operon-agents 0.1.0-alpha.16 → 0.1.0-alpha.17

package/dist/app-server/protocol.d.ts

@@ -204,7 +204,7 @@ export interface SessionInvokeResult {
  * This list stays explicit, one entry per reachable operation: it is a security boundary, so a
  * new capability operation should have to be named here to become remotely callable.
  */
-export declare const INVOKABLE_METHODS: readonly ["setModel", "setThinking", "setPermissionMode", "goal.create", "goal.snapshot", "goal.pause", "goal.resume", "goal.cancel", "goal.changeBudget", "plan.setEnabled", "plan.data", "compaction.request", "compaction.pending", "compaction.cancel", "skills.listSkills", "skills.activateSkill", "plugins.summaries", "plugins.info", "plugins.installSummary", "plugins.setEnabled", "plugins.setMcpServerEnabled", "plugins.remove", "plugins.reload", "background.list", "background.readOutput", "background.readOutputDelta", "background.stop", "background.detach", "background.listSubagents", "background.reconcileSubagents", "background.listWorkflows", "background.getWorkflow", "runCommand", "getRecords", "getContextBreakdown", "mcp.list", "mcp.listTools", "mcp.reconnect"];
+export declare const INVOKABLE_METHODS: readonly ["setModel", "setThinking", "setPermissionMode", "goal.create", "goal.snapshot", "goal.pause", "goal.resume", "goal.cancel", "goal.changeBudget", "plan.setEnabled", "plan.data", "compaction.request", "compaction.pending", "compaction.cancel", "skills.listSkills", "skills.activateSkill", "plugins.summaries", "plugins.info", "plugins.installSummary", "plugins.setEnabled", "plugins.setMcpServerEnabled", "plugins.remove", "plugins.reload", "background.list", "background.readOutput", "background.readOutputDelta", "background.stop", "background.detach", "background.listSubagents", "background.reconcileSubagents", "background.listWorkflows", "background.getWorkflow", "runCommand", "getRecords", "getAuditRecords", "getContextBreakdown", "mcp.list", "mcp.listTools", "mcp.reconnect"];
 export type InvokableMethod = (typeof INVOKABLE_METHODS)[number];
 /** `session/event` — an AgentEvent verbatim (already carries `sessionId` + `address`). */
 export type SessionEventParams = AgentEvent;

package/dist/app-server/protocol.js

@@ -95,8 +95,9 @@ export const INVOKABLE_METHODS = [
     // slash commands — the serializable control surface for extensions (cron et al.):
     // per-feature cron RPCs are gone with the capability, /cron rides this instead.
     "runCommand",
-    // conversation log
+    // conversation log, and the audit shard beside it
     "getRecords",
+    "getAuditRecords",
     // context introspection
     "getContextBreakdown",
     // mcp

package/dist/extensions/runtime.d.ts

@@ -83,8 +83,8 @@ export declare class ExtensionRuntime {
     /** Runs one extension's `session` and files its scope. Failure ⇒ skipped, contributions undone. */
     private setupExtension;
     /**
-     * Durable audit trail: replay needs "tool X only exists after record N" to reconstruct the
-     * capability timeline. Rides the `custom` record type — audit-only, ignored by reducers.
+     * Durable audit trail of when this extension joined or left the session — written to the
+     * session's audit shard, which nothing replays from.
      */
     private logChange;
     listTools(): readonly Tool[];

package/dist/extensions/runtime.js

@@ -1,5 +1,5 @@
 import { ServiceUnavailableError, isProbeProperty } from "./services.js";
-import { tagToolSource } from "operon-agents-core";
+import { appendAudit, tagToolSource } from "operon-agents-core";
 /** Decision points block the loop, so they get room to do real work (network, subprocess). */
 const DECISION_TIMEOUT_MS = 30_000;
 /** Observers must not become latency: a slow one is dropped, not waited on. */
@@ -162,8 +162,8 @@ export class ExtensionRuntime {
         }
     }
     /**
-     * Durable audit trail: replay needs "tool X only exists after record N" to reconstruct the
-     * capability timeline. Rides the `custom` record type — audit-only, ignored by reducers.
+     * Durable audit trail of when this extension joined or left the session — written to the
+     * session's audit shard, which nothing replays from.
      */
     async logChange(kind) {
         const extensionId = this.id;
@@ -171,7 +171,7 @@ export class ExtensionRuntime {
         if (!store)
             return;
         try {
-            await store.appendRecord({ type: "custom", name: `extensions.${kind}`, data: { extensionId } });
+            await appendAudit(store, { type: "custom", name: `extensions.${kind}`, data: { extensionId } });
         }
         catch (error) {
             await this.warn(extensionId, `failed to journal extension ${kind}: ${messageOf(error)}`);
@@ -697,7 +697,7 @@ export class ExtensionRuntime {
         return this.revocable(extensionId, {
             steer: (content, options) => runtime.enqueue(extensionId, content, "steering", options?.metadata),
             followUp: (content, options) => runtime.enqueue(extensionId, content, "follow_up", options?.metadata),
-            // Journaled by the engine into the main conversation as `extension:<id>:<name>`, and seen
+            // Written by the engine to the session's audit shard as `extension:<id>:<name>`, and seen
             // by `records()` straight away.
             record: (name, data) => {
                 const session = runtime.session;

