agent-relay-server 0.60.0 → 0.61.0

package/src/security.ts

@@ -5,6 +5,7 @@ import { dirname, join, resolve } from "node:path";
 import { getDb } from "./db";
 import { isPathWithinBase } from "./utils";
 import type { ComponentToken, TokenConstraints } from "./types";
+import { hasScope, normalizeScope } from "agent-relay-sdk/types";
 
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1", "localhost"]);
 
@@ -99,30 +100,7 @@ type AuthorizationCheck = {
   resource?: AuthorizationResource;
 };
 
-const SCOPE_ALIASES: Record<string, string> = {
-  "admin:*": "system:admin",
-  "system:write": "system:admin",
-  "agents:read": "agent:read",
-  "agents:write": "agent:write",
-  "messages:read": "message:read",
-  "messages:write": "message:send",
-  "tasks:read": "task:read",
-  "tasks:write": "task:write",
-  "commands:read": "command:read",
-  "commands:write": "command:write",
-  "channels:read": "channel:read",
-  "channels:write": "channel:write",
-  "integrations:read": "integration:read",
-  "integrations:write": "integration:write",
-  "connectors:read": "integration:read",
-  "connectors:write": "integration:write",
-  "events:create": "integration:write",
-  "tasks:create": "task:write",
-};
-
-export function normalizeScope(scope: string): string {
-  return SCOPE_ALIASES[scope] ?? scope;
-}
+export { normalizeScope };
 
 export function getIntegrationAuth(req: Request): IntegrationAuth | null {
   const token = extractToken(req);
@@ -170,6 +148,8 @@ export function requiredScopeFor(method: string, pathname: string): string | nul
   if (pathname === "/api/orchestrators/bootstrap") return "token:write";
   if (pathname.match(/^\/api\/orchestrators\/[^/]+\/logs\//)) return "logs:read";
   if (pathname.match(/^\/api\/orchestrators\/[^/]+\/terminal\//)) return "terminal:attach";
+  const settingScope = requiredSettingsScopeFor(method, pathname);
+  if (settingScope !== undefined) return settingScope;
   if (pathname.startsWith("/api/artifacts")) {
     if (method === "GET" || method === "HEAD") return "artifact:read";
     if (method === "DELETE") return "artifact:admin";
@@ -195,11 +175,13 @@ export function requiredScopeFor(method: string, pathname: string): string | nul
   if (pathname.startsWith("/api/inbox")) return method === "GET" ? "message:read" : "message:send";
   if (pathname.startsWith("/api/messages")) return method === "GET" ? "message:read" : "message:send";
   if (pathname.startsWith("/api/commands")) return method === "GET" ? "command:read" : "command:write";
+  if (pathname.startsWith("/api/merges")) return method === "GET" ? "command:read" : "command:write";
   if (pathname.startsWith("/api/workspaces")) return method === "GET" ? "agent:read" : "agent:write";
   if (pathname.startsWith("/api/agent-profiles")) return method === "GET" ? "agent:read" : "agent:write";
   if (pathname.startsWith("/api/recipes")) return method === "GET" ? "recipes:read" : "recipes:write";
   if (pathname === "/api/runtime-tokens/renew") return "agent:write";
   if (pathname.startsWith("/api/runtime-tokens")) return "token:write";
+  if (pathname === "/api/tokens/me") return null;
   if (pathname.startsWith("/api/tokens") || pathname.startsWith("/api/token-profiles")) return method === "GET" ? "token:read" : "token:write";
   if (pathname.startsWith("/api/maintenance")) return "system:admin";
   if (pathname.startsWith("/api/tasks")) return method === "GET" ? "task:read" : "task:write";
@@ -250,11 +232,15 @@ export function requiredComponentScopeFor(method: string, pathname: string): str
   if (pathname === "/api/mcp") return "mcp:use";
   if (pathname.match(/^\/api\/orchestrators\/[^/]+\/logs\//)) return "logs:read";
   if (pathname.match(/^\/api\/orchestrators\/[^/]+\/terminal\//)) return "terminal:attach";
+  const settingScope = requiredSettingsScopeFor(method, pathname);
+  if (settingScope !== undefined) return settingScope ?? "system:admin";
   if (pathname.startsWith("/api/commands")) {
     if (method === "GET") return "command:read";
     return "command:write";
   }
+  if (pathname.startsWith("/api/merges")) return method === "GET" ? "command:read" : "command:write";
   if (pathname.startsWith("/api/workspaces")) return method === "GET" ? "agent:read" : "agent:write";
+  if (pathname === "/api/tokens/me") return null;
   if (pathname.startsWith("/api/tokens") || pathname.startsWith("/api/token-profiles")) return method === "GET" ? "token:read" : "token:write";
   if (pathname.startsWith("/api/maintenance")) return "system:admin";
   if (pathname === "/api/recipes/start") return "recipe:start";
@@ -296,6 +282,32 @@ export function requiredComponentScopeFor(method: string, pathname: string): str
   return "system:admin";
 }
 
