open-multi-agent-kit 0.80.6 → 0.80.8

package/dist/core/agent-session.js

@@ -14,20 +14,24 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname } from "node:path";
-import { clampThinkingLevel, cleanupSessionResources, getSupportedThinkingLevels, isContextOverflow, modelsAreEqual, resetApiProviders, streamSimple, } from "@earendil-works/omk-ai";
+import { clampThinkingLevel, cleanupSessionResources, getSupportedThinkingLevels, isContextOverflow, modelsAreEqual, resetApiProviders, streamSimple, } from "omk-ai";
 import { theme } from "../modes/interactive/theme/theme.js";
 import { stripFrontmatter } from "../utils/frontmatter.js";
 import { resolvePath } from "../utils/paths.js";
 import { sleep } from "../utils/sleep.js";
 import { formatNoApiKeyFoundMessage, formatNoModelSelectedMessage } from "./auth-guidance.js";
 import { executeBashWithOperations } from "./bash-executor.js";
+import { classifyShellCommand } from "./command-safety.js";
 import { calculateContextTokens, collectEntriesForBranchSummary, compact, estimateContextTokens, estimateProjectedContextTokens, generateBranchSummary, prepareCompaction, shouldCompact, } from "./compaction/index.js";
 import { DEFAULT_THINKING_LEVEL } from "./defaults.js";
 import { exportSessionToHtml } from "./export-html/index.js";
 import { createToolHtmlRenderer } from "./export-html/tool-renderer.js";
+import { buildBlockedBashResult, evaluateCommandGate, isCommandSafetyAssumeYesEnabled, } from "./extensions/builtin/command-safety-gate.js";
 import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { emitSessionShutdownEvent } from "./extensions/runner.js";
+import { assertLoadoutAccess, decideLoadoutAccess } from "./loadout-access-policy.js";
 import { expandPromptTemplate } from "./prompt-templates.js";
+import { detectSandboxBackend } from "./sandbox/backend.js";
 import { CURRENT_SESSION_VERSION, getLatestCompactionEntry } from "./session-manager.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
 import { buildSystemPrompt } from "./system-prompt.js";
@@ -54,6 +58,26 @@ export function parseSkillBlock(text) {
 // ============================================================================
 /** Standard thinking levels */
 const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high"];
+function normalizeToolNames(toolNames) {
+    return [...new Set(toolNames.map((name) => name.trim()).filter((name) => name !== ""))].sort();
+}
+function toolNameSetsEqual(left, right) {
+    const normalizedLeft = normalizeToolNames(left);
+    const normalizedRight = normalizeToolNames(right);
+    return (normalizedLeft.length === normalizedRight.length &&
+        normalizedLeft.every((toolName, index) => toolName === normalizedRight[index]));
+}
+function isSandboxDeniedError(error) {
+    return error instanceof Error && error.message.startsWith("sandbox: shell denied");
+}
+function buildSandboxDeniedBashResult(reason) {
+    return {
+        output: reason,
+        exitCode: 1,
+        cancelled: false,
+        truncated: false,
+    };
+}
 // ============================================================================
 // AgentSession Class
 // ============================================================================
@@ -83,6 +107,8 @@ export class AgentSession {
     // Bash execution state
     _bashAbortController = undefined;
     _pendingBashMessages = [];
+    _configuredBashSandboxPreflight = undefined;
+    _detectedBashSandboxBackend = undefined;
     // Extension system
     _extensionRunner;
     _turnIndex = 0;
@@ -95,6 +121,7 @@ export class AgentSession {
     _allowedToolNames;
     _excludedToolNames;
     _baseToolsOverride;
+    _loadoutAccessPolicy;
     _sessionStartEvent;
     _extensionUIContext;
     _extensionMode = "print";
@@ -127,6 +154,8 @@ export class AgentSession {
         this._allowedToolNames = config.allowedToolNames ? new Set(config.allowedToolNames) : undefined;
         this._excludedToolNames = config.excludedToolNames ? new Set(config.excludedToolNames) : undefined;
         this._baseToolsOverride = config.baseToolsOverride;
+        this._loadoutAccessPolicy = config.loadoutAccessPolicy;
+        this._configuredBashSandboxPreflight = config.bashSandboxPreflight;
         this._sessionStartEvent = config.sessionStartEvent ?? { type: "session_start", reason: "startup" };
         // Always subscribe to agent events for internal handling
         // (session persistence, extensions, auto-compaction, retry logic)
@@ -141,6 +170,14 @@ export class AgentSession {
     get modelRegistry() {
         return this._modelRegistry;
     }
+    _getBashSandboxPreflight(override) {
+        const preflight = override ?? this._configuredBashSandboxPreflight;
+        if (!preflight || preflight.policy.mode === "off" || preflight.backend) {
+            return preflight;
+        }
+        this._detectedBashSandboxBackend ??= detectSandboxBackend();
+        return { ...preflight, backend: this._detectedBashSandboxBackend };
+    }
     async _getRequiredRequestAuth(model) {
         const result = await this._modelRegistry.getApiKeyAndHeaders(model);
         if (!result.ok) {
@@ -177,6 +214,9 @@ export class AgentSession {
      */
     _installAgentToolHooks() {
         this.agent.beforeToolCall = async ({ toolCall, args }) => {
+            if (this._loadoutAccessPolicy && !this._loadoutAccessPolicy.activeTools.includes(toolCall.name)) {
+                throw new Error(`loadout: inactive tool: ${toolCall.name}`);
+            }
             const runner = this._extensionRunner;
             if (!runner.hasHandlers("tool_call")) {
                 return undefined;
@@ -480,7 +520,7 @@ export class AgentSession {
         catch {
             // Dispose must succeed even if an abort hook throws.
