open-managed-agents 0.1.0

package/dist/src/control-plane/sessions/pi/sandbox/selection.js

@@ -0,0 +1,168 @@
+import { createHostPassthroughSandboxProvider, } from "./provider.js";
+import { createDockerSandboxProviderFactory, } from "./docker.js";
+import { createMicrosandboxSandboxProviderFactory } from "./microsandbox.js";
+export function parseSandboxProviderSelection(input) {
+    const obj = objectInput(input, "sandbox provider selection");
+    const type = stringField(obj, "type");
+    switch (type) {
+        case "none":
+            rejectUnknownFields(obj, ["type"]);
+            return { type };
+        case "host-passthrough": {
+            rejectUnknownFields(obj, [
+                "type",
+                "unsafeAllowHostPassthrough",
+                "envAllowlist",
+            ]);
+            const unsafeAllowHostPassthrough = obj.unsafeAllowHostPassthrough === true;
+            if (!unsafeAllowHostPassthrough) {
+                throw new Error("`unsafeAllowHostPassthrough` must be true for host-passthrough");
+            }
+            return {
+                type,
+                unsafeAllowHostPassthrough,
+                ...optionalEnvAllowlist(obj),
+            };
+        }
+        case "docker-local": {
+            rejectUnknownFields(obj, [
+                "type",
+                "envAllowlist",
+                "operationTimeoutMs",
+                "reapStaleContainersOlderThanMs",
+                "unsafeAllowHostPassthrough",
+            ]);
+            if (obj.unsafeAllowHostPassthrough !== undefined) {
+                throw new Error("`unsafeAllowHostPassthrough` is only valid for host-passthrough");
+            }
+            return {
+                type,
+                ...optionalEnvAllowlist(obj),
+                ...optionalOperationTimeoutMs(obj),
+                ...optionalReapStaleContainersOlderThanMs(obj),
+            };
+        }
+        case "microsandbox-local": {
+            rejectUnknownFields(obj, [
+                "type",
+                "operationTimeoutMs",
+                "reapStaleSandboxesOlderThanMs",
+            ]);
+            return {
+                type,
+                ...optionalOperationTimeoutMs(obj),
+                ...optionalReapStaleSandboxesOlderThanMs(obj),
+            };
+        }
+        default:
+            throw new Error(`Unsupported sandbox provider type: ${type}`);
+    }
+}
+export function resolveSandboxProviderFactory(selection, opts = {}) {
+    if (selection === undefined || selection.type === "none") {
+        rejectEgressOption(opts, selection?.type ?? "none");
+        return undefined;
+    }
+    if (selection.type === "host-passthrough") {
+        rejectEgressOption(opts, selection.type);
+        if (selection.unsafeAllowHostPassthrough !== true) {
+            throw new Error("`unsafeAllowHostPassthrough` must be true for host-passthrough");
+        }
+        if (opts.allowUnsafeHostPassthrough !== true) {
+            throw new Error("Host passthrough provider is disabled by deployment configuration");
+        }
+        if (!opts.hostPassthroughWorkspaceRoot) {
+            throw new Error("Host passthrough provider requires a deployment workspace root");
+        }
+        const workspaceRoot = opts.hostPassthroughWorkspaceRoot;
+        return async () => createHostPassthroughSandboxProvider({
+            workspaceRoot,
+            unsafeAllowHostPassthrough: selection.unsafeAllowHostPassthrough,
+            envAllowlist: selection.envAllowlist,
+        });
+    }
+    if (selection.type === "docker-local") {
+        if (opts.allowDockerLocal !== true) {
+            throw new Error("Docker-local sandbox provider is disabled by deployment configuration");
+        }
+        return createDockerSandboxProviderFactory({
+            envAllowlist: selection.envAllowlist,
+            operationTimeoutMs: selection.operationTimeoutMs,
+            reapStaleContainersOlderThanMs: selection.reapStaleContainersOlderThanMs,
