agent-embassy 2.0.1 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +56 -0
- package/CONTRIBUTING.md +19 -34
- package/README.md +110 -228
- package/SECURITY.md +55 -89
- package/dist/src/errors.d.ts +10 -1
- package/dist/src/errors.js +3 -1
- package/dist/src/errors.js.map +1 -1
- package/dist/src/gateway/claude-helper-protocol.d.ts +8 -11
- package/dist/src/gateway/claude-helper-protocol.js +12 -11
- package/dist/src/gateway/claude-helper-protocol.js.map +1 -1
- package/dist/src/gateway/claude-helper-supervisor.d.ts +1 -5
- package/dist/src/gateway/claude-helper-supervisor.js +10 -9
- package/dist/src/gateway/claude-helper-supervisor.js.map +1 -1
- package/dist/src/gateway/claude-helper.js +6 -6
- package/dist/src/gateway/claude-helper.js.map +1 -1
- package/dist/src/gateway/claude-peer.d.ts +0 -3
- package/dist/src/gateway/claude-peer.js +6 -18
- package/dist/src/gateway/claude-peer.js.map +1 -1
- package/dist/src/gateway/cli.d.ts +17 -6
- package/dist/src/gateway/cli.js +912 -261
- package/dist/src/gateway/cli.js.map +1 -1
- package/dist/src/gateway/codex-socket-holder.d.ts +26 -0
- package/dist/src/gateway/codex-socket-holder.js +76 -0
- package/dist/src/gateway/codex-socket-holder.js.map +1 -0
- package/dist/src/gateway/codex-stateless-transport.js +1 -1
- package/dist/src/gateway/codex-stateless-transport.js.map +1 -1
- package/dist/src/gateway/config.d.ts +1 -10
- package/dist/src/gateway/config.js +4 -10
- package/dist/src/gateway/config.js.map +1 -1
- package/dist/src/gateway/control.d.ts +45 -77
- package/dist/src/gateway/control.js +56 -141
- package/dist/src/gateway/control.js.map +1 -1
- package/dist/src/gateway/federation-nodes.d.ts +29 -2
- package/dist/src/gateway/federation-nodes.js +177 -7
- package/dist/src/gateway/federation-nodes.js.map +1 -1
- package/dist/src/gateway/peer-client.d.ts +4 -3
- package/dist/src/gateway/peer-client.js +22 -13
- package/dist/src/gateway/peer-client.js.map +1 -1
- package/dist/src/gateway/peer-protocol.d.ts +8 -11
- package/dist/src/gateway/peer-protocol.js +5 -12
- package/dist/src/gateway/peer-protocol.js.map +1 -1
- package/dist/src/gateway/provenance-envelope.d.ts +0 -1
- package/dist/src/gateway/provenance-envelope.js +4 -19
- package/dist/src/gateway/provenance-envelope.js.map +1 -1
- package/dist/src/gateway/providers.d.ts +7 -4
- package/dist/src/gateway/providers.js +16 -20
- package/dist/src/gateway/providers.js.map +1 -1
- package/dist/src/gateway/server.d.ts +3 -12
- package/dist/src/gateway/server.js +31 -50
- package/dist/src/gateway/server.js.map +1 -1
- package/dist/src/gateway/service-agent.d.ts +187 -0
- package/dist/src/gateway/service-agent.js +758 -0
- package/dist/src/gateway/service-agent.js.map +1 -0
- package/dist/src/gateway/service.d.ts +114 -31
- package/dist/src/gateway/service.js +461 -566
- package/dist/src/gateway/service.js.map +1 -1
- package/dist/src/gateway/status-view.d.ts +167 -0
- package/dist/src/gateway/status-view.js +488 -0
- package/dist/src/gateway/status-view.js.map +1 -0
- package/dist/src/gateway/store.d.ts +103 -21
- package/dist/src/gateway/store.js +454 -529
- package/dist/src/gateway/store.js.map +1 -1
- package/dist/src/gateway/types.d.ts +48 -99
- package/dist/src/gateway/types.js +15 -52
- package/dist/src/gateway/types.js.map +1 -1
- package/docs/CONFIGURATION.md +173 -44
- package/docs/DELIVERY.md +11 -11
- package/docs/GATEWAY-ARCHITECTURE.md +277 -375
- package/package.json +4 -12
- package/skills/embassy-peer/SKILL.md +65 -90
- package/skills/embassy-peer/agents/openai.yaml +1 -1
- package/README.zh-CN.md +0 -275
- package/assets/live-dashboard/app.css +0 -1619
- package/assets/vendor/react/LICENSE +0 -21
- package/assets/vendor/react/react-dom.production.min.js +0 -267
- package/assets/vendor/react/react.production.min.js +0 -31
- package/dist/src/gateway/acp-client.d.ts +0 -110
- package/dist/src/gateway/acp-client.js +0 -407
- package/dist/src/gateway/acp-client.js.map +0 -1
- package/dist/src/gateway/acp-provider.d.ts +0 -66
- package/dist/src/gateway/acp-provider.js +0 -275
- package/dist/src/gateway/acp-provider.js.map +0 -1
- package/dist/src/gateway/cli-copy.d.ts +0 -8
- package/dist/src/gateway/cli-copy.en.d.ts +0 -22
- package/dist/src/gateway/cli-copy.en.js +0 -62
- package/dist/src/gateway/cli-copy.en.js.map +0 -1
- package/dist/src/gateway/cli-copy.js +0 -27
- package/dist/src/gateway/cli-copy.js.map +0 -1
- package/dist/src/gateway/cli-copy.zh-CN.d.ts +0 -22
- package/dist/src/gateway/cli-copy.zh-CN.js +0 -62
- package/dist/src/gateway/cli-copy.zh-CN.js.map +0 -1
- package/dist/src/gateway/codex-doctor.d.ts +0 -36
- package/dist/src/gateway/codex-doctor.js +0 -127
- package/dist/src/gateway/codex-doctor.js.map +0 -1
- package/dist/src/gateway/dashboard-copy.d.ts +0 -7
- package/dist/src/gateway/dashboard-copy.en.d.ts +0 -504
- package/dist/src/gateway/dashboard-copy.en.js +0 -505
- package/dist/src/gateway/dashboard-copy.en.js.map +0 -1
- package/dist/src/gateway/dashboard-copy.js +0 -514
- package/dist/src/gateway/dashboard-copy.js.map +0 -1
- package/dist/src/gateway/dashboard-copy.zh-CN.d.ts +0 -504
- package/dist/src/gateway/dashboard-copy.zh-CN.js +0 -505
- package/dist/src/gateway/dashboard-copy.zh-CN.js.map +0 -1
- package/dist/src/gateway/dashboard-model.d.ts +0 -343
