agent-relay 12.2.4 → 12.2.6

package/dist/cli/lib/product-surface-store.js

@@ -0,0 +1,404 @@
+/**
+ * On-demand package tree for the mounted product SDKs.
+ *
+ * The npm distribution needs none of this: `@relayfile/sdk`, `@relayflows/sdk`
+ * and `ai-hist` are ordinary dependencies of `agent-relay`, so
+ * `import('@relayfile/sdk/relay-cli')` resolves and nothing here ever runs.
+ *
+ * The compiled standalone binary is the problem (#1795). It is one file with no
+ * node_modules, so every mounted group failed with MODULE_NOT_FOUND — reported
+ * as "not installed", in a distribution where installing cannot help. Bundling
+ * the SDKs does not fix it, and was tried:
+ *
+ *   - `@relayfile/sdk/relay-cli` locates and spawns a Go binary; exec needs a
+ *     real path on disk, not a bundled module
+ *   - `ai-hist` dlopens a native addon through a *variable* specifier, which no
+ *     bundler can see
+ *   - all three read data files relative to `import.meta.url`, which relocates
+ *     into Bun's `/$bunfs/root` once compiled
+ *
+ * So instead of pulling the packages into the binary, the binary puts them back
+ * on disk: a real `npm install` of the version pinned in
+ * `packages/cli/package.json`, under `~/.agentworkforce/relay/surfaces`, and the
+ * surface is imported from there. Real files satisfy dlopen, exec,
+ * `import.meta.url` and variable specifiers at once.
+ */
+import { execFile, spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { redactCredentialValues } from '@agent-relay/cloud/redact';
+import { describeError } from './describe-error.js';
+import { isBundledBunEntrypointPath } from './agent-relay-mcp-command.js';
+import { isBunRuntime } from './node-definition-loader.js';
+const execFileAsync = promisify(execFile);
+/** How long a single provisioning install may take before it is abandoned. */
+export const INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
+/** Largest npm output we will buffer while waiting for the install. */
+const INSTALL_MAX_BUFFER = 16 * 1024 * 1024;
+/**
+ * Name of the generated module that performs the import.
+ *
+ * It has to live *inside* the provisioned directory. A bare specifier resolves
+ * against the `node_modules` directories above the importing module, so an
+ * `import()` written in the CLI's own source could never see this tree no
+ * matter where it is; one written next to it sees nothing else.
+ */
+const RUNNER_FILENAME = 'run-surface.mjs';
+const RUNNER_SOURCE = `// Generated by agent-relay. Do not edit.
+//
+// Entry point for a child process that runs one mounted product surface out
+// of the node_modules beside this file.
+//
+// Why a child process rather than importing into the CLI: inside the compiled
+// standalone binary, Bun cannot resolve bare specifiers from a tree it loaded
+// by absolute path. Resolving the surface entry point by hand gets as far as
+// the entry point; its own imports then fail the same way, and there is no
+// bottom to that. NODE_PATH does not change it. Running under the node that
+// performed the install sidesteps module resolution entirely, and costs one
+// process per invocation.
+//
+// Two modes, because the host renders help from the declared command tree and
+// must not forward it — help has to say agent-relay, not the product's name:
+//
+//   describe [--options-for=surface] specifier
+//   run [--options-for=surface] specifier [argv...]
+import process from 'node:process';
+
+const rawArgs = process.argv.slice(2);
+let optionsFor = undefined;
+let argIndex = 0;
+
+// Parse --options-for flag
+if (rawArgs[0]?.startsWith('--options-for=')) {
+  optionsFor = rawArgs[0].slice('--options-for='.length);
+  argIndex = 1;
+}
+
+const [mode, specifier, ...argv] = rawArgs.slice(argIndex);
+
+const module = await import(specifier);
+if (typeof module.createRelayCliSurface !== 'function') {
+  process.stderr.write(specifier + ' does not export createRelayCliSurface()\\n');
+  process.exit(1);
+}
+
+// Resolve options from environment if the parent provided them.
+// The parent passes cloud client configuration through environment variables so the
+// child can create the client without importing from the parent's module tree.
