blun-king-cli 9.1.466 → 9.1.468

package/bin/agent-api-http-adapter.mjs

@@ -0,0 +1,318 @@
+const AGENT_TURNS_PATH = '/v1/agent/turns';
+const PUBLIC_MODEL_ID = 'king';
+const PUBLIC_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
+
+class AgentApiHttpAdapterError extends Error {
+  constructor(code, message, status = 400) {
+    super(message);
+    this.name = 'AgentApiHttpAdapterError';
+    this.code = code;
+    this.status = status;
+  }
+}
+
+function adapterError(code, message, status = 400) {
+  return new AgentApiHttpAdapterError(code, message, status);
+}
+
+function requireTrustedId(value, label) {
+  if (typeof value !== 'string' || value.trim().length === 0) {
+    throw adapterError('AGENT_API_UNAUTHENTICATED', `${label} is required`, 401);
+  }
+  return value.trim();
+}
+
+function requirePublicId(value, label) {
+  if (typeof value !== 'string' || !PUBLIC_ID_PATTERN.test(value)) {
+    throw adapterError(
+      'AGENT_API_INVALID_ID',
+      `${label} must match ${PUBLIC_ID_PATTERN}`,
+    );
+  }
+  return value;
+}
+
+function requireBody(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw adapterError('AGENT_API_INVALID_BODY', 'request body must be a JSON object');
+  }
+  return value;
+}
+
+function requireKing(value) {
+  if (value !== PUBLIC_MODEL_ID) {
+    throw adapterError('AGENT_API_INVALID_MODEL', 'model must be king');
+  }
+}
+
+function normalizePrompt(value) {
+  if (typeof value !== 'string' || value.trim().length === 0) {
+    throw adapterError('AGENT_API_INVALID_INPUT', 'input must be a non-empty string');
+  }
+  return value;
+}
+
+function normalizeTools(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) {
+    throw adapterError('AGENT_API_INVALID_TOOLS', 'tools must be an array');
+  }
+  return value;
+}
+
+function decodeRequestId(value) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    throw adapterError('AGENT_API_INVALID_ID', 'request ID is not valid URL encoding');
+  }
+  return requirePublicId(decoded, 'request ID');
+}
+
+function routeFor(method, rawPath) {
+  const path = String(rawPath ?? '').split('?', 1)[0];
+  if (method === 'POST' && path === AGENT_TURNS_PATH) return { kind: 'start' };
+  if (!path.startsWith(`${AGENT_TURNS_PATH}/`)) {
+    if (path.startsWith('/v1/agent/')) return { kind: 'unknown' };
+    return null;
+  }
+
+  const tail = path.slice(AGENT_TURNS_PATH.length + 1);
+  const toolSuffix = '/tool-results';
+  if (method === 'POST' && tail.endsWith(toolSuffix)) {
+    return {
+      kind: 'continue',
+      requestId: decodeRequestId(tail.slice(0, -toolSuffix.length)),
+    };
+  }
+  if (method === 'DELETE' && !tail.includes('/')) {
+    return { kind: 'cancel', requestId: decodeRequestId(tail) };
+  }
+  return { kind: 'unknown' };
+}
+
+function jsonResponse(status, body) {
+  return {
+    status,
+    headers: { 'content-type': 'application/json' },
+    body,
+  };
+}
+
+function publicCompletion(response) {
+  if (response === null || typeof response !== 'object' || Array.isArray(response)) {
+    throw adapterError('AGENT_API_INVALID_CONTROLLER_RESPONSE', 'Agent response is invalid', 502);
+  }
+  return { ...response, model: PUBLIC_MODEL_ID };
+}
+
+function publicErrorResponse(error) {
+  if (error instanceof AgentApiHttpAdapterError) {
+    return jsonResponse(error.status, {
+      error: {
+        type: 'invalid_request_error',
+        code: error.code,
+        message: error.message,
+      },
+    });
+  }
+
+  const code = typeof error?.code === 'string' ? error.code : '';
+  if (code === 'AGENT_API_TURN_SCOPE_MISMATCH') {
+    return jsonResponse(403, {
+      error: {
+        type: 'permission_error',
+        code,
+        message: 'Agent turn belongs to a different request.',
+      },
+    });
+  }
+  if (code === 'AGENT_API_SESSION_BUSY' || code === 'AGENT_API_TURN_NOT_ACTIVE') {
+    return jsonResponse(409, {
+      error: {
+        type: 'conflict_error',
+        code,
+        message: 'Agent session is not ready for this operation.',
+      },
+    });
+  }
+  if (code.startsWith('AGENT_API_INVALID_')) {
+    return jsonResponse(400, {
+      error: {
+        type: 'invalid_request_error',
+        code,
+        message: 'Agent request is invalid.',
+      },
+    });
+  }
+  if (code === 'AGENT_API_TURN_FAILED') {
+    return jsonResponse(502, {
+      error: {
+        type: 'upstream_error',
+        code,
+        message: 'Agent turn failed.',
+      },
+    });
+  }
+  return jsonResponse(500, {
+    error: {
+      type: 'internal_error',
+      code: 'AGENT_API_INTERNAL',
+      message: 'Agent request failed.',
+    },
+  });
+}
+
+function scopeKey(sessionId, requestId) {
+  return `${sessionId}\0${requestId}`;
+}
+
+function responseNeedsToolResult(response) {
