managed-deepagents 0.4.0-dev.67 → 0.4.0-dev.69

package/dist/runtime/managed-tools.js

@@ -1,3 +1,4 @@
+import { resolveRuntimeChannel } from "../channels/binding.js";
 import { createCredentialsProvider, } from "./credentials.js";
 import { buildRuntimeIdentity, resolveRuntimeConfigurable, sanitizeConfigurable, } from "./identity-runtime.js";
 /**
@@ -14,6 +15,15 @@ export function managedRuntimeOverrides(runtime, cfg) {
     if (identity) {
         overrides.identity = identity;
     }
+    if (runtime?.channel) {
+        overrides.channel = runtime.channel;
+    }
+    else {
+        const fromBinding = resolveRuntimeChannel(configurable);
+        if (fromBinding) {
+            overrides.channel = fromBinding;
+        }
+    }
     if (cfg) {
         const credentials = createCredentialsProvider(cfg, identity);
         if (credentials) {

package/dist/runtime/managed-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"managed-tools.js","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAmC/B;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsC,EACtC,GAAoB;IAEpB,MAAM,SAAS,GAGX,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;YACrC,CAAC;iBAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,GAAG;oBACjB,GAAG,OAAO,CAAC,MAAM;oBACjB,YAAY,EAAE,SAAS;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAqC,EACrC,GAAoB;IAEpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAyC,EACzC,GAA+B,EAC/B,QAAiB;IAEjB,OAAO,CAAC,KAAc,EAAE,UAAmB,EAAE,MAAe,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CACX,QAAQ,EACR,KAAK,EACL,UAAU,EACV,iBAAiB,CAAC,MAAuC,EAAE,GAAG,CAAC,CAChE,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAc,EACd,GAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EACjD,WAAW,CAIZ,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,GAAG,EACH,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,SAAS,CAAC,SAAS,GAAG,gBAAgB,CACpC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,GAAG,EACH,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE;QAC1B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAc,EAAE,OAA2B,EAAE,EAAE;oBACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACxD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE;wBAC9B,CAAC,CAAC,OAAO,CACZ,CAAC;gBACJ,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,KAAmB,EACnB,GAAoB;IAEpB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"managed-tools.js","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAwC/B;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsC,EACtC,GAAoB;IAEpB,MAAM,SAAS,GAGX,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAA0C,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;YACrC,CAAC;iBAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,GAAG;oBACjB,GAAG,OAAO,CAAC,MAAM;oBACjB,YAAY,EAAE,SAAS;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAqC,EACrC,GAAoB;IAEpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAyC,EACzC,GAA+B,EAC/B,QAAiB;IAEjB,OAAO,CAAC,KAAc,EAAE,UAAmB,EAAE,MAAe,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CACX,QAAQ,EACR,KAAK,EACL,UAAU,EACV,iBAAiB,CAAC,MAAuC,EAAE,GAAG,CAAC,CAChE,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAc,EACd,GAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EACjD,WAAW,CAIZ,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,GAAG,EACH,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,SAAS,CAAC,SAAS,GAAG,gBAAgB,CACpC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,GAAG,EACH,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE;QAC1B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAc,EAAE,OAA2B,EAAE,EAAE;oBACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACxD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE;wBAC9B,CAAC,CAAC,OAAO,CACZ,CAAC;gBACJ,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,KAAmB,EACnB,GAAoB;IAEpB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/runtime/memory/context-io.d.ts

@@ -0,0 +1,5 @@
+import type { BackendProtocolV2 } from "deepagents";
+export declare function pathExists(path: string): Promise<boolean>;
+export declare function downloadContextFile(backend: BackendProtocolV2, path: string): Promise<string | undefined>;
+export declare function asText(content: string | Uint8Array): string;
+//# sourceMappingURL=context-io.d.ts.map

package/dist/runtime/memory/context-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-io.d.ts","sourceRoot":"","sources":["../../../src/runtime/memory/context-io.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAK3D"}

package/dist/runtime/memory/context-io.js

@@ -0,0 +1,28 @@
+import { access } from "node:fs/promises";
+export async function pathExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function downloadContextFile(backend, path) {
+    if (typeof backend.downloadFiles !== "function") {
+        return undefined;
+    }
+    const responses = await backend.downloadFiles([path]);
+    const response = responses?.[0];
+    if (!response || response.error || response.content == null) {
+        return undefined;
+    }
+    return asText(response.content);
+}
+export function asText(content) {
+    if (typeof content === "string") {
+        return content;
+    }
+    return new TextDecoder().decode(content);
+}
+//# sourceMappingURL=context-io.js.map

package/dist/runtime/memory/context-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-io.js","sourceRoot":"","sources":["../../../src/runtime/memory/context-io.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA0B,EAC1B,IAAY;IAEZ,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAA4B;IACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/runtime/memory/index.d.ts