+            ...(opts.egress === undefined ? {} : { egress: opts.egress }),
+            ...(opts.onReaped === undefined ? {} : { onReaped: opts.onReaped }),
+        });
+    }
+    if (selection.type === "microsandbox-local") {
+        rejectEgressOption(opts, selection.type);
+        if (opts.allowMicrosandboxLocal !== true) {
+            throw new Error("Microsandbox-local sandbox provider is disabled by deployment configuration");
+        }
+        return createMicrosandboxSandboxProviderFactory({
+            operationTimeoutMs: selection.operationTimeoutMs,
+            reapStaleSandboxesOlderThanMs: selection.reapStaleSandboxesOlderThanMs,
+            ...(opts.onReaped === undefined ? {} : { onReaped: opts.onReaped }),
+        });
+    }
+    const _exhaustive = selection;
+    throw new Error(`Unsupported sandbox provider type: ${String(_exhaustive)}`);
+}
+function rejectEgressOption(opts, providerType) {
+    if (opts.egress !== undefined) {
+        throw new Error(`egress is only supported by docker-local, not ${providerType}`);
+    }
+}
+function objectInput(input, label) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        throw new Error(`${label} must be a JSON object`);
+    }
+    return input;
+}
+function stringField(obj, field) {
+    const value = obj[field];
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    throw new Error(`\`${field}\` must be a non-empty string`);
+}
+function optionalEnvAllowlist(obj) {
+    if (obj.envAllowlist === undefined)
+        return {};
+    if (!Array.isArray(obj.envAllowlist)) {
+        throw new Error("`envAllowlist` must be an array of strings");
+    }
+    const envAllowlist = obj.envAllowlist.map((value) => {
+        if (typeof value !== "string" || value.length === 0) {
+            throw new Error("`envAllowlist` must be an array of non-empty strings");
+        }
+        return value;
+    });
+    return { envAllowlist };
+}
+function optionalOperationTimeoutMs(obj) {
+    return optionalPositiveIntegerField(obj, "operationTimeoutMs");
+}
+function optionalReapStaleContainersOlderThanMs(obj) {
+    return optionalPositiveIntegerField(obj, "reapStaleContainersOlderThanMs");
+}
+function optionalReapStaleSandboxesOlderThanMs(obj) {
+    return optionalPositiveIntegerField(obj, "reapStaleSandboxesOlderThanMs");
+}
+function optionalPositiveIntegerField(obj, field) {
+    if (obj[field] === undefined)
+        return {};
+    const value = obj[field];
+    if (typeof value !== "number" ||
+        !Number.isSafeInteger(value) ||
+        value <= 0) {
+        throw new Error(`\`${field}\` must be a positive integer`);
+    }
+    return { [field]: value };
+}
+function rejectUnknownFields(obj, allowedFields) {
+    const allowed = new Set(allowedFields);
+    for (const field of Object.keys(obj)) {
+        if (allowed.has(field))
+            continue;
+        throw new Error(`Unsupported sandbox provider field: ${field}`);
+    }
+}

package/dist/src/control-plane/sessions/pi/span-normalizer.js

@@ -0,0 +1,82 @@
+export const zeroModelUsage = {
+    cache_creation_input_tokens: 0,
+    cache_read_input_tokens: 0,
+    input_tokens: 0,
+    output_tokens: 0,
+    speed: null,
+};
+export function spanModelRequestStartDraft(input) {
+    const message = assistantMessage(input);
+    if (!message || eventType(input) !== "message_start")
+        return [];
+    if (!hasModelRequestMetadata(message))
+        return [];
+    return [{ type: "span.model_request_start", payload: {} }];
+}
+export function spanModelRequestEndDraft(input, startEventId) {
+    const message = assistantMessage(input);
+    if (!message || eventType(input) !== "message_end")
+        return [];
+    if (!startEventId)
+        return [];
+    const payload = {
+        model_request_start_id: startEventId,
+        is_error: message.stopReason === "aborted" || message.stopReason === "error",
+        model_usage: usageFromMessage(message),
+    };
