dsh-bailinghub 0.4.0 → 0.5.0

package/lib/authorizations.js

@@ -1,3 +1,6 @@
+import { createHash } from 'node:crypto'
+import { subjectDisplayLabel, targetSubjectDisplay } from './subject-display.js'
+
 function canonical(value) {
   if (Array.isArray(value)) return value.map(canonical)
   if (value && typeof value === 'object') {
@@ -11,7 +14,7 @@ export function declarationKey(tool) {
   return JSON.stringify(canonical(tool))
 }
 
-export function sharedDeclarations(targets, limit, preferredNames = []) {
+export function sharedDeclarations(targets, limit, preferredNames = [], crossSystem = false, preferredRefs = []) {
   const grouped = new Map()
   const conflicts = new Set()
   for (const target of targets) {
@@ -19,15 +22,24 @@ export function sharedDeclarations(targets, limit, preferredNames = []) {
     if (run?.status !== 'active') continue
     for (const tool of run.activeTools) {
       const key = declarationKey(tool)
-      const existing = grouped.get(tool.name)
-      if (existing && existing.key !== key) conflicts.add(tool.name)
-      if (!existing) grouped.set(tool.name, { tool, key, targets: [] })
-      grouped.get(tool.name).targets.push(target)
+      // Identical schemas in different systems do not prove identical meaning.
+      // In a cross-system scope, also keep differing declarations within one
+      // system distinct instead of hiding an otherwise usable target's tool.
+      const identity = crossSystem ? JSON.stringify([target.authorization.systemRef, key]) : tool.name
+      const existing = grouped.get(identity)
+      if (existing && existing.key !== key) conflicts.add(identity)
+      const name = crossSystem
+        ? `bh_${createHash('sha256').update(identity).digest('hex').slice(0, 20)}_${tool.name.slice(0, 40)}` : tool.name
+      if (!existing) grouped.set(identity, { tool, key, name, identity, targets: [] })
+      grouped.get(identity).targets.push(target)
     }
   }
   const priority = new Map(preferredNames.map((name, index) => [name, index]))
-  const tools = [...grouped.values()].filter(({ tool }) => !conflicts.has(tool.name))
-    .sort((a, b) => (priority.get(a.tool.name) ?? Infinity) - (priority.get(b.tool.name) ?? Infinity))
+  const targetPriority = (entry) => crossSystem && preferredRefs.length
+    ? (entry.targets.some((target) => preferredRefs.includes(target.authorization.ref)) ? 0 : 1) : 0
+  const tools = [...grouped.values()].filter(({ identity }) => !conflicts.has(identity))
+    .sort((a, b) => targetPriority(a) - targetPriority(b) ||
+      (priority.get(a.tool.name) ?? Infinity) - (priority.get(b.tool.name) ?? Infinity))
   return { tools: tools.slice(0, limit), conflicts: [...conflicts].sort(), omitted: Math.max(0, tools.length - limit) }
 }
 
@@ -57,5 +69,8 @@ export function unwrapAuthorization(value) {
 }
 
 export function authorizedResult(target, result) {
-  return { authorization_ref: target.authorization.ref, authorization_label: target.authorization.label, result }
+  const subject = targetSubjectDisplay(target)
+  return { authorization_ref: target.authorization.ref, authorization_label: subjectDisplayLabel(subject),
+    subject_display: subject.subjectDisplay, subject_display_status: subject.subjectDisplayStatus,
+    ...(target.authorization.systemRef ? { system_ref: target.authorization.systemRef, workspace: target.workspace } : {}), result }
 }

package/lib/conversation-archive-store.js

@@ -5,7 +5,7 @@ import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { setTimeout as delay } from 'node:timers/promises'
 
-const SCHEMA = 'bailing.agent-conversation-outbox.v1'
+const SCHEMAS = new Set(['bailing.agent-conversation-outbox.v1', 'bailing.agent-conversation-outbox.v2'])
 const MAX_BYTES = 32 * 1024 * 1024
 const LOCK_TIMEOUT_MS = 1_000
 const SECRET_KEYS = new Set(['token', 'accesstoken', 'refreshtoken', 'password', 'clientsecret', 'authorization', 'credential', 'credentials'])
@@ -55,7 +55,7 @@ function snapshotJson(value, seen = new Set()) {
 
 function snapshotRecord(sessionId, record) {
   const copy = snapshotJson(record)
-  if (!copy || Array.isArray(copy) || copy.schema !== SCHEMA || copy.sessionId !== sessionId ||
+  if (!copy || Array.isArray(copy) || !SCHEMAS.has(copy.schema) || copy.sessionId !== sessionId ||
     !Number.isSafeInteger(copy.revision) || copy.revision < 1) throw storeError()
   if (Buffer.byteLength(JSON.stringify(copy)) > MAX_BYTES) throw storeError()
   return copy