package/dist/harness.d.ts

@@ -11,7 +11,7 @@
  * low-level "assemble it yourself / stateless server" path, import from
  * `operon-agents/core` instead.
  */
-import { type AgentEvent, type EventPublicationMode, type TelemetryService, type AgentEventListener, type AgentInput, SessionProjection, type SessionSnapshot, type SnapshotOptions, type DirectoryEntry, type ProjectionObservation, type ProjectionListener, type ApprovalRequest, type ApprovalResponse, type Capability, type InterruptAnswer, type ChatModel, ListenerSink, type PermissionManagerOptions, type PermissionMode, type PendingRunInterrupt, type QuestionRequest, type QuestionResult, type Responder, type RunHandle, type RunResult, type SessionStore, type SessionHandle, type SessionSummary, type ListSessionsFilter, type OpenSessionOptions, type DeleteSessionOptions, type ThinkingLevel, type Tool, type SteerMessage, type SteerOptions, type SteerOrigin, type SteerReceipt, Agent, Runner, Session, McpOAuthService, SkillRegistry, type HookDef, type McpServerConfig, type McpTransportKind, type PluginManager, type ApprovalRequestOptions, type Environment, type EnvironmentFactory, type SessionRepository, type ResolvedAgentProfile, type SubagentProvider } from "operon-agents-core";
+import { type AgentEvent, type EventPublicationMode, type TelemetryService, type AgentEventListener, type AgentInput, SessionProjection, type SessionSnapshot, type SnapshotOptions, type DirectoryEntry, type ProjectionObservation, type ProjectionListener, type ApprovalRequest, type ApprovalResponse, type Capability, type InterruptAnswer, type ChatModel, ListenerSink, type PermissionManagerOptions, type PermissionMode, type PendingRunInterrupt, type QuestionRequest, type QuestionResult, type Responder, type RunHandle, type RunResult, type SessionStore, type SessionHandle, type SessionSummary, type ListSessionsFilter, type OpenSessionOptions, type DeleteSessionOptions, type ThinkingLevel, type Tool, type SteerMessage, type SteerOptions, type SteerOrigin, type SteerReceipt, Agent, Runner, Session, McpOAuthService, SkillRegistry, type HookDef, type McpServerConfig, type McpTransportKind, type McpCredentialProvider, type PluginManager, type ApprovalRequestOptions, type Environment, type EnvironmentFactory, type SessionRepository, type ResolvedAgentProfile, type SubagentProvider } from "operon-agents-core";
 import type { SkillsService, CompactionService, BackgroundManager, McpServersHandle, GoalStore, PlanMode, Logger, ModelRuntime, TracingProcessor } from "operon-agents-core";
 import { type WorkspaceMcpPool } from "./workspace-mcp.ts";
 import { HarnessExtensionManager, ServiceRegistry, type ExtensionDefinition, type ServiceOptions } from "./extensions/index.ts";
@@ -107,6 +107,17 @@ export interface DefaultCapabilitiesOptions {
      * to run is the host's statement, not the kernel's.
      */
     readonly allowedMcpTransports?: readonly McpTransportKind[];
+    /** Credentials the host hands out per connect for this session's http MCP servers. See
+     *  `McpCredentialProvider`. */
+    readonly mcpCredentials?: McpCredentialProvider;
+    /**
+     * The session belongs to one tenant among many (a managed host's default): nothing the process
+     * shares reaches it — no process-wide MCP set, skill scan, OAuth service or directory pool —
