melchizedek-agents 0.16.2 → 0.17.0

package/dist/lib/storage/postgres/index.js

@@ -19,6 +19,7 @@ import { PostgresSessionService } from './sessionService.js';
 import { PostgresTaskStore, reapExpiredTasks, renewTaskLeases } from './taskStore.js';
 import { postgresTaskBackend } from './taskQueue.js';
 import { searchPathOption } from '../schema.js';
+import { POSTGRES_RLS_QUERY, evaluatePostgresRls } from '../rlsStatus.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { hostname } from 'node:os';
 export { PostgresSessionService } from './sessionService.js';
@@ -121,6 +122,16 @@ export function postgresStorage(options) {
                 throw err;
             }
         },
+        async rlsHardening() {
+            try {
+                const r = await pool.query(POSTGRES_RLS_QUERY);
+                const row = r.rows[0];
+                return evaluatePostgresRls({ apiRoles: row.api_roles, schema: row.schema, rows: row.rows });
+            }
+            catch (err) {
+                return { applied: false, detail: `hardening check failed: ${err instanceof Error ? err.message : String(err)}` };
+            }
+        },
         async erase(scopeKey, eraseOptions = {}) {
             if (!scopeKey?.trim())
                 throw new Error('erase: a scope key is required');

package/dist/lib/storage/rlsStatus.d.ts

@@ -0,0 +1,45 @@
+/**
+ * lib/storage/rlsStatus.ts — is db/hardening.sql in force? One set of rules
+ * for both storage paths.
+ *
+ * WHY: a Supabase project exposes the tables in `public` through its REST
+ * API, readable and writable with the published anon key wherever row-level
+ * security is off. The server refuses to start on a public deployment
+ * without the hardening (ADR 0021). The supabase-js path asked
+ * melchizedek_rls_status(); the DATABASE_URL path asked nothing, so a
+ * deployment that followed the recommended setup never had the check.
+ *
+ * Both paths now read the same rows and judge them here:
+ *   - adk_memory_facts and adk_sessions must have RLS on;
+ *   - adk_agent_registry, where it exists, must too (anon write access there
+ *     is agent takeover);
+ *   - adk_telemetry without RLS is reported but does not fail the check.
+ */
+export interface RlsHardeningStatus {
+    /** true when db/hardening.sql is in force, or when nothing exposes the tables. */
+    applied: boolean;
+    /** Human-readable explanation for logs. */
+    detail: string;
+}
+export interface RlsRow {
+    table_name: string;
+    rls_enabled: boolean;
+}
+/** Judge the RLS flags of the shipped tables. */
+export declare function evaluateRlsRows(rows: RlsRow[]): RlsHardeningStatus;
+/** What a direct Postgres connection sees: the API roles, the schema, and the flags. */
+export interface PostgresRlsFacts {
+    /** True when the Supabase API roles (anon, authenticated) exist. */
+    apiRoles: boolean;
+    /** The schema the tables live in (first on the search_path). */
+    schema: string;
+    rows: RlsRow[];
+}
+/**
+ * The DATABASE_URL path's judgment. Without the API roles nothing serves the
+ * tables over HTTP; in a schema other than `public` the Supabase REST API
+ * does not expose them unless someone adds that schema to it.
+ */
+export declare function evaluatePostgresRls(facts: PostgresRlsFacts): RlsHardeningStatus;
+/** The query evaluatePostgresRls reads. */
+export declare const POSTGRES_RLS_QUERY = "\n  SELECT\n    EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('anon', 'authenticated')) AS api_roles,\n    current_schema() AS schema,\n    coalesce(\n      (SELECT json_agg(json_build_object('table_name', c.relname, 'rls_enabled', c.relrowsecurity))\n       FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace\n       WHERE n.nspname = current_schema()\n         AND c.relname IN ('adk_memory_facts', 'adk_sessions', 'adk_agent_registry', 'adk_telemetry')),\n      '[]'::json\n    ) AS rows";