- package/dist/src/gateway/dashboard-model.js +0 -1061
- package/dist/src/gateway/dashboard-model.js.map +0 -1
- package/dist/src/gateway/dashboard.d.ts +0 -20
- package/dist/src/gateway/dashboard.js +0 -874
- package/dist/src/gateway/dashboard.js.map +0 -1
- package/dist/src/gateway/deepseek-detect.d.ts +0 -14
- package/dist/src/gateway/deepseek-detect.js +0 -41
- package/dist/src/gateway/deepseek-detect.js.map +0 -1
- package/dist/src/gateway/live-dashboard-app/app.js +0 -2385
- package/dist/src/gateway/live-dashboard-assets.d.ts +0 -10
- package/dist/src/gateway/live-dashboard-assets.js +0 -74
- package/dist/src/gateway/live-dashboard-assets.js.map +0 -1
- package/dist/src/gateway/live-dashboard-command.d.ts +0 -60
- package/dist/src/gateway/live-dashboard-command.js +0 -334
- package/dist/src/gateway/live-dashboard-command.js.map +0 -1
- package/dist/src/gateway/live-dashboard-http.d.ts +0 -39
- package/dist/src/gateway/live-dashboard-http.js +0 -383
- package/dist/src/gateway/live-dashboard-http.js.map +0 -1
- package/dist/src/gateway/live-dashboard-protocol.d.ts +0 -34
- package/dist/src/gateway/live-dashboard-protocol.js +0 -114
- package/dist/src/gateway/live-dashboard-protocol.js.map +0 -1
- package/dist/src/gateway/live-dashboard-server.d.ts +0 -33
- package/dist/src/gateway/live-dashboard-server.js +0 -144
- package/dist/src/gateway/live-dashboard-server.js.map +0 -1
- package/dist/src/gateway/live-dashboard-stream.d.ts +0 -46
- package/dist/src/gateway/live-dashboard-stream.js +0 -234
- package/dist/src/gateway/live-dashboard-stream.js.map +0 -1
- package/dist/src/gateway/live-dashboard.d.ts +0 -28
- package/dist/src/gateway/live-dashboard.js +0 -154
- package/dist/src/gateway/live-dashboard.js.map +0 -1
- package/dist/src/gateway/locale.d.ts +0 -4
- package/dist/src/gateway/locale.js +0 -10
- package/dist/src/gateway/locale.js.map +0 -1
- package/dist/src/gateway/progress-watch-machine.d.ts +0 -45
- package/dist/src/gateway/progress-watch-machine.js +0 -70
- package/dist/src/gateway/progress-watch-machine.js.map +0 -1
- package/docs/CONFIGURATION.zh-CN.md +0 -97
- package/docs/DASHBOARD.md +0 -98
- package/docs/DASHBOARD.zh-CN.md +0 -49
- package/docs/DELIVERY.zh-CN.md +0 -55
package/SECURITY.md
CHANGED
|
@@ -19,7 +19,10 @@ session or thread identifiers, or unredacted personal paths.
|
|
|
19
19
|
|
|
20
20
|
Embassy is personal software for one macOS user. Each broker remains local to
|
|
21
21
|
one machine; an explicit private `nodes.json` may connect the user's own
|
|
22
|
-
SSH-reachable machines through the user's existing OpenSSH configuration.
|
|
22
|
+
SSH-reachable machines through the user's existing OpenSSH configuration.
|
|
23
|
+
Broker identity always comes from that owned mode-0600 `nodes.json`; when it
|
|
24
|
+
is absent, the broker creates it once from this machine's hostname, and that
|
|
25
|
+
recorded identity stays as written when the machine is later renamed. Run
|
|
23
26
|
every node only under an OS account that is yours alone and where you trust
|
|
24
27
|
every process already running as that user. Do not expose Embassy sockets or
|
|
25
28
|
state on a network, host it as a service, or use it to share a provider
|
|
@@ -93,15 +96,10 @@ review, and audit work.
|
|
|
93
96
|
|
|
94
97
|
- **Other local software already running as the same user.** Embassy provides
|
|
95
98
|
no local-process authentication and no capability or local-user consent
|
|
96
|
-
boundary against software already operating under that UID.
|
|
97
|
-
routing
|
|
99
|
+
boundary against software already operating under that UID. Addressing is
|
|
100
|
+
routing, not authorization; aliases, conversation tokens,
|
|
98
101
|
inherited environment values, private sockets, and same-user file modes do
|
|
99
102
|
not authenticate one same-user process from another.
|
|
100
|
-
- **Local software through browser-origin checks.** Exact Host, Origin, the
|
|
101
|
-
`X-Embassy-Request` sentinel, and same-origin response policy constrain what a
|
|
102
|
-
browser can issue or read across origins. They do not authenticate a loopback
|
|
103
|
-
caller, its process, or its UID; the live dashboard assumes a trusted
|
|
104
|
-
single-user machine.
|
|
105
103
|
- **Predictions based on version strings.** A version string is diagnostic
|
|
106
104
|
metadata, never routing authority, security evidence, or attack detection.
|
|
107
105
|
Current path, ownership, protocol, interface, used-artifact generation, and
|
|
@@ -120,7 +118,7 @@ a doctrine-change proposal, including the product and threat-model consequence,
|
|
|
120
118
|
before adding the check. A test, review finding, or “hardening” patch must not
|
|
121
119
|
silently expand Embassy's claimed boundary.
|
|
122
120
|
|
|
123
|
-
## Routing and
|
|
121
|
+
## Routing and the permission model
|
|
124
122
|
|
|
125
123
|
- A universal shell peer explicitly registers one `peer-*` alias. Its principal
|
|
126
124
|
is that alias plus a `peer_` token minted and printed exactly once. The token
|
|
@@ -130,19 +128,37 @@ silently expand Embassy's claimed boundary.
|
|
|
130
128
|
there is deliberately no PID binding, token file, Keychain entry, or daemon.
|
|
131
129
|
- A Codex task must explicitly self-register with a `codex-*` alias before it
|
|
132
130
|
can participate.