+     * MCP runs over http only, and no server may read its token from the process environment.
+     * Each is refused rather than skipped where skipping would hide a misconfiguration. See
+     * docs/server-profile.md.
+     */
+    readonly strictIsolation?: boolean;
 }
 /**
  * The standard coding-agent capability bundle (goal / plan / todo / skills /
@@ -300,6 +311,11 @@ export interface SessionCapabilityContext {
     /** The session brought its own environment (`{ environment }` on this open): harness-shared objects
      *  derived from the harness's environment (the skill scan) do not apply to it. */
     readonly ownEnvironment: boolean;
+    /** {@link OpenSessionOptionsBase.mcpCredentials} for this open. */
+    readonly mcpCredentials?: McpCredentialProvider;
+    /** {@link OpenSessionOptionsBase.strictIsolation} for this open. A custom factory owns honouring
+     *  it the way `defaultCapabilities` does. */
+    readonly strictIsolation: boolean;
 }
 /**
  * Options common to every way of opening a session.
@@ -327,6 +343,16 @@ interface OpenSessionOptionsBase<TContext = unknown> {
      * shared one for this session; a custom factory can decide otherwise.
      */
     readonly mcpServers?: Record<string, McpServerConfig>;
+    /**
+     * Where this session's http MCP servers get their credentials, asked on every connect: the
+     * seam a host builds a per-user vault on. Not persisted — a resume passes it again.
+     */
+    readonly mcpCredentials?: McpCredentialProvider;
+    /**
+     * This session is one tenant's among many: see `DefaultCapabilitiesOptions.strictIsolation`.
+     * A managed host's worker sets it on every open unless it runs single-tenant.
+     */
+    readonly strictIsolation?: boolean;
     /**
      * Per-session argument for each registered extension, by extension id — handed to that
      * extension's `session(api, ctx)` as `ctx.params`. A value of `false` skips the extension for
@@ -601,6 +627,7 @@ export declare class HarnessSession<TContext = unknown> {
     /** PROBE tier: absent without an MCP capability. */
     get mcp(): McpServersHandle | undefined;
     getRecords(...args: Parameters<Session["getRecords"]>): ReturnType<Session["getRecords"]>;
+    getAuditRecords(): ReturnType<Session["getAuditRecords"]>;
     getContextBreakdown(): ReturnType<Session["getContextBreakdown"]>;
     /** Where this session's tools run. A host uses it to run a command in the same place the agent
      *  does — one shell, one filesystem, one working directory. */
@@ -689,6 +716,12 @@ export declare class Harness<TContext = unknown> {
     /** The extension whose `harness` is running right now — its `createSession` must refuse. */
     private runningCreate;
     constructor(options: HarnessOptions<TContext>);
+    /**
+     * Which session-facing parts the `harness` hook built for the whole process — what a
+     * multi-tenant host must not have, since every session on the process would share them.
+     * Infrastructure (repository, logger, model runtime) is not listed: sharing it is the point.
+     */
+    processSharedParts(): Promise<readonly ("mcpServers" | "oauthService" | "skillRegistry")[]>;
     /** The session repository, once the `harness` hook has had its say. */
     private repository;
     /** The fallback repository, built once so two opens share one in-memory store. */