+let options = undefined;
+if (optionsFor === 'sessions') {
+  const baseUrl = process.env['RELAY_RELAYHISTORY_BASE_URL'];
+  const token = process.env['RELAY_RELAYHISTORY_TOKEN'];
+  if (baseUrl && token) {
+    try {
+      const cloudClientModule = await import('@relayhistory/cloud-client');
+      options = {
+        cloud: cloudClientModule.createRelayhistoryCloudClient({ baseUrl, token })
+      };
+    } catch {
+      // Cloud client is optional; local session commands still work without it
+    }
+  }
+}
+
+const surface = await module.createRelayCliSurface(options);
+
+if (mode === 'describe') {
+  // Write JSON description and let streams flush before exiting.
+  // process.exit does not wait for pipe buffers, so output can be truncated.
+  const json = JSON.stringify({
+    id: surface.id,
+    version: surface.version,
+    contract: surface.contract,
+    commands: surface.commands,
+  });
+  process.stdout.write(json, () => process.exit(0));
+} else {
+  // stdout and stderr are written straight through: the host pipes them into
+  // its own io sink, and chunks stay bytes so a binary payload survives.
+  const code = await surface.run(argv, {
+    stdout: (chunk) => process.stdout.write(chunk),
+    stderr: (chunk) => process.stderr.write(chunk),
+  });
+  // Exit only after all writes have been flushed.
+  process.stdout.write('', () => process.exit(typeof code === 'number' ? code : 0));
+}
+`;
+/** Error code carried by every failure this module reports to the mount. */
+export const PROVISION_ERROR_CODE = 'ERR_RELAY_SURFACE_PROVISION';
+/**
+ * A provisioning failure with an operator-facing message.
+ *
+ * Tagged with a code so `describeLoadFailure` can print {@link Error.message}
+ * verbatim. The message already names the package, the directory and the fix;
+ * wrapping it in "Could not load … :" or letting a stack through would bury
+ * that.
+ */
+export class SurfaceProvisionError extends Error {
+    code = PROVISION_ERROR_CODE;
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'SurfaceProvisionError';
+    }
+}
+/** `~/.agentworkforce/relay/surfaces`, or the configured data directory. */
+export function defaultSurfaceStoreRoot() {
+    const dataDir = process.env['AGENT_RELAY_DATA_DIR'] || path.join(os.homedir(), '.agentworkforce/relay');
+    return path.join(dataDir, 'surfaces');
+}
+/**
+ * Whether this process is the compiled standalone binary.
+ *
+ * Both halves matter. `isBunRuntime` alone is true for anyone running the CLI
+ * under `bun`, where node_modules exists and provisioning would be pure waste;
+ * the `/$bunfs/root` entrypoint is what distinguishes `bun build --compile`
+ * output, which has no node_modules at all.
+ */
+export function isCompiledStandalone(argv = process.argv) {
+    return isBunRuntime() && isBundledBunEntrypointPath(argv[1] ?? '');
+}
+/**
+ * Where `pkg` is provisioned under `root`.
+ *
+ * Keyed by name *and* range, so upgrading the pin provisions a fresh tree
+ * rather than reusing a stale one. The readable prefix is for whoever opens the
+ * directory; the digest is what actually separates `^0.10.64` from `~0.10.64`,
+ * which sanitizing alone collapses onto the same name.
+ */
+export function surfaceInstallPath(root, pkg) {
+    const digest = createHash('sha256').update(`${pkg.name}@${pkg.range}`).digest('hex').slice(0, 8);
+    // `-` is deliberately not in the kept set: leaving it in makes `sdk-^0.10.64`
+    // read as `sdk--0.10.64`, since the separator and the range operator are adjacent.
+    const readable = `${pkg.name}-${pkg.range}`.replace(/[^A-Za-z0-9.]+/g, '-').replace(/^-+|-+$/g, '');
+    return path.join(root, `${readable}-${digest}`);
+}
+/**
+ * Provisioning runs already in flight, keyed by their destination.
+ *
+ * Two groups invoked in one process, or one group whose loader is retried,
+ * must not start two npm installs of the same package. Cross-process races are
+ * handled separately, by the atomic rename in {@link provisionOnce}.
