openwork-server 0.18.49 → 0.18.56

package/dist/opencode-plugins/openwork-context-v2.js

@@ -0,0 +1,84 @@
+import { createRequire } from "node:module";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/opencode-plugins/openwork-context-v2.ts
+var openwork_context_v2_default = {
+  id: "openwork.context",
+  async setup(context) {
+    const registration = await context.tool.transform((editor) => {
+      for (const name of ["openwork_context", "openwork_query"]) {
+        editor.add({
+          name,
+          description: name === "openwork_context" ? "Read OpenWork app context and available read-only affordances. Use this to discover session.search and session.read for other conversations." : "Read an OpenWork affordance without changing the app or navigating. Use the exact id and arguments from openwork_context; session.read includes live background-agent activity.",
+          input: name === "openwork_context" ? { type: "object", properties: {}, additionalProperties: false } : {
+            type: "object",
+            properties: { id: { type: "string" }, args: { type: "object", additionalProperties: true } },
+            required: ["id"],
+            additionalProperties: false
+          },
+          options: { codemode: false },
+          async execute(input, call) {
+            const response = await fetch(context.options.url, {
+              method: "POST",
+              redirect: "error",
+              signal: call.signal,
+              headers: { Authorization: `Bearer ${context.options.token}`, "Content-Type": "application/json" },
+              body: JSON.stringify({ name, input })
+            });
+            if (!response.ok)
+              throw new Error(`OpenWork read failed (${response.status})`);
+            return { content: [{ type: "text", text: await response.text() }] };
+          }
+        });
+      }
+    });
+    return () => registration.dispose();
+  }
+};
+export {
+  openwork_context_v2_default as default
+};

package/dist/opencode-plugins/openwork-extensions-preview-steering.js

@@ -0,0 +1,295 @@
+import { z } from "zod";
+const cloudFailureSchema = z.object({
+    code: z.string(),
+    stage: z.string(),
+    recommendedAction: z.string(),
+    message: z.string(),
+}).passthrough();
+const cloudHealthSchema = z.object({
+    usable: z.boolean(),
+    usableByCurrentModel: z.boolean().nullable(),
+    phase: z.string(),
+    connectCatalogEnabled: z.boolean().optional(),
+    workspace: z.object({
+        id: z.string(),
+        directory: z.string().nullable(),
+    }).passthrough(),
+    desired: z.object({
+        present: z.boolean(),
+        revision: z.string().nullable(),
+    }).passthrough(),
+    delivery: z.object({
+        appliedRevision: z.string().nullable().optional(),
+    }).passthrough().optional(),
+    engine: z.object({
+        status: z.string().optional(),
+    }).passthrough().optional(),
+    firstFailure: cloudFailureSchema.nullable(),
+}).passthrough();
+const connectStateResponseSchema = z.object({
+    ok: z.literal(true),
+    schemaVersion: z.number(),
+    connectEnabled: z.boolean(),
+    connectCatalogEnabled: z.boolean().optional(),
+    cloudMcpPresent: z.boolean(),
+    cloudHealth: cloudHealthSchema.nullable().optional(),
+    workspace: z.object({
+        resolution: z.string().optional(),
+        id: z.string().nullable().optional(),
+        directory: z.string().nullable().optional(),
+        reason: z.string().optional(),
+    }).passthrough().optional(),
+}).passthrough();
+// Both catalogs answer with the same envelope: a rendered prompt section.
+const connectCatalogResponseSchema = z.object({
+    ok: z.literal(true),
+    schemaVersion: z.number(),
+    instruction: z.string(),
+}).passthrough();
+export const OPENWORK_GOOGLE_CONNECTION_INSTRUCTION = `Google Workspace uses OpenWork Cloud Connect only, with the member's Google connection managed by the Cloud backend. Do not set up local Google OAuth, request Google tokens, or offer a legacy Google extension or another provider stack. OpenWork Cloud readiness alone does not establish Google connection readiness. When the user requests Google setup or the requested operation is blocked by its connection, follow the exact live Cloud connection status action returned for that connection under the openwork-cloud server instructions. Never invent a connection status, connection id, or setup action; if no live status action is available, report that limitation.
