macro-agent 0.2.4 → 0.2.6

package/dist/activity/watcher.js

@@ -0,0 +1,212 @@
+/**
+ * Activity Watcher
+ *
+ * Monitors events and triggers agent waking based on relevance.
+ * Central coordination point for activity-based waking.
+ *
+ * @module activity/watcher
+ * @see s-9rld In-Flight Steering spec section 3.4
+ */
+import { DEFAULT_ACTIVITY_WATCHER_CONFIG } from "./types.js";
+import { findRelevantAgents, } from "./relevance.js";
+import { createDeduplicator, } from "./deduplication.js";
+// =============================================================================
+// Implementation
+// =============================================================================
+/**
+ * Create an activity watcher instance.
+ */
+export function createActivityWatcher(agentSource, wakeHandler, config = {}) {
+    const cfg = { ...DEFAULT_ACTIVITY_WATCHER_CONFIG, ...config };
+    // State
+    let running = false;
+    let watchedEventTypes = cfg.eventTypes ?? [];
+    const subscriptions = new Map();
+    const customRules = [];
+    const activityListeners = new Set();
+    // Deduplicator
+    const deduplicator = cfg.enableDeduplication
+        ? createDeduplicator({ windowMs: cfg.deduplicationWindowMs })
+        : null;
+    // ─────────────────────────────────────────────────────────────────────────
+    // Lifecycle
+    // ─────────────────────────────────────────────────────────────────────────
+    function start() {
+        running = true;
+    }
+    function stop() {
+        running = false;
+    }
+    function isRunning() {
+        return running;
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Event Type Configuration
+    // ─────────────────────────────────────────────────────────────────────────
+    function setEventTypes(types) {
+        watchedEventTypes = [...types];
+    }
+    function getEventTypes() {
+        return [...watchedEventTypes];
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Subscription Management
+    // ─────────────────────────────────────────────────────────────────────────
+    function subscribe(subscription) {
+        const existing = subscriptions.get(subscription.agentId) ?? [];
+        // Check for duplicate subscription
+        const isDuplicate = existing.some((s) => JSON.stringify(s.eventTypes.sort()) ===
+            JSON.stringify(subscription.eventTypes.sort()) &&
+            JSON.stringify(s.scope) === JSON.stringify(subscription.scope));
+        if (!isDuplicate) {
+            subscriptions.set(subscription.agentId, [...existing, subscription]);
+        }
+    }
+    function unsubscribe(agentId, eventTypes) {
+        if (!eventTypes) {
+            // Remove all subscriptions for agent
+            subscriptions.delete(agentId);
+            return;
+        }
+        const existing = subscriptions.get(agentId);
+        if (!existing)
+            return;
+        // Remove subscriptions matching the event types
+        const remaining = existing.filter((s) => !eventTypes.some((et) => s.eventTypes.includes(et)) ||
+            s.eventTypes.filter((et) => !eventTypes.includes(et)).length > 0);
+        if (remaining.length === 0) {
+            subscriptions.delete(agentId);
+        }
+        else {
+            subscriptions.set(agentId, remaining);
+        }
+    }
+    function getSubscriptionsForAgent(agentId) {
+        return subscriptions.get(agentId) ?? [];
+    }
+    // Subscription source adapter for relevance detection
+    const subscriptionSource = {
+        getSubscribers(eventType) {
+            const result = [];
+            for (const [, agentSubs] of subscriptions) {
+                for (const sub of agentSubs) {
+                    if (sub.eventTypes.length === 0 || sub.eventTypes.includes(eventType)) {
+                        result.push(sub);
+                    }
+                }
+            }
+            return result;
+        },
+    };
+    // ─────────────────────────────────────────────────────────────────────────
+    // Relevance Rules
+    // ─────────────────────────────────────────────────────────────────────────
+    function addRelevanceRule(rule) {
+        if (!customRules.includes(rule)) {
+            customRules.push(rule);
+        }
+    }
+    function removeRelevanceRule(rule) {
+        const idx = customRules.indexOf(rule);
+        if (idx >= 0) {
+            customRules.splice(idx, 1);
+        }
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Activity Processing
+    // ─────────────────────────────────────────────────────────────────────────
+    async function processActivity(activity) {
+        // Check if we're watching this event type
+        if (watchedEventTypes.length > 0 &&
+            !watchedEventTypes.includes(activity.type)) {
+            return [];
+        }
+        // Notify activity listeners (for wait_for_activity)
+        for (const listener of activityListeners) {
+            try {
+                listener(activity);
+            }
+            catch {
+                // Ignore listener errors
+            }
+        }
+        // If not running, don't wake agents
+        if (!running) {
+            return [];
+        }
+        // Find relevant agents
+        const relevantAgents = findRelevantAgents(activity, agentSource, subscriptionSource, { customRules });
+        // Wake each relevant agent
+        const results = [];
+        const priority = activity.priority ?? cfg.defaultPriority ?? "normal";
+        for (const agentId of relevantAgents) {
+            // Check deduplication
+            if (deduplicator && !deduplicator.shouldNotify(agentId, activity)) {
+                results.push({ success: true, method: "queued", reason: "no_session" });
+                continue;
+            }
+            try {
+                const result = await wakeHandler(agentId, activity, priority);
+                results.push(result);
+            }
+            catch (error) {
+                results.push({
+                    success: false,
+                    reason: "error",
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return results;
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Activity Listeners (for wait_for_activity)
+    // ─────────────────────────────────────────────────────────────────────────
+    function addActivityListener(listener) {
+        activityListeners.add(listener);
+        return () => activityListeners.delete(listener);
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Stats
+    // ─────────────────────────────────────────────────────────────────────────
+    function getStats() {
+        if (!deduplicator) {
+            return { slots: 0, suppressed: 0 };
+        }
+        const stats = deduplicator.getStats();
+        return { slots: stats.totalSlots, suppressed: stats.totalSuppressed };
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Return Interface
+    // ─────────────────────────────────────────────────────────────────────────
+    return {
+        start,
+        stop,
+        isRunning,
+        setEventTypes,
+        getEventTypes,
+        subscribe,
+        unsubscribe,
+        getSubscriptions: getSubscriptionsForAgent,
+        addRelevanceRule,
+        removeRelevanceRule,
+        processActivity,
+        addActivityListener,
+        getStats,
+    };
+}
+// =============================================================================
+// Helper: Subscribe Agent to Event Types
+// =============================================================================
+/**
+ * Helper to subscribe an agent to specific event types with optional scope.
+ */
+export function subscribeAgentToEvents(watcher, agentId, eventTypes, scope, priority) {
+    watcher.subscribe({
+        agentId,
+        eventTypes,
+        scope,
+        priority,
+    });
+}
+//# sourceMappingURL=watcher.js.map