         }
-        this._extensionRunner.invalidate("This extension ctx is stale after session replacement or reload. Do not use a captured pi or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().");
+        this._extensionRunner.invalidate("This extension ctx is stale after session replacement or reload. Do not use a captured extension API or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().");
         this._disconnectFromAgent();
         this._eventListeners = [];
         cleanupSessionResources(this.sessionId);
@@ -541,14 +581,23 @@ export class AgentSession {
      * Changes take effect on the next agent turn.
      */
     setActiveToolsByName(toolNames) {
+        const requestedToolNames = normalizeToolNames(toolNames);
+        const lockedToolNames = this._loadoutAccessPolicy?.activeTools;
+        if (lockedToolNames && !toolNameSetsEqual(requestedToolNames, lockedToolNames)) {
+            throw new Error(`loadout active tools are locked: expected ${lockedToolNames.join(", ") || "(none)"}, received ${requestedToolNames.join(", ") || "(none)"}`);
+        }
+        const desiredToolNames = lockedToolNames ? [...lockedToolNames] : toolNames;
         const tools = [];
         const validToolNames = [];
-        for (const name of toolNames) {
+        for (const name of desiredToolNames) {
             const tool = this._toolRegistry.get(name);
             if (tool) {
                 tools.push(tool);
                 validToolNames.push(name);
             }
+            else if (lockedToolNames?.includes(name)) {
+                throw new Error(`loadout locked tool unavailable: ${name}`);
+            }
         }
         this.agent.state.tools = tools;
         // Rebuild base system prompt with new tool set
@@ -619,6 +668,107 @@ export class AgentSession {
         }
         return Array.from(unique);
     }
+    /**
+     * Extract the most recent user query text from conversation messages.
+     * Returns undefined when no user message exists or content is empty.
+     * Handles both string content and multimodal (array) content.
+     */
+    _extractCurrentQuery() {
+        const messages = this.messages;
+        if (messages.length === 0) {
+            return undefined;
+        }
+        // Scan recent messages (last 3) for the most recent user message
+        const recent = messages.slice(-3);
+        for (let i = recent.length - 1; i >= 0; i--) {
+            const msg = recent[i];
+            if (!("role" in msg) || msg.role !== "user") {
+                continue;
+            }
+            const content = msg.content;
+            if (typeof content === "string") {
+                const trimmed = content.trim();
+                return trimmed.length > 0 ? trimmed : undefined;
+            }
+            if (Array.isArray(content)) {
+                const textParts = content
+                    .filter((c) => "type" in c && c.type === "text")
+                    .map((c) => c.text);
+                const joined = textParts.join("\n").trim();
+                return joined.length > 0 ? joined : undefined;
+            }
+        }
+        return undefined;
+    }
+    _getContextBudgetOptions() {
+        if (process.env.OMK_CONTEXT_GOVERNOR !== "1") {
+            return undefined;
+        }
+        const contextWindow = this.model?.contextWindow ?? 0;
+        // --- maxPromptTokens ---
+        // Priority 1: explicit env override (user knows best)
+        const envMaxPrompt = parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_MAX_PROMPT_TOKENS");
+        let maxPromptTokens;
+        let responseReserveTokens;
+        if (envMaxPrompt !== undefined) {
+            // User override — use as-is for prompt, derive response reserve normally
+            maxPromptTokens = envMaxPrompt;
+            responseReserveTokens =
+                parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RESERVE_TOKENS") ??