|
|
133
|
-
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
131
|
+
- The permission to message is the OS boundary Embassy already sits inside:
|
|
132
|
+
the same UID, the same host — or a host the operator configured in the
|
|
133
|
+
private `nodes.json` — and an exact alias. Embassy holds no separate,
|
|
134
|
+
revocable grant between two endpoints, and never claimed one could defend
|
|
135
|
+
against software already running as that UID.
|
|
136
|
+
- A discovered Claude session's logical route is installed by the broker on
|
|
137
|
+
the session's first use — the first message sent to it, or its first native
|
|
138
|
+
message out. Installation records identity; it grants nothing that
|
|
139
|
+
addressing did not already imply.
|
|
140
|
+
- A name is not an identity. A route's identity is its (host, native session
|
|
141
|
+
UUID) pair: a session that re-anchors or renames itself keeps its
|
|
142
|
+
registration and its in-flight conversations, while a name that currently
|
|
143
|
+
belongs to more than one live session is refused with
|
|
144
|
+
`PEER_ALIAS_COLLISION` at send time and never resolved by picking first.
|
|
145
|
+
That fence is a fence on names: the session UUID stays addressable, and a
|
|
146
|
+
sender is never fenced by its own display name, because its identity was
|
|
147
|
+
attested rather than typed.
|
|
148
|
+
- Every routed body carries the broker-composed provenance envelope naming its
|
|
149
|
+
sender, and what "naming" is worth depends on the hop. On a local hop the
|
|
150
|
+
sender is verified: the broker read it from the inherited socket capability,
|
|
151
|
+
the inherited Codex thread id, or a shell peer's minted token, none of which
|
|
152
|
+
the sender chose. Across a federated hop the sender is named by the sending
|
|
153
|
+
node, and what the destination authorizes is that node's membership in its
|
|
154
|
+
own `nodes.json` — the destination trusts the peer broker to have verified
|
|
155
|
+
its own local sender, exactly as much as it trusts that operator. In both
|
|
156
|
+
cases the envelope is attribution, not authentication of the body's claims,
|
|
157
|
+
and the boundary that stops anyone else is the operating system's.
|
|
158
|
+
- Explicitly requested endpoint replacement
|
|
143
159
|
(`register-codex --succeeds`) is one atomic logical-route transaction: it
|
|
144
|
-
settles the outgoing route's work by recorded write phase, removes its
|
|
145
|
-
|
|
160
|
+
settles the outgoing route's work by recorded write phase, removes its
|
|
161
|
+
capabilities, and publishes only the replacement. There is no prepared,
|
|
146
162
|
activated, re-anchored, or recovery generation and no half-replaced state.
|
|
147
163
|
- Embassy never mutates a Codex task's approval or sandbox policy and never
|
|
148
164
|
answers an approval request. An inbound turn uses the task's existing native
|
|
@@ -159,11 +175,11 @@ silently expand Embassy's claimed boundary.
|
|
|
159
175
|
- A CLI initiator receives the full conversation token in the accepted control
|
|
160
176
|
result, and every routed recipient receives it in the broker-owned first
|
|
161
177
|
`embassy-reply-hint`. The token is a transient participant-scoped locator,
|
|
162
|
-
not sufficient authority: `
|
|
178
|
+
not sufficient authority: `send --conversation` rechecks inherited caller identity,
|
|
163
179
|
conversation membership, and current routing policy.
|
|
164
180
|
|
|
165
181
|
Every routed message is untrusted input capable of steering the receiving
|
|
166
|
-
agent.
|
|
182
|
+
agent. The OS boundary and routing control reachability; the provenance marker
|
|
167
183
|
does not make the message content or asserted intent trustworthy.
|
|
168
184
|
|
|
169
185
|
The literal leading `STEER:` prefix is a protocol instruction, not proof of a
|
|
@@ -186,16 +202,14 @@ broker.
|
|
|
186
202
|
ownership.
|
|
187
203
|
- The control plane is a private Unix-domain socket in a controller-owned
|
|
188
204
|
mode-0700 state directory. `embassy serve` has no TCP or HTTP listener; its
|
|
189
|
-
only listeners are private Unix-domain sockets.
|
|
190
|
-
`embassy dashboard --live` companion is a separate process with its own
|
|
191
|
-
loopback HTTP listener — see "Live companion boundary" below.
|
|
205
|
+
only listeners are private Unix-domain sockets.
|
|
192
206
|
- Provider startup validates exact OS ownership, path, symlink, lease, state,
|
|
193
207
|
and generation evidence. Unsafe evidence for Embassy-owned or executed
|
|
194
208
|
artifacts and Embassy callback, control, or state paths refuses broker
|
|
195
209
|
startup; unsafe UID or mode evidence for Claude's external sessions registry
|
|
196
210
|
root quarantines only Claude. A provider version is best-effort diagnostic
|
|
197
|
-
metadata and carries no routing authority. Runtime authority comes from
|
|
198
|
-
|
|
211
|
+
metadata and carries no routing authority. Runtime authority comes from the
|
|
212
|
+
OS boundary, exact owned route and session identity, current
|
|
199
213
|
per-operation transport facts, strict protocol handling, and correlated
|
|
200
214
|
operation results.
|
|
201
215
|
A Claude record whose peer protocol is not 1 is rejected in isolation and
|
|
@@ -210,8 +224,7 @@ broker.
|
|
|
210
224
|
still matches during graceful shutdown.
|
|
211
225
|
- App Server methods are allowlisted. Connectors expose no archive, deletion,
|
|
212
226
|
shell, configuration, authentication, plugin, history, approval-response, or
|
|
213
|
-
generic RPC method.
|
|
214
|
-
Embassy never turns them into an approval surface.
|
|
227
|
+
generic RPC method.
|
|
215
228
|
- `turn/steer` is reachable only for an exact leading `STEER:` body in the
|
|
216
229
|
Claude-to-Codex direction, with an exact observed active-turn ID. App Server
|
|
217
230
|
admits it at the next tool-call boundary; Embassy never interrupts or injects
|
|
@@ -219,7 +232,7 @@ broker.
|
|
|
219
232
|
retains at most three steers per route. The environment kill switch defaults
|
|
220
233
|
on and can disable this classification globally. Embassy never issues
|
|
221
234
|
`turn/interrupt`.
|
|
222
|
-
- The
|
|
235
|
+
- The App Server 0.147.0 initialization this adapter targets enables `experimentalApi: true`
|
|
223
236
|
solely for `thread/resume.excludeTurns: true`. It adds no general
|
|
224
237
|
experimental method or authority. Missing, malformed, or nonempty returned
|
|
225
238
|
turns fail closed and are never retained.
