open-multi-agent-kit 0.78.0

package/dist/runtime/capability-injection.d.ts

@@ -0,0 +1,39 @@
+import type { DagNodeRouting } from "../orchestration/dag.js";
+export interface CapabilityInjectionInput {
+    readonly mcpAllowlist?: readonly string[];
+    readonly mcpServers?: readonly string[];
+    readonly skillNames?: readonly string[];
+    readonly skills?: readonly string[];
+    readonly hookNames?: readonly string[];
+    readonly hooks?: readonly string[];
+    readonly tools?: readonly string[];
+    readonly requireMcp?: boolean;
+    readonly requiresToolCalling?: boolean;
+}
+export interface CapabilityKindSummary {
+    readonly enabled: boolean;
+    readonly count: number;
+    readonly names: readonly string[];
+}
+export interface CapabilityInjectionSummary {
+    readonly mcp: CapabilityKindSummary;
+    readonly skills: CapabilityKindSummary;
+    readonly hooks: CapabilityKindSummary;
+    readonly tools: CapabilityKindSummary;
+    readonly requiresMcp: boolean;
+    readonly requiresToolCalling: boolean;
+    readonly rationale: string;
+}
+export interface CapabilityInjection {
+    readonly mcpServers: readonly string[];
+    readonly skills: readonly string[];
+    readonly hooks: readonly string[];
+    readonly tools: readonly string[];
+    readonly requiresMcp: boolean;
+    readonly requiresToolCalling: boolean;
+    readonly summary: CapabilityInjectionSummary;
+}
+export declare function normalizeCapabilityNames(values: readonly string[] | undefined): string[];
+export declare function buildCapabilityInjection(input?: CapabilityInjectionInput): CapabilityInjection;
+export declare function applyCapabilityInjectionToRouting(routing: DagNodeRouting, injection: CapabilityInjection): DagNodeRouting;
+export declare function renderCapabilityInjectionSummary(injection: CapabilityInjection): string;

package/dist/runtime/capability-injection.js

@@ -0,0 +1,93 @@
+const MAX_CAPABILITY_NAME_LENGTH = 120;
+export function normalizeCapabilityNames(values) {
+    const seen = new Set();
+    const normalized = [];
+    for (const value of values ?? []) {
+        const name = value.trim().slice(0, MAX_CAPABILITY_NAME_LENGTH);
+        if (!name || seen.has(name))
+            continue;
+        seen.add(name);
+        normalized.push(name);
+    }
+    return normalized;
+}
+export function buildCapabilityInjection(input = {}) {
+    const mcpServers = normalizeCapabilityNames([...(input.mcpAllowlist ?? []), ...(input.mcpServers ?? [])]);
+    const skills = normalizeCapabilityNames([...(input.skillNames ?? []), ...(input.skills ?? [])]);
+    const hooks = normalizeCapabilityNames([...(input.hookNames ?? []), ...(input.hooks ?? [])]);
+    const tools = normalizeCapabilityNames(input.tools);
+    const requiresMcp = input.requireMcp ?? false;
+    const requiresToolCalling = input.requiresToolCalling ?? tools.length > 0;
+    const summary = {
+        mcp: summarizeCapabilityKind(mcpServers),
+        skills: summarizeCapabilityKind(skills),
+        hooks: summarizeCapabilityKind(hooks),
+        tools: summarizeCapabilityKind(tools),
+        requiresMcp,
+        requiresToolCalling,
+        rationale: [
+            `mcp=${mcpServers.length}`,
+            `skills=${skills.length}`,
+            `hooks=${hooks.length}`,
+            `tools=${tools.length}`,
+            `requiresMcp=${requiresMcp ? "true" : "false"}`,
+            `requiresToolCalling=${requiresToolCalling ? "true" : "false"}`,
+        ].join("; "),
+    };
+    return {
+        mcpServers,
+        skills,
+        hooks,
+        tools,
+        requiresMcp,
+        requiresToolCalling,
+        summary,
+    };
+}
+export function applyCapabilityInjectionToRouting(routing, injection) {
+    return {
+        ...routing,
+        mcpServers: [...injection.mcpServers],
+        skills: [...injection.skills],
+        tools: [...injection.tools],
+        hooks: [...injection.hooks],
+        assignedCapabilities: {
+            ...(routing.assignedCapabilities ?? {}),
+            mcpServers: [...injection.mcpServers],
+            skills: [...injection.skills],
+            tools: [...injection.tools],
+            hooks: [...injection.hooks],
+        },
+        requiresMcp: injection.requiresMcp,
+        requiresToolCalling: routing.requiresToolCalling ?? injection.requiresToolCalling,
+        rationale: appendRationale(routing.rationale, `capability envelope: ${injection.summary.rationale}`),
+    };
+}
+export function renderCapabilityInjectionSummary(injection) {
+    return [
+        `MCP selected: ${formatCapabilityKind(injection.summary.mcp)}; required=${injection.requiresMcp ? "true" : "false"}; failure-policy=${injection.requiresMcp ? "strict" : "required-only"}`,
+        `Skills selected: ${formatCapabilityKind(injection.summary.skills)}`,
+        `Hooks active: ${formatCapabilityKind(injection.summary.hooks)}`,
+        `Tools available: ${formatCapabilityKind(injection.summary.tools)}; tool-calling-required=${injection.requiresToolCalling ? "true" : "false"}`,
+        "Do not activate every available MCP server or skill; use only capabilities needed for this request.",
+        "Optional MCP failures are warnings unless MCP is explicitly required for this node.",
+    ].join("\n");
+}
+function summarizeCapabilityKind(names) {
+    return {
+        enabled: names.length > 0,
+        count: names.length,
+        names: [...names],
+    };
+}
+function formatCapabilityKind(summary) {
+    if (!summary.enabled)
+        return "disabled";
+    const preview = summary.names.slice(0, 8).join(", ");
+    const more = summary.count > 8 ? `, +${summary.count - 8} more` : "";
+    return `enabled (${summary.count}) [${preview}${more}]`;
+}
+function appendRationale(existing, addition) {
+    const trimmed = existing?.trim();
+    return trimmed ? `${trimmed}; ${addition}` : addition;
+}

