify({ ok: results.every((r) => r.shipped), sessions: results })}\n`);
     return results.every((r) => r.shipped) ? 0 : 2;

package/dist/session/drain.d.ts

@@ -3,6 +3,8 @@ export interface DrainResult {
     shipped: boolean;
     /** Events the gateway still doesn't have (0 when shipped). */
     left: number;
+    /** With `close`: whether the session was closed. */
+    closed?: boolean;
 }
 /** Only for agents that have stopped: a running agent ships its own spool. Never throws. */
 export declare function drainSpools(options: {
@@ -10,4 +12,6 @@ export declare function drainSpools(options: {
     spoolDir?: string;
     timeoutMs?: number;
     logger?: (message: string) => void;
+    /** LA.5: close each session once shipped, as `abandoned`. */
+    close?: boolean;
 }): Promise<DrainResult[]>;

package/dist/session/drain.js

@@ -1,7 +1,7 @@
 // Audit K5: ships the events a stopped agent left in its spool. The SDK keeps the token of a session
 // it opened itself next to the spool (`<id>.token`, mode 0600), since only it knew the token; this
-// reads each one and ships what the gateway hasn't acknowledged. The session isn't closed: the
-// gateway already recorded the lost contact, and an operator closes it (or it lapses, spec/api.md).
+// reads each one and ships what the gateway hasn't acknowledged. With `close` (LA.5) each shipped
+// session is then closed as `abandoned`, with its own token; without it an operator closes it.
 import { existsSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -26,10 +26,18 @@ export async function drainSpools(options) {
         }, id, token);
         const shipped = await s.flush({ timeoutMs: options.timeoutMs ?? 30_000 });
         const left = s.stats.recorded - s.stats.acked;
+        const closed = shipped && options.close
+            ? await s.close("abandoned", "the agent stopped; its spool was drained")
+            : undefined;
         s.stop();
         if (shipped)
             rmSync(join(dir, file), { force: true });
-        out.push({ session_id: id, shipped, left: shipped ? 0 : Math.max(0, left) });
+        out.push({
+            session_id: id,
+            shipped,
+            left: shipped ? 0 : Math.max(0, left),
+            ...(closed === undefined ? {} : { closed }),
+        });
     }
     return out;
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.7.0";
+export declare const VERSION = "0.8.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // The SDK version, on its own so the CLI can print it without loading the whole SDK.
-export const VERSION = "0.7.0";
+export const VERSION = "0.8.0";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zanii/blackbox",
   "license": "Apache-2.0",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The flight recorder for AI agents: sessions, a zero-loss spool, framework hooks, approvals, and offline verification of the gateway's hash-chained record.",
   "keywords": [
     "ai-agents",