|
|
@@ -236,9 +249,8 @@ broker.
|
|
|
236
249
|
opening or closing copies of its reserved framing tags before composing the
|
|
237
250
|
real outer frame. Framing or size failure occurs before provider write and is
|
|
238
251
|
never an ambiguous write.
|
|
239
|
-
-
|
|
240
|
-
`embassy
|
|
241
|
-
boundary". Everything enumerated above concerns `embassy serve`.
|
|
252
|
+
- Embassy creates no network listener at all. Everything enumerated above
|
|
253
|
+
concerns `embassy serve`.
|
|
242
254
|
|
|
243
255
|
## Filesystem boundary
|
|
244
256
|
|
|
@@ -289,77 +301,32 @@ Raw provider frames, tool data, stderr, callback addresses, and socket paths
|
|
|
289
301
|
remain memory-only and are discarded on restart. Message bodies are the
|
|
290
302
|
exception: queued and recently delivered bodies are retained under bounded caps
|
|
291
303
|
in the mode-0600 state file. A queued or reserved message may resume once after
|
|
292
|
-
a broker restart against its still-exact logical route
|
|
304
|
+
a broker restart against its still-exact logical route. An
|
|
293
305
|
armed or accepted message at crash settles ambiguous or unconfirmed and is
|
|
294
306
|
never replayed.
|
|
295
307
|
|
|
296
308
|
For a shell peer, durable route ownership stores only
|
|
297
309
|
`peer:<sha256(uid NUL alias NUL token)>`; the raw peer token and private mailbox
|
|
298
|
-
receipts never enter state, logs, snapshots,
|
|
310
|
+
receipts never enter state, logs, snapshots, or routed frames.
|
|
299
311
|
Pending waiters, acknowledgements, and the bounded exact-duplicate receipt
|
|
300
312
|
tombstone are memory-only. A restart therefore cannot falsely confirm a
|
|
301
313
|
stdout write whose acknowledgement was not observed.
|
|
302
314
|
|
|
303
315
|
The full `conv_` token exposed to a CLI initiator or routed recipient travels
|
|
304
316
|
only inside the accepted CLI result or transient provider payload. It is never
|
|
305
|
-
persisted, journaled, logged, placed in a receipt, projected through public
|
|
306
|
-
events or snapshots
|
|
307
|
-
|
|
317
|
+
persisted, journaled, logged, placed in a receipt, or projected through public
|
|
318
|
+
events or snapshots; public metadata may retain only an existing
|
|
319
|
+
non-reconstructable suffix. Broker-owned marker fields
|
|
308
320
|
introduce no socket paths, Codex thread IDs, Claude session UUIDs, endpoint
|
|
309
321
|
generations, or private route handles. The untrusted body remains opaque text
|
|
310
322
|
and may itself contain sender-provided strings.
|
|
311
323
|
|
|
312
324
|
The closed private binding store may retain the exact Codex thread ID and Claude
|
|
313
325
|
session UUID required for logical ownership. Native IDs are
|
|
314
|
-
forbidden from public snapshots, normalized events,
|
|
326
|
+
forbidden from public snapshots, normalized events, aliases,
|
|
315
327
|
logs, errors, and CLI output. A Claude UUID may enter only as a user-supplied
|
|
316
|
-
explicit CLI selector; Embassy never discovers or
|
|
317
|
-
|
|
318
|
-
The static dashboard is two atomically rewritten mode-0600 files, not a web
|
|
319
|
-
application: `gateway-dashboard.html` and `gateway-dashboard.zh-CN.html`, both
|
|
320
|
-
written on every publish and cross-linked in the page. They contain allowlisted
|
|
321
|
-
metadata only and have no JavaScript, external assets, storage, telemetry,
|
|
322
|
-
mutation endpoint, or self-refresh. Any process already running as the same OS
|
|
323
|
-
user can read them.
|
|
324
|
-
|
|
325
|
-
### Live companion boundary
|
|
326
|
-
|
|
327
|
-
`embassy dashboard --live` binds exact `127.0.0.1` on one stable port: `41961`
|
|
328
|
-
by default, or the integer from the per-invocation `--port <n>` option (1024
|
|
329
|
-
through 65535). It is a separate foreground process from `embassy serve` and
|
|
330
|
-
serves the direct root URL `http://127.0.0.1:<port>/`. Multiple windows and
|
|
331
|
-
browsers may use that URL while the companion runs. If the port is occupied,
|
|
332
|
-
startup fails with `LIVE_DASHBOARD_PORT_IN_USE`, points to `--port`, and never
|
|
333
|
-
falls back to another port.
|
|
334
|
-
|
|
335
|
-
The live companion has no login, capability token, URL fragment, cookie,
|
|
336
|
-
browser session, random instance path, or bootstrap file. Its intended posture
|
|
337
|
-
is one operator and software already trusted under that operator's macOS UID.
|
|
338
|
-
The HTTP listener deliberately does not authenticate processes or OS users,
|
|
339
|
-
so this is a trusted single-user-machine assumption, not a same-UID
|
|
340
|
-
enforcement mechanism: any local software that can reach or spoof loopback can
|
|
341
|
-
read retained message bodies from the live view and invoke its bounded actions.
|
|
342
|
-
|
|
343
|
-
The exact Host header is checked on every request. Navigation GETs may omit
|
|
344
|
-
Origin; every POST requires the exact Origin plus
|
|
345
|
-
`X-Embassy-Request: 1`. `OPTIONS` is rejected and no CORS headers are sent.
|
|
346
|
-
Those checks block ambient cross-origin browser requests but do not authenticate
|
|
347
|
-
local software. There are no generic control or provider routes, telemetry, or
|
|
348
|
-
external assets. The sole mutation route accepts only exact pair, unpair,
|
|
349
|
-
refresh-discovery, and named Codex-registration-removal JSON bodies, capped at
|
|
350
|
-
1 KiB and six confirmed actions per minute. Registration removal requires an
|
|
351
|
-
in-page consequence confirmation; it removes incident consent edges and
|
|
352
|
-
settles active work by its durable write phase. The browser cannot create a
|
|
353
|
-
registration, send, reply, approve,
|
|
354
|
-
interrupt, change settings, or invoke arbitrary broker/provider methods.