package/dist/runtime/chat-advisory-runtime.d.ts

@@ -0,0 +1,2 @@
+import type { AgentRuntime } from "./agent-runtime.js";
+export declare function createChatAdvisoryRuntime(): AgentRuntime;

package/dist/runtime/chat-advisory-runtime.js

@@ -0,0 +1,71 @@
+import { execSync } from "child_process";
+export function createChatAdvisoryRuntime() {
+    return {
+        id: "omk-advisory",
+        priority: 0,
+        supports: () => true,
+        async runNode(_capsule, _signal) {
+            const available = [];
+            try {
+                execSync("which codex", { stdio: "ignore" });
+                available.push("codex");
+            }
+            catch { /* unavailable */ }
+            try {
+                execSync("which opencode", { stdio: "ignore" });
+                available.push("opencode");
+            }
+            catch { /* unavailable */ }
+            try {
+                execSync("which commandcode", { stdio: "ignore" });
+                available.push("commandcode");
+            }
+            catch { /* unavailable */ }
+            if (process.env.DEEPSEEK_API_KEY)
+                available.push("deepseek");
+            const sep = "\n" + "─".repeat(60) + "\n";
+            const hasNpm = (() => { try {
+                execSync("which npm", { stdio: "ignore" });
+                return true;
+            }
+            catch {
+                return false;
+            } })();
+            const hasCargo = (() => { try {
+                execSync("which cargo", { stdio: "ignore" });
+                return true;
+            }
+            catch {
+                return false;
+            } })();
+            const msg = [
+                sep,
+                "⚠  No AI runtime adapter detected.",
+                "",
+                "OMK is running in advisory mode. To enable the interactive agent:",
+                "",
+                "  1. Run: omk auth",
+                "     (shows available providers + guided setup)",
+                "",
+                "  2. Install a CLI runtime:",
+                hasNpm ? "     • npm install -g @openai/codex" : undefined,
+                hasCargo ? "     • cargo install opencode" : undefined,
+                "",
+                "  3. Or set API keys:",
+                "     • export DEEPSEEK_API_KEY=\"sk-...\"",
+                "     • export OPENAI_API_KEY=\"sk-...\"",
+                "     • export KIMI_API_KEY=\"sk-...\"",
+                "",
+                "  4. Then try again: omk chat",
+                "",
+                available.length > 0
+                    ? `Detected: ${available.join(", ")}`
+                    : "No runtimes detected. Install one or configure an API key.",
+                "",
+                "Quick start: export OPENAI_API_KEY=\"sk-...\" && omk chat",
+                sep,
+            ].filter((line) => line !== undefined).join("\n");
+            return { success: true, stdout: msg, stderr: "" };
+        },
+    };
+}