+  return response?.choices?.[0]?.finish_reason === 'tool_calls';
+}
+
+function validateController(controller) {
+  if (controller === null || typeof controller !== 'object') {
+    throw new TypeError('controller is required');
+  }
+  for (const method of ['startTurn', 'continueTurn', 'cancelTurn']) {
+    if (typeof controller[method] !== 'function') {
+      throw new TypeError(`controller.${method} must be a function`);
+    }
+  }
+  return controller;
+}
+
+function createAgentApiHttpAdapter(options = {}) {
+  const controller = validateController(options.controller);
+  if (typeof options.resolveSession !== 'function') {
+    throw new TypeError('resolveSession must be a function');
+  }
+  const owners = new Map();
+
+  function requireOwner(principalId, sessionId, requestId) {
+    const key = scopeKey(sessionId, requestId);
+    const owner = owners.get(key);
+    if (owner === undefined) {
+      throw adapterError(
+        'AGENT_API_TURN_NOT_ACTIVE',
+        'Agent turn is not active.',
+        409,
+      );
+    }
+    if (owner !== principalId) {
+      throw adapterError(
+        'AGENT_API_FORBIDDEN',
+        'Agent turn belongs to a different account.',
+        403,
+      );
+    }
+    return key;
+  }
+
+  function trackScope(key, principalId, response) {
+    if (responseNeedsToolResult(response)) owners.set(key, principalId);
+    else owners.delete(key);
+  }
+
+  async function handleStart(input, principalId) {
+    const body = requireBody(input.body);
+    requireKing(body.model);
+    if (body.stream === true) {
+      throw adapterError(
+        'AGENT_API_STREAMING_UNSUPPORTED',
+        'streaming is not available on Agent turns yet',
+      );
+    }
+    const sessionId = requirePublicId(body.session_id, 'session_id');
+    const requestId = requirePublicId(body.request_id, 'request_id');
+    const session = await options.resolveSession({
+      principalId,
+      sessionId,
+      create: true,
+    });
+    if (session?.id !== sessionId) {
+      throw adapterError(
+        'AGENT_API_SESSION_SCOPE_MISMATCH',
+        'resolved session does not match session_id',
+        403,
+      );
+    }
+    const response = publicCompletion(await controller.startTurn({
+      session,
+      requestId,
+      prompt: normalizePrompt(body.input),
+      tools: normalizeTools(body.tools),
+    }));
+    trackScope(scopeKey(sessionId, requestId), principalId, response);
+    return jsonResponse(200, response);
+  }
+
+  async function handleContinue(input, principalId, requestId) {
+    const body = requireBody(input.body);
+    const sessionId = requirePublicId(body.session_id, 'session_id');
+    const key = requireOwner(principalId, sessionId, requestId);
+    const response = publicCompletion(await controller.continueTurn({
+      sessionId,
+      requestId,
+      toolResults: body.tool_results,
+    }));
+    trackScope(key, principalId, response);
+    return jsonResponse(200, response);
+  }
+
+  async function handleCancel(input, principalId, requestId) {
+    const body = requireBody(input.body ?? {});
+    const sessionId = requirePublicId(body.session_id, 'session_id');
+    const key = requireOwner(principalId, sessionId, requestId);
+    await controller.cancelTurn({
+      sessionId,
+      requestId,
+      reason: typeof body.reason === 'string' ? body.reason : undefined,
+    });
+    owners.delete(key);
+    return jsonResponse(200, {
+      id: `agent-${requestId}`,
+      object: 'agent.turn.cancelled',
+      model: PUBLIC_MODEL_ID,
+      cancelled: true,
+    });
+  }
+
+  async function handleRequest(input) {
+    if (input === null || typeof input !== 'object') return null;
+    const method = String(input.method ?? '').toUpperCase();
+    let route;
+    try {
+      route = routeFor(method, input.path);
+      if (route === null) return null;
+      if (route.kind === 'unknown') {
+        return jsonResponse(404, {
+          error: {
+            type: 'invalid_request_error',
+            code: 'AGENT_API_ROUTE_NOT_FOUND',
+            message: 'Agent API route not found.',
+          },
+        });
+      }
+      const principalId = requireTrustedId(input.principalId, 'principalId');
+      if (route.kind === 'start') return await handleStart(input, principalId);
+      if (route.kind === 'continue') {
+        return await handleContinue(input, principalId, route.requestId);
+      }
+      return await handleCancel(input, principalId, route.requestId);
+    } catch (error) {
+      return publicErrorResponse(error);
+    }
+  }
+
+  return Object.freeze({ handleRequest });
+}
+
+export {
+  AGENT_TURNS_PATH,
+  AgentApiHttpAdapterError,
+  PUBLIC_MODEL_ID,
+  createAgentApiHttpAdapter,
+};

