openpond-sdk 0.6.2 → 0.6.3

package/dist/{chunk-6T23L3LH.js → chunk-2DMYAJLS.js}

@@ -1,7 +1,7 @@
 import {
   apiFetch,
   readApiJson
-} from "./chunk-22RMONJA.js";
+} from "./chunk-CEZEVILU.js";
 
 // src/profile-actions.ts
 var OpenPondProfileActionsClient = class {
@@ -69,4 +69,4 @@ function requiredValue(value, name) {
 export {
   OpenPondProfileActionsClient
 };
-//# sourceMappingURL=chunk-6T23L3LH.js.map
+//# sourceMappingURL=chunk-2DMYAJLS.js.map

package/dist/{chunk-22RMONJA.js → chunk-CEZEVILU.js}

@@ -38,13 +38,13 @@ var OpenPondApiError = class extends Error {
   }
 };
 async function apiFetch(baseUrl, token, requestPath, options = {}) {
-  const { timeoutMs = DEFAULT_API_TIMEOUT_MS, maxResponseBytes = DEFAULT_API_RESPONSE_BYTES, useEnvironmentApiKey = true, ...init } = options;
+  const { timeoutMs = DEFAULT_API_TIMEOUT_MS, maxResponseBytes = DEFAULT_API_RESPONSE_BYTES, explicitBearerAuth = false, ...init } = options;
   const requestUrl = `${baseUrl}${requestPath}`;
   const headers = new Headers(init.headers);
   headers.set("Content-Type", "application/json");
-  const apiKey = useEnvironmentApiKey ? process.env.OPENPOND_API_KEY : void 0;
+  const apiKey = !explicitBearerAuth ? process.env.OPENPOND_API_KEY : void 0;
   const trimmedToken = token?.trim() || "";
-  const tokenIsApiKey = trimmedToken.startsWith("opk_");
+  const tokenIsApiKey = !explicitBearerAuth && trimmedToken.startsWith("opk_");
   const effectiveApiKey = apiKey || (tokenIsApiKey ? trimmedToken : null);
   if (effectiveApiKey && !headers.has("openpond-api-key"))
     headers.set("openpond-api-key", effectiveApiKey);
@@ -152,4 +152,4 @@ export {
   apiFetch,
   readApiJson
 };
-//# sourceMappingURL=chunk-22RMONJA.js.map
+//# sourceMappingURL=chunk-CEZEVILU.js.map