@@ -0,0 +1,8 @@
+export { asText, downloadContextFile, pathExists } from "./context-io.js";
+export { managedContextBackend, managedContextPermissions, managedContextRoutes, MountedPathBackend, } from "./mounts.js";
+export type { MemoryUserMount } from "./mounts.js";
+export { ensureAbsolute, localMemoryHotPath, stripTrailingSlash, trimSlashes, } from "./paths.js";
+export { ensureIdentityMemorySlice, ensureLocalMemorySlice, ensureUserMemorySeed, LOCAL_MEMORY_SEED, } from "./seed.js";
+export { hasOrgMemory, openUserMemoryBackend, resolveMemoryRepoPrefix, resolveRunMemoryRepoHandle, } from "./user-repo.js";
+export type { UserMemoryBackend } from "./user-repo.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/memory/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/memory/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/runtime/memory/index.js

@@ -0,0 +1,6 @@
+export { asText, downloadContextFile, pathExists } from "./context-io.js";
+export { managedContextBackend, managedContextPermissions, managedContextRoutes, MountedPathBackend, } from "./mounts.js";
+export { ensureAbsolute, localMemoryHotPath, stripTrailingSlash, trimSlashes, } from "./paths.js";
+export { ensureIdentityMemorySlice, ensureLocalMemorySlice, ensureUserMemorySeed, LOCAL_MEMORY_SEED, } from "./seed.js";
+export { hasOrgMemory, openUserMemoryBackend, resolveMemoryRepoPrefix, resolveRunMemoryRepoHandle, } from "./user-repo.js";
+//# sourceMappingURL=index.js.map

package/dist/runtime/memory/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/memory/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC"}

package/dist/runtime/memory/mounts.d.ts

@@ -0,0 +1,38 @@
+import { CompositeBackend } from "deepagents";
+import type { BackendProtocolV2 } from "deepagents";
+/** How `/memories/user` is backed: a path in the deploy hub, or a whole user repo. */
+export type MemoryUserMount = {
+    kind: "path";
+    repoPrefix: string;
+} | {
+    kind: "repo";
+    backend: BackendProtocolV2;
+} | null;
+export declare function managedContextBackend(contextBackend: BackendProtocolV2, sandboxBackend: unknown | undefined, memoryUser: MemoryUserMount, mountOrgMemory: boolean): CompositeBackend;
+export declare class MountedPathBackend {
+    private readonly backend;
+    private readonly target;
+    private constructor();
+    static directory(backend: BackendProtocolV2, repoPrefix: string, visiblePrefix: string): MountedPathBackend;
+    static file(backend: BackendProtocolV2, repoFile: string, visibleFile: string): MountedPathBackend;
+    ls(path?: string): Promise<import("deepagents").LsResult>;
+    read(filePath: string, offset?: number, limit?: number): Promise<import("deepagents").ReadResult>;
+    readRaw(filePath: string): Promise<import("deepagents").ReadRawResult>;
+    grep(pattern: string, path?: string | null, glob?: string | null): Promise<import("deepagents").GrepResult>;
+    glob(pattern: string, path?: string): Promise<import("deepagents").GlobResult>;
+    write(filePath: string, content: string): Promise<import("deepagents").WriteResult>;
+    edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<import("deepagents").EditResult>;
+    uploadFiles(files: Array<[string, Uint8Array]>): Promise<import("deepagents").FileUploadResponse[]>;
+    downloadFiles(paths: string[]): Promise<import("deepagents").FileDownloadResponse[]>;
+    private optional;
+    private toRepoPath;
+    private toRepoGlob;
+    private remapPathCollections;
+    private withVisiblePath;
+    private fromRepoPath;
+    private toVisiblePath;
+    private assertFileRootPath;
+}
+export declare function managedContextRoutes(contextBackend: BackendProtocolV2, memoryUser: MemoryUserMount, mountOrgMemory: boolean): Record<string, MountedPathBackend>;
+export declare function managedContextPermissions(existing: unknown, mountOrgMemory: boolean): unknown[];
+//# sourceMappingURL=mounts.d.ts.map