package/lib/conversation-outbox.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from 'node:crypto'
 import { createFileConversationArchiveStore } from './conversation-archive-store.js'
 
 const SCHEMA = 'bailing.agent-conversation-outbox.v1'
+const TARGET_SCHEMA = 'bailing.agent-conversation-outbox.v2'
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
 const KEY = /^conn_[0-9a-f]{32}$/
 const KINDS = new Set(['turn_start', 'user_message', 'assistant_message', 'run_link', 'turn_end'])
@@ -24,25 +25,29 @@ function eventPayload(value) {
 
 function contextSnapshot(value) {
   const copy = structuredClone(value)
+  const crossSystem = copy?.binding && !Object.hasOwn(copy.binding, 'clientAppId')
   if (typeof copy?.clientConversationId !== 'string' || !copy.clientConversationId || copy.clientConversationId.length > 256 ||
-    !copy.binding || typeof copy.binding.hubUrl !== 'string' || typeof copy.binding.clientAppId !== 'string' || typeof copy.binding.workspace !== 'string' ||
+    !copy.binding || typeof copy.binding.hubUrl !== 'string' ||
+    (!crossSystem && (typeof copy.binding.clientAppId !== 'string' || typeof copy.binding.workspace !== 'string')) ||
     !Array.isArray(copy.members) || !copy.members.length || copy.members.length > 64 ||
     Object.keys(copy).some((key) => !['clientConversationId', 'binding', 'members'].includes(key)) ||
-    Object.keys(copy.binding).some((key) => !['hubUrl', 'clientAppId', 'workspace'].includes(key))) throw fail('ARCHIVE_MEMBERS_INVALID')
+    Object.keys(copy.binding).some((key) => !(crossSystem ? ['hubUrl'] : ['hubUrl', 'clientAppId', 'workspace']).includes(key))) throw fail('ARCHIVE_MEMBERS_INVALID')
   const keys = new Set()
   const identities = new Set()
   for (const member of copy.members) {
     if (!KEY.test(member?.connectionKey ?? '') || keys.has(member.connectionKey) || !UUID.test(member.expectedSessionId ?? '') ||
-      identities.has(member.expectedSessionId) || member.workspace !== copy.binding.workspace || typeof member.label !== 'string' || member.label.length > 128 ||
-      Object.keys(member).some((key) => !['connectionKey', 'workspace', 'expectedSessionId', 'label'].includes(key))) throw fail('ARCHIVE_MEMBERS_INVALID')
+      identities.has(member.expectedSessionId.toLowerCase()) ||
+      (crossSystem ? member.hubUrl !== copy.binding.hubUrl || !/^[a-z0-9][a-z0-9_-]{1,63}$/.test(member.clientAppId ?? '') || !/^[a-z0-9][a-z0-9_-]{1,63}$/.test(member.workspace ?? '')
+        : member.workspace !== copy.binding.workspace) || typeof member.label !== 'string' || member.label.length > 128 ||
+      Object.keys(member).some((key) => !['connectionKey', 'workspace', 'expectedSessionId', 'label', ...(crossSystem ? ['hubUrl', 'clientAppId'] : [])].includes(key))) throw fail('ARCHIVE_MEMBERS_INVALID')
     keys.add(member.connectionKey)
-    identities.add(member.expectedSessionId)
+    identities.add(member.expectedSessionId.toLowerCase())
   }
   return copy
 }
 
 function validateRecord(record, sessionId, context) {
-  if (!record || record.schema !== SCHEMA || record.sessionId !== sessionId || !Number.isSafeInteger(record.revision) || record.revision < 1 ||
+  if (!record || record.schema !== (Object.hasOwn(context.binding, 'clientAppId') ? SCHEMA : TARGET_SCHEMA) || record.sessionId !== sessionId || !Number.isSafeInteger(record.revision) || record.revision < 1 ||
     !UUID.test(record.clientArchiveId ?? '') || digest(contextSnapshot(record.context)) !== digest(context) ||
     !Number.isSafeInteger(record.acknowledged) || record.acknowledged < 0 || !Array.isArray(record.events) || record.acknowledged > record.events.length ||
     record.conversationId !== null && !UUID.test(record.conversationId ?? '') ||
@@ -88,7 +93,8 @@ export class ConversationOutbox {
     if (saved) entry.record = validateRecord(saved, entry.sessionId, entry.context)
     else {
       const record = {
-        schema: SCHEMA, sessionId: entry.sessionId, revision: 1, clientArchiveId: randomUUID(), context: entry.context,
+        schema: Object.hasOwn(entry.context.binding, 'clientAppId') ? SCHEMA : TARGET_SCHEMA,
+        sessionId: entry.sessionId, revision: 1, clientArchiveId: randomUUID(), context: entry.context,
         acknowledged: 0, conversationId: null, events: [], syncState: 'pending',
       }
       await this.store.save(entry.sessionId, record, null)