package/dist/activity/watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.js","sourceRoot":"","sources":["../../src/activity/watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AA0D5B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAiC,EACjC,WAAwB,EACxB,SAAyC,EAAE;IAE3C,MAAM,GAAG,GAAG,EAAE,GAAG,+BAA+B,EAAE,GAAG,MAAM,EAAE,CAAC;IAE9D,QAAQ;IACR,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,iBAAiB,GAAwB,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC9D,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEtD,eAAe;IACf,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB;QAC1C,CAAC,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC;IAET,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,SAAS,KAAK;QACZ,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,SAAS,IAAI;QACX,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAC5E,2BAA2B;IAC3B,4EAA4E;IAE5E,SAAS,aAAa,CAAC,KAA0B;QAC/C,iBAAiB,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,aAAa;QACpB,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,SAAS,SAAS,CAAC,YAA+B;QAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAE/D,mCAAmC;QACnC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CACjE,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,SAAS,WAAW,CAAC,OAAgB,EAAE,UAAgC;QACrE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,qCAAqC;YACrC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,gDAAgD;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CACnE,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,SAAS,wBAAwB,CAAC,OAAgB;QAChD,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,sDAAsD;IACtD,MAAM,kBAAkB,GAAG;QACzB,cAAc,CAAC,SAA4B;YACzC,MAAM,MAAM,GAAwB,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC1C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;oBAC5B,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;wBACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IAEF,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E,SAAS,gBAAgB,CAAC,IAAmB;QAC3C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,SAAS,mBAAmB,CAAC,IAAmB;QAC9C,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAE5E,KAAK,UAAU,eAAe,CAAC,QAAkB;QAC/C,0CAA0C;QAC1C,IACE,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAyB,CAAC,EAC/D,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,oDAAoD;QACpD,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,uBAAuB;QACvB,MAAM,cAAc,GAAG,kBAAkB,CACvC,QAAQ,EACR,WAAW,EACX,kBAAkB,EAClB,EAAE,WAAW,EAAE,CAChB,CAAC;QAEF,2BAA2B;QAC3B,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC,eAAe,IAAI,QAAQ,CAAC;QAEtE,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,sBAAsB;YACtB,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC;oBACX,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAE5E,SAAS,mBAAmB,CAAC,QAA0B;QACrD,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,QAAQ;IACR,4EAA4E;IAE5E,SAAS,QAAQ;QACf,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAE5E,OAAO;QACL,KAAK;QACL,IAAI;QACJ,SAAS;QACT,aAAa;QACb,aAAa;QACb,SAAS;QACT,WAAW;QACX,gBAAgB,EAAE,wBAAwB;QAC1C,gBAAgB;QAChB,mBAAmB;QACnB,eAAe;QACf,mBAAmB;QACnB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,OAAgB,EAChB,UAA+B,EAC/B,KAA8B,EAC9B,QAA0B;IAE1B,OAAO,CAAC,SAAS,CAAC;QAChB,OAAO;QACP,UAAU;QACV,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/federation.d.ts