package/dist/runtime/memory/mounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounts.d.ts","sourceRoot":"","sources":["../../../src/runtime/memory/mounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,YAAY,CAAC;AAC5D,OAAO,KAAK,EAAsB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMxE,sFAAsF;AACtF,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAC5C,IAAI,CAAC;AAET,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,iBAAiB,EACjC,cAAc,EAAE,OAAO,GAAG,SAAS,EACnC,UAAU,EAAE,eAAe,EAC3B,cAAc,EAAE,OAAO,oBAUxB;AAED,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,OAAO;IAOP,MAAM,CAAC,SAAS,CACd,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM;IAQvB,MAAM,CAAC,IAAI,CACT,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM;IAQf,EAAE,CAAC,IAAI,SAAM;IAKb,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;IAItD,OAAO,CAAC,QAAQ,EAAE,MAAM;IAIxB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAShE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAM;IAQhC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAKvC,IAAI,CACR,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,UAAQ;IAWd,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAa9C,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE;IAQnC,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,YAAY;IAoBpB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,kBAAkB;CAU3B;AAED,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,iBAAiB,EACjC,UAAU,EAAE,eAAe,EAC3B,cAAc,EAAE,OAAO,sCAqCxB;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,cAAc,EAAE,OAAO,GACtB,OAAO,EAAE,CAaX"}