package/dist/harness.js

@@ -11,7 +11,7 @@
  * low-level "assemble it yourself / stateless server" path, import from
  * `operon-agents/core` instead.
  */
-import { readLog, SessionProjection, ListenerSink, agentEventFromRecord, newAgentEventId, Agent, buildAgentFromProfile, INTERRUPTION_STATE_KEY, flattenPendingInterrupts, parseInterruptionState, Runner, Session, emptyUsage, isGuardrailTripwireError, askUserQuestionTool, backgroundCapability, compactionCapability, filesystemTools, goalCapability, LocalEnvironment, McpOAuthService, MemorySessionRepository, SessionRepositoryNotFoundError, planCapability, skillsCapability, SkillRegistry, mcpServersCapability, pluginsCapability, userHooksCapability, taskCapability, workflowCapability, DEFAULT_AGENT_PROFILES, DEFAULT_AGENT_PROFILE_NAME, DEFAULT_SUBAGENT_NAMES, profileSubagentProvider, DEFAULT_ADDRESS, envLogger, noopLogger, } from "operon-agents-core";
+import { readSessionTails, SessionProjection, ListenerSink, agentEventFromRecord, newAgentEventId, Agent, buildAgentFromProfile, INTERRUPTION_STATE_KEY, flattenPendingInterrupts, parseInterruptionState, Runner, Session, emptyUsage, isGuardrailTripwireError, askUserQuestionTool, backgroundCapability, compactionCapability, filesystemTools, goalCapability, LocalEnvironment, McpOAuthService, MemorySessionRepository, SessionRepositoryNotFoundError, planCapability, skillsCapability, SkillRegistry, mcpServersCapability, pluginsCapability, userHooksCapability, taskCapability, workflowCapability, DEFAULT_AGENT_PROFILES, DEFAULT_AGENT_PROFILE_NAME, DEFAULT_SUBAGENT_NAMES, profileSubagentProvider, DEFAULT_ADDRESS, envLogger, noopLogger, } from "operon-agents-core";
 import { mkdirSync } from "node:fs";
 import { workspaceMcpCapability } from "./workspace-mcp.js";
 import { join } from "node:path";
@@ -42,9 +42,15 @@ const EXTENSION_PARAMS_STATE_KEY = "extensions:params";
 export function defaultCapabilities(options = {}) {
     const manager = options.pluginManager ?? options.shared?.pluginManager;
     // A session on its own environment ignores the process-wide registry: it was scanned elsewhere.
-    const sharedSkills = options.ownEnvironment === true ? undefined : options.shared?.skillRegistry;
-    const sharedServers = options.ownEnvironment === true ? undefined : options.shared?.mcpServers;
-    const oauthService = options.oauthService ?? options.shared?.oauthService;
+    const strict = options.strictIsolation === true;
+    // A session on its own environment, or one tenant among many, gets nothing the process shares.
+    const isolated = strict || options.ownEnvironment === true;
+    const sharedSkills = isolated ? undefined : options.shared?.skillRegistry;
+    const sharedServers = isolated ? undefined : options.shared?.mcpServers;
+    const oauthService = options.oauthService ?? (strict ? undefined : options.shared?.oauthService);
+    const allowedMcpTransports = strict
+        ? (options.allowedMcpTransports ?? ["http", "stdio"]).filter((kind) => kind === "http")
+        : options.allowedMcpTransports;
     // Shared registry so the plugin session-start injector can render a skill the skills capability
     // loaded (its roots include the plugin skill dirs below). A process-wide registry is scanned
     // once for every session; a session-level one is scanned here.
@@ -69,7 +75,8 @@ export function defaultCapabilities(options = {}) {
     const sessionMcp = options.sessionMcpServers ?? {};
     const mcpOptions = {
         ...(oauthService !== undefined ? { oauthService } : {}),
-        ...(options.allowedMcpTransports !== undefined ? { allowedTransports: options.allowedMcpTransports } : {}),
+        ...(allowedMcpTransports !== undefined ? { allowedTransports: allowedMcpTransports } : {}),
+        ...(options.mcpCredentials !== undefined ? { credentials: options.mcpCredentials } : {}),
     };
     // Everything this session would connect that is not private to it: the directory's servers
     // last, so they win over a same-named plugin server the way they did as a session overlay.
@@ -78,7 +85,15 @@ export function defaultCapabilities(options = {}) {
         ...(manager?.mcpServerConfigs() ?? {}),
         ...(options.workspaceMcp?.servers ?? {}),
     };
-    const pooled = sharedServers === undefined && options.ownEnvironment !== true ? options.workspaceMcp : undefined;
+    if (strict) {
+        // The process environment has no tenant boundary: a token read from it is every tenant's.
+        for (const [name, config] of Object.entries({ ...shareable, ...sessionMcp })) {
+            if (config.bearerTokenEnvVar !== undefined) {
+                throw new Error(`MCP server "${name}" reads its token from the process environment (bearerTokenEnvVar), which every tenant on this host shares; hand it out per session with mcpCredentials instead.`);
+            }
+        }
+    }
+    const pooled = sharedServers === undefined && !isolated ? options.workspaceMcp : undefined;
     if (pooled !== undefined && Object.keys(shareable).length > 0) {
         // Borrowed per directory: the capability views the pool's set, `sessionMcp` is its overlay.
         capabilities.push(workspaceMcpCapability({ pool: pooled.pool, workDir: pooled.workDir, servers: shareable, overlay: sessionMcp, overlayOptions: mcpOptions }));
@@ -698,6 +713,9 @@ export class HarnessSession {
     getRecords(...args) {
         return this.core.getRecords(...args);
     }
+    getAuditRecords() {
+        return this.core.getAuditRecords();
+    }
     // ── context introspection — where the model's window is spent, as of the last turn ──
     getContextBreakdown() {
         return this.core.getContextBreakdown();