@@ -64,8 +64,15 @@ export interface FederationPeer {
  *
  * When a remote instance sends a spawn request via inbox, this handler
  * spawns the agent locally and sends a confirmation back.
+ *
+ * Spawns are honored only for senders on an explicitly allowlisted remote
+ * system (`allowedSystems`). This fails closed: an empty/omitted allowlist
+ * rejects every request. It is deliberately stricter than agent-inbox's
+ * transport trust (which treats an empty allowlist as open federation) and
+ * also blocks a local agent from driving a spawn through this path, which
+ * would otherwise bypass the MCP capability gate.
  */
-export declare function createRemoteSpawnHandler(agentManager: AgentManager, inboxAdapter: InboxAdapter, systemId: string): (event: InboxDeliveryEvent) => Promise<void>;
+export declare function createRemoteSpawnHandler(agentManager: AgentManager, inboxAdapter: InboxAdapter, systemId: string, allowedSystems?: string[]): (event: InboxDeliveryEvent) => Promise<void>;
 /**
  * Set up federation for a macro-agent instance.
  *

package/dist/adapters/federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/adapters/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAM9D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IAEjB,mCAAmC;IACnC,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IAEzB,mBAAmB;IACnB,KAAK,CAAC,EAAE;QACN,oDAAoD;QACpD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM,IAEF,OAAO,kBAAkB,mBA8DxC;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,gBAAgB,GACvB,MAAM,IAAI,CAoBZ"}
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/adapters/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAM9D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IAEjB,mCAAmC;IACnC,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IAEzB,mBAAmB;IACnB,KAAK,CAAC,EAAE;QACN,oDAAoD;QACpD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,EAAE,IAEX,OAAO,kBAAkB,mBA8ExC;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,gBAAgB,GACvB,MAAM,IAAI,CAqBZ"}