package/dist/runtime/memory/mounts.js

@@ -0,0 +1,185 @@
+import { CompositeBackend, StateBackend } from "deepagents";
+import { ensureAbsolute, stripTrailingSlash, trimSlashes } from "./paths.js";
+export function managedContextBackend(contextBackend, sandboxBackend, memoryUser, mountOrgMemory) {
+    const routes = managedContextRoutes(contextBackend, memoryUser, mountOrgMemory);
+    const defaultBackend = (sandboxBackend ??
+        new StateBackend());
+    return new CompositeBackend(defaultBackend, routes);
+}
+export class MountedPathBackend {
+    backend;
+    target;
+    constructor(backend, target) {
+        this.backend = backend;
+        this.target = target;
+    }
+    static directory(backend, repoPrefix, visiblePrefix) {
+        return new MountedPathBackend(backend, {
+            repoPrefix: trimSlashes(repoPrefix),
+            visiblePrefix: stripTrailingSlash(ensureAbsolute(visiblePrefix)),
+        });
+    }
+    static file(backend, repoFile, visibleFile) {
+        return new MountedPathBackend(backend, {
+            repoFile: trimSlashes(repoFile),
+            visibleFile: ensureAbsolute(visibleFile),
+        });
+    }
+    async ls(path = "/") {
+        const result = await this.backend.ls(this.toRepoPath(path));
+        return this.remapPathCollections(result, "files");
+    }
+    async read(filePath, offset, limit) {
+        return this.backend.read(this.toRepoPath(filePath), offset, limit);
+    }
+    async readRaw(filePath) {
+        return this.backend.readRaw(this.toRepoPath(filePath));
+    }
+    async grep(pattern, path, glob) {
+        const result = await this.backend.grep(pattern, path === undefined || path === null ? path : this.toRepoPath(path), glob ? this.toRepoGlob(glob) : glob);
+        return this.remapPathCollections(result, "matches");
+    }
+    async glob(pattern, path = "/") {
+        const result = await this.backend.glob(this.toRepoGlob(pattern), this.toRepoPath(path));
+        return this.remapPathCollections(result, "files");
+    }
+    async write(filePath, content) {
+        const result = await this.backend.write(this.toRepoPath(filePath), content);
+        return this.withVisiblePath(result, filePath);
+    }
+    async edit(filePath, oldString, newString, replaceAll = false) {
+        const result = await this.backend.edit(this.toRepoPath(filePath), oldString, newString, replaceAll);
+        return this.withVisiblePath(result, filePath);
+    }
+    async uploadFiles(files) {
+        const upload = this.optional("uploadFiles");
+        const result = await upload(files.map(([path, content]) => [this.toRepoPath(path), content]));
+        return result.map((entry, index) => this.withVisiblePath(entry, files[index]?.[0] ?? "/"));
+    }
+    async downloadFiles(paths) {
+        const download = this.optional("downloadFiles");
+        const result = await download(paths.map((path) => this.toRepoPath(path)));
+        return result.map((entry, index) => this.withVisiblePath(entry, paths[index] ?? "/"));
+    }
+    optional(method) {
+        const fn = this.backend[method];
+        if (typeof fn !== "function") {
+            throw new Error(`Context Hub backend does not support ${method}`);
+        }
+        return fn.bind(this.backend);
+    }
+    toRepoPath(path) {
+        if ("repoFile" in this.target) {
+            this.assertFileRootPath(path);
+            return ensureAbsolute(this.target.repoFile);
+        }
+        const suffix = trimSlashes(path);
+        // Empty repoPrefix = mount the backend root (per-user Hub repos).
+        if (!this.target.repoPrefix) {
+            return ensureAbsolute(suffix);
+        }
+        const joined = suffix
+            ? `${this.target.repoPrefix}/${suffix}`
+            : this.target.repoPrefix;
+        return ensureAbsolute(joined);
+    }
+    toRepoGlob(pattern) {
+        if ("repoFile" in this.target) {
+            return pattern;
+        }
+        const suffix = trimSlashes(pattern);
+        if (!this.target.repoPrefix) {
+            return suffix;
+        }
+        return suffix
+            ? `${this.target.repoPrefix}/${suffix}`
+            : this.target.repoPrefix;
+    }
+    remapPathCollections(result, key) {
+        const value = result[key];
+        if (!value) {
+            return result;
+        }
+        return {
+            ...result,
+            [key]: value.map((entry) => ({
+                ...entry,
+                path: this.fromRepoPath(entry.path),
+            })),
+        };
+    }
+    withVisiblePath(result, backendPath) {
+        if (!("path" in result)) {
+            return result;
+        }
+        return { ...result, path: this.toVisiblePath(backendPath) };
+    }
+    fromRepoPath(path) {
+        const normalized = ensureAbsolute(path);
+        if ("repoFile" in this.target) {
+            return normalized === ensureAbsolute(this.target.repoFile)
+                ? "/"
+                : normalized;
+        }
+        if (!this.target.repoPrefix) {
+            return normalized;
+        }
+        const prefix = ensureAbsolute(this.target.repoPrefix);
+        if (normalized === prefix) {
+            return "/";
+        }
+        if (normalized.startsWith(`${prefix}/`)) {
+            return ensureAbsolute(normalized.slice(prefix.length));
+        }
+        return normalized;
+    }
+    toVisiblePath(path) {
+        if ("visibleFile" in this.target) {
+            return this.target.visibleFile;
+        }
+        const suffix = trimSlashes(path);
+        return suffix
+            ? `${this.target.visiblePrefix}/${suffix}`
+            : this.target.visiblePrefix;
+    }
+    assertFileRootPath(path) {
+        const normalized = ensureAbsolute(path);
+        if (normalized !== "/") {
+            const visible = "visibleFile" in this.target ? this.target.visibleFile : "/";
+            throw new Error(`Context Hub file mount ${visible} does not contain ${normalized}`);
+        }
+    }
+}
+export function managedContextRoutes(contextBackend, memoryUser, mountOrgMemory) {
+    const routes = {
+        "/instructions.md": MountedPathBackend.file(contextBackend, "instructions.md", "/instructions.md"),
+        "/skills/": MountedPathBackend.directory(contextBackend, "skills", "/skills"),
+    };
+    if (memoryUser?.kind === "path") {
+        // Shared agent (or legacy flat) slice inside the deployment Hub repo.
+        routes["/memories/user/"] = MountedPathBackend.directory(contextBackend, memoryUser.repoPrefix, "/memories/user");
+    }
+    else if (memoryUser?.kind === "repo") {
+        // Dedicated per-user Hub repo mounted at its root.
+        routes["/memories/user/"] = MountedPathBackend.directory(memoryUser.backend, "", "/memories/user");
+    }
+    if (mountOrgMemory) {
+        routes["/memories/org/"] = MountedPathBackend.directory(contextBackend, "org-memory", "/memories/org");
+    }
+    return routes;
+}
+export function managedContextPermissions(existing, mountOrgMemory) {
+    const deniedPaths = ["/instructions.md", "/skills/**"];
+    if (mountOrgMemory) {
+        deniedPaths.push("/memories/org/**");
+    }
+    const managed = [
+        {
+            operations: ["write"],
+            paths: deniedPaths,
+            mode: "deny",
+        },
+    ];
+    return Array.isArray(existing) ? [...managed, ...existing] : managed;
+}
+//# sourceMappingURL=mounts.js.map