+    return [{ type: "span.model_request_end", payload: toJsonObject(payload) }];
+}
+export function syntheticSpanModelRequestEndDrafts(startEventIds) {
+    return startEventIds.map((startEventId) => ({
+        type: "span.model_request_end",
+        payload: toJsonObject({
+            model_request_start_id: startEventId,
+            is_error: true,
+            model_usage: zeroModelUsage,
+        }),
+    }));
+}
+function assistantMessage(input) {
+    if (!isObject(input) || !isObject(input.message))
+        return undefined;
+    return input.message.role === "assistant" ? input.message : undefined;
+}
+function eventType(input) {
+    return isObject(input) && typeof input.type === "string" ? input.type : "";
+}
+function hasModelRequestMetadata(message) {
+    return (typeof message.api === "string" &&
+        typeof message.provider === "string" &&
+        typeof message.model === "string");
+}
+function usageFromMessage(message) {
+    if (!isObject(message.usage))
+        return zeroModelUsage;
+    return {
+        cache_creation_input_tokens: numberField(message.usage.cacheWrite),
+        cache_read_input_tokens: numberField(message.usage.cacheRead),
+        input_tokens: numberField(message.usage.input),
+        output_tokens: numberField(message.usage.output),
+        speed: speedField(message),
+    };
+}
+function speedField(message) {
+    if (message.speed === "standard" || message.speed === "fast") {
+        return message.speed;
+    }
+    if (isObject(message.model)) {
+        const speed = message.model.speed;
+        if (speed === "standard" || speed === "fast")
+            return speed;
+    }
+    return null;
+}
+function numberField(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function toJsonObject(value) {
+    return value;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/src/control-plane/sessions/pi/tool-permissions.js

@@ -0,0 +1,392 @@
+const DEFAULT_ACCESS = {
+    enabled: true,
+    permission: "allow",
+};
+const DEFAULT_TOOL_CONFIRMATION_TIMEOUT_MS = 5 * 60 * 1000;
+export class PiToolPermissionBridge {
+    opts;
+    pending = new Map();
+    publicToolUseIdsBySession = new Map();
+    suppressedPiToolUseIdsBySession = new Map();
+    permissionDeniedPiToolCallIdsBySession = new Map();
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    access(workspaceId, sessionId, toolName) {
+        return this.opts.access?.(workspaceId, sessionId, toolName) ?? DEFAULT_ACCESS;
+    }
+    wrapTool(workspaceId, sessionId, toolName, tool, getEmitter) {
+        return {
+            ...tool,
+            execute: async (piToolCallId, params, signal, onUpdate, ctx) => {
+                const access = this.access(workspaceId, sessionId, toolName);
+                if (!access.enabled) {
+                    this.markPermissionDenied(sessionId, piToolCallId);
+                    throw new Error(`Builtin tool ${toolName} is disabled`);
+                }
+                const input = isRecord(params) ? params : {};
+                const materialized = await this.publishToolUse({
+                    workspaceId,
+                    sessionId,
+                    toolName,
+                    piToolCallId,
+                    input,
+                    permission: access.permission,
+                    signal,
+                    getEmitter,
+                });
+                if (access.permission === "deny") {
+                    this.markPermissionDenied(sessionId, piToolCallId);
+                    throw new Error(`Builtin tool ${toolName} is denied by policy`);
+                }
+                if (access.permission === "ask") {
+                    if (!materialized.confirmation) {
+                        throw new Error(`Builtin tool ${toolName} confirmation was not registered`);
+                    }
+                    const confirmation = await materialized.confirmation;
+                    if (confirmation.result === "deny") {
