dsh-a2a-server 0.2.0 → 0.4.0

package/lib/contexts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contexts.d.ts","sourceRoot":"","sources":["../src/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACxC,mEAAmE;IACnE,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,0DAA0D;AAC1D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,CAAA;AAEnD,8DAA8D;AAC9D,qBAAa,eAAe;IASxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAElE;;;;OAIG;gBAEgB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,qDAAqD;IACrD,MAAM,IAAI,UAAU,EAAE;IAItB,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa;IAQzE;;;OAGG;IACH,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IAIjC;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,YAAY,GAAG,UAAU,GAAG,SAAS;IAMvD,yEAAyE;IACzE,KAAK,IAAI,UAAU,EAAE;IAMrB;;;;;;;;OAQG;IACH,SAAS,IAAI,UAAU,EAAE;CAa1B"}
+{"version":3,"file":"contexts.d.ts","sourceRoot":"","sources":["../src/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACxC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,mEAAmE;IACnE,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,0DAA0D;AAC1D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,CAAA;AAEnD,8DAA8D;AAC9D,qBAAa,eAAe;IASxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAElE;;;;OAIG;gBAEgB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,qDAAqD;IACrD,MAAM,IAAI,UAAU,EAAE;IAItB,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa;IAQzE;;;OAGG;IACH,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IAMjC;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,YAAY,GAAG,UAAU,GAAG,SAAS;IAMvD,yEAAyE;IACzE,KAAK,IAAI,UAAU,EAAE;IAMrB;;;;;;;OAOG;IACH,SAAS,IAAI,UAAU,EAAE;CAI1B"}

package/lib/contexts.js

@@ -59,6 +59,10 @@ export class ContextRegistry {
      * @param activation - the Activation to hold.
      */
     add(activation) {
+        if (this.activations.has(activation.contextId))
+            throw new Error('context is already resident');
+        if (this.activations.size >= this.maxResident)
+            throw new Error('resident context capacity reached');
         this.activations.set(activation.contextId, activation);
     }
     /**
@@ -81,23 +85,13 @@ export class ContextRegistry {
      * Select Activations that may be evicted right now.
      *
      * An Activation is evictable only when nothing is owed: no in-flight task and
-     * no recent touch. A context over the resident ceiling is evicted by least
-     * recent touch — but a busy context is NEVER evicted to make room, because
-     * dropping work a peer is waiting on is worse than exceeding a soft ceiling.
+     * no recent touch. Admission separately evicts the oldest quiet activation
+     * BEFORE creating a new agent. A busy context is never evicted for capacity.
      * @returns Activations the caller should dispose and remove.
      */
     evictable() {
         const cutoff = this.now() - this.idleTtlMs;
-        const quiet = this.values().filter(a => a.slots.size === 0);
-        const expired = quiet.filter(a => a.lastTouchedAt <= cutoff);
-        if (this.activations.size <= this.maxResident)
-            return expired;
-        const overflow = this.activations.size - this.maxResident;
-        const byOldest = quiet
-            .filter(a => !expired.includes(a))
-            .sort((a, b) => a.lastTouchedAt - b.lastTouchedAt)
-            .slice(0, Math.max(0, overflow - expired.length));
-        return [...expired, ...byOldest];
+        return this.values().filter(a => a.slots.size === 0 && a.lastTouchedAt <= cutoff);
     }
 }
 //# sourceMappingURL=contexts.js.map

package/lib/contexts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contexts.js","sourceRoot":"","sources":["../src/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwBH,8DAA8D;AAC9D,MAAM,OAAO,eAAe;IASP;IACA;IACA;IAVF,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAA;IAElE;;;;OAIG;IACH,YACmB,WAAmB,EACnB,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;QAF5B,gBAAW,GAAX,WAAW,CAAQ;QACnB,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,qDAAqD;IACrD,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAuB,EAAE,IAAY;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC9C,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,WAAW,CAAA;QAChD,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACrC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,UAAsB;QACxB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACxD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAuB;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QACzB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QACxB,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,CAAA;QAC5D,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,OAAO,CAAA;QAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAA;QACzD,MAAM,QAAQ,GAAG,KAAK;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;aACjD,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACnD,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;IAClC,CAAC;CACF"}
+{"version":3,"file":"contexts.js","sourceRoot":"","sources":["../src/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA8BH,8DAA8D;AAC9D,MAAM,OAAO,eAAe;IASP;IACA;IACA;IAVF,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAA;IAElE;;;;OAIG;IACH,YACmB,WAAmB,EACnB,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;QAF5B,gBAAW,GAAX,WAAW,CAAQ;QACnB,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,qDAAqD;IACrD,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAuB,EAAE,IAAY;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC9C,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,WAAW,CAAA;QAChD,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACrC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,UAAsB;QACxB,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QAC9F,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACnG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACxD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAuB;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QACzB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QACxB,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;QAC1C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,CAAA;IACnF,CAAC;CACF"}