package/dist/runtime/child-env.d.ts

@@ -0,0 +1,31 @@
+export type ChildEnvSource = Readonly<Record<string, string | undefined>>;
+export declare const DEFAULT_CHILD_ENV_ALLOWLIST: readonly string[];
+export interface ChildEnvOptions {
+    readonly parentEnv?: ChildEnvSource;
+    readonly overrideEnv?: ChildEnvSource;
+    readonly inheritParentEnv?: boolean;
+    readonly allowedParentEnvNames?: readonly string[];
+    readonly allowedSecretEnvNames?: readonly string[];
+    readonly allowSecretPassthrough?: boolean;
+}
+export interface ChildEnvAuditMetadata {
+    readonly grantedSecretEnvNames: readonly string[];
+    readonly deniedSecretEnvNames: readonly string[];
+    readonly deniedChildEnvNames: readonly string[];
+}
+export interface ChildEnvBuildResult {
+    readonly env: Record<string, string>;
+    readonly metadata: ChildEnvAuditMetadata;
+}
+export interface RuntimeChildEnvMetadata {
+    readonly runtimeId?: string;
+    readonly runId?: string;
+    readonly nodeId?: string;
+    readonly role?: string;
+    readonly goal?: string;
+}
+export declare function isSecretLikeEnvName(name: string): boolean;
+export declare function isDeniedChildEnvName(name: string): boolean;
+export declare function buildChildEnvWithMetadata(options?: ChildEnvOptions): ChildEnvBuildResult;
+export declare function buildChildEnv(options?: ChildEnvOptions): Record<string, string>;
+export declare function runtimeMetadataEnv(metadata: RuntimeChildEnvMetadata): Record<string, string>;