package/dist/adapters/federation.js

@@ -38,13 +38,33 @@
 // =============================================================================
 // Remote Spawn Handler
 // =============================================================================
+/**
+ * Extract the system id from a federated sender address (`agentId@systemId`).
+ * Returns `undefined` for a local sender (no `@systemId` suffix).
+ */
+function parseSenderSystem(senderId) {
+    if (!senderId)
+        return undefined;
+    const at = senderId.lastIndexOf("@");
+    if (at < 0)
+        return undefined;
+    const system = senderId.slice(at + 1);
+    return system.length > 0 ? system : undefined;
+}
 /**
  * Handle incoming remote_spawn_request events from federated instances.
  *
  * When a remote instance sends a spawn request via inbox, this handler
  * spawns the agent locally and sends a confirmation back.
+ *
+ * Spawns are honored only for senders on an explicitly allowlisted remote
+ * system (`allowedSystems`). This fails closed: an empty/omitted allowlist
+ * rejects every request. It is deliberately stricter than agent-inbox's
+ * transport trust (which treats an empty allowlist as open federation) and
+ * also blocks a local agent from driving a spawn through this path, which
+ * would otherwise bypass the MCP capability gate.
  */
-export function createRemoteSpawnHandler(agentManager, inboxAdapter, systemId) {
+export function createRemoteSpawnHandler(agentManager, inboxAdapter, systemId, allowedSystems) {
     return async (event) => {
         const { message } = event;
         const content = message.content;
@@ -54,6 +74,17 @@ export function createRemoteSpawnHandler(agentManager, inboxAdapter, systemId) {
             event.agentId !== `system@${systemId}`) {
             return;
         }
+        // Fail-closed sender validation (see the JSDoc above).
+        const senderSystem = parseSenderSystem(message.sender_id);
+        if (!senderSystem) {
+            console.warn(`[federation] Rejected remote_spawn_request from non-federated sender '${message.sender_id}'`);
+            return;
+        }
+        if (!allowedSystems || !allowedSystems.includes(senderSystem)) {
+            console.warn(`[federation] Rejected remote_spawn_request from untrusted system '${senderSystem}' ` +
+                `(allowedSystems: ${allowedSystems && allowedSystems.length ? allowedSystems.join(", ") : "none"})`);
+            return;
+        }
         const data = content.data;
         if (!data?.task)
             return;
@@ -104,7 +135,7 @@ export function createRemoteSpawnHandler(agentManager, inboxAdapter, systemId) {
  * Returns a cleanup function.
  */
 export function setupFederation(agentManager, inboxAdapter, config) {
-    const handler = createRemoteSpawnHandler(agentManager, inboxAdapter, config.systemId);
+    const handler = createRemoteSpawnHandler(agentManager, inboxAdapter, config.systemId, config.trust?.allowedSystems);
     inboxAdapter.onDelivery(handler);
     // Register "system" as a virtual agent for receiving federation requests
     inboxAdapter.registerAgent(`system@${config.systemId}`, {