package/bin/agent-api-runtime.mjs

@@ -6,7 +6,12 @@ const { createAgentApiToolBroker } = require('./agent-api-tool-broker.cjs');
 
 const CLIENT_TOOL_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/u;
 const INTERNAL_TOOL_PREFIX = 'client__';
-const NO_CLIENT_TOOLS_PREFIX = '__blun_agent_api_no_client_tools__';
+const AGENT_API_INTERNAL_TOOLS = Object.freeze([
+  'Agent',
+  'TaskList',
+  'TaskOutput',
+  'TaskStop',
+]);
 
 class AgentApiRuntimeError extends Error {
   constructor(code, message) {
@@ -112,10 +117,6 @@ function internalToolName(publicName, index) {
   return `${prefix}${publicName.slice(0, available)}${suffix}`;
 }
 
-function noClientToolsSentinel(sessionId, requestId) {
-  return `${NO_CLIENT_TOOLS_PREFIX}${shortHash(`${sessionId}\0${requestId}`, 16)}`;
-}
-
 function validateSession(session) {
   if (session === null || typeof session !== 'object') {
     throw runtimeError('AGENT_API_INVALID_SESSION', 'session must be an SDK session');
@@ -188,11 +189,10 @@ function createAgentApiRuntime(options = {}) {
         registeredNames.push(tool.internalName);
       }
 
-      await input.session.setAllowedTools(
-        registeredNames.length > 0
-          ? registeredNames
-          : [noClientToolsSentinel(sessionId, requestId)],
-      );
+      await input.session.setAllowedTools([
+        ...AGENT_API_INTERNAL_TOOLS,
+        ...registeredNames,
+      ]);
     } catch (error) {
       broker.abortRequest({
         sessionId,
@@ -244,9 +244,9 @@ function createAgentApiRuntime(options = {}) {
 }
 
 export {
+  AGENT_API_INTERNAL_TOOLS,
   AgentApiRuntimeError,
   CLIENT_TOOL_NAME_PATTERN,
-  NO_CLIENT_TOOLS_PREFIX,
   createAgentApiRuntime,
   normalizeClientToolDefinitions,
 };