package/dist/lib/storage/rlsStatus.js

@@ -0,0 +1,69 @@
+/**
+ * lib/storage/rlsStatus.ts — is db/hardening.sql in force? One set of rules
+ * for both storage paths.
+ *
+ * WHY: a Supabase project exposes the tables in `public` through its REST
+ * API, readable and writable with the published anon key wherever row-level
+ * security is off. The server refuses to start on a public deployment
+ * without the hardening (ADR 0021). The supabase-js path asked
+ * melchizedek_rls_status(); the DATABASE_URL path asked nothing, so a
+ * deployment that followed the recommended setup never had the check.
+ *
+ * Both paths now read the same rows and judge them here:
+ *   - adk_memory_facts and adk_sessions must have RLS on;
+ *   - adk_agent_registry, where it exists, must too (anon write access there
+ *     is agent takeover);
+ *   - adk_telemetry without RLS is reported but does not fail the check.
+ */
+/** Judge the RLS flags of the shipped tables. */
+export function evaluateRlsRows(rows) {
+    const unprotected = ['adk_memory_facts', 'adk_sessions'].filter((t) => !rows.some((r) => r.table_name === t && r.rls_enabled));
+    if (unprotected.length > 0) {
+        return { applied: false, detail: `RLS is disabled on: ${unprotected.join(', ')}` };
+    }
+    const registryRow = rows.find((r) => r.table_name === 'adk_agent_registry');
+    if (registryRow && !registryRow.rls_enabled) {
+        return {
+            applied: false,
+            detail: 'RLS is disabled on: adk_agent_registry (agent definitions are '
+                + 'writable with the anon key) — re-run db/hardening.sql',
+        };
+    }
+    const telemetryRow = rows.find((r) => r.table_name === 'adk_telemetry');
+    if (telemetryRow && !telemetryRow.rls_enabled) {
+        return {
+            applied: true,
+            detail: 'RLS enabled on adk_memory_facts and adk_sessions — but NOT on adk_telemetry; re-run db/hardening.sql',
+        };
+    }
+    return { applied: true, detail: 'RLS enabled on adk_memory_facts and adk_sessions' };
+}
+/**
+ * The DATABASE_URL path's judgment. Without the API roles nothing serves the
+ * tables over HTTP; in a schema other than `public` the Supabase REST API
+ * does not expose them unless someone adds that schema to it.
+ */
+export function evaluatePostgresRls(facts) {
+    if (!facts.apiRoles) {
+        return { applied: true, detail: 'no anon or authenticated role in this database, so no API exposes the tables' };
+    }
+    if (facts.schema !== 'public') {
+        return {
+            applied: true,
+            detail: `tables live in schema "${facts.schema}", which the Supabase API does not expose unless it is added to the exposed schemas`,
+        };
+    }
+    return evaluateRlsRows(facts.rows);
+}
+/** The query evaluatePostgresRls reads. */
+export const POSTGRES_RLS_QUERY = `
+  SELECT
+    EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('anon', 'authenticated')) AS api_roles,
+    current_schema() AS schema,
+    coalesce(
+      (SELECT json_agg(json_build_object('table_name', c.relname, 'rls_enabled', c.relrowsecurity))
+       FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+       WHERE n.nspname = current_schema()
+         AND c.relname IN ('adk_memory_facts', 'adk_sessions', 'adk_agent_registry', 'adk_telemetry')),
+      '[]'::json
+    ) AS rows`;