package/dist/adapters/federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/adapters/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAmCH,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAA0B,EAC1B,YAA0B,EAC1B,QAAgB;IAEhB,OAAO,KAAK,EAAE,KAAyB,EAAE,EAAE;QACzC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAc,CAAC;QAEvC,gEAAgE;QAChE,IACE,OAAO,EAAE,IAAI,KAAK,OAAO;YACzB,OAAO,EAAE,KAAK,KAAK,sBAAsB;YACzC,KAAK,CAAC,OAAO,KAAK,UAAU,QAAQ,EAAE,EACtC,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,IAAI;YAAE,OAAO;QAExB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;gBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YAEH,sCAAsC;YACtC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,YAAY,CAAC,IAAI,CACrB,UAAU,QAAQ,EAAE,EACpB,IAAI,CAAC,WAAW,EAChB;oBACE,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,uBAAuB;oBAC9B,IAAI,EAAE;wBACJ,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,OAAO,CAAC,EAAE;wBACnB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;wBACxB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;wBACxB,QAAQ;qBACT;iBACF,EACD,EAAE,UAAU,EAAE,MAAM,EAAE,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+BAA+B;YAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,YAAY,CAAC,IAAI,CACrB,UAAU,QAAQ,EAAE,EACpB,IAAI,CAAC,WAAW,EAChB;oBACE,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,uBAAuB;oBAC9B,IAAI,EAAE;wBACJ,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACvD,QAAQ;qBACT;iBACF,EACD,EAAE,UAAU,EAAE,MAAM,EAAE,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,YAA0B,EAC1B,YAA0B,EAC1B,MAAwB;IAExB,MAAM,OAAO,GAAG,wBAAwB,CACtC,YAAY,EACZ,YAAY,EACZ,MAAM,CAAC,QAAQ,CAChB,CAAC;IAEF,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAEjC,yEAAyE;IACzE,YAAY,CAAC,aAAa,CAAC,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;KAC1D,CAAC,CAAC;IAEH,OAAO,GAAG,EAAE;QACV,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/adapters/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAmCH,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAA4B;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAA0B,EAC1B,YAA0B,EAC1B,QAAgB,EAChB,cAAyB;IAEzB,OAAO,KAAK,EAAE,KAAyB,EAAE,EAAE;QACzC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAc,CAAC;QAEvC,gEAAgE;QAChE,IACE,OAAO,EAAE,IAAI,KAAK,OAAO;YACzB,OAAO,EAAE,KAAK,KAAK,sBAAsB;YACzC,KAAK,CAAC,OAAO,KAAK,UAAU,QAAQ,EAAE,EACtC,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,yEAAyE,OAAO,CAAC,SAAS,GAAG,CAC9F,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,CACV,qEAAqE,YAAY,IAAI;gBACnF,oBAAoB,cAAc,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CACtG,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,IAAI;YAAE,OAAO;QAExB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;gBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YAEH,sCAAsC;YACtC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,YAAY,CAAC,IAAI,CACrB,UAAU,QAAQ,EAAE,EACpB,IAAI,CAAC,WAAW,EAChB;oBACE,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,uBAAuB;oBAC9B,IAAI,EAAE;wBACJ,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,OAAO,CAAC,EAAE;wBACnB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;wBACxB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;wBACxB,QAAQ;qBACT;iBACF,EACD,EAAE,UAAU,EAAE,MAAM,EAAE,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+BAA+B;YAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,YAAY,CAAC,IAAI,CACrB,UAAU,QAAQ,EAAE,EACpB,IAAI,CAAC,WAAW,EAChB;oBACE,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,uBAAuB;oBAC9B,IAAI,EAAE;wBACJ,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACvD,QAAQ;qBACT;iBACF,EACD,EAAE,UAAU,EAAE,MAAM,EAAE,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,YAA0B,EAC1B,YAA0B,EAC1B,MAAwB;IAExB,MAAM,OAAO,GAAG,wBAAwB,CACtC,YAAY,EACZ,YAAY,EACZ,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,KAAK,EAAE,cAAc,CAC7B,CAAC;IAEF,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAEjC,yEAAyE;IACzE,YAAY,CAAC,aAAa,CAAC,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;KAC1D,CAAC,CAAC;IAEH,OAAO,GAAG,EAAE;QACV,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC"}

package/dist/agent/agent-manager-v2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-manager-v2.d.ts","sourceRoot":"","sources":["../../src/agent/agent-manager-v2.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,EAGX,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,iBAAiB,EAelB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAIlE,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,uBAAuB,CAAC;AAMzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAoFzE,oEAAoE;AACpE,UAAU,kBAAkB;IAC1B,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CACf,YAAY,EAAE,iBAAiB,KAC5B,OAAO,oBAAoB,EAAE,OAAO,GAAG,SAAS,CAAC;CACvD;AAMD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,MAAM,GAAE,oBAAyB,GAChC,YAAY,CA0xDd"}
+{"version":3,"file":"agent-manager-v2.d.ts","sourceRoot":"","sources":["../../src/agent/agent-manager-v2.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,EAGX,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,iBAAiB,EAelB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAIlE,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,uBAAuB,CAAC;AAMzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAoFzE,oEAAoE;AACpE,UAAU,kBAAkB;IAC1B,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CACf,YAAY,EAAE,iBAAiB,KAC5B,OAAO,oBAAoB,EAAE,OAAO,GAAG,SAAS,CAAC;CACvD;AAMD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,MAAM,GAAE,oBAAyB,GAChC,YAAY,CAi7Dd"}