+For Google Drive uploads and Gmail attachments, Cloud search results alone do not establish that upload is unavailable. Discover the native Gmail draft schema before declaring attachments unsupported: OpenWork fulfills its attachment paths through host file transport, preserving the selected connection. Draft creation does not send email; sending is a separate, permissioned operation that requires the user's authorization. For Google Drive uploads, when OpenWork host tools are exposed, first query extension.actions with extensionId openwork-cloud-uploads. Only if drive_upload_file is returned and the user authorizes the upload, execute that exact action through openwork_execute id extension.call with extensionId openwork-cloud-uploads and args containing path and optional folderId. This host action supports files up to 4 MiB under authorized roots and preserves bytes outside model context. Drive uses the member's default Google connection and cannot select another named connection; do not substitute it for a requested account unless it is confirmed to be the default. If using the Gmail host action directly, only if gmail_create_draft_with_attachments is returned and the user authorizes draft creation, execute it with authorized paths and draft fields from its returned input schema, including the selected connectionId. It creates a reviewable draft, does not send email, and supports up to 10 files totaling 4 MiB. The bridge uses the Cloud backend member connection, not local Google credentials. Never load file bytes into model context or tool arguments, extract tokens, or use shell uploads as a fallback. If host tools or the action are absent, including in external MCP-only clients, report that limitation rather than claiming this host upload route is available. Do not retry or switch routes after an uncertain result; verify whether the draft was created first.`;
+export const OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION = `If the user asks for something you cannot do with obvious built-in tools, check OpenWork extensions before saying the capability is unavailable. Use openwork_query with id extension.actions to inspect available extension actions, then openwork_execute with id extension.call for the matching action. Do not use another route to bypass a failed connection; follow its connection guidance. ${OPENWORK_GOOGLE_CONNECTION_INSTRUCTION}`;
+export const OPENWORK_CLOUD_SKILL_AUTHORING_INSTRUCTION = "Skill creation: Cloud. When the user asks to create a skill, retrieve and follow the listed create-skill remote skill by calling openwork-cloud_get_skill with { name: \"create-skill\" }, or openwork-cloud_execute_capability with its exact <capability> when get_skill is not exposed. Create the skill in OpenWork Cloud as a private plugin, not in the workspace. For later steps, use share-plugin when the user wants a specific person or team to use a skill, and use add-to-marketplace or add-user-to-marketplace only when the user asks. Use a workspace-local skill only when the user explicitly requests one. Do not create both copies.";
+export const OPENWORK_LOCAL_SKILL_AUTHORING_INSTRUCTION = "Skill creation: Local. Create or update a workspace-local skill only when the user requests one. Keep one skill in .opencode/skills/<skill-name>/SKILL.md, validate it, and re-read it after writing. Do not create a Cloud copy.";
+export const OPENWORK_ON_DEMAND_DISCOVERY_INSTRUCTION = `For remote skills and plugin instructions, read the exact known remote skill with openwork-cloud_get_skill by its name or capability, or list every available one with openwork-cloud_list_skills; when those tools are not exposed, execute the exact known remote skill capability with openwork-cloud_execute_capability, or discover it with openwork-cloud_search_capabilities, then execute the exact returned name and follow its instructions. Discover Workflows and Automations on demand; read live before reporting their current state. Follow the openwork-cloud server instructions when its tools are exposed. No Cloud readiness probe has been performed for this prompt; do not infer that Cloud is ready, disconnected, or unavailable.
+When the user asks to create a Cloud skill, read the create-skill remote skill with openwork-cloud_get_skill and follow it to create a private Cloud plugin. For skill creation without an explicit local request, read create-skill rather than defaulting to a local copy because Cloud is unprobed. Discover share-plugin for requested sharing, or add-to-marketplace and add-user-to-marketplace when requested. Do not create both copies. ${OPENWORK_LOCAL_SKILL_AUTHORING_INSTRUCTION}`;
+// Cloud availability plus shared Google guidance. The base agent prompt names the two
+// Connect tools and the catalog rule, and the detailed Connect contract
+// (search-first discovery, MCP Apps, connection_status handling, schema
+// guidance, retry semantics, "a successful search proves authorization")
+// ships with the connection itself as the openwork-cloud server's MCP
+// initialize instructions — guaranteed present exactly when this "ready"
+// steering is selected. Restating either here costs characters on every
+// request and drifts.