+const CONFIG_SETTINGS_NAMESPACES = new Set(["steward", "insights", "notifications", "workspace", "landing", "provider"]);
+
+function requiredSettingsScopeFor(method: string, pathname: string): string | null | undefined {
+  if (pathname === "/api/settings") return method === "GET" ? "settings:read" : null;
+  const settingsMatch = pathname.match(/^\/api\/settings\/([^/]+)(?:\/[^/]+)?$/);
+  if (settingsMatch) return settingsScope(method, decodeURIComponent(settingsMatch[1]!));
+  if (pathname === "/api/steward-config") return settingsScope(method, "steward");
+  if (pathname === "/api/workspace-config") return settingsScope(method, "workspace");
+  if (pathname === "/api/insights/config") return settingsScope(method, "insights");
+  const configMatch = pathname.match(/^\/api\/config\/([^/]+)(?:\/[^/]+)?(?:\/history)?$/);
+  if (configMatch) {
+    const namespace = decodeURIComponent(configMatch[1]!);
+    if (CONFIG_SETTINGS_NAMESPACES.has(namespace)) return settingsScope(method, namespace);
+  }
+  if (pathname.match(/^\/api\/providers\/[^/]+\/models\/[^/]+$/) && ["PUT", "PATCH", "DELETE"].includes(method)) {
+    return "settings:write:provider";
+  }
+  return undefined;
+}
+
+function settingsScope(method: string, namespace: string): string | null {
+  if (method === "GET" || method === "HEAD") return `settings:read:${namespace}`;
+  if (["PUT", "PATCH", "POST", "DELETE"].includes(method)) return `settings:write:${namespace}`;
+  return null;
+}
+
 export function signComponentToken(payload: Omit<ComponentToken, "iat"> & { iat?: number }): string {
   const header = { alg: "HS256", typ: "JWT" };
   const body: ComponentToken = {
@@ -402,19 +414,6 @@ function isComponentToken(value: unknown): value is ComponentToken {
     (record.jti === undefined || typeof record.jti === "string");
 }
 
-function hasScope(scopes: string[], requiredScope: string): boolean {
-  const required = normalizeScope(requiredScope);
-  if (scopes.includes("*")) return true;
-  for (const rawScope of scopes) {
-    const scope = normalizeScope(rawScope);
-    if (scope === "system:admin") return true;
-    if (scope === required) return true;
-    const [category] = required.split(":");
-    if (category && scope === `${category}:*`) return true;
-  }
-  return false;
-}
-
 /** Authoritative parent lineage from a registering token's signed constraints — agent-initiated
  * spawn (`spawnedBy`) or the delegating-component path (`parentAgents`). One home, used by both the
  * HTTP `postAgent` route and the bus register path so `spawned_by` is set however a child registers

package/src/services/merge-pause.ts

@@ -0,0 +1,37 @@
+import {
+  acquireMergePause as acquireMergePauseRow,
+  getMergePause,
+  listMergePauses,
+  releaseMergePause as releaseMergePauseRow,
+  renewMergePause as renewMergePauseRow,
+  type MergePauseRecord,
+} from "../db";
+
+export type { MergePauseRecord };
+
+export function listAutoMergePauses(): MergePauseRecord[] {
+  return listMergePauses();
+}
+
+export function getAutoMergePause(id: string): MergePauseRecord | null {
+  return getMergePause(id);
+}
+
+export function pauseAutoMerge(input: {
+  repoRoot: string;
+  baseRef?: string;
+  holder: string;
+  reason?: string;
+  ttlMs?: number;
+  now?: number;
+}): { ok: true; pause: MergePauseRecord } | { ok: false; pause: MergePauseRecord } {
+  return acquireMergePauseRow(input);
+}
+
+export function renewAutoMergePause(id: string, ttlMs?: number): MergePauseRecord | null {
+  return renewMergePauseRow(id, ttlMs);
+}
+
+export function resumeAutoMerge(input: { id?: string; repoRoot?: string; baseRef?: string }): boolean {
+  return releaseMergePauseRow(input);
+}