|
|
355
|
-
|
|
356
|
-
Reports involving the live companion are in scope if they demonstrate a
|
|
357
|
-
non-loopback bind, a bypass of the documented Host/Origin/sentinel action
|
|
358
|
-
guards from a browser origin, or authority beyond the four allowlisted
|
|
359
|
-
actions. Access by local software or another local UID is within the documented
|
|
360
|
-
trusted-machine model and is not itself treated as an authentication bypass,
|
|
361
|
-
because this surface intentionally has no such authentication boundary.
|
|
362
|
-
|
|
328
|
+
explicit CLI selector (`embassy send --to <uuid>`); Embassy never discovers or
|
|
329
|
+
prints it publicly.
|
|
363
330
|
|
|
364
331
|
## Validation boundary
|
|
365
332
|
|
|
@@ -370,8 +337,7 @@ Broker/provider startup owns bounded validation of configured installations and
|
|
|
370
337
|
exact OS boundaries. Unsafe Embassy-owned or executed artifacts, callback,
|
|
371
338
|
control, or state paths remain startup-fatal; unsafe UID or mode evidence on
|
|
372
339
|
Claude's external sessions registry root quarantines only that provider.
|
|
373
|
-
Runtime
|
|
374
|
-
from version metadata. It reports best-effort connector health, observation
|
|
340
|
+
Runtime derives no authority from version metadata. It reports best-effort connector health, observation
|
|
375
341
|
freshness, and last safe codes while strict record, frame, response, identity,
|
|
376
342
|
current used-artifact generation, correlation, and deadline checks decide each
|
|
377
343
|
operation. Claude registry parsing remains strict for every required and
|
package/dist/src/errors.d.ts
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Bounded, non-private values a client may interpolate into an operator hint.
|
|
3
|
+
* Messages stay internal (the CLI prints codes and fixed lines, never a
|
|
4
|
+
* message), so anything an operator must actually read travels here and is
|
|
5
|
+
* rendered by a client-side hint. Every value is already pattern-bounded at
|
|
6
|
+
* the point it is recorded.
|
|
7
|
+
*/
|
|
8
|
+
export type BridgeErrorDetail = Readonly<Record<string, string>>;
|
|
1
9
|
export declare class BridgeError extends Error {
|
|
2
10
|
readonly code: string;
|
|
3
11
|
readonly recoverable: boolean;
|
|
4
|
-
|
|
12
|
+
readonly detail: BridgeErrorDetail | undefined;
|
|
13
|
+
constructor(code: string, message: string, recoverable?: boolean, detail?: BridgeErrorDetail);
|
|
5
14
|
}
|
package/dist/src/errors.js
CHANGED
|
@@ -1,11 +1,13 @@
|
|
|
1
1
|
export class BridgeError extends Error {
|
|
2
2
|
code;
|
|
3
3
|
recoverable;
|
|
4
|
-
|
|
4
|
+
detail;
|
|
5
|
+
constructor(code, message, recoverable = false, detail) {
|
|
5
6
|
super(message);
|
|
6
7
|
this.name = "BridgeError";
|
|
7
8
|
this.code = code;
|
|
8
9
|
this.recoverable = recoverable;
|
|
10
|
+
this.detail = detail;
|
|
9
11
|
}
|
|
10
12
|
}
|
|
11
13
|
//# sourceMappingURL=errors.js.map
|
package/dist/src/errors.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAS;IACb,WAAW,CAAU;IACrB,MAAM,CAAgC;IAE/C,YAAY,IAAY,EAAE,OAAe,EAAE,WAAW,GAAG,KAAK,EAAE,MAA0B;QACxF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}
|
|
@@ -1,10 +1,9 @@
|
|
|
1
1
|
import type { ClaudePeerInboundProgress } from "./claude-peer.js";
|
|
2
2
|
import type { AttestedClaudePeerRuntime } from "./claude-runtime.js";
|
|
3
3
|
import type { GatewayDeliveryNoticeMode } from "./config.js";
|
|
4
|
-
import type { DashboardLocale } from "./locale.js";
|
|
5
4
|
import type { GatewayAdapterDispatchResult } from "./service.js";
|
|
6
5
|
import { type GatewayProvider, type LogicalRouteBinding } from "./types.js";
|
|
7
|
-
export declare const CLAUDE_NATIVE_HELPER_PROTOCOL_VERSION:
|
|
6
|
+
export declare const CLAUDE_NATIVE_HELPER_PROTOCOL_VERSION: 2;
|
|
8
7
|
export declare const CLAUDE_NATIVE_HELPER_MAX_IPC_BYTES: number;
|
|
9
8
|
export declare const CLAUDE_NATIVE_HELPER_MAX_REQUESTS = 64;
|
|
10
9
|
export declare const CLAUDE_NATIVE_HELPER_PREPARED_TTL_MS = 5000;
|
|
@@ -14,12 +13,11 @@ export type ClaudeNativeHelperRegistration = Readonly<{
|
|
|
14
13
|
cwd: string;
|
|
15
14
|
}>;
|
|
16
15
|
export type ClaudeNativeHelperInitialization = Readonly<{
|
|
17
|
-
protocolVersion:
|
|
16
|
+
protocolVersion: 2;
|
|
18
17
|
type: "initialize";
|
|
19
18
|
requestId: string;
|
|
20
19
|
runtime: AttestedClaudePeerRuntime;
|
|
21
20
|
hostId: string;
|
|
22
|
-
locale: DashboardLocale;
|
|
23
21
|
deliveryNotices: GatewayDeliveryNoticeMode;
|
|
24
22
|
maxPendingMessages: number;
|
|
25
23
|
registration: ClaudeNativeHelperRegistration;
|
|
@@ -27,8 +25,8 @@ export type ClaudeNativeHelperInitialization = Readonly<{
|
|
|
27
25
|
export type ClaudeNativeHelperCommand = Readonly<{
|
|
28
26
|
method: "prepare_dispatch";
|
|
29
27
|
binding: LogicalRouteBinding;
|
|
30
|
-
authorization: "selected_route"
|
|
31
|
-
stateRoot
|
|
28
|
+
authorization: "selected_route";
|
|
29
|
+
stateRoot: string;
|
|
32
30
|
messageId: string;
|
|
33
31
|
sourceAlias: string;
|
|
34
32
|
sourceProvider: GatewayProvider;
|
|
@@ -37,7 +35,6 @@ export type ClaudeNativeHelperCommand = Readonly<{
|
|
|
37
35
|
text: string;
|
|
38
36
|
expectsReply: boolean;
|
|
39
37
|
deadlineAt: string;
|
|
40
|
-
progressWatchActive?: true;
|
|
41
38
|
}> | Readonly<{
|
|
42
39
|
method: "perform_dispatch" | "cancel_dispatch";
|
|
43
40
|
preparationId: string;
|
|
@@ -64,7 +61,7 @@ export type ClaudeNativeHelperCommand = Readonly<{
|
|
|
64
61
|
method: "close";