package/dist/chunk-CEZEVILU.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../cloud/src/api/core.ts"],
+  "sourcesContent": ["const DEFAULT_API_TIMEOUT_MS = 30_000;\nconst DEFAULT_API_RESPONSE_BYTES = 8 * 1024 * 1024;\nexport const LONG_STREAM_API_OPTIONS = { timeoutMs: 15 * 60 * 1000, maxResponseBytes: 64 * 1024 * 1024 } as const;\n\nexport type ApiFetchOptions = RequestInit & {\n  /** Generic services always use their explicit bearer token, regardless of prefix. */\n  explicitBearerAuth?: boolean;\n  timeoutMs?: number;\n  maxResponseBytes?: number;\n};\n\nexport class ApiTimeoutError extends Error {\n  readonly code = \"OPENPOND_API_TIMEOUT\";\n\n  constructor(readonly timeoutMs: number, readonly requestUrl: string) {\n    super(`API request timed out after ${timeoutMs}ms: ${requestUrl}`);\n    this.name = \"ApiTimeoutError\";\n  }\n}\n\nexport class ApiResponseTooLargeError extends Error {\n  readonly code = \"OPENPOND_API_RESPONSE_TOO_LARGE\";\n\n  constructor(readonly maximumBytes: number, readonly requestUrl: string) {\n    super(`API response exceeded ${maximumBytes} bytes: ${requestUrl}`);\n    this.name = \"ApiResponseTooLargeError\";\n  }\n}\n\nexport class OpenPondApiError extends Error {\n  readonly code: string;\n\n  constructor(\n    readonly status: number,\n    errorCode: string | null,\n    label: string,\n    readonly apiMessage: string | null = null,\n  ) {\n    const detail = apiMessage || errorCode;\n    super(`${label} failed: ${status}${detail ? ` ${detail}` : \"\"}`);\n    this.name = \"OpenPondApiError\";\n    this.code = errorCode || \"OPENPOND_API_ERROR\";\n  }\n}\n\nexport async function apiFetch(\n  baseUrl: string,\n  token: string | null,\n  requestPath: string,\n  options: ApiFetchOptions = {},\n): Promise<Response> {\n  const { timeoutMs = DEFAULT_API_TIMEOUT_MS, maxResponseBytes = DEFAULT_API_RESPONSE_BYTES, explicitBearerAuth = false, ...init } = options;\n  const requestUrl = `${baseUrl}${requestPath}`;\n  const headers = new Headers(init.headers);\n  headers.set(\"Content-Type\", \"application/json\");\n  const apiKey = !explicitBearerAuth ? process.env.OPENPOND_API_KEY : undefined;\n  const trimmedToken = token?.trim() || \"\";\n  const tokenIsApiKey = !explicitBearerAuth && trimmedToken.startsWith(\"opk_\");\n  const effectiveApiKey = apiKey || (tokenIsApiKey ? trimmedToken : null);\n  if (effectiveApiKey && !headers.has(\"openpond-api-key\")) headers.set(\"openpond-api-key\", effectiveApiKey);\n  if (token) {\n    headers.set(\"Authorization\", tokenIsApiKey ? `ApiKey ${trimmedToken}` : `Bearer ${token}`);\n  } else if (apiKey && !headers.has(\"Authorization\")) {\n    headers.set(\"Authorization\", `ApiKey ${apiKey}`);\n  }\n\n  const timeoutController = new AbortController();\n  const timeoutError = new ApiTimeoutError(timeoutMs, requestUrl);\n  const timer = timeoutMs > 0\n    ? setTimeout(() => timeoutController.abort(timeoutError), timeoutMs)\n    : null;\n  timer?.unref?.