@@ -920,6 +938,22 @@ export class Harness {
         // Surfaced to whoever opens a session; never an unhandled rejection on its own.
         this.sharedReady.catch(() => undefined);
     }
+    /**
+     * Which session-facing parts the `harness` hook built for the whole process — what a
+     * multi-tenant host must not have, since every session on the process would share them.
+     * Infrastructure (repository, logger, model runtime) is not listed: sharing it is the point.
+     */
+    async processSharedParts() {
+        await this.sharedReady;
+        const parts = [];
+        if (this.parts.mcpServers !== undefined)
+            parts.push("mcpServers");
+        if (this.parts.oauthService !== undefined)
+            parts.push("oauthService");
+        if (this.parts.skillRegistry !== undefined)
+            parts.push("skillRegistry");
+        return parts;
+    }
     /** The session repository, once the `harness` hook has had its say. */
     async repository() {
         await this.sharedReady;
@@ -1379,7 +1413,17 @@ export class Harness {
     }
     /** Resolve the capability set for one session — the `session` hook, called fresh every time. */
     async resolveCapabilities(ctx, params = {}) {
-        const base = this.options.session !== undefined ? await this.options.session(ctx) : defaultCapabilities({ shared: this.parts });
+        // A session on its own environment (a sandbox) does not get the process's MCP connections or
+        // skill scan: both describe the HARNESS's machine, not the one this session's tools run on.
+        const base = this.options.session !== undefined
+            ? await this.options.session(ctx)
+            : defaultCapabilities({
+                shared: this.parts,
+                ownEnvironment: ctx.ownEnvironment,
+                strictIsolation: ctx.strictIsolation,
+                ...(ctx.mcpServers !== undefined ? { sessionMcpServers: ctx.mcpServers } : {}),
+                ...(ctx.mcpCredentials !== undefined ? { mcpCredentials: ctx.mcpCredentials } : {}),
+            });
         // Every definition registered on this harness: by value (`extensions`, harness halves
         // included — their per-session `session` is mounted here like any other), then from files.
         const extensions = [...this.valueDefs.values(), ...(this.extensions?.sessionDefinitions() ?? [])];
@@ -1459,12 +1503,13 @@ export class Harness {
             // Environment: this call's override → the harness's default → a LocalEnvironment at the
             // session's own workDir. The session only OPERATES a caller-supplied environment.
             const environment = opts.environment ?? this.parts.environment ?? new LocalEnvironment(workDir);
-            // ONE open-time log read, shared: the projection seeds from it, and Session.open
-            // receives it as `preloadedLog` so its capability restore + context pre-build fold the
-            // same records — same IO, and the same `Message` objects (no second parsed copy).
+            // ONE open-time log read, shared: every shard from its newest checkpoint on (each
+            // checkpoint carries the history and lifecycle before it). The projection seeds from it,
+            // and Session.open receives it as `preloadedLog` so its capability restore + context
+            // pre-build fold the same records — same IO, and the same `Message` objects.
             // Attach still happens BEFORE Session.open: no events flow yet, so the seed cannot
             // race the subscription, and anything capabilities emit during open is already folded.
-            let preloadedLog = await readLog(store);
+            let preloadedLog = await readSessionTails(store);
             // A fresh session has an empty log; anything else is a reopen. Telemetry is the only reader.
             const resumed = preloadedLog.length > 0;
             projection = await SessionProjection.attach({ id, store, events }, preloadedLog);
@@ -1478,7 +1523,9 @@ export class Harness {
                 sessionId: id,
                 workDir,
                 ownEnvironment: opts.environment !== undefined,
+                strictIsolation: opts.strictIsolation === true,
                 ...(opts.mcpServers !== undefined ? { mcpServers: opts.mcpServers } : {}),
+                ...(opts.mcpCredentials !== undefined ? { mcpCredentials: opts.mcpCredentials } : {}),
             }, params);
             // Everything the session runs on, by value. The repository owns the store's lifetime.
             core = await Session.open({
@@ -1595,7 +1642,7 @@ export class Harness {
 export async function closeOrphanedTurns(sessionId, store) {
     if ((await store.getState(INTERRUPTION_STATE_KEY)) !== null)
         return [];
-    const projection = await SessionProjection.attach({ id: sessionId, store, events: new ListenerSink() }, await readLog(store));
+    const projection = await SessionProjection.attach({ id: sessionId, store, events: new ListenerSink() }, await readSessionTails(store));
     const records = await closeOrphanedProjectionFrames(sessionId, store, projection);
     const events = [];
     for (const record of records) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "operon-agents",
-  "version": "0.1.0-alpha.16",
+  "version": "0.1.0-alpha.17",
   "description": "Public SDK entrypoint for building agents.",
   "type": "module",
   "engines": {
@@ -74,7 +74,7 @@
     "zod": "^4.4.3",
     "smol-toml": "^1.6.1",
     "@earendil-works/pi-ai": "0.87.1",
-    "operon-agents-core": "0.1.0-alpha.16"
+    "operon-agents-core": "0.1.0-alpha.17"
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "0.87.1"