+                        this.markPermissionDenied(sessionId, piToolCallId);
+                        throw new Error(confirmation.denyMessage ?? `Builtin tool ${toolName} was denied`);
+                    }
+                }
+                return tool.execute(piToolCallId, params, signal, onUpdate, ctx);
+            },
+        };
+    }
+    claimConfirmation(workspaceId, sessionId, event) {
+        const pending = this.pending.get(event.tool_use_id);
+        if (!pending)
+            return undefined;
+        if (pending.workspaceId !== workspaceId || pending.sessionId !== sessionId) {
+            return undefined;
+        }
+        return () => {
+            this.pending.delete(event.tool_use_id);
+            pending.cleanup();
+            pending.resolve({
+                result: event.result,
+                denyMessage: event.deny_message,
+            });
+        };
+    }
+    rejectSession(sessionId, error) {
+        for (const [id, pending] of this.pending) {
+            if (pending.sessionId !== sessionId)
+                continue;
+            this.pending.delete(id);
+            pending.cleanup();
+            pending.reject(error);
+        }
+        this.publicToolUseIdsBySession.delete(sessionId);
+        this.suppressedPiToolUseIdsBySession.delete(sessionId);
+        this.permissionDeniedPiToolCallIdsBySession.delete(sessionId);
+    }
+    publicToolUseIdForPiToolCallId(sessionId, piToolCallId) {
+        return this.publicToolUseIdsBySession.get(sessionId)?.get(piToolCallId);
+    }
+    suppressPiToolUse(sessionId, piToolCallId) {
+        return (this.suppressedPiToolUseIdsBySession.get(sessionId)?.has(piToolCallId) ===
+            true);
+    }
+    permissionDenied(sessionId, piToolCallId) {
+        return (this.permissionDeniedPiToolCallIdsBySession
+            .get(sessionId)
+            ?.has(piToolCallId) === true);
+    }
+    /**
+     * MCP variant of `publishToolUse` (plan 0122 §4.4): same id-bind-before-
+     * execute contract and the SAME pending-confirmation store — inbound
+     * `user.tool_confirmation` claims (`claimConfirmation`) work identically
+     * for MCP and builtin tools; the events service dispatch is unchanged.
+     *
+     * Extra guarantee (terminal-result rule): if the Pi signal aborts between
+     * emit and bind, the bind callback immediately emits a synthetic
+     * `oma.mcp_tool_result` so the persisted `agent.mcp_tool_use` can never be
+     * orphaned by that race.
+     */
+    async publishMcpToolUse(opts) {
+        const emit = opts.getEmitter();
+        if (!emit) {
+            throw new Error(`No active runtime consumer for MCP tool ${opts.toolName}`);
+        }
+        return new Promise((resolve, reject) => {
+            let released = false;
+            let aborted = false;
+            let toolUseId;
+            let releaseToolUseId;
+            let confirmation;
+            const cleanup = () => {
+                if (released)
+                    return;
+                released = true;
+                opts.signal?.removeEventListener("abort", onAbort);
+            };
+            const onAbort = () => {
+                aborted = true;
+                cleanup();
+                reject(new Error(`MCP tool ${opts.toolName} aborted`));
+            };
+            opts.signal?.addEventListener("abort", onAbort, { once: true });
+            try {
+                emit({
+                    type: "oma.mcp_tool_use",
+                    piToolCallId: opts.piToolCallId,
+                    mcpServerName: opts.mcpServerName,
+                    name: opts.toolName,
+                    input: opts.input,
+                    evaluatedPermission: opts.permission,
+                    bindToolUseId: (boundToolUseId, release) => {
+                        if (aborted) {
+                            // The use event was persisted after the caller already saw the
+                            // abort; close the loop with a terminal result and release.
+                            opts.getEmitter()?.({
+                                type: "oma.mcp_tool_result",
+                                mcpToolUseId: boundToolUseId,
+                                content: [
+                                    { type: "text", text: `MCP tool ${opts.toolName} aborted` },
+                                ],
+                                isError: true,
+                            });
+                            release("interrupted");
+                            return;
+                        }
+                        toolUseId = boundToolUseId;
+                        releaseToolUseId = release;
+                        this.bindPublicToolUseId(opts.sessionId, opts.piToolCallId, boundToolUseId);
+                        cleanup();
+                        confirmation =
+                            opts.permission === "ask"
+                                ? this.registerPendingConfirmation({
+                                    workspaceId: opts.workspaceId,
+                                    sessionId: opts.sessionId,
+                                    toolName: opts.toolName,
+                                    toolLabel: `MCP tool ${opts.toolName}`,
+                                    piToolCallId: opts.piToolCallId,
+                                    toolUseId: boundToolUseId,
+                                    signal: opts.signal,
+                                    releaseToolUseId: release,
+                                })
+                                : undefined;
+                        resolve({
+                            toolUseId: boundToolUseId,
+                            confirmation: confirmation?.promise,
+                        });
+                    },
+                    rejectToolUse: (error) => {
+                        if (toolUseId) {
+                            this.forgetPublicToolUseId(opts.sessionId, opts.piToolCallId);
+                            this.pending.delete(toolUseId);
+                        }
+                        if (confirmation) {
+                            confirmation.reject(error);
+                        }
+                        else {
+                            releaseToolUseId?.();
+                        }
+                        cleanup();
+                        reject(error);
+                    },
+                });
+            }
+            catch (error) {
+                cleanup();
+                reject(toError(error));
+            }
+        });
+    }
+    async publishToolUse(opts) {
+        const emit = opts.getEmitter();
+        if (!emit) {
+            throw new Error(`No active runtime consumer for builtin tool ${opts.toolName}`);
+        }
+        return new Promise((resolve, reject) => {
+            let released = false;
+            let toolUseId;
+            let releaseToolUseId;
+            let confirmation;
+            const cleanup = () => {
+                if (released)
+                    return;
+                released = true;
+                opts.signal?.removeEventListener("abort", onAbort);
+            };
+            const onAbort = () => {
+                cleanup();
+                reject(new Error(`Builtin tool ${opts.toolName} aborted`));
+            };
+            opts.signal?.addEventListener("abort", onAbort, { once: true });
+            try {
+                emit({
+                    type: "oma.tool_permission_use",
+                    piToolCallId: opts.piToolCallId,
+                    name: opts.toolName,
+                    input: opts.input,
+                    evaluatedPermission: opts.permission,
+                    bindToolUseId: (boundToolUseId, release) => {
+                        toolUseId = boundToolUseId;
+                        releaseToolUseId = release;
+                        this.bindPublicToolUseId(opts.sessionId, opts.piToolCallId, boundToolUseId);
+                        cleanup();
+                        confirmation =
+                            opts.permission === "ask"
+                                ? this.registerPendingConfirmation({
+                                    ...opts,
+                                    toolUseId: boundToolUseId,
+                                    releaseToolUseId: release,
+                                })
+                                : undefined;
+                        resolve({
+                            toolUseId: boundToolUseId,
+                            confirmation: confirmation?.promise,
+                        });
+                    },
+                    rejectToolUse: (error) => {
+                        if (toolUseId) {
+                            this.forgetPublicToolUseId(opts.sessionId, opts.piToolCallId);
+                            this.pending.delete(toolUseId);
+                        }
+                        if (confirmation) {
+                            confirmation.reject(error);
+                        }
+                        else {
+                            releaseToolUseId?.();
+                        }
+                        cleanup();
+                        reject(error);
+                    },
+                });
+            }
+            catch (error) {
+                cleanup();
+                reject(toError(error));
+            }
+        });
+    }
+    registerPendingConfirmation(opts) {
+        const label = opts.toolLabel ?? `Builtin tool ${opts.toolName}`;
+        let rejectPending;
+        const promise = new Promise((resolve, reject) => {
+            let released = false;
+            let timer;
+            const cleanup = (reason) => {
+                if (released)
+                    return;
+                released = true;
+                if (timer)
+                    clearTimeout(timer);
+                opts.signal?.removeEventListener("abort", onAbort);
+                opts.releaseToolUseId(reason);
+            };
+            const onAbort = () => {
+                this.pending.delete(opts.toolUseId);
+                cleanup("interrupted");
+                reject(new Error(`${label} aborted`));
+            };
+            opts.signal?.addEventListener("abort", onAbort, { once: true });
+            const timeoutMs = this.opts.timeoutMs ?? DEFAULT_TOOL_CONFIRMATION_TIMEOUT_MS;
+            if (timeoutMs > 0) {
+                timer = setTimeout(() => {
+                    this.pending.delete(opts.toolUseId);
+                    this.markPermissionDenied(opts.sessionId, opts.piToolCallId);
+                    cleanup("timeout");
+                    reject(Object.assign(new Error(`${label} confirmation timed out`), {
+                        omaConfirmationTimeout: true,
+                    }));
+                }, timeoutMs);
+            }
+            rejectPending = (error) => {
+                this.pending.delete(opts.toolUseId);
+                cleanup();
+                reject(error);
+            };
+            this.pending.set(opts.toolUseId, {
+                workspaceId: opts.workspaceId,
+                sessionId: opts.sessionId,
+                piToolCallId: opts.piToolCallId,
+                resolve,
+                reject,
+                cleanup,
+            });
+        });
+        return {
+            promise,
+            reject: rejectPending,
+        };
+    }
+    bindPublicToolUseId(sessionId, piToolCallId, publicToolUseId) {
+        let ids = this.publicToolUseIdsBySession.get(sessionId);
+        if (!ids) {
+            ids = new Map();
+            this.publicToolUseIdsBySession.set(sessionId, ids);
+        }
+        ids.set(piToolCallId, publicToolUseId);
+        let suppressed = this.suppressedPiToolUseIdsBySession.get(sessionId);
+        if (!suppressed) {
+            suppressed = new Set();
+            this.suppressedPiToolUseIdsBySession.set(sessionId, suppressed);
+        }
+        suppressed.add(piToolCallId);
+    }
+    forgetPublicToolUseId(sessionId, piToolCallId) {
+        const ids = this.publicToolUseIdsBySession.get(sessionId);
+        ids?.delete(piToolCallId);
+        if (ids?.size === 0)
+            this.publicToolUseIdsBySession.delete(sessionId);
+        const suppressed = this.suppressedPiToolUseIdsBySession.get(sessionId);
+        suppressed?.delete(piToolCallId);
+        if (suppressed?.size === 0) {
+            this.suppressedPiToolUseIdsBySession.delete(sessionId);
+        }
+    }
+    markPermissionDenied(sessionId, piToolCallId) {
+        let denied = this.permissionDeniedPiToolCallIdsBySession.get(sessionId);
+        if (!denied) {
+            denied = new Set();
+            this.permissionDeniedPiToolCallIdsBySession.set(sessionId, denied);
+        }
+        denied.add(piToolCallId);
+    }
+}
+export function createStoreBackedBuiltinToolAccessResolver(opts) {
+    return (workspaceId, sessionId, toolName, context) => {
+        const session = opts.sessions.retrieveAny(workspaceId, sessionId);
+        const agentId = session?.agent.id ?? context?.agentId;
+        const agentVersion = session?.agent.version ?? context?.agentVersion;
+        if (!agentId || agentVersion === undefined) {
+            return { enabled: false, permission: "deny" };
+        }
+        const agent = opts.agents.retrieveVersion(workspaceId, agentId, agentVersion);
+        if (!agent)
+            return { enabled: false, permission: "deny" };
+        return resolveBuiltinToolAccessForAgent(agent, toolName);
+    };
+}
+export function resolveBuiltinToolAccessForAgent(agent, toolName) {
+    const toolsets = agent.tools.filter((tool) => tool.type === "agent_toolset_20260401");
+    if (toolsets.length !== 1)
+        return { enabled: false, permission: "deny" };
+    const [toolset] = toolsets;
+    const defaultConfig = toolset.default_config;
+    const config = toolset.configs?.find((item) => item.name === toolName);
+    return {
+        enabled: config?.enabled ?? defaultConfig?.enabled ?? true,
+        permission: policyToPermission(config?.permission_policy?.type ??
+            defaultConfig?.permission_policy?.type ??
+            "always_allow"),
+    };
+}
+function policyToPermission(policy) {
+    if (policy === "always_allow")
+        return "allow";
+    if (policy === "always_ask")
+        return "ask";
+    if (policy === "never_allow")
+        return "deny";
+    return "deny";
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}