+                    this._computeResponseReserve(contextWindow);
+        }
+        else if (contextWindow > 0) {
+            // Dynamic: derive from model contextWindow
+            const envPromptRatio = parsePositiveFloatEnv("OMK_CONTEXT_GOVERNOR_PROMPT_RATIO");
+            const envResponseRatio = parsePositiveFloatEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RATIO");
+            responseReserveTokens =
+                parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RESERVE_TOKENS") ??
+                    this._computeResponseReserve(contextWindow, envResponseRatio);
+            const safetyMargin = Math.floor(contextWindow * SAFETY_MARGIN_RATIO);
+            if (envPromptRatio !== undefined && envPromptRatio > 0 && envPromptRatio < 1) {
+                maxPromptTokens = Math.floor(contextWindow * envPromptRatio);
+            }
+            else {
+                // Default: contextWindow minus reserves and safety margin
+                maxPromptTokens = contextWindow - responseReserveTokens - safetyMargin;
+            }
+        }
+        else {
+            // No model info — legacy fallback
+            maxPromptTokens = LEGACY_MAX_PROMPT_TOKENS;
+            responseReserveTokens =
+                parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RESERVE_TOKENS") ?? LEGACY_RESPONSE_RESERVE_TOKENS;
+        }
+        // Enforce floor
+        if (maxPromptTokens < MIN_PROMPT_TOKENS) {
+            maxPromptTokens = MIN_PROMPT_TOKENS;
+        }
+        // Ensure responseReserve does not exceed maxPromptTokens
+        if (responseReserveTokens >= maxPromptTokens) {
+            responseReserveTokens = Math.max(Math.floor(maxPromptTokens / 4), LEGACY_RESPONSE_RESERVE_TOKENS);
+        }
+        return {
+            maxPromptTokens,
+            responseReserveTokens,
+            modelId: this.model?.id ?? "unknown",
+            tokenizerMode: parseTokenizerModeEnv(process.env.OMK_CONTEXT_GOVERNOR_TOKENIZER),
+            activeSkillNames: parseCommaSeparatedEnv(process.env.OMK_CONTEXT_GOVERNOR_ACTIVE_SKILLS),
+            queryContext: this._extractCurrentQuery(),
+        };
+    }
+    /**
+     * Compute responseReserveTokens from contextWindow.
+     * Prefers the model's own maxTokens when available, otherwise uses a ratio.
+     */
+    _computeResponseReserve(contextWindow, overrideRatio) {
+        // Prefer model's maxTokens (actual output limit) if available and reasonable
+        const modelMaxTokens = this.model?.maxTokens;
+        if (modelMaxTokens !== undefined && modelMaxTokens > 0 && modelMaxTokens < contextWindow) {
+            return modelMaxTokens;
+        }
+        const ratio = overrideRatio ?? RESPONSE_RESERVE_RATIO;
+        return Math.max(Math.floor(contextWindow * ratio), LEGACY_RESPONSE_RESERVE_TOKENS);
+    }
     _rebuildSystemPrompt(toolNames) {
         const validToolNames = toolNames.filter((name) => this._toolRegistry.has(name));
         const toolSnippets = {};
@@ -647,6 +797,7 @@ export class AgentSession {
             selectedTools: validToolNames,
             toolSnippets,
             promptGuidelines,
+            contextBudget: this._getContextBudgetOptions(),
         };
         return buildSystemPrompt(this._baseSystemPromptOptions);
     }
@@ -691,7 +842,7 @@ export class AgentSession {
     }
     /**
      * Send a prompt to the agent.