();\n  const signal = composedSignal(init.signal, timeoutController.signal, timeoutMs);\n  const cleanup = () => {\n    if (timer) clearTimeout(timer);\n  };\n\n  try {\n    const response = await fetch(requestUrl, { ...init, headers, signal });\n    return boundedResponse(response, {\n      cleanup,\n      maximumBytes: maxResponseBytes,\n      requestUrl,\n      timeoutController,\n      timeoutError,\n    });\n  } catch (error) {\n    cleanup();\n    if (timeoutController.signal.aborted) throw timeoutError;\n    throw error;\n  }\n}\n\nexport async function readApiJson<T>(response: Response, label: string): Promise<T> {\n  let payload: T & { error?: unknown; message?: unknown };\n  try {\n    const text = await response.text();\n    payload = (text ? JSON.parse(text) : {}) as T & { error?: unknown; message?: unknown };\n  } catch (error) {\n    if (error instanceof ApiTimeoutError || error instanceof ApiResponseTooLargeError) throw error;\n    payload = {} as T & { error?: unknown; message?: unknown };\n  }\n  if (!response.ok) {\n    const errorCode = typeof payload.error === \"string\" ? payload.error : null;\n    const apiMessage =\n      typeof payload.message === \"string\" ? payload.message : null;\n    throw new OpenPondApiError(response.status, errorCode, label, apiMessage);\n  }\n  return payload as T;\n}\n\nfunction boundedResponse(\n  response: Response,\n  input: {\n    cleanup: () => void;\n    maximumBytes: number;\n    requestUrl: string;\n    timeoutController: AbortController;\n    timeoutError: ApiTimeoutError;\n  },\n): Response {\n  if (!response.body) {\n    input.cleanup();\n    return response;\n  }\n  const contentLength = Number(response.headers.get(\"content-length\"));\n  if (input.maximumBytes > 0 && Number.isFinite(contentLength) && contentLength > input.maximumBytes) {\n    input.cleanup();\n    void response.body.cancel();\n    throw new ApiResponseTooLargeError(input.maximumBytes, input.requestUrl);\n  }\n\n  const reader = response.body.getReader();\n  let receivedBytes = 0;\n  const body = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      try {\n        const result = await reader.read();\n        if (result.done) {\n          input.cleanup();\n          controller.close();\n          return;\n        }\n        receivedBytes += result.value.byteLength;\n        if (input.maximumBytes > 0 && receivedBytes > input.maximumBytes) {\n          input.cleanup();\n          await reader.cancel();\n          controller.error(new ApiResponseTooLargeError(input.maximumBytes, input.requestUrl));\n          return;\n        }\n        controller.enqueue(result.value);\n      } catch (error) {\n        input.cleanup();\n        controller.error(input.timeoutController.signal.aborted ? input.timeoutError : error);\n      }\n    },\n    async cancel(reason) {\n      input.cleanup();\n      await reader.cancel(reason);\n    },\n  });\n  return new Response(body, {\n    headers: response.headers,\n    status: response.status,\n    statusText: response.statusText,\n  });\n}\n\nfunction composedSignal(\n  callerSignal: AbortSignal | null | undefined,\n  timeoutSignal: AbortSignal,\n  timeoutMs: number,\n): AbortSignal | undefined {\n  if (timeoutMs <= 0) return callerSignal ?? undefined;\n  return callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;\n}\n"],