package/dist/runtime/child-env.js

@@ -0,0 +1,131 @@
+export const DEFAULT_CHILD_ENV_ALLOWLIST = Object.freeze([
+    "CI",
+    "COLORTERM",
+    "COMSPEC",
+    "FORCE_COLOR",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "NO_COLOR",
+    "OMK_ORIGINAL_HOME",
+    "OMK_PROJECT_ROOT",
+    "PATH",
+    "PATHEXT",
+    "SHELL",
+    "SystemRoot",
+    "TEMP",
+    "TERM",
+    "TMP",
+    "TMPDIR",
+    "USERPROFILE",
+    "WINDIR",
+]);
+const SECRET_LIKE_ENV_NAME = /(?:^|_)(?:API_?KEY|AUTH(?:ORIZATION)?|BEARER|COOKIE|CREDENTIAL|PASS(?:WORD)?|PRIVATE|SECRET|SESSION|TOKEN)(?:_|$)/iu;
+const DENIED_CHILD_ENV_NAME_PATTERNS = Object.freeze([
+    /^AWS_/iu,
+    /^GOOGLE_APPLICATION_CREDENTIALS$/iu,
+    /^GITHUB_TOKEN$/iu,
+    /^GH_TOKEN$/iu,
+    /^NPM_TOKEN$/iu,
+    /^NODE_AUTH_TOKEN$/iu,
+    /^SSH_AUTH_SOCK$/iu,
+    /^KUBECONFIG$/iu,
+    /(?:^|_)DOTENV(?:_|$)/iu,
+    /(?:^|_)ENV_FILE(?:_|$)/iu,
+    /(?:^|_)ENV_PATH(?:_|$)/iu,
+]);
+function normalizeEnvName(name) {
+    return process.platform === "win32" ? name.toUpperCase() : name;
+}
+function envNameSet(names) {
+    return new Set(names.map((name) => normalizeEnvName(name)));
+}
+function sortedNames(names) {
+    return [...names].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}
+function validEnvName(name) {
+    return name.length > 0 && !name.includes("=") && !name.includes("\0");
+}
+function validEnvValue(value) {
+    return value !== undefined && !value.includes("\0");
+}
+export function isSecretLikeEnvName(name) {
+    return SECRET_LIKE_ENV_NAME.test(name);
+}
+export function isDeniedChildEnvName(name) {
+    return DENIED_CHILD_ENV_NAME_PATTERNS.some((pattern) => pattern.test(name));
+}
+function hasExplicitSecretGrant(name, options, allowedSecretNames) {
+    return options.allowSecretPassthrough === true && allowedSecretNames.has(normalizeEnvName(name));
+}
+export function buildChildEnvWithMetadata(options = {}) {
+    const parentEnv = options.parentEnv ?? process.env;
+    const allowedNames = envNameSet(options.allowedParentEnvNames ?? DEFAULT_CHILD_ENV_ALLOWLIST);
+    const allowedSecretNames = envNameSet(options.allowedSecretEnvNames ?? []);
+    const inheritParentEnv = options.inheritParentEnv ?? false;
+    const childEnv = {};
+    const grantedSecretEnvNames = new Set();
+    const deniedSecretEnvNames = new Set();
+    const deniedChildEnvNames = new Set();
+    for (const [name, value] of Object.entries(parentEnv)) {
+        if (!validEnvName(name) || !validEnvValue(value))
+            continue;
+        const normalizedName = normalizeEnvName(name);
+        const isAllowed = allowedNames.has(normalizedName);
+        if (isDeniedChildEnvName(name)) {
+            deniedChildEnvNames.add(name);
+            continue;
+        }
+        if (!isAllowed && !inheritParentEnv)
+            continue;
+        if (isSecretLikeEnvName(name)) {
+            if (!hasExplicitSecretGrant(name, options, allowedSecretNames)) {
+                deniedSecretEnvNames.add(name);
+                continue;
+            }
+            grantedSecretEnvNames.add(name);
+        }
+        childEnv[name] = value;
+    }
+    for (const [name, value] of Object.entries(options.overrideEnv ?? {})) {
+        if (!validEnvName(name) || !validEnvValue(value))
+            continue;
+        if (isDeniedChildEnvName(name)) {
+            deniedChildEnvNames.add(name);
+            continue;
+        }
+        if (isSecretLikeEnvName(name)) {
+            if (!hasExplicitSecretGrant(name, options, allowedSecretNames)) {
+                deniedSecretEnvNames.add(name);
+                continue;
+            }
+            grantedSecretEnvNames.add(name);
+        }
+        childEnv[name] = value;
+    }
+    return {
+        env: childEnv,
+        metadata: {
+            grantedSecretEnvNames: sortedNames(grantedSecretEnvNames),
+            deniedSecretEnvNames: sortedNames(deniedSecretEnvNames),
+            deniedChildEnvNames: sortedNames(deniedChildEnvNames),
+        },
+    };
+}
+export function buildChildEnv(options = {}) {
+    const { env } = buildChildEnvWithMetadata(options);
+    return env;
+}
+export function runtimeMetadataEnv(metadata) {
+    return buildChildEnv({
+        parentEnv: {},
+        overrideEnv: {
+            OMK_RUNTIME_ID: metadata.runtimeId,
+            OMK_RUN_ID: metadata.runId,
+            OMK_NODE_ID: metadata.nodeId,
+            OMK_ROLE: metadata.role,
+            OMK_GOAL: metadata.goal,
+        },
+    });
+}

package/dist/runtime/codex-cli-runtime.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CodexCliRuntime — wraps createCodexCliAdvisoryTaskRunner into an AgentRuntime.
+ */
+import type { AgentRuntime } from "./agent-runtime.js";
+export interface CodexCliRuntimeOptions {
+    cwd: string;
+    model?: string;
+    timeoutMs?: number;
+}
+export declare function createCodexCliRuntime(options: CodexCliRuntimeOptions): AgentRuntime;

