agentic-assistant 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.4.0
+
+Added
+
+- `origins` option on `createAssistantApi` and `createWorker`: origins that may send a write signed in with a session cookie.
+
+Changed
+
+- The HTTP API reads the credential with `requirePrincipal` from `agentic-identity/http` and checks the kind with `PRINCIPAL_KINDS`. The `agentic-identity` dependency is now `^0.6.0`.
+- A bearer token must hold only `A-Za-z0-9_-` and at most 512 characters, or the call is a 401. `createStaticTokenAuth` refuses other tokens when it is built.
+- An Auth that throws gives a 503, not a 401. A cookie write from an origin not in `origins` gives a 403.
+
 ## 0.3.0
 
 Added

package/README.md

@@ -174,9 +174,9 @@ export default {
 };
 ```
 
-To deploy the demo Worker yourself, set the secrets `ASSISTANT_TOKENS` (a JSON map of a bearer token of 32 bytes or more to `{"id":"ana","scopes":["demo:read"]}`) and `MODEL_KEY`, set the var `MODEL_URL` (or `MODEL_USE_DEFAULT_ENDPOINT=1` to call the US-hosted `api.anthropic.com`), then run `npm run deploy:demo`. Without `MODEL_KEY`, chat answers 503. `agentic-assistant/worker` also exports `createStaticTokenAuth`, an `agentic-identity` `Auth` that reads bearer tokens from a fixed map.
+To deploy the demo Worker yourself, set the secrets `ASSISTANT_TOKENS` (a JSON map of a bearer token of 32 to 512 characters from `A-Za-z0-9_-` to `{"id":"ana","scopes":["demo:read"]}`) and `MODEL_KEY`, set the var `MODEL_URL` (or `MODEL_USE_DEFAULT_ENDPOINT=1` to call the US-hosted `api.anthropic.com`), then run `npm run deploy:demo`. Without `MODEL_KEY`, chat answers 503. `agentic-assistant/worker` also exports `createStaticTokenAuth`, an `agentic-identity` `Auth` that reads bearer tokens from a fixed map.
 
-Every route is under `/api/v1` and needs `Authorization: Bearer <key>`. The key resolves to an `agentic-identity` principal. A person, an agent, and a token that acts for a user all work. A missing, bad, or odd credential is a 401. Every chat response has the header `x-ai-generated: true`.
+Every route is under `/api/v1` and needs `Authorization: Bearer <key>`. The key resolves to an `agentic-identity` principal. A person, an agent, and a token that acts for a user all work. A missing, bad, or odd credential is a 401. An Auth that fails gives a 503. A write signed in with a session cookie needs an `Origin` listed in the `origins` option, or it is a 403. Every chat response has the header `x-ai-generated: true`.
 
 | Route | What it does |
 |---|---|

package/dist/{chunk-3LKTJJ75.js → chunk-C44QT474.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.3.0" : readPackageVersion();
+var VERSION = true ? "0.4.0" : readPackageVersion();
 
 // src/approvals.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-DXTIEMOT.js → chunk-FQD4OK2R.js}

@@ -1,6 +1,6 @@
 import {
   ProviderError
-} from "./chunk-3LKTJJ75.js";
+} from "./chunk-C44QT474.js";
 
 // src/providers/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";

package/dist/{chunk-T5WVSGYQ.js → chunk-KNUEYFX2.js}

@@ -1,11 +1,11 @@
 import {
   runChat
-} from "./chunk-3X6KU636.js";
+} from "./chunk-MESH6X6N.js";
 import {
   VERSION,
   provenanceLabel,
   provenanceMarker
-} from "./chunk-3LKTJJ75.js";
+} from "./chunk-C44QT474.js";
 
 // src/mcp-server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/{chunk-3X6KU636.js → chunk-MESH6X6N.js}

@@ -5,7 +5,7 @@ import {
   AnthropicProvider,
   checkBaseUrl,
   isLoopback
-} from "./chunk-DXTIEMOT.js";
+} from "./chunk-FQD4OK2R.js";
 import {
   PrincipalError,
   ProviderError,
@@ -17,7 +17,7 @@ import {
   digestCall,
   printable,
   runAssistant
-} from "./chunk-3LKTJJ75.js";
+} from "./chunk-C44QT474.js";
 
 // src/sources/mcp.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";

package/dist/{chunk-GLU222OQ.js → chunk-YMEM57LX.js}

@@ -4,22 +4,29 @@ import {
   hasScope,
   parseScope,
   runAssistant
-} from "./chunk-3LKTJJ75.js";
+} from "./chunk-C44QT474.js";
 
 // src/api.ts