+  "mappings": ";AAAA,IAAM,yBAAyB;AAC/B,IAAM,6BAA6B,IAAI,OAAO;AACvC,IAAM,0BAA0B,EAAE,WAAW,KAAK,KAAK,KAAM,kBAAkB,KAAK,OAAO,KAAI;AAShG,IAAO,kBAAP,cAA+B,MAAK;EAGnB;EAA4B;EAFxC,OAAO;EAEhB,YAAqB,WAA4B,YAAkB;AACjE,UAAM,+BAA+B,SAAS,OAAO,UAAU,EAAE;AAD9C,SAAA,YAAA;AAA4B,SAAA,aAAA;AAE/C,SAAK,OAAO;EACd;;AAGI,IAAO,2BAAP,cAAwC,MAAK;EAG5B;EAA+B;EAF3C,OAAO;EAEhB,YAAqB,cAA+B,YAAkB;AACpE,UAAM,yBAAyB,YAAY,WAAW,UAAU,EAAE;AAD/C,SAAA,eAAA;AAA+B,SAAA,aAAA;AAElD,SAAK,OAAO;EACd;;AAGI,IAAO,mBAAP,cAAgC,MAAK;EAI9B;EAGA;EANF;EAET,YACW,QACT,WACA,OACS,aAA4B,MAAI;AAEzC,UAAM,SAAS,cAAc;AAC7B,UAAM,GAAG,KAAK,YAAY,MAAM,GAAG,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE;AANtD,SAAA,SAAA;AAGA,SAAA,aAAA;AAIT,SAAK,OAAO;AACZ,SAAK,OAAO,aAAa;EAC3B;;AAGF,eAAsB,SACpB,SACA,OACA,aACA,UAA2B,CAAA,GAAE;AAE7B,QAAM,EAAE,YAAY,wBAAwB,mBAAmB,4BAA4B,qBAAqB,OAAO,GAAG,KAAI,IAAK;AACnI,QAAM,aAAa,GAAG,OAAO,GAAG,WAAW;AAC3C,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,UAAQ,IAAI,gBAAgB,kBAAkB;AAC9C,QAAM,SAAS,CAAC,qBAAqB,QAAQ,IAAI,mBAAmB;AACpE,QAAM,eAAe,OAAO,KAAI,KAAM;AACtC,QAAM,gBAAgB,CAAC,sBAAsB,aAAa,WAAW,MAAM;AAC3E,QAAM,kBAAkB,WAAW,gBAAgB,eAAe;AAClE,MAAI,mBAAmB,CAAC,QAAQ,IAAI,kBAAkB;AAAG,YAAQ,IAAI,oBAAoB,eAAe;AACxG,MAAI,OAAO;AACT,YAAQ,IAAI,iBAAiB,gBAAgB,UAAU,YAAY,KAAK,UAAU,KAAK,EAAE;EAC3F,WAAW,UAAU,CAAC,QAAQ,IAAI,eAAe,GAAG;AAClD,YAAQ,IAAI,iBAAiB,UAAU,MAAM,EAAE;EACjD;AAEA,QAAM,oBAAoB,IAAI,gBAAe;AAC7C,QAAM,eAAe,IAAI,gBAAgB,WAAW,UAAU;AAC9D,QAAM,QAAQ,YAAY,IACtB,WAAW,MAAM,kBAAkB,MAAM,YAAY,GAAG,SAAS,IACjE;AACJ,SAAO,QAAO;AACd,QAAM,SAAS,eAAe,KAAK,QAAQ,kBAAkB,QAAQ,SAAS;AAC9E,QAAM,UAAU,MAAK;AACnB,QAAI;AAAO,mBAAa,KAAK;EAC/B;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,YAAY,EAAE,GAAG,MAAM,SAAS,OAAM,CAAE;AACrE,WAAO,gBAAgB,UAAU;MAC/B;MACA,cAAc;MACd;MACA;MACA;KACD;EACH,SAAS,OAAO;AACd,YAAO;AACP,QAAI,kBAAkB,OAAO;AAAS,YAAM;AAC5C,UAAM;EACR;AACF;AAEA,eAAsB,YAAe,UAAoB,OAAa;AACpE,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,KAAI;AAChC,cAAW,OAAO,KAAK,MAAM,IAAI,IAAI,CAAA;EACvC,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAmB,iBAAiB;AAA0B,YAAM;AACzF,cAAU,CAAA;EACZ;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,YAAY,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AACtE,UAAM,aACJ,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAC1D,UAAM,IAAI,iBAAiB,SAAS,QAAQ,WAAW,OAAO,UAAU;EAC1E;AACA,SAAO;AACT;AAEA,SAAS,gBACP,UACA,OAMC;AAED,MAAI,CAAC,SAAS,MAAM;AAClB,UAAM,QAAO;AACb,WAAO;EACT;AACA,QAAM,gBAAgB,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;AACnE,MAAI,MAAM,eAAe,KAAK,OAAO,SAAS,aAAa,KAAK,gBAAgB,MAAM,cAAc;AAClG,UAAM,QAAO;AACb,SAAK,SAAS,KAAK,OAAM;AACzB,UAAM,IAAI,yBAAyB,MAAM,cAAc,MAAM,UAAU;EACzE;AAEA,QAAM,SAAS,SAAS,KAAK,UAAS;AACtC,MAAI,gBAAgB;AACpB,QAAM,OAAO,IAAI,eAA2B;IAC1C,MAAM,KAAK,YAAU;AACnB,UAAI;AACF,cAAM,SAAS,MAAM,OAAO,KAAI;AAChC,YAAI,OAAO,MAAM;AACf,gBAAM,QAAO;AACb,qBAAW,MAAK;AAChB;QACF;AACA,yBAAiB,OAAO,MAAM;AAC9B,YAAI,MAAM,eAAe,KAAK,gBAAgB,MAAM,cAAc;AAChE,gBAAM,QAAO;AACb,gBAAM,OAAO,OAAM;AACnB,qBAAW,MAAM,IAAI,yBAAyB,MAAM,cAAc,MAAM,UAAU,CAAC;AACnF;QACF;AACA,mBAAW,QAAQ,OAAO,KAAK;MACjC,SAAS,OAAO;AACd,cAAM,QAAO;AACb,mBAAW,MAAM,MAAM,kBAAkB,OAAO,UAAU,MAAM,eAAe,KAAK;MACtF;IACF;IACA,MAAM,OAAO,QAAM;AACjB,YAAM,QAAO;AACb,YAAM,OAAO,OAAO,MAAM;IAC5B;GACD;AACD,SAAO,IAAI,SAAS,MAAM;IACxB,SAAS,SAAS;IAClB,QAAQ,SAAS;IACjB,YAAY,SAAS;GACtB;AACH;AAEA,SAAS,eACP,cACA,eACA,WAAiB;AAEjB,MAAI,aAAa;AAAG,WAAO,gBAAgB;AAC3C,SAAO,eAAe,YAAY,IAAI,CAAC,cAAc,aAAa,CAAC,IAAI;AACzE;",
+  "names": []
+}