package/src/services/spawn-agent.ts

@@ -208,19 +208,21 @@ export async function spawnAgent(input: SpawnAgentInput, ctx: AuthContext): Prom
   // resolves it. Absent (graceful) when the cwd is inside no registered root.
   const callerProject = resolveProjectForCwd(resolvedCwd);
 
-  // #409 — instruction projection (default OFF). Only when the caller opts in AND the
-  // spawn cwd resolves to a project do we compose a knowledge preamble and PREPEND it to
-  // systemPromptAppend. Absent flag / no project / empty block ⇒ systemPromptAppend is
-  // left exactly as the caller passed it, so the spawn command stays byte-identical.
-  let systemPromptAppend = input.systemPromptAppend;
+  // #409 + #463 — one composition home for the prompt material handed to providers.
+  // Precedence is: project preamble, profile system, profile append entries, then
+  // transient caller/fork context. Spawns without profile/project material stay
+  // byte-identical to the caller-provided systemPromptAppend.
+  const appendBlocks: string[] = [];
   if (input.projectInstructions && callerProject) {
     const block = composeProjectInstructions(callerProject, {
       ...(input.projectInstructions.policy ? { policy: input.projectInstructions.policy } : {}),
     });
-    if (block) {
-      systemPromptAppend = systemPromptAppend ? `${block}\n\n${systemPromptAppend}` : block;
-    }
+    if (block.trim()) appendBlocks.push(block);
   }
+  if (agentProfile?.instructions.system?.trim()) appendBlocks.push(agentProfile.instructions.system);
+  appendBlocks.push(...(agentProfile?.instructions.append.filter((entry) => entry.trim()) ?? []));
+  if (input.systemPromptAppend?.trim()) appendBlocks.push(input.systemPromptAppend);
+  const systemPromptAppend = appendBlocks.length ? appendBlocks.join("\n\n") : input.systemPromptAppend;
 
   // Child runner token. `agentInitiated` (set whenever an agent is the caller) forces a
   // non-spawn-capable child (no grandchildren); `spawnedBy` stamps authoritative lineage the