+import { PRINCIPAL_KINDS } from "agentic-identity";
+import { requirePrincipal } from "agentic-identity/http";
 var MAX_BODY_BYTES = 65536;
 var MAX_MESSAGE_CHARS = 1e4;
 var MAX_REASON_CHARS = 500;
 var DEFAULT_MAX_CONCURRENT_RUNS = 4;
-var KINDS = ["human", "agent_of_human", "agent_of_agent", "agent", "user_token"];
 var APPROVER_SCOPE = "assistant:admin";
+async function callerOf(request, auth, origins) {
+  const found = await requirePrincipal(request, auth, { origins });
+  if (found instanceof Response) return found.status === 401 ? fail(401, "sign in with a valid key", { "www-authenticate": "Bearer" }) : found;
+  return toCaller(found) ?? fail(401, "sign in with a valid key", { "www-authenticate": "Bearer" });
+}
 var json = (body, status = 200, headers = {}) => Response.json(body, { status, headers: { "cache-control": "no-store", ...headers } });
 var fail = (status, error, headers = {}) => json({ error }, status, headers);
 function toCaller(context) {
   if (typeof context !== "object" || context === null) return void 0;
   const { principalId, kind, chain, scopes } = context;
-  if (typeof principalId !== "string" || principalId === "" || !KINDS.includes(kind)) return void 0;
-  if (!Array.isArray(chain) || chain.length === 0 || chain[chain.length - 1]?.id !== principalId) return void 0;
+  if (typeof principalId !== "string" || principalId === "" || !Array.isArray(chain) || chain.length === 0) return void 0;
+  if (!PRINCIPAL_KINDS.includes(kind)) return void 0;
+  if (chain[chain.length - 1]?.id !== principalId) return void 0;
   if (chain[chain.length - 1]?.kind !== kind || kind === "human" && chain.length !== 1) return void 0;
   const ids = chain.map((step) => step?.id);
   if (ids.some((id) => typeof id !== "string" || id === "")) return void 0;
@@ -132,8 +139,8 @@ function createAssistantApi(options) {
           scopes: caller.scopes,
           // Each check asks the Auth again. A key revoked during a run, or one with other scopes, stops it.
           isRevoked: async () => {
-            const now = toCaller(await options.auth.authenticate(request));
-            return now?.id !== caller.id || [...now.scopes].sort().join(" ") !== [...caller.scopes].sort().join(" ");
+            const now = await callerOf(request, options.auth, options.origins);
+            return now instanceof Response || now.id !== caller.id || [...now.scopes].sort().join(" ") !== [...caller.scopes].sort().join(" ");
           }
         }),
         approvals: gateFor(caller),
@@ -198,13 +205,8 @@ function createAssistantApi(options) {
       const allowed = route === "chat" || verb !== void 0 ? "POST" : "GET";
       if (request.method !== allowed) return fail(405, "method not allowed", { allow: allowed });
       if (route !== "approvals" && id !== void 0) return fail(404, "not found");
-      let caller;
-      try {
-        caller = toCaller(await options.auth.authenticate(request));
-      } catch {
-        caller = void 0;
-      }
-      if (caller === void 0) return fail(401, "sign in with a valid key", { "www-authenticate": "Bearer" });
+      const caller = await callerOf(request, options.auth, options.origins);
+      if (caller instanceof Response) return caller;
       if (route === "tools") {
         const tools = options.registry.list().filter((tool) => hasScope(caller.scopes, tool.scope)).map(({ name, description, scope, risk, inputSchema }) => ({ name, description, scope, risk, inputSchema }));
         return json({ tools });
@@ -257,6 +259,7 @@ async function createStaticTokenAuth(tokens) {
   for (const [token, entry] of Object.entries(tokens)) {
     if (encoder.encode(token).length < MIN_TOKEN_BYTES) throw new Error(`tokens must hold at least ${MIN_TOKEN_BYTES} bytes`);
     if (/\s/.test(token)) throw new Error("a token may not hold white space");
+    if (!/^[A-Za-z0-9_-]{1,512}$/.test(token)) throw new Error("a token may hold only A-Z a-z 0-9 _ - and at most 512 characters");
     if (typeof entry !== "object" || entry === null || Object.keys(entry).some((key) => key !== "id" && key !== "scopes")) {
       throw new Error("a token entry has only an id and scopes: every caller is a person");
     }

package/dist/cli.js

@@ -4,15 +4,15 @@ import {
   buildSetup,
   readTextFile,
   runChat
-} from "./chunk-3X6KU636.js";
+} from "./chunk-MESH6X6N.js";
 import "./chunk-HYT732TN.js";
-import "./chunk-DXTIEMOT.js";
+import "./chunk-FQD4OK2R.js";
 import {
   TOOL_RISKS,
   VERSION,
   printable,
   provenanceLabel
-} from "./chunk-3LKTJJ75.js";
+} from "./chunk-C44QT474.js";
 
 // src/cli.ts
 import { realpathSync } from "fs";
@@ -272,7 +272,7 @@ async function runCli(argv, io = defaultIo()) {
     for (const skip of setup.skipped.slice(0, MAX_SKIPPED_LINES)) io.err(`skipped tool ${oneLine(skip.name, 100)}: ${oneLine(skip.reason, 200)}`);
     if (setup.skipped.length > MAX_SKIPPED_LINES) io.err(`skipped ${setup.skipped.length - MAX_SKIPPED_LINES} more tools`);
     if (parsed.command === "mcp") {
-      const { startAssistantMcp } = await import("./mcp-server-ZPCPYMCT.js");
+      const { startAssistantMcp } = await import("./mcp-server-LXGWKEHG.js");
       await startAssistantMcp(setup);
       return 0;
     }

package/dist/demo.js

@@ -1,14 +1,14 @@
 import {
   createStaticTokenAuth,
   createWorker
-} from "./chunk-GLU222OQ.js";
+} from "./chunk-YMEM57LX.js";
 import {
   AnthropicProvider
-} from "./chunk-DXTIEMOT.js";
+} from "./chunk-FQD4OK2R.js";
 import {
   ToolRegistry,
   VERSION
-} from "./chunk-3LKTJJ75.js";
+} from "./chunk-C44QT474.js";
 
 // src/demo-page.ts
 var DEMO_CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createAssistantMcpServer,
   startAssistantMcp
-} from "./chunk-T5WVSGYQ.js";
+} from "./chunk-KNUEYFX2.js";
 import {
   ConfigError,
   FallbackProvider,
@@ -10,13 +10,13 @@ import {
   connectMcpTools,
   parseTarget,
   runChat
-} from "./chunk-3X6KU636.js";
+} from "./chunk-MESH6X6N.js";
 import "./chunk-HYT732TN.js";
 import {
   AnthropicProvider,
   DEFAULT_ANTHROPIC_MODEL,
   PRICING_CHECKED_ON
-} from "./chunk-DXTIEMOT.js";
+} from "./chunk-FQD4OK2R.js";
 import {
   ACTIONS,
   DATA_NOTICE,
@@ -40,7 +40,7 @@ import {
   provenanceMarker,
   runAssistant,
   scopeCovers
-} from "./chunk-3LKTJJ75.js";
+} from "./chunk-C44QT474.js";
 export {
   ACTIONS,
   AnthropicProvider,

package/dist/{mcp-server-ZPCPYMCT.js → mcp-server-LXGWKEHG.js}

@@ -1,11 +1,11 @@
 import {
   createAssistantMcpServer,
   startAssistantMcp
-} from "./chunk-T5WVSGYQ.js";
-import "./chunk-3X6KU636.js";
+} from "./chunk-KNUEYFX2.js";
+import "./chunk-MESH6X6N.js";
 import "./chunk-HYT732TN.js";
-import "./chunk-DXTIEMOT.js";
-import "./chunk-3LKTJJ75.js";
+import "./chunk-FQD4OK2R.js";
+import "./chunk-C44QT474.js";
 export {
   createAssistantMcpServer,
   startAssistantMcp

package/dist/worker.d.ts

@@ -11,6 +11,8 @@ interface AssistantApiOptions {
     registry: ToolRegistry;
     system?: string;
     limits?: RunLimits;
+    /** Origins (such as `https://app.example.org`) that may send a write signed in with a session cookie. A write with a cookie from any other origin is a 403. A Bearer key needs no origin. */
+    origins?: readonly string[];
     /** Most chat turns one principal may run at once. Default 4. */
     maxConcurrentRuns?: number;
 }

package/dist/worker.js

@@ -3,8 +3,8 @@ import {
   createAssistantApi,
   createStaticTokenAuth,
   createWorker
-} from "./chunk-GLU222OQ.js";
-import "./chunk-3LKTJJ75.js";
+} from "./chunk-YMEM57LX.js";
+import "./chunk-C44QT474.js";
 export {
   APPROVER_SCOPE,
   createAssistantApi,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-assistant",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "An AI assistant that acts inside your apps with the user's own permissions.",
   "keywords": [
     "assistant",
@@ -74,7 +74,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^1.3.0",
     "@modelcontextprotocol/sdk": "^1.32.2",
-    "agentic-identity": "^0.4.0",
+    "agentic-identity": "^0.6.0",
     "ajv": "^8.20.0"
   },
   "devDependencies": {