package/lib/docker-executor.d.ts

@@ -0,0 +1,11 @@
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
+export declare const VISITOR_IMAGE = "talk2myagent/visitor-runtime:0.1.0";
+export declare const MAX_VISITOR_CONTAINERS = 4;
+/** Per backend process, shared by all its visitor contexts. No unbounded queue. */
+export declare function reserveContainer(): () => void;
+export declare function docker(args: string[], input?: string, signal?: AbortSignal, timeoutMs?: number): Promise<string>;
+export declare function requireDocker(): Promise<void>;
+export declare function containerArgs(name: string, dataRoot: string, workRoot: string, worker: string): Promise<string[]>;
+/** The model supplies only read arguments; never Docker flags, mounts or commands. */
+export declare function dockerReadTool(definition: ToolDefinition, dataRoot: string, workRoot: string, verify: () => Promise<void>): ToolDefinition;
+//# sourceMappingURL=docker-executor.d.ts.map

package/lib/docker-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-executor.d.ts","sourceRoot":"","sources":["../src/docker-executor.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAG5D,eAAO,MAAM,aAAa,uCAAuC,CAAA;AACjE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAGvC,mFAAmF;AACnF,wBAAgB,gBAAgB,IAAI,MAAM,IAAI,CAK7C;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,SAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBlH;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAUnD;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAYvH;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAuB1I"}