+export const OPENWORK_CLOUD_CONNECTION_INSTRUCTION = `The OpenWork Cloud connection is verified ready for this exact workspace/model. The openwork-cloud server instructions in this prompt are authoritative for search-first discovery, MCP Apps, connection_status results, schema guidance, and retry rules; follow them instead of improvising. ${OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION}`;
+export const OPENWORK_CONNECT_SIGN_IN_INSTRUCTION = `${OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION} OpenWork Cloud is not signed in or no desired agent access configuration exists for this workspace. Direct the user to sign in to OpenWork and connect the service in Settings → Connect.`;
+export const OPENWORK_CONNECT_DISABLED_INSTRUCTION = `${OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION} OpenWork Cloud agent access is explicitly disabled for this workspace. Explain that the user can enable agent access in Settings → Connect.`;
+const OPENWORK_CLOUD_MCP_NAME = "openwork-cloud";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function getRecordProperty(value, key) {
+    return isRecord(value) ? value[key] : undefined;
+}
+function readNestedString(value, keys) {
+    let current = value;
+    for (const key of keys)
+        current = getRecordProperty(current, key);
+    return readString(current);
+}
+function readContext(input) {
+    const context = getRecordProperty(input, "context");
+    const session = getRecordProperty(input, "session");
+    const directory = readNestedString(input, ["directory"]) ?? readNestedString(context, ["directory"]) ?? readNestedString(session, ["directory"]);
+    const worktree = readNestedString(input, ["worktree"]) ?? readNestedString(context, ["worktree"]) ?? readNestedString(session, ["worktree"]);
+    const workspaceId = readNestedString(input, ["workspaceId"]) ?? readNestedString(input, ["workspaceID"]) ?? readNestedString(context, ["workspaceId"]) ?? readNestedString(context, ["workspaceID"]);
+    return {
+        ...(directory ? { directory } : {}),
+        ...(worktree ? { worktree } : {}),
+        ...(workspaceId ? { workspaceId } : {}),
+    };
+}
+function readProviderModel(input) {
+    const model = getRecordProperty(input, "model");
+    const provider = readNestedString(model, ["providerID"]) ?? readNestedString(model, ["provider"]) ?? readNestedString(input, ["provider"]);
+    const modelId = readNestedString(model, ["modelID"]) ?? readNestedString(model, ["id"]) ?? readNestedString(input, ["modelID"]);
+    if (provider && modelId)
+        return { provider, model: modelId };
+    const combined = modelId?.includes("/") ? modelId : readNestedString(input, ["model"]) ?? readNestedString(model, ["name"]);
+    if (combined?.includes("/")) {
+        const [providerPart, ...modelParts] = combined.split("/");
+        const joinedModel = modelParts.join("/").trim();
+        if (providerPart?.trim() && joinedModel)
+            return { provider: providerPart.trim(), model: joinedModel };
+    }
+    return undefined;
+}
+function serverUrl() {
+    return String(process.env.OPENWORK_SERVER_URL || "").replace(/\/$/, "");
+}
+function serverToken() {
+    return String(process.env.OPENWORK_SERVER_TOKEN || "");
+}
+function requireOpenWorkServer() {
+    const url = serverUrl();
+    const token = serverToken();
+    if (!url || !token) {
+        throw new Error("OpenWork extension tools are only available when OpenCode is launched by OpenWork.");
+    }
+    return { url, token };
+}
+async function parseResponse(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { message: text };
+    }
+}
+function getStringProperty(value, key) {
+    if (!isRecord(value))
+        return null;
+    const property = value[key];
+    return typeof property === "string" ? property : null;
+}
+function errorMessage(payload, fallback) {
+    return getStringProperty(payload, "message") ?? getStringProperty(payload, "code") ?? fallback;
+}
+function readEngineDirectory(input, fallback) {
+    const context = readContext(input);
+    return context.directory ?? context.worktree ?? readString(fallback);
+}
+function engineStatusPayload(result) {
+    if (!isRecord(result))
+        return result;
+    const data = result.data;
+    if (data !== undefined)
+        return data;
+    if (result.error !== undefined)
+        throw new Error("OpenCode MCP status request failed");
+    const responseOk = getRecordProperty(result.response, "ok");
+    if (responseOk === false)
+        throw new Error("OpenCode MCP status request failed");
+    return result;
+}
+function readEngineMcpStatus(result) {
+    const entry = getRecordProperty(engineStatusPayload(result), OPENWORK_CLOUD_MCP_NAME);
+    if (entry === undefined)
+        return { found: false };
+    if (typeof entry === "string")
+        return { found: true, status: readString(entry) };
+    return { found: true, status: readNestedString(entry, ["status"]) };
+}
+async function fetchEngineMcpStatus(input, engine) {
+    if (!engine.client)
+        return { found: false };
+    const directory = readEngineDirectory(input, engine.directory);
+    const request = directory ? { query: { directory } } : undefined;
+    return readEngineMcpStatus(await engine.client.mcp.status(request));
+}
+async function fetchOpenWorkConnectState(input, fetcher) {
+    const { url, token } = requireOpenWorkServer();
+    const context = readContext(input);
+    const providerModel = readProviderModel(input);
+    const query = new URLSearchParams();
+    const workspaceId = context.workspaceId ?? context.workspaceID;
+    const directory = context.worktree ?? context.directory;
+    if (workspaceId)
+        query.set("workspaceId", workspaceId);
+    if (directory)
+        query.set("directory", directory);
+    if (providerModel) {
+        query.set("provider", providerModel.provider);
+        query.set("model", providerModel.model);
+    }
+    const suffix = query.size ? `?${query.toString()}` : "";
+    const response = await fetcher(`${url}/experimental/connect/state${suffix}`, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    const payload = await parseResponse(response);
+    if (!response.ok)
+        throw new Error(errorMessage(payload, "OpenWork connect state request failed"));
+    const parsed = connectStateResponseSchema.parse(payload);
+    return {
+        connectEnabled: parsed.connectEnabled,
+        connectCatalogEnabled: parsed.connectCatalogEnabled ?? parsed.connectEnabled,
+        cloudMcpPresent: parsed.cloudMcpPresent,
+        cloudHealth: parsed.cloudHealth ?? null,
+        ...(parsed.workspace ? { workspace: parsed.workspace } : {}),
+    };
+}
+export async function resolveOpenWorkConnectSkillInstruction(_input, fetcher = fetch) {
+    try {
+        const { url, token } = requireOpenWorkServer();
+        // Connect skills are server-scoped; workspace/directory query params are unused.
+        const response = await fetcher(`${url}/experimental/connect/skills`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (!response.ok)
+            return "";
+        return connectCatalogResponseSchema.parse(await parseResponse(response)).instruction;
+    }
+    catch {
+        return "";
+    }
+}
+export async function resolveOpenWorkAutomationInstruction(_input, fetcher = fetch) {
+    try {
+        const { url, token } = requireOpenWorkServer();
+        // Automations are account-scoped like Connect skills, not per-workspace.
+        const response = await fetcher(`${url}/experimental/connect/automations`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (!response.ok)
+            return "";
+        return connectCatalogResponseSchema.parse(await parseResponse(response)).instruction;
+    }
+    catch {
+        return "";
+    }
+}
+export function composeOpenWorkExtensionDiscoveryInstruction(state) {
+    if (!state)
+        return OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION;
+    if (state.workspace?.resolution && state.workspace.resolution !== "resolved")
+        return OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION;
+    const health = state.cloudHealth;
+    if (health?.usable === true && health.usableByCurrentModel !== false)
+        return OPENWORK_CLOUD_CONNECTION_INSTRUCTION;
+    if (health?.phase === "engine_disabled" || health?.firstFailure?.code === "engine_disabled" || health?.firstFailure?.code === "cloud_mcp_disabled")
+        return OPENWORK_CONNECT_DISABLED_INSTRUCTION;
+    if (health) {
+        if (!health.desired.present || health.firstFailure?.code === "cloud_mcp_missing")
+            return OPENWORK_CONNECT_SIGN_IN_INSTRUCTION;
+        return OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION;
+    }
+    if (!state.connectCatalogEnabled)
+        return OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION;
+    return OPENWORK_CONNECT_SIGN_IN_INSTRUCTION;
+}
+export function composeSteeringFromEngineMcpStatus(status) {
+    if (status === "connected")
+        return OPENWORK_CLOUD_CONNECTION_INSTRUCTION;
+    if (status === "disabled")
+        return OPENWORK_CONNECT_DISABLED_INSTRUCTION;
+    if (status === "needs_auth" || status === "needs_client_registration")
+        return OPENWORK_CONNECT_SIGN_IN_INSTRUCTION;
+    return OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION;
+}
+export function composeSkillAuthoringInstruction(extensionInstruction) {
+    if (extensionInstruction === OPENWORK_CLOUD_CONNECTION_INSTRUCTION) {
+        return { mode: "cloud", prompt: OPENWORK_CLOUD_SKILL_AUTHORING_INSTRUCTION };
+    }
+    return { mode: "local", prompt: OPENWORK_LOCAL_SKILL_AUTHORING_INSTRUCTION };
+}
+export function resetOpenWorkExtensionDiscoveryInstructionCacheForTests() {
+    // Retained for older tests; steering is deliberately uncached so repair is observed immediately.
+}
+export async function resolveOpenWorkExtensionDiscoveryInstruction(input, fetcher = fetch, engine = {}) {
+    if (engine.client) {
+        try {
+            // Invariant: the OpenCode engine owns MCP registration and builds the
+            // prompt tool list, so tool-availability steering must come from that
+            // same in-process MCP state. Server health probes may fail for reasons
+            // (for example corporate TLS trust) that do not affect engine tools.
+            const engineStatus = await fetchEngineMcpStatus(input, engine);
+            if (engineStatus.found)
+                return composeSteeringFromEngineMcpStatus(engineStatus.status);
+        }
+        catch {
+            return OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION;
+        }
+    }
+    try {
+        return composeOpenWorkExtensionDiscoveryInstruction(await fetchOpenWorkConnectState(input, fetcher));
+    }
+    catch {
+        return OPENWORK_EXTENSION_DISCOVERY_INSTRUCTION;
+    }
+}