@zixt/host 0.0.81 → 0.0.83

package/dist/index.js

@@ -31,7 +31,7 @@ import { homedir as homedir3 } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.81",
+  version: "0.0.83",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14661,6 +14661,8 @@ var ID_PREFIXES = {
   conversationEvent: "cve",
   /** One human-confirmed integration action prepared by the Manager. */
   managerIntegrationAction: "mia",
+  /** One Manager-prepared secure Credential entry card (MG-17). */
+  managerCredentialRequest: "mcr",
   /** One Manager inference call's token-metering row (MG-8). */
   managerUsage: "mgu",
   /** One ordered Manager reply awaiting Slack delivery. */
@@ -14712,6 +14714,10 @@ var ManagerIntegrationActionId = idSchema(
   ID_PREFIXES.managerIntegrationAction,
   "Manager integration action id"
 );
+var ManagerCredentialRequestId = idSchema(
+  ID_PREFIXES.managerCredentialRequest,
+  "Manager credential request id"
+);
 var ManagerEmailInboxId = idSchema(
   ID_PREFIXES.managerEmailInbox,
   "Manager email inbox id"
@@ -18331,7 +18337,9 @@ var ConversationEventProjection = external_exports.discriminatedUnion("kind", [
     taskId: TaskId.nullable(),
     agentId: AgentId.nullable(),
     /** Present only for a confirmation card; OAuth authority never appears here. */
-    integrationActionId: ManagerIntegrationActionId.nullable().optional()
+    integrationActionId: ManagerIntegrationActionId.nullable().optional(),
+    /** Present only for a secure Credential entry card; never a value (MG-17). */
+    credentialRequestId: ManagerCredentialRequestId.nullable().optional()
   }).strict(),
   /** A mirrored child-Task event: what the teammate wrote or became. */
   external_exports.object({
@@ -18397,6 +18405,48 @@ var ManagerIntegrationActionResponse = external_exports.object({
   action: ManagerIntegrationActionProjection,
   oauth: ManagerIntegrationOAuthStart.nullable()
 }).strict();
+var ManagerCredentialRequestStatus = external_exports.enum([
+  "awaiting_entry",
+  "storing",
+  "stored",
+  "cancelled",
+  "expired",
+  "failed"
+]);
+var ManagerCredentialRequestProjection = external_exports.object({
+  id: ManagerCredentialRequestId,
+  conversationId: ConversationId,
+  /** The Credential name, exactly as it will appear in Credentials. */
+  name: external_exports.string().min(1).max(120),
+  /** `env` reaches a Task as an environment variable; `web_login` fills a sign-in form. */
+  kind: external_exports.enum(["env", "web_login"]),
+  /** Saved as the Credential's description so teammates know what they hold. */
+  purpose: external_exports.string().max(500).nullable(),
+  scope: external_exports.enum(["organization", "teammates"]),
+  /** Named teammates for a teammate-scoped Credential; empty for organization scope. */
+  teammates: external_exports.array(external_exports.object({ agentId: AgentId, name: external_exports.string().min(1).max(200) }).strict()).max(100),
+  /** Suggested sign-in page for a website login; the person can correct it. */
+  loginUrl: external_exports.url().max(2e3).nullable(),
+  status: ManagerCredentialRequestStatus,
+  outcome: external_exports.string().max(1e3).nullable(),
+  createdAt: external_exports.string(),
+  expiresAt: external_exports.string()
+}).strict();
+var SubmitManagerCredentialRequest = external_exports.object({
+  requestId: external_exports.uuid(),
+  /** env kind. */
+  value: external_exports.string().min(1).max(1e4).optional(),
+  /** web_login kind. */
+  webLogin: WebLoginValue.optional()
+}).strict().superRefine((request, ctx) => {
+  if (request.value === void 0 === (request.webLogin === void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["value"],
+      message: "submit exactly one of value or webLogin, matching the requested kind"
+    });
+  }
+});
 var NonEmptyTaskRunnerSelection = TaskRunnerSelection.refine(
   (selection) => selection.type !== void 0 || selection.model !== void 0 || selection.effort !== void 0,
   "choose at least one runtime preference"
@@ -25396,6 +25446,9 @@ var DO_NOT_RESTART_EXIT_CODE = 64;
 var RESTART_BACKOFF_MS = 2e3;
 var MAX_RESTART_BACKOFF_MS = 6e4;
 var CRASH_STREAK_RESET_MS = 6e4;
+function streakBackoffMs(streak) {
+  return Math.min(MAX_RESTART_BACKOFF_MS, RESTART_BACKOFF_MS * 2 ** Math.min(streak - 1, 10));
+}
 var RELEASE_PROBATION_MS = 5 * 6e4;
 var FAST_UPDATE_EXIT_MS = 1e4;
 var STOP_GRACE_MS = 3e4;
@@ -25446,6 +25499,23 @@ function versionsRoot() {
 function npmCommand(platform = process.platform) {
   return platform === "win32" ? "npm.cmd" : "npm";
 }
+async function resolveInstallerCommand(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const command = npmCommand(platform);
+  if (platform !== "win32") return command;
+  const execPath = options.execPath ?? process.execPath;
+  const resolution = {
+    platform,
+    ...options.searchPath !== void 0 ? { searchPath: options.searchPath } : {}
+  };
+  return (
+    // npm ships beside the `node` running this process, and that copy is the
+    // one matching it. A per-user Scheduled Task may carry no npm on PATH.