package/dist/runtime/memory/mounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounts.js","sourceRoot":"","sources":["../../../src/runtime/memory/mounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAU7E,MAAM,UAAU,qBAAqB,CACnC,cAAiC,EACjC,cAAmC,EACnC,UAA2B,EAC3B,cAAuB;IAEvB,MAAM,MAAM,GAAG,oBAAoB,CACjC,cAAc,EACd,UAAU,EACV,cAAc,CACkC,CAAC;IACnD,MAAM,cAAc,GAAG,CAAC,cAAc;QACpC,IAAI,YAAY,EAAE,CAAuB,CAAC;IAC5C,OAAO,IAAI,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,kBAAkB;IAEV;IACA;IAFnB,YACmB,OAA0B,EAC1B,MAE4B;QAH5B,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAEsB;IAC5C,CAAC;IAEJ,MAAM,CAAC,SAAS,CACd,OAA0B,EAC1B,UAAkB,EAClB,aAAqB;QAErB,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE;YACrC,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC;YACnC,aAAa,EAAE,kBAAkB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CACT,OAA0B,EAC1B,QAAgB,EAChB,WAAmB;QAEnB,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC;YAC/B,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,IAAI,GAAG,GAAG;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,MAAe,EAAE,KAAc;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,IAAoB,EAAE,IAAoB;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CACpC,OAAO,EACP,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAClE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CACpC,CAAC;QACF,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,IAAI,GAAG,GAAG;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CACpC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAe;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,UAAU,GAAG,KAAK;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EACzB,SAAS,EACT,SAAS,EACT,UAAU,CACX,CAAC;QACF,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAkC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,KAAK,CAAC,GAAG,CACP,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAClB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAyB,CAC3D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAe;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,MAAS;QAET,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAsC,CAAC;IACpE,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,kEAAkE;QAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM;YACnB,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,EAAE;YACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,UAAU,CAAC,OAAe;QAChC,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,MAAM;YACX,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,EAAE;YACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;IAC7B,CAAC;IAEO,oBAAoB,CAE1B,MAAS,EAAE,GAAwB;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO;YACL,GAAG,MAAM;YACT,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,KAAK;gBACR,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;aACpC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAEO,eAAe,CACrB,MAAS,EACT,WAAmB;QAEnB,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,UAAU,KAAK,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACxD,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,UAAU,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,aAAa,CAAC,IAAY;QAChC,IAAI,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,MAAM;YACX,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,EAAE;YAC1C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;IAChC,CAAC;IAEO,kBAAkB,CAAC,IAAY;QACrC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,OAAO,GACX,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,qBAAqB,UAAU,EAAE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,cAAiC,EACjC,UAA2B,EAC3B,cAAuB;IAEvB,MAAM,MAAM,GAAuC;QACjD,kBAAkB,EAAE,kBAAkB,CAAC,IAAI,CACzC,cAAc,EACd,iBAAiB,EACjB,kBAAkB,CACnB;QACD,UAAU,EAAE,kBAAkB,CAAC,SAAS,CACtC,cAAc,EACd,QAAQ,EACR,SAAS,CACV;KACF,CAAC;IACF,IAAI,UAAU,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,sEAAsE;QACtE,MAAM,CAAC,iBAAiB,CAAC,GAAG,kBAAkB,CAAC,SAAS,CACtD,cAAc,EACd,UAAU,CAAC,UAAU,EACrB,gBAAgB,CACjB,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QACvC,mDAAmD;QACnD,MAAM,CAAC,iBAAiB,CAAC,GAAG,kBAAkB,CAAC,SAAS,CACtD,UAAU,CAAC,OAAO,EAClB,EAAE,EACF,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,gBAAgB,CAAC,GAAG,kBAAkB,CAAC,SAAS,CACrD,cAAc,EACd,YAAY,EACZ,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAiB,EACjB,cAAuB;IAEvB,MAAM,WAAW,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IACvD,IAAI,cAAc,EAAE,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG;QACd;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,MAAM;SACb;KACF,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC"}