+ */
+const inFlight = new Map();
+function defaults(overrides) {
+    return {
+        root: overrides.root ?? defaultSurfaceStoreRoot(),
+        install: overrides.install ?? npmInstall,
+        notify: overrides.notify ?? ((line) => process.stderr.write(`${line}\n`)),
+    };
+}
+/**
+ * Ensure `pkg` is installed in the store and return the directory holding it.
+ *
+ * @param pkg - Package name and the range pinned by the CLI manifest.
+ * @param overrides - Test seams for the store root, installer, and notices.
+ * @returns Absolute path to a directory with `node_modules` and the loader.
+ * @throws {SurfaceProvisionError} When the install cannot be completed, with a
+ *   message naming the fix rather than a stack.
+ */
+export async function provisionSurfacePackage(pkg, overrides = {}) {
+    const deps = defaults(overrides);
+    const target = surfaceInstallPath(deps.root, pkg);
+    if (fs.existsSync(path.join(target, RUNNER_FILENAME)))
+        return target;
+    const existing = inFlight.get(target);
+    if (existing)
+        return existing;
+    const run = provisionOnce(pkg, target, deps).finally(() => {
+        inFlight.delete(target);
+    });
+    inFlight.set(target, run);
+    return run;
+}
+/**
+ * Install into a private staging directory, then publish it with one rename.
+ *
+ * The rename is what makes a concurrent second process safe: the destination
+ * either does not exist or is a finished tree, never a half-written one, so a
+ * reader can never import from an install that is still running. The loser of
+ * the race discards its own work and adopts the winner's — both trees hold the
+ * same pinned version, so there is nothing to reconcile.
+ */
+async function provisionOnce(pkg, target, deps) {
+    const spec = `${pkg.name}@${pkg.range}`;
+    fs.mkdirSync(deps.root, { recursive: true });
+    // Unique per attempt, so two processes never write into the same staging
+    // tree and npm never sees another install's partial node_modules.
+    const staging = `${target}.staging-${process.pid}-${randomBytes(4).toString('hex')}`;
+    fs.mkdirSync(staging, { recursive: true });
+    try {
+        // npm walks up from its cwd looking for a manifest; without this it would
+        // find the user's project (or this repo) and install into that instead.
+        fs.writeFileSync(path.join(staging, 'package.json'), `${JSON.stringify({
+            name: 'agent-relay-surface',
+            version: '0.0.0',
+            private: true,
+            dependencies: { [pkg.name]: pkg.range },
+        }, null, 2)}\n`);
+        fs.writeFileSync(path.join(staging, RUNNER_FILENAME), RUNNER_SOURCE);
+        // A silent multi-second npm install is indistinguishable from a hang, and
+        // this one is minutes on a cold cache.
+        deps.notify(`agent-relay: ${spec} is not bundled into the standalone binary; installing it now.\n` +
+            `  -> ${target}\n` +
+            `  This runs once per version. Later runs reuse it.`);
+        const started = Date.now();
+        try {
+            await deps.install(pkg, staging);
+        }
+        catch (error) {
+            throw new SurfaceProvisionError(`${spec} could not be installed into ${deps.root}.\n` +
+                `${describeError(error)}\n` +
+                `The standalone agent-relay binary installs the product SDKs on first use, ` +
+                `so this needs \`npm\` on PATH and network access to the npm registry.\n` +
+                `Retry when online, or install agent-relay from npm (\`npm i -g agent-relay\`), ` +
+                `which ships ${pkg.name} directly.`, { cause: error });
+        }
+        try {
+            fs.renameSync(staging, target);
+        }
+        catch (error) {
+            // Another process published the same version between our existence check
+            // and this rename. Its tree is the same install, so use it.
+            if (!fs.existsSync(path.join(target, RUNNER_FILENAME)))
+                throw error;
+        }
+        deps.notify(`agent-relay: ${spec} ready (${Math.round((Date.now() - started) / 1000)}s).`);
+        return target;
+    }
+    finally {
+        // A no-op after a successful rename; on any failure it is what keeps a
+        // dead staging tree from accumulating in the store.