package/dist/lib/syndicateSchema.d.ts

@@ -24,6 +24,7 @@
 import { z } from 'zod';
 import type { SyndicateYamlConfig } from './loadSyndicate.ts';
 export declare const MEMORY_SYSTEMS: readonly ['internal-only', 'session-only', 'long-term'];
+export declare const SKILL_SCRIPT_MODES: readonly ['none', 'local'];
 export declare const agentSchema: z.ZodObject<{
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
@@ -61,6 +62,42 @@ export declare const agentSchema: z.ZodObject<{
     }, z.core.$loose>>;
     outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     mcp_server_url: z.ZodOptional<z.ZodString>;
+    skills: z.ZodOptional<z.ZodObject<{
+        dir: z.ZodString;
+        scripts: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            none: "none";
+        }>>;
+        tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    openapi: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        spec: z.ZodString;
+        operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        base_url: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        auth: z.ZodOptional<z.ZodObject<{
+            bearer_env: z.ZodOptional<z.ZodString>;
+            api_key: z.ZodOptional<z.ZodObject<{
+                env: z.ZodString;
+                in: z.ZodEnum<{
+                    header: "header";
+                    query: "query";
+                }>;
+                name: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    code_execution: z.ZodOptional<z.ZodLiteral<"gemini">>;
+    context: z.ZodOptional<z.ZodObject<{
+        compact_after_tokens: z.ZodNumber;
+        keep_recent_events: z.ZodOptional<z.ZodNumber>;
+        summary_model: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    examples: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        input: z.ZodString;
+        output: z.ZodString;
+    }, z.core.$strict>>>;
+    mode: z.ZodOptional<z.ZodLiteral<"task">>;
     orchestration: z.ZodOptional<z.ZodObject<{
         role: z.ZodOptional<z.ZodEnum<{
             primary: "primary";
@@ -109,6 +146,42 @@ export declare const subagentSchema: z.ZodObject<{
     }, z.core.$loose>>;
     outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     mcp_server_url: z.ZodOptional<z.ZodString>;
+    skills: z.ZodOptional<z.ZodObject<{
+        dir: z.ZodString;
+        scripts: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            none: "none";
+        }>>;
+        tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    openapi: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        spec: z.ZodString;
+        operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        base_url: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        auth: z.ZodOptional<z.ZodObject<{
+            bearer_env: z.ZodOptional<z.ZodString>;
+            api_key: z.ZodOptional<z.ZodObject<{
+                env: z.ZodString;
+                in: z.ZodEnum<{
+                    header: "header";
+                    query: "query";
+                }>;
+                name: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    code_execution: z.ZodOptional<z.ZodLiteral<"gemini">>;
+    context: z.ZodOptional<z.ZodObject<{
+        compact_after_tokens: z.ZodNumber;
+        keep_recent_events: z.ZodOptional<z.ZodNumber>;
+        summary_model: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    examples: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        input: z.ZodString;
+        output: z.ZodString;
+    }, z.core.$strict>>>;
+    mode: z.ZodOptional<z.ZodLiteral<"task">>;
     orchestration: z.ZodOptional<z.ZodObject<{
         role: z.ZodOptional<z.ZodEnum<{
             primary: "primary";
@@ -161,6 +234,42 @@ export declare const syndicateSchema: z.ZodObject<{
         }, z.core.$loose>>;
         outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         mcp_server_url: z.ZodOptional<z.ZodString>;
+        skills: z.ZodOptional<z.ZodObject<{
+            dir: z.ZodString;
+            scripts: z.ZodOptional<z.ZodEnum<{
+                local: "local";
+                none: "none";
+            }>>;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        openapi: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            spec: z.ZodString;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            base_url: z.ZodOptional<z.ZodString>;
+            prefix: z.ZodOptional<z.ZodString>;
+            auth: z.ZodOptional<z.ZodObject<{
+                bearer_env: z.ZodOptional<z.ZodString>;
+                api_key: z.ZodOptional<z.ZodObject<{
+                    env: z.ZodString;
+                    in: z.ZodEnum<{
+                        header: "header";
+                        query: "query";
+                    }>;
+                    name: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+        code_execution: z.ZodOptional<z.ZodLiteral<"gemini">>;
+        context: z.ZodOptional<z.ZodObject<{
+            compact_after_tokens: z.ZodNumber;
+            keep_recent_events: z.ZodOptional<z.ZodNumber>;
+            summary_model: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        examples: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            input: z.ZodString;
+            output: z.ZodString;
+        }, z.core.$strict>>>;
+        mode: z.ZodOptional<z.ZodLiteral<"task">>;
         orchestration: z.ZodOptional<z.ZodObject<{
             role: z.ZodOptional<z.ZodEnum<{
                 primary: "primary";
@@ -203,6 +312,42 @@ export declare const syndicateSchema: z.ZodObject<{
         }, z.core.$loose>>;
         outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         mcp_server_url: z.ZodOptional<z.ZodString>;
+        skills: z.ZodOptional<z.ZodObject<{
+            dir: z.ZodString;
+            scripts: z.ZodOptional<z.ZodEnum<{
+                local: "local";
+                none: "none";
+            }>>;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        openapi: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            spec: z.ZodString;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            base_url: z.ZodOptional<z.ZodString>;
+            prefix: z.ZodOptional<z.ZodString>;
+            auth: z.ZodOptional<z.ZodObject<{
+                bearer_env: z.ZodOptional<z.ZodString>;
+                api_key: z.ZodOptional<z.ZodObject<{
+                    env: z.ZodString;
+                    in: z.ZodEnum<{
+                        header: "header";
+                        query: "query";
+                    }>;
+                    name: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+        code_execution: z.ZodOptional<z.ZodLiteral<"gemini">>;
+        context: z.ZodOptional<z.ZodObject<{
+            compact_after_tokens: z.ZodNumber;
+            keep_recent_events: z.ZodOptional<z.ZodNumber>;
+            summary_model: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        examples: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            input: z.ZodString;
+            output: z.ZodString;
+        }, z.core.$strict>>>;
+        mode: z.ZodOptional<z.ZodLiteral<"task">>;
         orchestration: z.ZodOptional<z.ZodObject<{
             role: z.ZodOptional<z.ZodEnum<{
                 primary: "primary";
@@ -227,6 +372,30 @@ export declare const syndicateSchema: z.ZodObject<{
             reason: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>;
+    workflow: z.ZodOptional<z.ZodObject<{
+        edges: z.ZodArray<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>]>>>;
+        nodes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            ask_user: z.ZodOptional<z.ZodString>;
+            schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            join: z.ZodOptional<z.ZodLiteral<true>>;
+            map: z.ZodOptional<z.ZodString>;
+            max_parallel: z.ZodOptional<z.ZodNumber>;
+            tool: z.ZodOptional<z.ZodString>;
+            route_key: z.ZodOptional<z.ZodString>;
+            retry: z.ZodOptional<z.ZodObject<{
+                max_attempts: z.ZodOptional<z.ZodNumber>;
+                initial_delay: z.ZodOptional<z.ZodNumber>;
+                max_delay: z.ZodOptional<z.ZodNumber>;
+                backoff_factor: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+            timeout: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>>;
+        max_concurrency: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    retries: z.ZodOptional<z.ZodObject<{
+        model_errors: z.ZodOptional<z.ZodNumber>;
+        tool_errors: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
     variables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     memory_system: z.ZodOptional<z.ZodEnum<{
         "internal-only": "internal-only";