|
|
65
62
|
}>;
|
|
66
63
|
export type ClaudeNativeHelperParentMessage = ClaudeNativeHelperInitialization | Readonly<{
|
|
67
|
-
protocolVersion:
|
|
64
|
+
protocolVersion: 2;
|
|
68
65
|
type: "request";
|
|
69
66
|
requestId: string;
|
|
70
67
|
command: ClaudeNativeHelperCommand;
|
|
@@ -96,13 +93,13 @@ export type ClaudeNativeHelperResult = Readonly<{
|
|
|
96
93
|
ok: true;
|
|
97
94
|
}>;
|
|
98
95
|
export type ClaudeNativeHelperChildMessage = Readonly<{
|
|
99
|
-
protocolVersion:
|
|
96
|
+
protocolVersion: 2;
|
|
100
97
|
type: "response";
|
|
101
98
|
requestId: string;
|
|
102
99
|
ok: true;
|
|
103
100
|
result: ClaudeNativeHelperResult;
|
|
104
101
|
}> | Readonly<{
|
|
105
|
-
protocolVersion:
|
|
102
|
+
protocolVersion: 2;
|
|
106
103
|
type: "response";
|
|
107
104
|
requestId: string;
|
|
108
105
|
ok: false;
|
|
@@ -111,7 +108,7 @@ export type ClaudeNativeHelperChildMessage = Readonly<{
|
|
|
111
108
|
recoverable: boolean;
|
|
112
109
|
}>;
|
|
113
110
|
}> | Readonly<{
|
|
114
|
-
protocolVersion:
|
|
111
|
+
protocolVersion: 2;
|
|
115
112
|
type: "event";
|
|
116
113
|
value: ClaudeNativeHelperEvent;
|
|
117
114
|
}>;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { gatewayRegistrationIngressPrefixes, isGatewayProvider } from "./types.js";
|
|
2
|
-
export const CLAUDE_NATIVE_HELPER_PROTOCOL_VERSION =
|
|
2
|
+
export const CLAUDE_NATIVE_HELPER_PROTOCOL_VERSION = 2;
|
|
3
3
|
export const CLAUDE_NATIVE_HELPER_MAX_IPC_BYTES = 128 * 1024;
|
|
4
4
|
export const CLAUDE_NATIVE_HELPER_MAX_REQUESTS = 64;
|
|
5
5
|
export const CLAUDE_NATIVE_HELPER_PREPARED_TTL_MS = 5_000;
|
|
@@ -34,17 +34,18 @@ function command(v) {
|
|
|
34
34
|
if (v.method === "perform_dispatch" || v.method === "cancel_dispatch")
|
|
35
35
|
return exact(v, ["method", "preparationId"]) && typeof v.preparationId === "string" && PREPARATION.test(v.preparationId);
|
|
36
36
|
if (v.method === "prepare_dispatch") {
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
37
|
+
// Protocol 2: `selected_route` is the only authorization, so `stateRoot` is
|
|
38
|
+
// always required. Protocol 1's second arm omitted it and therefore skipped
|
|
39
|
+
// the target-workspace assertion; that arm is gone.
|
|
40
|
+
return exact(v, ["method", "binding", "authorization", "stateRoot", "messageId", "sourceAlias",
|
|
41
|
+
"sourceProvider", "targetAlias", "conversationId", "text", "expectsReply", "deadlineAt"]) &&
|
|
42
|
+
route(v.binding) && v.authorization === "selected_route" && str(v.messageId, 256) &&
|
|
41
43
|
source(v.sourceAlias, v.sourceProvider) &&
|
|
42
44
|
typeof v.targetAlias === "string" && ALIAS.test(v.targetAlias) &&
|
|
43
45
|
typeof v.conversationId === "string" && CONVERSATION.test(v.conversationId) &&
|
|
44
46
|
typeof v.text === "string" && Buffer.byteLength(v.text) <= 16 * 1024 && typeof v.expectsReply === "boolean" &&
|
|
45
47
|
typeof v.deadlineAt === "string" && Number.isFinite(Date.parse(v.deadlineAt)) &&
|
|
46
|
-
(v.
|
|
47
|
-
(selected ? str(v.stateRoot) && v.stateRoot.startsWith("/") : v.stateRoot === undefined);
|
|
48
|
+
str(v.stateRoot) && v.stateRoot.startsWith("/");
|
|
48
49
|
}
|
|
49
50
|
if (v.method === "update_inbound_status")
|
|
50
51
|
return exact(v, ["method", "receiptHandle", "status"], ["diagnosticCode"]) &&
|
|
@@ -63,16 +64,16 @@ function command(v) {
|
|
|
63
64
|
return v.method === "unadvertise" && exact(v, ["method", "alias"]) && typeof v.alias === "string" && ALIAS.test(v.alias);
|
|
64
65
|
}
|
|
65
66
|
export function isClaudeNativeHelperParentMessage(v) {
|
|
66
|
-
if (!rec(v) || v.protocolVersion !==
|
|
67
|
+
if (!rec(v) || v.protocolVersion !== 2 || typeof v.requestId !== "string" || !ID.test(v.requestId))
|
|
67
68
|
return false;
|
|
68
69
|
if (v.type === "request")
|
|
69
70
|
return exact(v, ["protocolVersion", "type", "requestId", "command"]) && command(v.command);
|
|
70
|
-
if (v.type !== "initialize" || !exact(v, ["protocolVersion", "type", "requestId", "runtime", "hostId",
|
|
71
|
+
if (v.type !== "initialize" || !exact(v, ["protocolVersion", "type", "requestId", "runtime", "hostId",
|
|
71
72
|
"deliveryNotices", "maxPendingMessages", "registration"]) || !rec(v.runtime) || !rec(v.registration))
|
|
72
73
|
return false;
|
|
73
74
|
return exact(v.runtime, ["sessionsDir", "socketDir"]) && str(v.runtime.sessionsDir) && v.runtime.sessionsDir.startsWith("/") &&
|
|
74
75
|
str(v.runtime.socketDir) && v.runtime.socketDir.startsWith("/") && typeof v.hostId === "string" && HOST.test(v.hostId) &&
|
|
75
|
-
|
|
76
|
+
["merged", "verbose", "quiet"].includes(String(v.deliveryNotices)) &&
|
|
76
77
|
Number.isSafeInteger(v.maxPendingMessages) && Number(v.maxPendingMessages) >= 1 && Number(v.maxPendingMessages) <= 4_096 &&
|
|
77
78
|
exact(v.registration, ["alias", "sourceProvider", "cwd"]) && source(v.registration.alias, v.registration.sourceProvider) &&
|
|
78
79
|
str(v.registration.cwd) && v.registration.cwd.startsWith("/");
|
|
@@ -95,7 +96,7 @@ function result(v) {
|
|
|
95
96
|
(v.replyText === undefined || typeof v.replyText === "string" && Buffer.byteLength(v.replyText) <= 64 * 1024);
|
|
96
97
|
}
|
|
97
98
|
export function isClaudeNativeHelperChildMessage(v) {
|
|
98
|
-
if (!rec(v) || v.protocolVersion !==
|
|
99
|
+
if (!rec(v) || v.protocolVersion !== 2)
|
|
99
100
|
return false;
|
|
100
101
|
if (v.type === "response")
|
|
101
102
|
return typeof v.requestId === "string" && ID.test(v.requestId) && typeof v.ok === "boolean" &&