package/src/settings/modules.ts

@@ -0,0 +1,149 @@
+import {
+  SPAWN_PROVIDERS,
+  errMessage,
+  isRecord,
+  type ConnectorManifest,
+  type JSONSchema,
+  type SettingDescriptor,
+  type SettingDisplay,
+  type SettingScope,
+  type SettingTier,
+} from "agent-relay-sdk";
+import { ValidationError } from "../db";
+import { cleanString } from "../validation";
+import type { ProviderConfig } from "../../runner/src/adapter";
+import { defaultProviderConfig } from "../../runner/src/config";
+import { SETTING_ADMIN_SCOPE, getSettingDescriptor, registerProviderConfigSetting, registerSetting, validateSettingValue } from "./registry";
+
+export const CONNECTOR_CONFIG_NAMESPACE = "connector-config";
+export const CHANNEL_TYPE_CONFIG_NAMESPACE = "channel-type";
+
+export function registerConnectorConfigSetting(
+  manifest: Pick<ConnectorManifest, "id" | "displayName" | "description" | "configSchema">,
+  opts: { defaults?: unknown } = {},
+): SettingDescriptor | undefined {
+  if (!manifest.configSchema) return undefined;
+  const schema = schemaFromRecord(manifest.configSchema, `connector ${manifest.id} configSchema`);
+  return registerModuleSetting({
+    namespace: CONNECTOR_CONFIG_NAMESPACE,
+    key: manifest.id,
+    schema,
+    defaults: opts.defaults ?? schemaDefault(schema) ?? {},
+    scope: { read: "integration:read", write: SETTING_ADMIN_SCOPE },
+    tier: "server-runtime",
+    display: {
+      group: "Connectors",
+      label: manifest.displayName || manifest.id,
+      description: manifest.description ?? `Configuration for connector ${manifest.id}.`,
+      order: 100,
+    },
+  });
+}
+
+export function validateConnectorConfig(manifest: ConnectorManifest, config: unknown): void {
+  const descriptor = getSettingDescriptor(CONNECTOR_CONFIG_NAMESPACE, manifest.id) ?? registerConnectorConfigSetting(manifest);
+  if (!descriptor) return;
+  const validation = validateSettingValue(descriptor.namespace, descriptor.key, config);
+  if (!validation.valid) throw new ValidationError(validation.errors.join("; "));
+}
+
+export function registerChannelTypeSetting(input: {
+  type: string;
+  schema: JSONSchema;
+  defaults: unknown;
+  scope?: Partial<SettingScope>;
+  tier?: SettingTier;
+  display?: Partial<SettingDisplay>;
+}): SettingDescriptor {
+  const type = cleanString(input.type, "channel type", { required: true, max: 80 })!;
+  return registerModuleSetting({
+    namespace: CHANNEL_TYPE_CONFIG_NAMESPACE,
+    key: type,
+    schema: input.schema,
+    defaults: input.defaults,
+    scope: { read: "integration:read", write: SETTING_ADMIN_SCOPE, ...input.scope },
+    tier: input.tier ?? "server-runtime",
+    display: {
+      group: "Channels",
+      label: `${type} channel`,
+      description: `Configuration for ${type} channel integrations.`,
+      order: 120,
+      ...input.display,
+    },
+  });
+}
+
+export interface ProviderSettingsDeclaration {
+  provider: string;
+  defaults: ProviderConfig;
+  display?: Partial<SettingDisplay>;
+}
+
+const providerSettingsDeclarations = new Map<string, ProviderSettingsDeclaration>();
+let builtInProvidersSeeded = false;
+
+export function registerProviderSettingsDeclaration(input: {
+  provider: string;
+  defaults?: ProviderConfig;
+  display?: Partial<SettingDisplay>;
+}): ProviderSettingsDeclaration {
+  const provider = cleanString(input.provider, "provider", { required: true, max: 80 })!;
+  const declaration: ProviderSettingsDeclaration = {
+    provider,
+    defaults: input.defaults ?? defaultProviderConfig(provider),
+    display: input.display,
+  };
+  providerSettingsDeclarations.set(provider, declaration);
+  return declaration;
+}
+
+export function listProviderSettingsDeclarations(): ProviderSettingsDeclaration[] {
+  ensureBuiltInProviderSettingsDeclarations();
+  return [...providerSettingsDeclarations.values()];
+}
+
+export function getProviderSettingsDeclaration(provider: string): ProviderSettingsDeclaration | undefined {
+  ensureBuiltInProviderSettingsDeclarations();
+  return providerSettingsDeclarations.get(provider);
+}
+
+export function providerConfigDefaults(provider: string): ProviderConfig {
+  return getProviderSettingsDeclaration(provider)?.defaults ?? defaultProviderConfig(provider);
+}
+
+export function registerDeclaredProviderConfigSetting(input: { host: string; provider: string }): SettingDescriptor {
+  const declaration = getProviderSettingsDeclaration(input.provider);
+  if (!declaration) throw new ValidationError(`provider must be one of: ${listProviderSettingsDeclarations().map((d) => d.provider).join(", ")}`);
+  return registerProviderConfigSetting({
+    host: input.host,
+    provider: declaration.provider,
+    defaults: declaration.defaults,
+    display: declaration.display,
+  });
+}
+
+function ensureBuiltInProviderSettingsDeclarations(): void {
+  if (builtInProvidersSeeded) return;
+  builtInProvidersSeeded = true;
+  for (const provider of SPAWN_PROVIDERS) {
+    registerProviderSettingsDeclaration({ provider, defaults: defaultProviderConfig(provider) });
+  }
+}
+
+function registerModuleSetting(input: Parameters<typeof registerSetting>[0]): SettingDescriptor {
+  try {
+    return registerSetting(input);
+  } catch (error) {
+    if (error instanceof ValidationError) throw error;
+    throw new ValidationError(errMessage(error));
+  }
+}
+
+function schemaFromRecord(value: Record<string, unknown>, field: string): JSONSchema {
+  if (!isRecord(value)) throw new ValidationError(`${field} must be an object`);
+  return value as JSONSchema;
+}
+
+function schemaDefault(schema: JSONSchema): unknown {
+  return Object.prototype.hasOwnProperty.call(schema, "default") ? schema.default : undefined;
+}