package/bin/subagent-tool-policy.cjs

@@ -0,0 +1,60 @@
+'use strict';
+
+const NESTED_AGENT_LIFECYCLE_TOOLS = Object.freeze([
+  'Agent',
+  'TaskList',
+  'TaskOutput',
+  'TaskStop',
+]);
+
+function validateParentAllowedTools(parentTools) {
+  if (parentTools === null || typeof parentTools !== 'object') {
+    throw new TypeError('parentTools is required');
+  }
+  const allowed = parentTools.allowedTools;
+  if (allowed !== undefined && !Array.isArray(allowed)) {
+    throw new TypeError('parentTools.allowedTools must be an array or undefined');
+  }
+  return allowed;
+}
+
+function inheritSubagentLifecycleTools(parentTools, childTools) {
+  const allowed = validateParentAllowedTools(parentTools);
+  if (allowed === undefined) return [];
+  if (childTools === null || typeof childTools !== 'object'
+    || typeof childTools.data !== 'function'
+    || typeof childTools.setActiveTools !== 'function'
+    || typeof childTools.refreshBuiltinTools !== 'function') {
+    throw new TypeError('childTools lifecycle controls are required');
+  }
+
+  const toolData = childTools.data();
+  if (!Array.isArray(toolData)) throw new TypeError('childTools.data() must return an array');
+  const available = new Set(toolData.map((tool) => tool?.name).filter(Boolean));
+  const inherited = NESTED_AGENT_LIFECYCLE_TOOLS.filter((name) => (
+    allowed.includes(name) && available.has(name)
+  ));
+  if (inherited.length === 0) return [];
+
+  const active = toolData.filter((tool) => tool?.active === true).map((tool) => tool.name);
+  childTools.setActiveTools([...new Set([...active, ...inherited])]);
+  childTools.refreshBuiltinTools();
+  return inherited;
+}
+
+function inheritSubagentAllowedTools(parentTools, childTools) {
+  const allowed = validateParentAllowedTools(parentTools);
+  if (childTools === null || typeof childTools !== 'object'
+    || typeof childTools.setAllowedTools !== 'function') {
+    throw new TypeError('childTools.setAllowedTools is required');
+  }
+  const inherited = allowed === undefined ? undefined : [...allowed];
+  childTools.setAllowedTools(inherited);
+  return inherited;
+}
+
+module.exports = {
+  NESTED_AGENT_LIFECYCLE_TOOLS,
+  inheritSubagentAllowedTools,
+  inheritSubagentLifecycleTools,
+};

package/blun.mjs

@@ -252406,7 +252406,7 @@ function shouldSuppressQueuedAttemptFailureEvent(options, error) {
 	if (isProviderRateLimitError(error)) return true;
 	return isAbortError$4(error) || options.signal.aborted;
 }
-var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
+var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, inheritSubagentAllowedTools, inheritSubagentLifecycleTools, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
 var init_subagent_host = __esmMin((() => {
 	init_src$4();
 	init_errors$8();
@@ -252420,6 +252420,7 @@ var init_subagent_host = __esmMin((() => {
 	init_summary_continuation();
 	({ DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation } = createRequire(import.meta.url)("./bin/subagent-timeout-policy.cjs"));
 	({ buildSubagentUsageDelta } = createRequire(import.meta.url)("./bin/subagent-usage-rollup-policy.cjs"));
+	({ inheritSubagentAllowedTools, inheritSubagentLifecycleTools } = createRequire(import.meta.url)("./bin/subagent-tool-policy.cjs"));
 	({
 		SUBAGENT_MAX_TOKENS_ERROR,
 		SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT,
@@ -252729,6 +252730,8 @@ IMPORTANT:
 			const context = await prepareSystemPromptContext(this.session.systemContextKaos(child.kaos.getcwd()), this.session.options.blunHomeDir, { additionalDirs: child.getAdditionalDirs() });
 			child.useProfile(profile, context, this.session.options.blunHomeDir);
 			child.tools.inheritUserTools(parent.tools);
+			inheritSubagentLifecycleTools(parent.tools, child.tools);
+			inheritSubagentAllowedTools(parent.tools, child.tools);
 		}
 		async triggerSubagentStart(parent, profileName, prompt, signal) {
 			await parent.hooks?.trigger("SubagentStart", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.466",
+  "version": "9.1.468",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {