agent-relay-server 0.34.0 → 0.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-server",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Lightweight HTTP message relay for inter-agent communication across machines",
   "module": "src/index.ts",
   "type": "module",

package/src/mcp.ts

@@ -46,11 +46,11 @@ import {
   isComponentAuthorizedFor,
   isIntegrationAllowed,
 } from "./security";
-import type { ActivityKind, AgentCard, ArtifactKind, ArtifactSensitivity, AttachmentRef, Command, SendMessageInput, Message, SpawnApprovalMode, SpawnProvider, WorkspaceMergeStrategy, WorkspaceRecord } from "./types";
+import type { ActivityKind, AgentCard, ArtifactKind, ArtifactSensitivity, AttachmentRef, Command, SendMessageInput, Message, SpawnApprovalMode, SpawnProvider, WorkspaceMergeStrategy, WorkspaceMode, WorkspaceRecord } from "./types";
 import { LAND_STRATEGIES, applyWorkspaceAction, waitForWorkspaceStatus, type WorkspaceAction } from "./workspace-actions";
 import { describeWorkspacePhase, landReceipt, readyContract, worktreeMcpInstructions } from "./workspace-phase";
 import { type ProviderEffort } from "agent-relay-sdk/provider-catalog";
-import { errMessage, isRecord, SPAWN_PROVIDERS, APPROVAL_MODES, VALID_EFFORTS } from "agent-relay-sdk";
+import { errMessage, isRecord, SPAWN_PROVIDERS, APPROVAL_MODES, VALID_EFFORTS, VALID_WORKSPACE_MODES } from "agent-relay-sdk";
 import { runnerRuntimeTokenEnv } from "./runtime-tokens";
 
 type JsonRpcId = string | number | null;
@@ -270,6 +270,7 @@ const TOOLS: ToolDefinition[] = [
         providerArgs: { type: "array", items: { type: "string" } },
         policyName: { type: "string" },
         spawnRequestId: { type: "string" },
+        workspaceMode: { type: "string", enum: VALID_WORKSPACE_MODES, description: "Git workspace for the worker. `isolated` = its own worktree on an `agent/session-*` branch off main that auto-lands when ready (delegate a unit of work, get a branch worker). `shared` = edits your live checkout (a sidecar). `inherit` = let the orchestrator decide. DEFAULT for agent-initiated spawns is `isolated` so a delegated worker lands to main instead of editing your tree; pass `shared`/`inherit` to override." },
         waitForRegistrationMs: { type: "integer", minimum: 0, maximum: 30000, description: "How long to wait for the spawned agent to register before returning, so the response carries its resolved agent id (default 8000; 0 = return immediately with just spawnRequestId)." },
       },
       required: ["provider"],
@@ -804,6 +805,11 @@ async function relaySpawnAgent(auth: McpAuthContext, args: Record<string, unknow
   const label = optionalString(args.label, "label", 120);
   const policyName = optionalString(args.policyName, "policyName", 120);
   const profile = optionalString(args.profile, "profile", 120);
+  // #324 — expose the workspace knob on the MCP spawn surface (payload home always supported it; the
+  // handler just never passed it → orchestrator fell back to `inherit`→`shared`, so a worker edited the
+  // CALLER's live tree). Agent-initiated spawns (real caller behind the token) default to `isolated` (a
+  // branch worker that auto-lands); non-agent callers (admin/server) keep `inherit`. Explicit wins.
+  const workspaceMode = (optionalEnum(args.workspaceMode, "workspaceMode", VALID_WORKSPACE_MODES) as WorkspaceMode | undefined) ?? (callerId ? "isolated" : undefined);
 
   // #221 runtime gate (belt; the coarse `command:spawn` scope is enforced in callTool, and is
   // granted only to agents whose profile sets maxSpawnedAgents>0 and never to children).
@@ -820,10 +826,10 @@ async function relaySpawnAgent(auth: McpAuthContext, args: Record<string, unknow
     }
   }
 
-  assertComponentResourceAllowed(auth, {
-    scope: "agent:write",
-    resource: { orchestratorId: orchestrator.id, cwd: resolvedCwd, policyName, spawnRequestId },
-  });
+  // #323 — gate child spawn only on `orchestrators` (the parent's legit bound), NOT its self-scoping
+  // spawnRequestIds/cwdPrefixes/policies: those describe the child, not parent-owned resources, so
+  // gating on them makes maxSpawnedAgents unreachable for every component token (cwd checked above).
+  assertComponentResourceAllowed(auth, { scope: "agent:write", resource: { orchestratorId: orchestrator.id } });
 
   // Child runner token: a normal long-living agent that is NOT itself spawn-capable
   // (canSpawn:false → no grandchildren), stamped with authoritative lineage so it registers
@@ -848,6 +854,7 @@ async function relaySpawnAgent(auth: McpAuthContext, args: Record<string, unknow
       provider,
       modelParams: selection,
       cwd: resolvedCwd,
+      ...(workspaceMode ? { workspaceMode } : {}),
       label,
       profile: profile || undefined,
       tags: optionalStringArray(args.tags, "tags") ?? [],