package/dist/runtime/codex-cli-runtime.js

@@ -0,0 +1,78 @@
+/**
+ * CodexCliRuntime — wraps createCodexCliAdvisoryTaskRunner into an AgentRuntime.
+ */
+import { createCodexCliAdvisoryTaskRunner } from "../providers/codex-cli-runner.js";
+export function createCodexCliRuntime(options) {
+    const runner = createCodexCliAdvisoryTaskRunner(options);
+    return {
+        id: "codex-cli",
+        displayName: "Codex CLI",
+        kind: "cli",
+        priority: 60,
+        supports(_capsule) {
+            return true;
+        },
+        async runNode(capsule, signal) {
+            // Validate capsule task is not empty to prevent runner errors
+            if (!capsule.task || capsule.task.trim().length === 0) {
+                const errorMsg = `Empty task for node ${capsule.nodeId}`;
+                process.stderr.write(`[omk] ${errorMsg}\n`);
+                return {
+                    success: false,
+                    exitCode: 1,
+                    stdout: `[ERROR] ${errorMsg}`,
+                    stderr: errorMsg,
+                    metadata: { runtime: "codex-cli", error: errorMsg },
+                };
+            }
+            const node = {
+                ...capsule.node,
+                name: capsule.task,
+            };
+            const env = {
+                OMK_RUN_ID: capsule.runId,
+                OMK_NODE_ID: capsule.nodeId,
+                OMK_ROLE: capsule.node.role ?? "",
+                OMK_GOAL: capsule.goal,
+                OMK_GOAL_CONTEXT: capsule.goal,
+                OMK_TASK_TYPE: "general",
+                OMK_PROVIDER_AUTHORITY: "advisory",
+            };
+            const startedAt = Date.now();
+            try {
+                const result = await runner.run(node, env, signal);
+                if (signal.aborted) {
+                    return {
+                        success: false,
+                        exitCode: 130,
+                        stdout: result.stdout,
+                        stderr: "Aborted by signal",
+                        metadata: { runtime: "codex-cli", aborted: true },
+                    };
+                }
+                const durationMs = Date.now() - startedAt;
+                return {
+                    success: result.success,
+                    exitCode: result.exitCode,
+                    stdout: result.stdout,
+                    stderr: result.stderr,
+                    metadata: {
+                        runtime: "codex-cli",
+                        durationMs,
+                        ...result.metadata,
+                    },
+                };
+            }
+            catch (err) {
+                const errorMsg = String(err);
+                return {
+                    success: false,
+                    exitCode: 1,
+                    stdout: `[ERROR] ${errorMsg}`,
+                    stderr: errorMsg,
+                    metadata: { runtime: "codex-cli", error: errorMsg },
+                };
+            }
+        },
+    };
+}

package/dist/runtime/codex-runtime.d.ts

@@ -0,0 +1,35 @@
+/**
+ * CodexRuntime — Codex CLI runtime adapter.
+ *
+ * Spawns the `codex` CLI subprocess and bridges AgentTask / AgentResult.
+ */
+import type { AgentRuntime, AgentRunResult, AgentResult, AgentTask, RuntimeCapabilities, RuntimeHealth } from "./agent-runtime.js";
+import type { ContextCapsule } from "./context-capsule.js";
+export interface CodexRuntimeOptions {
+    bin?: string;
+    cwd?: string;
+    model?: string;
+    timeoutMs?: number;
+    contextWindow?: number;
+    reservedOutputTokens?: number;
+    safetyMarginTokens?: number;
+}
+export declare class CodexRuntime implements AgentRuntime {
+    readonly id = "codex-cli";
+    readonly kind = "cli";
+    readonly priority = 60;
+    readonly capabilities: RuntimeCapabilities;
+    private readonly cwd;
+    private readonly bin;
+    private readonly model;
+    private readonly timeoutMs;
+    private readonly contextWindow;
+    private readonly reservedOutputTokens;
+    private readonly safetyMarginTokens;
+    constructor(options?: CodexRuntimeOptions);
+    supports(capsule: ContextCapsule): boolean;
+    health(): Promise<RuntimeHealth>;
+    runNode(capsule: ContextCapsule, signal: AbortSignal): Promise<AgentRunResult>;
+    execute(task: AgentTask): Promise<AgentResult>;
+    private buildPrompt;
+}