package/dist/runtime/memory/paths.d.ts

@@ -0,0 +1,10 @@
+/** Trim leading/trailing `/` without regex (avoids CodeQL poly-ReDoS alerts). */
+export declare function trimSlashes(path: string): string;
+export declare function ensureAbsolute(path: string): string;
+export declare function stripTrailingSlash(path: string): string;
+/**
+ * Resolve ``memoryRepoPrefix/AGENTS.md`` under ``rootDir``, rejecting ``..``
+ * segments so a malicious actor id cannot escape the Context Hub mock root.
+ */
+export declare function localMemoryHotPath(rootDir: string, memoryRepoPrefix: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/runtime/memory/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/runtime/memory/paths.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAsBR"}

package/dist/runtime/memory/paths.js

@@ -0,0 +1,50 @@
+import { resolve, sep } from "node:path";
+/** Trim leading/trailing `/` without regex (avoids CodeQL poly-ReDoS alerts). */
+export function trimSlashes(path) {
+    let start = 0;
+    let end = path.length;
+    while (start < end && path.charCodeAt(start) === 47) {
+        start += 1;
+    }
+    while (end > start && path.charCodeAt(end - 1) === 47) {
+        end -= 1;
+    }
+    return path.slice(start, end);
+}
+export function ensureAbsolute(path) {
+    return `/${trimSlashes(path)}`;
+}
+export function stripTrailingSlash(path) {
+    if (path.length <= 1) {
+        return path;
+    }
+    let end = path.length;
+    while (end > 1 && path.charCodeAt(end - 1) === 47) {
+        end -= 1;
+    }
+    return path.slice(0, end);
+}
+/**
+ * Resolve ``memoryRepoPrefix/AGENTS.md`` under ``rootDir``, rejecting ``..``
+ * segments so a malicious actor id cannot escape the Context Hub mock root.
+ */
+export function localMemoryHotPath(rootDir, memoryRepoPrefix) {
+    const segments = memoryRepoPrefix
+        .split("/")
+        .filter((part) => part.length > 0);
+    for (const segment of segments) {
+        if (segment === "." || segment === "..") {
+            throw new Error(`invalid memory path segment in prefix: ${memoryRepoPrefix}`);
+        }
+    }
+    const rootResolved = resolve(rootDir);
+    const hotPath = resolve(rootResolved, ...segments, "AGENTS.md");
+    const rootPrefix = rootResolved.endsWith(sep)
+        ? rootResolved
+        : `${rootResolved}${sep}`;
+    if (!hotPath.startsWith(rootPrefix)) {
+        throw new Error(`memory slice path escapes context root: ${memoryRepoPrefix}`);
+    }
+    return hotPath;
+}
+//# sourceMappingURL=paths.js.map

package/dist/runtime/memory/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/runtime/memory/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzC,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACpD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACtD,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClD,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,gBAAwB;IAExB,MAAM,QAAQ,GAAG,gBAAgB;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,0CAA0C,gBAAgB,EAAE,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,GAAG,YAAY,GAAG,GAAG,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,2CAA2C,gBAAgB,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/runtime/memory/seed.d.ts

@@ -0,0 +1,30 @@
+import type { BackendProtocolV2 } from "deepagents";
+/** Fallback hot-memory seed when the hub has no agent/flat AGENTS.md. */
+export declare const LOCAL_MEMORY_SEED = "<!-- MANAGED-DEEPAGENTS MEMORY INSTRUCTIONS: DO NOT DELETE -->\n# Memory Instructions\n\nManaged Deep Agents mounts durable memory under `/memories/`:\n\n- `/memories/user/` \u2014 this run's private slice (read/write)\n- `/memories/org/` \u2014 optional org facts (read-only)\n\n## Hot memory \u2014 `/memories/user/AGENTS.md` (always loaded)\n\nUse this file for compact, high-value state that should be available every turn.\n\nRules:\n\n- Keep this file small. Prefer bullet points over long prose.\n- When adding new hot entries, remove or compress stale ones in the same edit.\n- Use only `read_file` / `edit_file` on `/memories/user/AGENTS.md` (not shell paths).\n- Cold files go under `/memories/user/` (for example `archive/`).\n- Do not write under `/memories/org/**`.\n- Do not store secrets, API keys, OAuth tokens, or passwords in any memory file.\n\n<!-- END MANAGED-DEEPAGENTS MEMORY INSTRUCTIONS: DO NOT DELETE -->\n";
+/**
+ * Seed `/AGENTS.md` in a per-user memory repo from the deploy agent template.
+ * First write creates the Hub repo via LangSmith `pushAgent`.
+ */
+export declare function ensureUserMemorySeed(options: {
+    userBackend: BackendProtocolV2;
+    deployBackend: BackendProtocolV2;
+    localRoot?: string;
+    deployRoot?: string;
+}): Promise<void>;
+/**
+ * Seed a missing identity memory slice (`memories/<actor|tenant>/AGENTS.md`).
+ *
+ * Copies the agent (or legacy flat) hot-memory seed when present; otherwise
+ * writes {@link LOCAL_MEMORY_SEED}. Local ``contextRoot`` mocks use the
+ * filesystem; remote Hub uses the Context Hub backend write API.
+ */
+export declare function ensureIdentityMemorySlice(options: {
+    backend: BackendProtocolV2;
+    rootDir?: string;
+    memoryRepoPrefix: string;
+}): Promise<void>;
+/**
+ * Seed a missing identity memory slice under the local Context Hub mock.
+ */
+export declare function ensureLocalMemorySlice(rootDir: string, memoryRepoPrefix: string): Promise<void>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/runtime/memory/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../../src/runtime/memory/seed.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAmDpD,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,y6BAsB7B,CAAC;AAsBF;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,iBAAiB,CAAC;IAC/B,aAAa,EAAE,iBAAiB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDhB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/runtime/memory/seed.js