-     * - Handles extension commands (registered via pi.registerCommand) immediately, even during streaming
+     * - Handles extension commands (registered via omk.registerCommand) immediately, even during streaming
      * - Expands file-based prompt templates by default
      * - During streaming, queues via steer() or followUp() based on streamingBehavior option
      * - Validates model and API key before sending (when not streaming)
@@ -704,7 +855,7 @@ export class AgentSession {
         let messages;
         try {
             // Handle extension commands first (execute immediately, even during streaming)
-            // Extension commands manage their own LLM interaction via pi.sendMessage()
+            // Extension commands manage their own LLM interaction via omk.sendMessage()
             if (expandPromptTemplates && text.startsWith("/")) {
                 const handled = await this._tryExecuteExtensionCommand(text);
                 if (handled) {
@@ -1852,6 +2003,12 @@ export class AgentSession {
                 sourceInfo: createSyntheticSourceInfo(`<sdk:${definition.name}>`, { source: "sdk" }),
             })),
         ].filter((tool) => isAllowedTool(tool.definition.name));
+        if (this._loadoutAccessPolicy) {
+            const shadowedBuiltins = normalizeToolNames(allCustomTools.map((tool) => tool.definition.name).filter((name) => this._baseToolDefinitions.has(name)));
+            if (shadowedBuiltins.length > 0) {
+                throw new Error(`loadout extension tool shadows builtin: ${shadowedBuiltins.join(", ")}`);
+            }
+        }
         const definitionRegistry = new Map(Array.from(this._baseToolDefinitions.entries())
             .filter(([name]) => isAllowedTool(name))
             .map(([name, definition]) => [
@@ -1893,6 +2050,14 @@ export class AgentSession {
             toolRegistry.set(tool.name, tool);
         }
         this._toolRegistry = toolRegistry;
+        if (this._loadoutAccessPolicy) {
+            const missingLockedTools = this._loadoutAccessPolicy.activeTools.filter((toolName) => !isAllowedTool(toolName) || !this._toolRegistry.has(toolName));
+            if (missingLockedTools.length > 0) {
+                throw new Error(`loadout locked tool unavailable: ${missingLockedTools.join(", ")}`);
+            }
+            this.setActiveToolsByName([...this._loadoutAccessPolicy.activeTools]);
+            return;
+        }
         const nextActiveToolNames = (options?.activeToolNames ? [...options.activeToolNames] : [...previousActiveToolNames]).filter((name) => isAllowedTool(name));
         if (allowedToolNames) {
             for (const toolName of this._toolRegistry.keys()) {
@@ -1919,14 +2084,34 @@ export class AgentSession {
         const autoResizeImages = this.settingsManager.getImageAutoResize();
         const shellCommandPrefix = this.settingsManager.getShellCommandPrefix();
         const shellPath = this.settingsManager.getShellPath();
+        const loadoutAccessPolicy = this._loadoutAccessPolicy;
+        const loadoutAccessGuard = loadoutAccessPolicy
+            ? (request) => decideLoadoutAccess(loadoutAccessPolicy, request)
+            : undefined;
+        const loadoutReadOptions = loadoutAccessGuard
+            ? {
+                canReadPath: (path) => loadoutAccessGuard({ operation: "read", toolName: "read", path }).allowed,
+            }
+            : {};
+        const loadoutWriteOptions = loadoutAccessGuard
+            ? {
+                canWritePath: (path) => loadoutAccessGuard({ operation: "write", toolName: "write", path }).allowed,
+            }
+            : {};
         const baseToolDefinitions = this._baseToolsOverride
             ? Object.fromEntries(Object.entries(this._baseToolsOverride).map(([name, tool]) => [
                 name,
                 createToolDefinitionFromAgentTool(tool),
             ]))
             : createAllToolDefinitions(this._cwd, {
-                read: { autoResizeImages },
-                bash: { commandPrefix: shellCommandPrefix, shellPath },
+                read: { autoResizeImages, ...loadoutReadOptions },
+                bash: {
+                    commandPrefix: shellCommandPrefix,
+                    shellPath,
+                    ...(loadoutAccessGuard ? { loadoutAccessGuard } : {}),
+                },
+                edit: loadoutWriteOptions,
+                write: loadoutWriteOptions,
             });
         this._baseToolDefinitions = new Map(Object.entries(baseToolDefinitions).map(([name, tool]) => [name, tool]));
         const extensionsResult = this._resourceLoader.getExtensions();
@@ -2073,20 +2258,64 @@ export class AgentSession {
      * @param onChunk Optional streaming callback for output
      * @param options.excludeFromContext If true, command output won't be sent to LLM (!! prefix)
      * @param options.operations Custom BashOperations for remote execution
+     * @param options.safetyGate When "headless", pre-classify the command and deny confirm/block-tier verdicts without interactive confirmation
+     * @param options.sandboxPolicy Trusted sandbox preflight for local bash execution (never sourced from RPC payloads)
      */
     async executeBash(command, onChunk, options) {
-        this._bashAbortController = new AbortController();
         // Apply command prefix if configured (e.g., "shopt -s expand_aliases" for alias support)
         const prefix = this.settingsManager.getShellCommandPrefix();
         const shellPath = this.settingsManager.getShellPath();
         const resolvedCommand = prefix ? `${prefix}\n${command}` : command;
-        try {
-            const result = await executeBashWithOperations(resolvedCommand, this.sessionManager.getCwd(), options?.operations ?? createLocalBashOperations({ shellPath }), {
-                onChunk,
-                signal: this._bashAbortController.signal,
+        if (this._loadoutAccessPolicy) {
+            assertLoadoutAccess((request) => decideLoadoutAccess(this._loadoutAccessPolicy, request), { operation: "execute", toolName: "bash", command: resolvedCommand });
+        }
+        // Non-negotiable safety floor for headless callers (RPC bash): hard-deny
+        // block-tier commands and credential/secret file access before any shell is
+        // spawned. This mirrors the §0.1 freedom safety floor behavior in omakit.