package/lib/docker-executor.js

@@ -0,0 +1,115 @@
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { realpath } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { contains } from "./isolation.js";
+export const VISITOR_IMAGE = 'talk2myagent/visitor-runtime:0.1.0';
+export const MAX_VISITOR_CONTAINERS = 4;
+let activeContainers = 0;
+/** Per backend process, shared by all its visitor contexts. No unbounded queue. */
+export function reserveContainer() {
+    if (activeContainers >= MAX_VISITOR_CONTAINERS)
+        throw new Error('Visitor tools are busy; try again later');
+    activeContainers++;
+    let released = false;
+    return () => { if (!released) {
+        released = true;
+        activeContainers--;
+    } };
+}
+export async function docker(args, input = '', signal, timeoutMs = 30_000) {
+    return await new Promise((resolve, reject) => {
+        const child = spawn('docker', args, { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+        let output = '', errors = '', failed = false;
+        const fail = (error) => { if (!failed) {
+            failed = true;
+            child.kill();
+            reject(error);
+        } };
+        const abort = () => fail(new Error('Container operation canceled'));
+        const timer = setTimeout(() => fail(new Error('Container operation timed out')), timeoutMs);
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted)
+            abort();
+        child.on('error', error => fail(new Error(`Docker unavailable: ${error.message}`)));
+        child.stdin.on('error', () => { });
+        child.stdout.on('data', bytes => { output += String(bytes); if (output.length > 256_000)
+            fail(new Error('Container output exceeded limit')); });
+        child.stderr.on('data', bytes => { errors = (errors + String(bytes)).slice(-4000); });
+        child.on('close', code => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', abort);
+            if (failed)
+                return;
+            if (code === 0)
+                resolve(output);
+            else
+                reject(new Error(`Container failed (${code}): ${errors || output.slice(0, 4000)}`));
+        });
+        child.stdin.end(input);
+    });
+}
+export async function requireDocker() {
+    if (process.platform === 'linux' && process.getuid?.() === 0)
+        throw new Error('Run the A2A backend as a non-root user so private workspace permissions match the container user');
+    // Bind sources must refer to this computer, never an unrelated remote daemon.
+    if (process.env['DOCKER_HOST'] && !/^(npipe:|unix:)/.test(process.env['DOCKER_HOST']))
+        throw new Error('A local Docker engine is required');
+    const context = JSON.parse(await docker(['context', 'inspect']));
+    if (!/^(npipe:|unix:)/.test(context[0]?.Endpoints?.docker?.Host ?? ''))
+        throw new Error('A local Docker context is required');
+    const info = JSON.parse(await docker(['info', '--format', '{{json .}}']));
+    if (info.OSType !== 'linux')
+        throw new Error('Linux containers are required');
+    try {
+        await docker(['image', 'inspect', VISITOR_IMAGE]);
+    }
+    catch {
+        throw new Error(`Missing ${VISITOR_IMAGE}. Build the runtime with: docker build -t ${VISITOR_IMAGE} <dsh-a2a>/docker`);
+    }
+}
+export async function containerArgs(name, dataRoot, workRoot, worker) {
+    const [data, work, script] = await Promise.all([realpath(dataRoot), realpath(workRoot), realpath(worker)]);
+    if (contains(data, work) || contains(work, data))
+        throw new Error('Public data and private workspace must be disjoint');
+    if ([data, work, script].some(path => /[,\r\n]/.test(path)))
+        throw new Error('Docker mount paths cannot contain commas or newlines');
+    return ['run', '--rm', '--pull=never', '--name', name, '--label', 'talk2myagent.role=visitor-tool',
+        '--network=none', '--read-only', `--user=${process.platform === 'linux' ? `${process.getuid?.() || 1000}:${process.getgid?.() || 1000}` : '1000:1000'}`, '--cap-drop=ALL', '--security-opt=no-new-privileges',
+        '--pids-limit=64', '--memory=256m', '--cpus=1', '--workdir=/work',
+        '--tmpfs=/tmp:rw,nosuid,nodev,noexec,size=67108864,mode=1777',
+        '--mount', `type=bind,src=${data},dst=/source,readonly,bind-recursive=disabled`,
+        '--mount', `type=bind,src=${work},dst=/work,bind-recursive=disabled`,
+        '--mount', `type=bind,src=${script},dst=/opt/visitor-worker.mjs,readonly`,
+        '-i', VISITOR_IMAGE];
+}
+/** The model supplies only read arguments; never Docker flags, mounts or commands. */
+export function dockerReadTool(definition, dataRoot, workRoot, verify) {
+    return { ...definition, execute: async (raw, { signal }) => {
+            signal.throwIfAborted();
+            const release = reserveContainer();
+            const name = `a2a-read-${randomUUID()}`;
+            let started = false;
+            try {
+                await verify();
+                signal.throwIfAborted();
+                const compiled = fileURLToPath(new URL('./visitor-worker.mjs', import.meta.url));
+                const worker = existsSync(compiled) ? compiled : fileURLToPath(new URL('../lib/visitor-worker.mjs', import.meta.url));
+                const args = await containerArgs(name, dataRoot, workRoot, worker);
+                started = true;
+                const output = await docker([...args, 'node', '/opt/visitor-worker.mjs'], JSON.stringify(raw), signal);
+                const response = JSON.parse(output);
+                if (response.error || response.result === undefined)
+                    throw new Error(response.error ?? 'Invalid worker response');
+                return response.result;
+            }
+            finally {
+                // Killing the Docker CLI alone does not terminate its container.
+                if (started)
+                    await docker(['rm', '-f', name], '', undefined, 10_000).catch(() => { });
+                release();
+            }
+        } };
+}
+//# sourceMappingURL=docker-executor.js.map