@@ -0,0 +1,185 @@
+import { copyFile, mkdir, open, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { downloadContextFile, pathExists } from "./context-io.js";
+import { localMemoryHotPath, trimSlashes } from "./paths.js";
+/**
+ * True when hot memory has inject-able body text.
+ *
+ * deepagents' Python MemoryMiddleware drops `<!-- ... -->` before injection, so
+ * blank or comment-only files surface as "(No memory loaded)". Uses a linear
+ * scan (no regex) so CodeQL does not flag sanitization / ReDoS patterns.
+ */
+function hotMemoryHasBody(content) {
+    if (content === undefined) {
+        return false;
+    }
+    return nonCommentBodyLength(content) > 0;
+}
+/** Count non-whitespace characters outside HTML comments. */
+function nonCommentBodyLength(content) {
+    let i = 0;
+    let count = 0;
+    const n = content.length;
+    while (i < n) {
+        if (content.startsWith("<!--", i)) {
+            const end = content.indexOf("-->", i + 4);
+            if (end === -1) {
+                // Unclosed comment: ignore the remainder (no inject-able body).
+                break;
+            }
+            i = end + 3;
+            continue;
+        }
+        const code = content.charCodeAt(i);
+        // Whitespace: space, tab, LF, CR, FF, VT
+        if (code !== 32 &&
+            code !== 9 &&
+            code !== 10 &&
+            code !== 13 &&
+            code !== 12 &&
+            code !== 11) {
+            count += 1;
+        }
+        i += 1;
+    }
+    return count;
+}
+/** Fallback hot-memory seed when the hub has no agent/flat AGENTS.md. */
+export const LOCAL_MEMORY_SEED = `<!-- MANAGED-DEEPAGENTS MEMORY INSTRUCTIONS: DO NOT DELETE -->
+# Memory Instructions
+
+Managed Deep Agents mounts durable memory under \`/memories/\`:
+
+- \`/memories/user/\` — this run's private slice (read/write)
+- \`/memories/org/\` — optional org facts (read-only)
+
+## Hot memory — \`/memories/user/AGENTS.md\` (always loaded)
+
+Use this file for compact, high-value state that should be available every turn.
+
+Rules:
+
+- Keep this file small. Prefer bullet points over long prose.
+- When adding new hot entries, remove or compress stale ones in the same edit.
+- Use only \`read_file\` / \`edit_file\` on \`/memories/user/AGENTS.md\` (not shell paths).
+- Cold files go under \`/memories/user/\` (for example \`archive/\`).
+- Do not write under \`/memories/org/**\`.
+- Do not store secrets, API keys, OAuth tokens, or passwords in any memory file.
+
+<!-- END MANAGED-DEEPAGENTS MEMORY INSTRUCTIONS: DO NOT DELETE -->
+`;
+async function writeSeedFileExclusive(path, content) {
+    let handle;
+    try {
+        handle = await open(path, "wx", 0o600);
+    }
+    catch (err) {
+        if (err.code === "EEXIST") {
+            return;
+        }
+        throw err;
+    }
+    try {
+        await handle.writeFile(content, "utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Seed `/AGENTS.md` in a per-user memory repo from the deploy agent template.
+ * First write creates the Hub repo via LangSmith `pushAgent`.
+ */
+export async function ensureUserMemorySeed(options) {
+    const { userBackend, deployBackend, localRoot, deployRoot } = options;
+    if (localRoot !== undefined) {
+        const hotPath = join(localRoot, "AGENTS.md");
+        if (await pathExists(hotPath)) {
+            const existing = await readFile(hotPath, "utf8");
+            if (hotMemoryHasBody(existing)) {
+                return;
+            }
+        }