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claude-helper-protocol.js","sourceRoot":"","sources":["../../../src/gateway/claude-helper-protocol.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"claude-helper-protocol.js","sourceRoot":"","sources":["../../../src/gateway/claude-helper-protocol.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kCAAkC,EAAE,iBAAiB,EAAkD,MAAM,YAAY,CAAC;AAEnI,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAU,CAAC;AAChE,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AACpD,MAAM,CAAC,MAAM,oCAAoC,GAAG,KAAK,CAAC;AA4C1D,MAAM,IAAI,GAAG,wBAAwB,CAAC;AACtC,MAAM,EAAE,GAAG,wBAAwB,CAAC;AACpC,MAAM,IAAI,GAAG,4EAA4E,CAAC;AAC1F,MAAM,KAAK,GAAG,+DAA+D,CAAC;AAC9E,MAAM,IAAI,GAAG,yCAAyC,CAAC;AACvD,MAAM,YAAY,GAAG,6BAA6B,CAAC;AACnD,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAC3F,MAAM,GAAG,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnH,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,GAAG,GAAG,KAAK,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpI,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,QAAiB,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3G,iBAAiB,CAAC,QAAQ,CAAC,IAAI,kCAAkC,CAAC,QAAQ,CAAC,KAAK,SAAS;IACzF,KAAK,CAAC,UAAU,CAAC,kCAAkC,CAAC,QAAQ,CAAE,CAAC,CAAC;AAClE,SAAS,KAAK,CAAC,CAA0B,EAAE,QAAkB,EAAE,WAAqB,EAAE;IACpF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACpF,CAAC;AACD,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAChF,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9E,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AAChG,CAAC;AACD,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,CAAC,MAAM,KAAK,iBAAiB;QACnE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC3H,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACpC,4EAA4E;QAC5E,4EAA4E;QAC5E,oDAAoD;QACpD,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa;YAC5F,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YACzF,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,gBAAgB,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;YACjF,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC;YACvC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;YAC9D,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;YAC3E,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS;YAC3G,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC7E,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;YAClH,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAClG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,MAAM,KAAK,yBAAyB;QAAE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAClG,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;YACpG,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,4BAA4B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,MAAM,KAAK,yBAAyB;QAAE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACtH,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAC7G,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3H,CAAC;AACD,MAAM,UAAU,iCAAiC,CAAC,CAAU;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACjH,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ;QACnG,iBAAiB,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACrH,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1H,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACtH,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAClE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,KAAK;QACxH,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC;QACxH,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AACD,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;IACnE,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;YACjG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YACnG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;AAClH,CAAC;AACD,MAAM,UAAU,gCAAgC,CAAC,CAAU;IACzD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS;YACpH,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9F,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;oBACjF,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC;IACxJ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACxF,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;QACjI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QAC9G,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACvG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI;QAC5E,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AACD,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,kCAAkC;QAAE,MAAM,IAAI,UAAU,CAAC,oCAAoC,CAAC,CAAC;AAChJ,CAAC"}
|
|
@@ -1,7 +1,6 @@
|
|
|
1
1
|
import { type ChildProcess } from "node:child_process";
|
|
2
2
|
import type { AttestedClaudePeerRuntime } from "./claude-runtime.js";
|
|
3
3
|
import type { GatewayDeliveryNoticeMode } from "./config.js";
|
|
4
|
-
import type { DashboardLocale } from "./locale.js";
|
|
5
4
|
import type { GatewayAdapterCallbacks, GatewayAdapterDispatchResult } from "./service.js";
|
|
6
5
|
import { type GatewayProvider, type LogicalRouteBinding } from "./types.js";
|
|
7
6
|
import { type ClaudeNativeHelperCommand, type ClaudeNativeHelperEvent, type ClaudeNativeHelperRegistration, type ClaudeNativeHelperResult } from "./claude-helper-protocol.js";
|
|
@@ -16,7 +15,6 @@ export type ClaudeNativeHelperClientStartOptions = Readonly<{
|
|
|
16
15
|
entryPath?: string;
|
|
17
16
|
runtime: AttestedClaudePeerRuntime;
|
|
18
17
|
hostId: string;
|
|
19
|
-
locale: DashboardLocale;
|
|
20
18
|
deliveryNotices: GatewayDeliveryNoticeMode;
|
|
21
19
|
maxPendingMessages: number;
|