+    await resolveTrustedCliCommand(join8(dirname4(execPath), command), resolution) ?? await resolveTrustedCliCommand(command, resolution) ?? // Nothing resolved: keep the previous behaviour, so a Machine without npm
+    // fails one install rather than changing how failure is handled.
+    command
+  );
+}
 function windowsInstallerCommandLine(command, args) {
   return [command, ...args].map(quoteForCmd).join(" ");
 }
@@ -25738,12 +25808,12 @@ var InstallerContainmentError = class extends Error {
 async function installRelease(version2, options = {}) {
   if (!VERSION_DIR.test(version2)) return null;
   const platform = options.platform ?? process.platform;
-  const installerCommand = options.installerCommand ?? npmCommand(platform);
   const root = options.root ?? versionsRoot();
   const prefix = join8(root, version2);
   const entry = installedReleaseEntry(version2, root);
   if (await validReleaseAtPrefix(prefix, version2)) return entry;
   if (options.signal?.aborted) return null;
+  const installerCommand = options.installerCommand ?? await resolveInstallerCommand({ platform });
   await mkdir5(root, { recursive: true, mode: 448 });
   const staging = join8(root, `.install-${version2}-${process.pid}-${crypto.randomUUID()}`);
   const quarantine = join8(root, `.invalid-${version2}-${process.pid}-${crypto.randomUUID()}`);
@@ -26552,6 +26622,7 @@ async function superviseHost(options = {}) {
     announceShutdown = resolve18;
   });
   const attempted = /* @__PURE__ */ new Set();
+  let unsatisfiableUpdates = 0;
   const waitOrShutdown = async (ms) => {
     if (shuttingDown2) return false;
     if (!customDelay) {
@@ -26572,11 +26643,7 @@ async function superviseHost(options = {}) {
   const waitAfterCrash = async (runtimeMs) => {
     if (runtimeMs >= CRASH_STREAK_RESET_MS) consecutiveCrashes = 0;
     consecutiveCrashes++;
-    const backoff = Math.min(
-      MAX_RESTART_BACKOFF_MS,
-      RESTART_BACKOFF_MS * 2 ** Math.min(consecutiveCrashes - 1, 10)
-    );
-    return waitOrShutdown(backoff);
+    return waitOrShutdown(streakBackoffMs(consecutiveCrashes));
   };
   const cleanupExitedWorker = async (exitedChild, childExited, workerBoundary, containment) => {
     for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS2; attempt++) {
@@ -26939,10 +27006,15 @@ async function superviseHost(options = {}) {
       consecutiveCrashes = 0;
       if (orderlyValidatedBoundary) rollbackCandidate = null;
       const target = await published();
+      let updateLanded = false;
       if (target === null) {
         log2(
           "Zixt Host: a newer release was reported but the registry is unreachable; staying on the current version"
         );
+      } else if (target === command.version) {
+        log2(
+          `Zixt Host: this Machine already runs the newest published release (${target}), so an update cannot satisfy the cloud; waiting for a newer one`
+        );
       } else if (attempted.has(target)) {
         log2(`Zixt Host: already running ${target}; ignoring a repeated update request`);
       } else {
@@ -27016,6 +27088,7 @@ async function superviseHost(options = {}) {
               }
               rollbackCandidate = { failedVersion: target, command: fallback };
               command = { entry, version: target };
+              updateLanded = true;
               if (reloadAfterActivation) return SUPERVISOR_RELOAD_EXIT_CODE;
               if (releaseStore) {
                 const probation = durableState("probation", target, fallback.version);
@@ -27043,7 +27116,10 @@ async function superviseHost(options = {}) {
           log2(`Zixt Host: could not install ${target}; staying on the current version`);
         }
       }
-      if (now() - startedAt < FAST_UPDATE_EXIT_MS && !await waitOrShutdown(RESTART_BACKOFF_MS)) {
+      unsatisfiableUpdates = updateLanded ? 0 : unsatisfiableUpdates + 1;
+      if (unsatisfiableUpdates > 0) {
+        if (!await waitOrShutdown(streakBackoffMs(unsatisfiableUpdates))) return 0;
+      } else if (now() - startedAt < FAST_UPDATE_EXIT_MS && !await waitOrShutdown(RESTART_BACKOFF_MS)) {
         return 0;
       }
       if (shuttingDown2) return 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zixt/host",
-  "version": "0.0.81",
+  "version": "0.0.83",
   "type": "module",
   "exports": {
     ".": "./src/client.ts",