package/dist/{chunk-FJ7IMEG5.js → chunk-IWT6JUZD.js}

@@ -1,7 +1,7 @@
 import {
   apiFetch,
   readApiJson
-} from "./chunk-22RMONJA.js";
+} from "./chunk-CEZEVILU.js";
 
 // src/project-actions.ts
 import { promises as fs } from "node:fs";
@@ -80,4 +80,4 @@ function projectActionPath(projectId, suffix, teamId) {
 export {
   OpenPondProjectActionsClient
 };
-//# sourceMappingURL=chunk-FJ7IMEG5.js.map
+//# sourceMappingURL=chunk-IWT6JUZD.js.map

package/dist/{chunk-JHKNPQD5.js → chunk-MEKWESBF.js}

@@ -1,7 +1,7 @@
 import {
   apiFetch,
   readApiJson
-} from "./chunk-22RMONJA.js";
+} from "./chunk-CEZEVILU.js";
 
 // src/workflows.ts
 import { randomUUID } from "node:crypto";
@@ -77,4 +77,4 @@ function requiredId(value, label) {
 export {
   OpenPondWorkflowsClient
 };
-//# sourceMappingURL=chunk-JHKNPQD5.js.map
+//# sourceMappingURL=chunk-MEKWESBF.js.map

package/dist/index.js

@@ -5,18 +5,18 @@ import {
 import "./chunk-5FBPNWT4.js";
 import {
   OpenPondProjectActionsClient
-} from "./chunk-FJ7IMEG5.js";
+} from "./chunk-IWT6JUZD.js";
 import {
   OpenPondProfileActionsClient
-} from "./chunk-6T23L3LH.js";
+} from "./chunk-2DMYAJLS.js";
 import {
   OpenPondWorkflowsClient
-} from "./chunk-JHKNPQD5.js";
+} from "./chunk-MEKWESBF.js";
 import {
   OpenPondApiError,
   apiFetch,
   readApiJson
-} from "./chunk-22RMONJA.js";
+} from "./chunk-CEZEVILU.js";
 import "./chunk-LXXQVGQY.js";
 import {
   DEFAULT_REFINER_REVIEW_PROFILE,
@@ -943,11 +943,11 @@ var OpenPondSandboxInstanceClient = class {
     });
   }
   async request(path, init = {}) {
-    const response = await apiFetch(this.sandboxApiUrl, this.apiKey, path, this.customEndpoint ? { ...init, useEnvironmentApiKey: false, redirect: "error" } : init);
+    const response = await apiFetch(this.sandboxApiUrl, this.apiKey, path, this.customEndpoint ? { ...init, explicitBearerAuth: true, redirect: "error" } : init);
     return readApiJson(response, "Sandbox request");
   }
   async requestApiRoot(path, init = {}) {
-    const response = await apiFetch(this.apiRootUrl, this.apiKey, path, this.customEndpoint ? { ...init, useEnvironmentApiKey: false, redirect: "error" } : init);
+    const response = await apiFetch(this.apiRootUrl, this.apiKey, path, this.customEndpoint ? { ...init, explicitBearerAuth: true, redirect: "error" } : init);
     return readApiJson(response, "OpenPond API request");
   }
 };
@@ -2297,7 +2297,9 @@ function systemPrompt(sandboxId, hasInputs) {
     "You are OpenPond Work, a careful coding agent operating in an isolated Linux sandbox.",
     `The active sandbox is ${sandboxId}.`,
     ...hasInputs ? [
-      `Caller-provided durable files are staged under ${WORK_INPUT_DIRECTORY}; structured metadata is in ${WORK_INPUT_MANIFEST}.`
+      `The authoritative saved files for this turn are staged under /workspace/${WORK_INPUT_DIRECTORY}; their manifest is /workspace/${WORK_INPUT_MANIFEST}.`,
+      "Before revising a previous output, read its staged file and manifest. Copy the staged input into the output directory before editing it; previous output paths may not exist in this sandbox.",
+      "Preserve the actual file bytes. Never reconstruct a saved file from the conversation or claim to have preserved it without reading the staged input."
     ] : [],
     "Use run_command to inspect the workspace, edit files, and validate your work.",
     `Place completed user-facing files in ${WORK_OUTPUT_DIRECTORY}. The runtime collects new and revised files there automatically when the turn completes.`,