package/lib/docker-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-executor.js","sourceRoot":"","sources":["../src/docker-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEpC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC,MAAM,CAAC,MAAM,aAAa,GAAG,oCAAoC,CAAA;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AACvC,IAAI,gBAAgB,GAAG,CAAC,CAAA;AAExB,mFAAmF;AACnF,MAAM,UAAU,gBAAgB;IAC9B,IAAI,gBAAgB,IAAI,sBAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC1G,gBAAgB,EAAE,CAAA;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC;QAAC,gBAAgB,EAAE,CAAA;IAAC,CAAC,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,KAAK,GAAG,EAAE,EAAE,MAAoB,EAAE,SAAS,GAAG,MAAM;IAC/F,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3F,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,CAAA;QAC5C,MAAM,IAAI,GAAG,CAAC,KAAY,EAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC,CAAC,CAAC,CAAA;QACpG,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA;QACzE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;QAC3F,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAA;QAC5B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACnF,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO;YAAE,IAAI,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC9I,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACpF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAChE,IAAI,MAAM;gBAAE,OAAM;YAClB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAA;;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1F,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAA;IACjL,8EAA8E;IAC9E,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IAC3I,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAA0D,CAAA;IACzH,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IAC7H,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAuB,CAAA;IAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC7E,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;IAAC,CAAC;IACzD,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,WAAW,aAAa,6CAA6C,aAAa,mBAAmB,CAAC,CAAA;IAAC,CAAC;AAClI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB,EAAE,MAAc;IAClG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC1G,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvH,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACpI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,gCAAgC;QAChG,gBAAgB,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,gBAAgB,EAAE,kCAAkC;QAC7M,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB;QACjE,6DAA6D;QAC7D,SAAS,EAAE,iBAAiB,IAAI,+CAA+C;QAC/E,SAAS,EAAE,iBAAiB,IAAI,oCAAoC;QACpE,SAAS,EAAE,iBAAiB,MAAM,uCAAuC;QACzE,IAAI,EAAE,aAAa,CAAC,CAAA;AACxB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,UAA0B,EAAE,QAAgB,EAAE,QAAgB,EAAE,MAA2B;IACxH,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzD,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;YAClC,MAAM,IAAI,GAAG,YAAY,UAAU,EAAE,EAAE,CAAA;YACvC,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,EAAE,CAAA;gBACd,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;gBACrH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;gBAClE,OAAO,GAAG,IAAI,CAAA;gBACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,yBAAyB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;gBACtG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAyC,CAAA;gBAC3E,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAA;gBACjH,OAAO,QAAQ,CAAC,MAAM,CAAA;YACxB,CAAC;oBAAS,CAAC;gBACT,iEAAiE;gBACjE,IAAI,OAAO;oBAAE,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACpF,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,EAAE,CAAA;AACL,CAAC"}

package/lib/index.d.ts

@@ -1,38 +1,8 @@
-/**
- * Inbound A2A protocol server for DeepSeek Harness.
- *
- * Publishes an Agent Card at a well-known URI and serves the A2A v1.0 JSON-RPC
- * binding, so any compliant peer that knows this deployment's URL can discover
- * it and submit tasks to a harness agent. There is no outbound client: this
- * plugin never connects to another agent.
- *
- * v1.0 is the ONLY protocol version served. The v0.3 method names, `kind`
- * discriminators, and lowercase enums are gone rather than aliased: a reply
- * this server produces is v1.0 JSON, and a v0.3 client could not read it, so
- * answering a v0.3 request would fail further from its cause than refusing it.
- *
- * It is a TRANSPORT ADAPTER, not a capability seam — the same self-limitation
- * `dsh-acp` states. It exposes no editor navigation, transcript replay,
- * commands, modes, or tool presentation.
- *
- * @module dsh-a2a-server
- */
 import type { Context } from '@deepseek-ai/cordis';
 import { Config, type A2AServerConfig } from './config.ts';
 export { Config };
 export type { A2AServerConfig };
 export declare const name = "a2a-server";
-/**
- * The server creates and owns agents, needs an HTTP carrier for its routes, and
- * cannot authenticate a single request without the credential seam. Everything
- * else it uses is probed with `ctx.get()` so a composition missing an optional
- * capability still boots with A2A serving.
- */
 export declare const inject: string[];
-/**
- * Mount the inbound A2A server.
- * @param ctx - the Cordis context carrying the agent factory, HTTP carrier, and credentials.
- * @param config - the validated plugin configuration.
- */
-export declare function apply(ctx: Context, config: A2AServerConfig): void;
+export declare function apply(ctx: Context, config: A2AServerConfig): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAelD,OAAO,EAAwB,MAAM,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA;AAehF,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,YAAY,EAAE,eAAe,EAAE,CAAA;AAE/B,eAAO,MAAM,IAAI,eAAe,CAAA;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,MAAM,UAAyC,CAAA;AAW5D;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CA6gBjE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AASlD,OAAO,EAAwB,MAAM,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA;AAuBhF,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,YAAY,EAAE,eAAe,EAAE,CAAA;AAC/B,eAAO,MAAM,IAAI,eAAe,CAAA;AAGhC,eAAO,MAAM,MAAM,UAAkE,CAAA;AAKrF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgbhF"}