+        fs.rmSync(staging, { recursive: true, force: true });
+    }
+}
+/**
+ * Run the surface runner in a child process and collect its result.
+ *
+ * `node` is the interpreter because `node` is what performed the install: a
+ * provisioned tree exists only if npm ran, and npm implies node. The compiled
+ * binary cannot run these itself — see RUNNER_SOURCE.
+ */
+function runnerProcess(installRoot, args, io, optionsFor, relayhistoryConfig) {
+    const runner = path.join(installRoot, RUNNER_FILENAME);
+    const runnerArgs = optionsFor ? [`--options-for=${optionsFor}`, ...args] : args;
+    // Pass cloud client config through environment if configured.
+    const env = { ...process.env };
+    if (relayhistoryConfig) {
+        env['RELAY_RELAYHISTORY_BASE_URL'] = relayhistoryConfig.baseUrl;
+        env['RELAY_RELAYHISTORY_TOKEN'] = relayhistoryConfig.token;
+    }
+    return new Promise((resolve, reject) => {
+        const child = spawn(process.execPath.endsWith('node') ? process.execPath : 'node', [runner, ...runnerArgs], {
+            // Do not change cwd: product commands may read relative paths (e.g., mount roots,
+            // output files), and those should be relative to where the user invoked the CLI.
+            cwd: process.cwd(),
+            // stdin inherited so an interactive product prompt still works.
+            stdio: ['inherit', 'pipe', 'pipe'],
+            env,
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (chunk) => {
+            if (io)
+                io.stdout(chunk);
+            else
+                stdout += chunk.toString('utf8');
+        });
+        child.stderr?.on('data', (chunk) => {
+            const text = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+            stderr += text;
+            if (io) {
+                // Redact credentials in stderr before passing to io, since the child's
+                // stderr may contain argv that the npm path masks.
+                io.stderr(redactCredentialValues(text));
+            }
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            // Let all pending writes flush before resolving.
+            setImmediate(() => resolve({ code: code ?? 1, stdout, stderr }));
+        });
+    });
+}
+/**
+ * The surface's declared command tree, read out of a provisioned tree.
+ *
+ * Only the declaration crosses the process boundary — `run` cannot, so the
+ * returned surface's `run` delegates to another child process.
+ *
+ * @param installRoot - Directory holding the provisioned package.
+ * @param specifier - Package subpath exporting `createRelayCliSurface`.
+ * @param optionsFor - Optional product name for which to create options (e.g., 'sessions').
+ * @param relayhistoryConfig - Optional Relayhistory cloud client config for sessions.
+ */
+export async function loadSurfaceFromStore(installRoot, specifier, optionsFor, relayhistoryConfig) {
+    const described = await runnerProcess(installRoot, ['describe', specifier], undefined, optionsFor, relayhistoryConfig);
+    if (described.code !== 0) {
+        // If describe failed, show the child's stderr so the operator sees the real error
+        // (missing Go binary, native addon not compiled, factory threw, etc.) instead of
+        // just being told to reinstall. Only suggest reinstall if stderr is empty.
+        const detail = described.stderr.trim();
+        throw new SurfaceProvisionError(detail
+            ? `The provisioned package tree at ${installRoot} could not describe ${specifier}:\n${detail}`
+            : `The provisioned package tree at ${installRoot} could not describe ${specifier}.\n` +
+                'Delete that directory and retry; it will be reinstalled.');
+    }
+    const declaration = JSON.parse(described.stdout);
+    return {
+        ...declaration,
+        run: async (argv, io) => {
+            const result = await runnerProcess(installRoot, ['run', specifier, ...argv], io, optionsFor, relayhistoryConfig);
+            return result.code;
+        },
+    };
+}
+/**
+ * Turn a failed `npm install` into one actionable line.
+ *
+ * npm's own output is dozens of lines ending in a path to a debug log the user
+ * of a standalone binary has no reason to read. What decides their next move is
+ * the first error npm reported — `ENOTFOUND`, `E403`, `ETARGET` — so that is
+ * what gets lifted out.
+ */
+export function describeInstallFailure(command, error) {
+    const code = error?.code;
+    if (code === 'ENOENT') {
+        return `\`${command}\` is not on PATH.`;
+    }
+    if (error?.killed === true) {
+        return `\`${command} install\` timed out after ${Math.round(INSTALL_TIMEOUT_MS / 60_000)} minutes.`;
+    }
+    const lines = String(error?.stderr ?? '')
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line !== '')
+        .slice(0, 3);
+    return lines.length > 0 ? redactCredentialValues(lines.join('\n')) : describeError(error);
+}
+/** The real installer: one `npm install` scoped to the staging directory. */
+async function npmInstall(pkg, directory) {
+    const command = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    try {
+        await execFileAsync(command, [
+            'install',
+            `${pkg.name}@${pkg.range}`,
+            ...(pkg.companions ?? []).map((companion) => `${companion.name}@${companion.range}`),
+            '--no-audit',
+            '--no-fund',
+            '--loglevel=error',
+        ], {
+            cwd: directory,
+            timeout: INSTALL_TIMEOUT_MS,
+            maxBuffer: INSTALL_MAX_BUFFER,
+            // The update notifier writes to stderr and can outlive the install.
+            env: { ...process.env, npm_config_update_notifier: 'false' },
+        });
+    }
+    catch (error) {
+        throw new Error(describeInstallFailure(command, error), { cause: error });
+    }
+}
+//# sourceMappingURL=product-surface-store.js.map

package/dist/cli/lib/product-surface-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"product-surface-store.js","sourceRoot":"","sources":["../../../src/cli/lib/product-surface-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C;;;;;;;GAOG;AAEH,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+ErB,CAAC;AA+BF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,oBAAoB,CAAC;IAErC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACxG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA0B,OAAO,CAAC,IAAI;IACzE,OAAO,YAAY,EAAE,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAmB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjG,8EAA8E;IAC9E,mFAAmF;IACnF,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpD,SAAS,QAAQ,CAAC,SAA4C;IAC5D,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,uBAAuB,EAAE;QACjD,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,UAAU;QACxC,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAmB,EACnB,YAA+C,EAAE;IAEjD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAErE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACxD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAmB,EACnB,MAAc,EACd,IAA8B;IAE9B,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;IACxC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,OAAO,GAAG,GAAG,MAAM,YAAY,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,0EAA0E;QAC1E,wEAAwE;QACxE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,GAAG,IAAI,CAAC,SAAS,CACf;YACE,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE;SACxC,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,aAAa,CAAC,CAAC;QAErE,0EAA0E;QAC1E,uCAAuC;QACvC,IAAI,CAAC,MAAM,CACT,gBAAgB,IAAI,kEAAkE;YACpF,QAAQ,MAAM,IAAI;YAClB,oDAAoD,CACvD,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAC7B,GAAG,IAAI,gCAAgC,IAAI,CAAC,IAAI,KAAK;gBACnD,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI;gBAC3B,4EAA4E;gBAC5E,yEAAyE;gBACzE,iFAAiF;gBACjF,eAAe,GAAG,CAAC,IAAI,YAAY,EACrC,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,4DAA4D;YAC5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,uEAAuE;QACvE,oDAAoD;QACpD,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,WAAmB,EACnB,IAAuB,EACvB,EAAe,EACf,UAAmB,EACnB,kBAAuD;IAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhF,8DAA8D;IAC9D,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,kBAAkB,EAAE,CAAC;QACvB,GAAG,CAAC,6BAA6B,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAChE,GAAG,CAAC,0BAA0B,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAC7D,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,EACvB;YACE,kFAAkF;YAClF,iFAAiF;YACjF,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,gEAAgE;YAChE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;YAClC,GAAG;SACJ,CACF,CAAC;QACF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,EAAE;gBAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,EAAE,EAAE,CAAC;gBACP,uEAAuE;gBACvE,mDAAmD;gBACnD,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,iDAAiD;YACjD,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,SAAiB,EACjB,UAAmB,EACnB,kBAAuD;IAEvD,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,WAAW,EACX,CAAC,UAAU,EAAE,SAAS,CAAC,EACvB,SAAS,EACT,UAAU,EACV,kBAAkB,CACnB,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,kFAAkF;QAClF,iFAAiF;QACjF,2EAA2E;QAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,qBAAqB,CAC7B,MAAM;YACJ,CAAC,CAAC,mCAAmC,WAAW,uBAAuB,SAAS,MAAM,MAAM,EAAE;YAC9F,CAAC,CAAC,mCAAmC,WAAW,uBAAuB,SAAS,KAAK;gBACjF,0DAA0D,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAiC,CAAC;IACjF,OAAO;QACL,GAAG,WAAW;QACd,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,WAAW,EACX,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,EAC3B,EAAE,EACF,UAAU,EACV,kBAAkB,CACnB,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAc;IACpE,MAAM,IAAI,GAAI,KAAwC,EAAE,IAAI,CAAC;IAC7D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,KAAK,OAAO,oBAAoB,CAAC;IAC1C,CAAC;IACD,IAAK,KAA0C,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,KAAK,OAAO,8BAA8B,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAE,KAA0C,EAAE,MAAM,IAAI,EAAE,CAAC;SAC5E,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,SAAiB;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,aAAa,CACjB,OAAO,EACP;YACE,SAAS;YACT,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE;YAC1B,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACpF,YAAY;YACZ,WAAW;YACX,kBAAkB;SACnB,EACD;YACE,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,kBAAkB;YAC7B,oEAAoE;YACpE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,OAAO,EAAE;SAC7D,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/dist/index.cjs

@@ -303,7 +303,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // ../../node_modules/@relaycast/sdk/dist/version.js
-var SDK_VERSION = "8.11.1";
+var SDK_VERSION = "8.11.3";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -21338,6 +21338,9 @@ var FleetNodeRegisterMessageSchema = external_exports.object({
   capabilities: external_exports.array(FleetCapabilitySchema),
   // Provider-level capacity; the node figure is the aggregate across providers.
   max_agents: external_exports.number().int().nonnegative(),
+  // `cloud:*` is reserved for control-plane lifecycle tags set at enrollment.
+  // The engine ignores (and logs) any `cloud:*` entry here and keeps the
+  // node's enrolled `cloud:*` tags instead.
   tags: external_exports.array(FleetNodeTagSchema),
   // Placement-safe repository identities. The engine persists these as
   // `repo:<owner/name>` tags so existing node roster readers can consume them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay",
-  "version": "12.2.4",
+  "version": "12.2.6",
   "description": "Real-time agent-to-agent communication system",
   "type": "module",
   "main": "dist/index.cjs",
@@ -43,22 +43,22 @@
     "pack:validate": "npm pack --dry-run"
   },
   "dependencies": {
-    "@agent-relay/cli-surface": "12.2.4",
-    "@agent-relay/cloud": "12.2.4",
-    "@agent-relay/config": "12.2.4",
-    "@agent-relay/fleet": "12.2.4",
-    "@agent-relay/harness-driver": "12.2.4",
-    "@agent-relay/harnesses": "12.2.4",
-    "@agent-relay/sdk": "12.2.4",
-    "@agent-relay/session": "12.2.4",
-    "@agent-relay/utils": "12.2.4",
+    "@agent-relay/cli-surface": "12.2.6",
+    "@agent-relay/cloud": "12.2.6",
+    "@agent-relay/config": "12.2.6",
+    "@agent-relay/fleet": "12.2.6",
+    "@agent-relay/harness-driver": "12.2.6",
+    "@agent-relay/harnesses": "12.2.6",
+    "@agent-relay/sdk": "12.2.6",
+    "@agent-relay/session": "12.2.6",
+    "@agent-relay/utils": "12.2.6",
     "@modelcontextprotocol/sdk": "^1.23.0",
     "@relayfile/client": "^0.10.27",
-    "@relayfile/sdk": "^0.10.63",
+    "@relayfile/sdk": "^0.10.64",
     "@relayflows/cli": "1.0.1",
-    "@relayflows/sdk": "^2.0.16",
+    "@relayflows/sdk": "^2.0.19",
     "@xterm/headless": "^6.0.0",
-    "ai-hist": "^0.18.0",
+    "ai-hist": "^0.18.1",
     "commander": "^12.1.0",
     "dotenv": "^17.2.3",
     "jiti": "^2.6.1",