+        if (options?.safetyGate === "headless") {
+            const floorVerdict = classifyShellCommand(command);
+            if (floorVerdict.risk === "block" || floorVerdict.rule.startsWith("secret.")) {
+                throw new Error(`OMK §0.1 safety floor blocked bash: [${floorVerdict.rule}] ${floorVerdict.reason}`);
+            }
+        }
+        // Command-safety parity for non-interactive callers (RPC bash). Interactive
+        // `!`/`!!` bash is gated earlier through the user_bash extension event, which
+        // keeps its prompt-based approval semantics, so it does not pass safetyGate and
+        // is never double-prompted here. confirm/block-tier verdicts deny headlessly;
+        // the EFFECTIVE command (after the shell command prefix) is classified.
+        if (options?.safetyGate === "headless") {
+            const decision = await evaluateCommandGate(resolvedCommand, {
+                hasUI: false,
+                headlessConfirmPolicy: isCommandSafetyAssumeYesEnabled() ? "allow" : "deny",
             });
-            this.recordBashResult(command, result, options);
-            return result;
+            if (decision?.deny) {
+                const blocked = buildBlockedBashResult(decision.reason);
+                this.recordBashResult(command, blocked, options);
+                return blocked;
+            }
+        }
+        this._bashAbortController = new AbortController();
+        try {
+            try {
+                const result = await executeBashWithOperations(resolvedCommand, this.sessionManager.getCwd(), options?.operations ??
+                    createLocalBashOperations({
+                        shellPath,
+                        sandboxPolicy: this._getBashSandboxPreflight(options?.sandboxPolicy),
+                    }), {
+                    onChunk,
+                    signal: this._bashAbortController.signal,
+                });
+                this.recordBashResult(command, result, options);
+                return result;
+            }
+            catch (error) {
+                if (!isSandboxDeniedError(error)) {
+                    throw error;
+                }
+                const blocked = buildSandboxDeniedBashResult(error.message);
+                this.recordBashResult(command, blocked, options);
+                return blocked;
+            }
         }
         finally {
             this._bashAbortController = undefined;
@@ -2548,4 +2777,55 @@ export class AgentSession {
         return this._extensionRunner;
     }
 }
+// ---------------------------------------------------------------------------
+// Context budget constants
+// ---------------------------------------------------------------------------
+/** Fraction of contextWindow reserved for model response generation. */
+const RESPONSE_RESERVE_RATIO = 0.2;
+/** Fraction of contextWindow held back as safety margin for token-count imprecision. */
+const SAFETY_MARGIN_RATIO = 0.1;
+// Default prompt budget = contextWindow - responseReserve - safetyMargin.
+// With the defaults above (0.2 + 0.1) this yields ~0.70 of contextWindow, but it
+// stays correct when responseReserve is overridden by model.maxTokens.
+/** Absolute floor for maxPromptTokens — below this the budget is meaningless. */
+const MIN_PROMPT_TOKENS = 4000;
+/** Legacy defaults when no model contextWindow is known. */
+const LEGACY_MAX_PROMPT_TOKENS = 60_000;
+const LEGACY_RESPONSE_RESERVE_TOKENS = 8_192;
+function parsePositiveIntegerEnv(name) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === "") {
+        return undefined;
+    }
+    const value = Number.parseInt(raw, 10);
+    return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+function parsePositiveFloatEnv(name) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === "") {
+        return undefined;
+    }
+    const value = Number.parseFloat(raw);
+    return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+function parseTokenizerModeEnv(value) {
+    switch (value) {
+        case "fallback":
+        case "openai-js":
+        case "openai-wasm":
+        case "auto":
+            return value;
+        default:
+            return "fallback";
+    }
+}
+function parseCommaSeparatedEnv(value) {
+    if (value === undefined || value.trim() === "") {
+        return [];
+    }
+    return Array.from(new Set(value
+        .split(",")
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0)));
+}
 //# sourceMappingURL=agent-session.js.map