+        await mkdir(dirname(hotPath), { recursive: true, mode: 0o700 });
+        let seed = LOCAL_MEMORY_SEED;
+        if (deployRoot !== undefined) {
+            const agentHot = join(deployRoot, "memories", "agent", "AGENTS.md");
+            const flatHot = join(deployRoot, "memories", "AGENTS.md");
+            if (await pathExists(agentHot)) {
+                seed = await readFile(agentHot, "utf8");
+            }
+            else if (await pathExists(flatHot)) {
+                seed = await readFile(flatHot, "utf8");
+            }
+        }
+        if (await pathExists(hotPath)) {
+            // Blank / comment-only leftovers: overwrite (exclusive create would no-op).
+            await writeFile(hotPath, seed, "utf8");
+            return;
+        }
+        await writeSeedFileExclusive(hotPath, seed);
+        return;
+    }
+    if (hotMemoryHasBody(await downloadContextFile(userBackend, "/AGENTS.md"))) {
+        return;
+    }
+    const agentHot = await downloadContextFile(deployBackend, "/memories/agent/AGENTS.md");
+    const flatHot = await downloadContextFile(deployBackend, "/memories/AGENTS.md");
+    const content = agentHot !== undefined && hotMemoryHasBody(agentHot)
+        ? agentHot
+        : flatHot !== undefined && hotMemoryHasBody(flatHot)
+            ? flatHot
+            : LOCAL_MEMORY_SEED;
+    const result = await userBackend.write("/AGENTS.md", content);
+    const error = result && typeof result === "object" && "error" in result
+        ? result.error
+        : undefined;
+    if (error != null && error !== "") {
+        throw new Error(`failed to seed user hot memory: ${String(error)}`);
+    }
+}
+/**
+ * Seed a missing identity memory slice (`memories/<actor|tenant>/AGENTS.md`).
+ *
+ * Copies the agent (or legacy flat) hot-memory seed when present; otherwise
+ * writes {@link LOCAL_MEMORY_SEED}. Local ``contextRoot`` mocks use the
+ * filesystem; remote Hub uses the Context Hub backend write API.
+ */
+export async function ensureIdentityMemorySlice(options) {
+    const { backend, rootDir, memoryRepoPrefix } = options;
+    if (rootDir !== undefined) {
+        await ensureLocalMemorySlice(rootDir, memoryRepoPrefix);
+        return;
+    }
+    const hotPath = `/${trimSlashes(memoryRepoPrefix)}/AGENTS.md`;
+    if ((await downloadContextFile(backend, hotPath)) !== undefined) {
+        return;
+    }
+    const agentHot = await downloadContextFile(backend, "/memories/agent/AGENTS.md");
+    const flatHot = await downloadContextFile(backend, "/memories/AGENTS.md");
+    await backend.write(hotPath, agentHot ?? flatHot ?? LOCAL_MEMORY_SEED);
+}
+/**
+ * Seed a missing identity memory slice under the local Context Hub mock.
+ */
+export async function ensureLocalMemorySlice(rootDir, memoryRepoPrefix) {
+    const hotPath = localMemoryHotPath(rootDir, memoryRepoPrefix);
+    if (await pathExists(hotPath)) {
+        return;
+    }
+    await mkdir(dirname(hotPath), { recursive: true, mode: 0o700 });
+    const agentHot = join(rootDir, "memories", "agent", "AGENTS.md");
+    const flatHot = join(rootDir, "memories", "AGENTS.md");
+    if (await pathExists(agentHot)) {
+        await copyFile(agentHot, hotPath);
+        return;
+    }
+    if (await pathExists(flatHot)) {
+        await copyFile(flatHot, hotPath);
+        return;
+    }
+    // Exclusive create (wx) + 0600: avoids TOCTOU / symlink races under shared
+    // temp dirs (CodeQL js/insecure-temporary-file).
+    await writeSeedFileExclusive(hotPath, LOCAL_MEMORY_SEED);
+}
+//# sourceMappingURL=seed.js.map