|
22
20
|
registration: ClaudeNativeHelperRegistration;
|
|
@@ -54,7 +52,6 @@ export type ClaudeNativeHelperPreparedDispatch = Readonly<{
|
|
|
54
52
|
export type ClaudeNativeHelperSupervisorOptions = Readonly<{
|
|
55
53
|
identity: Pick<LogicalRouteBinding, "provider" | "hostId">;
|
|
56
54
|
runtime: AttestedClaudePeerRuntime;
|
|
57
|
-
locale: DashboardLocale;
|
|
58
55
|
deliveryNotices: GatewayDeliveryNoticeMode;
|
|
59
56
|
maxPendingMessages: number;
|
|
60
57
|
maxHelpers: number;
|
|
@@ -77,12 +74,11 @@ export declare class ClaudeNativeHelperSupervisor {
|
|
|
77
74
|
selectedAlias?: string;
|
|
78
75
|
stateRoot?: string;
|
|
79
76
|
binding: LogicalRouteBinding;
|
|
80
|
-
authorization: "selected_route"
|
|
77
|
+
authorization: "selected_route";
|
|
81
78
|
messageId: string;
|
|
82
79
|
text: string;
|
|
83
80
|
expectsReply: boolean;
|
|
84
81
|
deadlineAt: string;
|
|
85
|
-
progressWatchActive?: true;
|
|
86
82
|
}>): Promise<ClaudeNativeHelperPreparedDispatch>;
|
|
87
83
|
updateInboundStatus(receiptHandle: string, status: "held" | "delivered" | "denied" | "expired", diagnosticCode?: string): Promise<void>;
|
|
88
84
|
notifyInboundProgress(receiptHandle: string, progress: import("./claude-peer.js").ClaudePeerInboundProgress): Promise<void>;
|
|
@@ -3,7 +3,7 @@ import { randomBytes } from "node:crypto";
|
|
|
3
3
|
import { fileURLToPath } from "node:url";
|
|
4
4
|
import { BridgeError } from "../errors.js";
|
|
5
5
|
import { gatewayRegistrationIngressPrefixes, isGatewayProvider } from "./types.js";
|
|
6
|
-
import { assertClaudeNativeHelperIpcSize, CLAUDE_NATIVE_HELPER_MAX_REQUESTS, isClaudeNativeHelperChildMessage, } from "./claude-helper-protocol.js";
|
|
6
|
+
import { assertClaudeNativeHelperIpcSize, CLAUDE_NATIVE_HELPER_MAX_REQUESTS, CLAUDE_NATIVE_HELPER_PROTOCOL_VERSION, isClaudeNativeHelperChildMessage, } from "./claude-helper-protocol.js";
|
|
7
7
|
const TIMEOUT = 5_000, CLOSE_TIMEOUT = 2_000;
|
|
8
8
|
const ALIAS = /^[a-z][a-z0-9_-]{0,31}@[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
|
|
9
9
|
const CONVERSATION = /^conv_[A-Za-z0-9_-]{16,64}$/;
|
|
@@ -51,8 +51,8 @@ export class ClaudeNativeHelperClient {
|
|
|
51
51
|
execArgv: [], serialization: "json", stdio: ["ignore", "ignore", "ignore", "ipc"],
|
|
52
52
|
});
|
|
53
53
|
const client = new ClaudeNativeHelperClient(child, options.registration, options.callbacks);
|
|
54
|
-
const init = { protocolVersion:
|
|
55
|
-
runtime: options.runtime, hostId: options.hostId,
|
|
54
|
+
const init = { protocolVersion: CLAUDE_NATIVE_HELPER_PROTOCOL_VERSION, type: "initialize", requestId: id(),
|
|
55
|
+
runtime: options.runtime, hostId: options.hostId, deliveryNotices: options.deliveryNotices,
|
|
56
56
|
maxPendingMessages: options.maxPendingMessages, registration: options.registration };
|
|
57
57
|
try {
|
|
58
58
|
const result = await client.#send(init);
|
|
@@ -67,7 +67,7 @@ export class ClaudeNativeHelperClient {
|
|
|
67
67
|
}
|
|
68
68
|
}
|
|
69
69
|
request(command, timeoutMs = TIMEOUT) {
|
|
70
|
-
return this.#send({ protocolVersion:
|
|
70
|
+
return this.#send({ protocolVersion: CLAUDE_NATIVE_HELPER_PROTOCOL_VERSION, type: "request", requestId: id(), command }, timeoutMs);
|
|
71
71
|
}
|
|
72
72
|
async close() {
|
|
73
73
|
if (!this.#closed) {
|
|
@@ -177,7 +177,7 @@ export class ClaudeNativeHelperSupervisor {
|
|
|
177
177
|
throw fault("CLAUDE_NATIVE_HELPER_CAPACITY", true);
|
|
178
178
|
let helper, earlyExit = false;
|
|
179
179
|
const buffered = [];
|
|
180
|
-
const client = await this.#factory({ runtime: this.options.runtime, hostId: this.options.identity.hostId,
|
|
180
|
+
const client = await this.#factory({ runtime: this.options.runtime, hostId: this.options.identity.hostId,
|
|
181
181
|
deliveryNotices: this.options.deliveryNotices, maxPendingMessages: this.options.maxPendingMessages, registration: input,
|
|
182
182
|
callbacks: { onEvent: (event) => helper ? this.#event(helper, event) : buffered.push(event),
|
|
183
183
|
onExit: () => helper ? this.#exit(helper) : earlyExit = true } });
|
|
@@ -223,14 +223,15 @@ export class ClaudeNativeHelperSupervisor {
|
|
|
223
223
|
throw fault("CLAUDE_NATIVE_HELPER_UNAVAILABLE", true);
|
|
224
224
|
if (helper.sourceProvider !== input.sourceProvider)
|
|
225
225
|
throw fault("PROVENANCE_ENVELOPE_INVALID");
|
|
226
|
-
|
|
226
|
+
// Every dispatch is a routed dispatch, so the target-workspace assertion
|
|
227
|
+
// always runs: no `stateRoot`, no preparation.
|
|
228
|
+
if (!input.stateRoot)
|
|
227
229
|
throw fault("CLAUDE_ROUTE_UNAVAILABLE", true);
|
|
228
230
|
const result = await helper.client.request({ method: "prepare_dispatch", binding: input.binding,
|
|
229
|
-
authorization: input.authorization,
|
|
231
|
+
authorization: input.authorization, stateRoot: input.stateRoot,
|
|
230
232
|
messageId: input.messageId, sourceAlias: helper.alias, sourceProvider: helper.sourceProvider,
|
|
231
233
|
targetAlias: input.targetAlias, conversationId: input.conversationId, text: input.text,
|
|
232
|
-
expectsReply: input.expectsReply, deadlineAt: input.deadlineAt,
|
|
233
|
-
...(input.progressWatchActive ? { progressWatchActive: true } : {}) }, this.#deadline(input.deadlineAt));
|
|
234
|
+
expectsReply: input.expectsReply, deadlineAt: input.deadlineAt }, this.#deadline(input.deadlineAt));
|
|
234
235
|
if (!("preparationId" in result))
|
|
235
236
|
throw fault("CLAUDE_NATIVE_HELPER_INVALID_RESPONSE");
|
|
236
237
|
let state = "prepared";
|