pi-roundtable-sandbox 0.7.11 → 0.7.13

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.7.13
+
+- `precheckScriptRunner` forwards only the tools approved with the script (pi-roundtable 0.7.13's `PrecheckScriptContext.tools`) among those `grant` allows, and takes `toolName(server, tool)`, the name the host's hold rules know a tool by (default the tool's own name).
+
+## 0.7.12
+
+- A host compactor gets at most half the time the turn has left (the runtime passes the broker its `deadline`, `PiHostContext.deadline`), so Pi's own summary still fits after it runs out; with under two seconds left the broker falls back to Pi's summary at once.
+- The broker logs the first `error` event of a server-sent event stream that started with a 200 (`sandbox upstream call failed`, with the event's data, credentials removed), which the status alone never showed; the worker still receives the whole stream.
+
 ## 0.7.11
 
 - `precheckScriptRunner` runs agents' precheck scripts (pi-roundtable 0.7.11) in a sealed container per run: no network, a read-only root, no capabilities, a non-root user, an empty workspace, and a per-run broker (`precheckBroker`) that forwards only single `tools/call` requests of the tools `grant(scope)` allows, with the host's credential (`PrecheckMcpServer`). The container runs `worker/precheck-main.ts` (`PRECHECK_ENTRYPOINT`, `PrecheckWorkerInput`), which gives the script `mcp.call`, `mcp.json`, `firedAt`, `timeZone`, `today`, and `schedule`.

package/README.md

@@ -262,7 +262,7 @@ new PiSandboxRuntime({
 
 `PiCompactRequest` carries Pi's preparation: `reason`, `tokensBefore`, `firstKeptEntryId`, `isSplitTurn`, `messagesToSummarize`, `turnPrefixMessages`, `keptMessages` (the messages from `firstKeptEntryId` on), `previousSummary?`, `customInstructions?`, `readFiles` and `modifiedFiles`.
 A `PiCompaction` is Pi's `CompactionResult`: `summary`, `firstKeptEntryId` (the request's), `tokensBefore`, `estimatedTokensAfter?` and `details?` (an object; the broker sets its `engine`).
-A compactor that returns `undefined`, throws, answers out of shape, outlasts `timeoutMs` (its `signal` aborts), or gets a request over `maxRequestBytes` falls back to Pi's summary, and the host logs the reason.
+A compactor that returns `undefined`, throws, answers out of shape, outlasts `timeoutMs` or half the time the turn has left, whichever is shorter (its `signal` aborts), or gets a request over `maxRequestBytes` falls back to Pi's summary, and the host logs the reason.
 The timeout may be at most half of `turnTimeoutMs`, so Pi's summary keeps time to run.
 A turn may ask the host for three compactions and send sixteen compaction reports; later compactions fall back to Pi's summary, and while a compactor that ignored its signal still runs, a new request falls back too.
 Without `compaction` the worker registers no compaction handler; the tiers and Pi's summary still apply.
@@ -391,7 +391,8 @@ export const precheckScripts = definePlugin({
 });
 ```
 
-`grant({ channel, target })` returns the `PrecheckMcpServer`s a script for that schedule may call: `{ name, url, tools, token? }`.
+`grant({ channel, target, tier })` returns the `PrecheckMcpServer`s a script for that schedule may call: `{ name, url, tools, token? }`.
+Each run reaches only the granted tools that were approved with the script: the core reads a script's calls when it is saved, and saving one that calls a tool the host's hold rules hold waits for the owner's approval. `toolName(server, tool)` gives the name those rules know a tool by, the name the host's own agent calls it by; the default is the tool's own name, so pass it when your agent sees MCP tools under another name, such as `${server}_${tool}`.
 The script calls a server by `name`, only the listed `tools`, and only with single `tools/call` requests; every other server, tool, method, query, and extra credential is refused, and refused calls count against the run's budget (`maxCalls`, default 16).
 `url` is a fixed HTTPS Streamable HTTP endpoint answering with JSON or one SSE event; `token` is read on the host for each call and inserted by the broker. An answer that carries it, plainly, inside JSON text, or base64-encoded, is refused; this catches an echo, not an upstream set on leaking it, so grant only upstreams you trust.
 Calls run one at a time; a second call while one is pending is refused.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-sandbox",
-	"version": "0.7.11",
+	"version": "0.7.13",
 	"description": "Sealed guest channels and an allow-listed credential broker for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -52,7 +52,7 @@
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
 		"discord.js": "14.27.0",
-		"pi-roundtable": "0.7.11",
+		"pi-roundtable": "0.7.13",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/pi-broker.ts

@@ -27,6 +27,8 @@ export interface PiHostContext {
 	/** The host-judged level for this turn; the worker can request less but never more. */
 	thinking: PiThinkingLevel;
 	signal: AbortSignal;
+	/** When the turn must end, in epoch milliseconds; a host compactor gets at most half the time left. */
+	deadline?: number;
 }
 export interface PiMcpServer {
 	name: string;
@@ -127,12 +129,55 @@ function endpoint(raw: string, allowHttp = false): URL {
 		throw new Error("Invalid trusted endpoint");
 	return url;
 }
+/**
+ * Watches a server-sent event stream as it passes and reports its first `error` event: an
+ * upstream can fail mid-answer after a 200, which the status alone never shows.
+ */
+function sseErrorWatcher(
+	onError: (data: string) => void,
+): (chunk: Uint8Array, done: boolean) => void {
+	const decoder = new TextDecoder();
+	let pending = "";
+	let reported = false;
+	const scan = (event: string) => {
+		const lines = event.split(/\r?\n/);
+		const type = lines
+			.find((line) => line.startsWith("event:"))
+			?.slice(6)
+			.trim();
+		const data = lines
+			.filter((line) => line.startsWith("data:"))
+			.map((line) => line.slice(5).replace(/^ /, ""))
+			.join("\n");
+		let typed: unknown;
+		try {
+			typed = JSON.parse(data);
+		} catch {
+			typed = undefined;
+		}
+		if (type === "error" || (isRecord(typed) && typed.type === "error")) {
+			reported = true;
+			onError(data);
+		}
+	};
+	return (chunk, done) => {
+		if (reported) return;
+		pending += decoder.decode(chunk, { stream: !done });
+		const events = pending.split(/\r?\n\r?\n/);
+		pending = done ? "" : (events.pop() ?? "");
+		// An event this long is no error report; keep scanning without holding it.
+		if (pending.length > 64 * 1024) pending = "";
+		for (const event of events) if (!reported) scan(event);
+	};
+}
+
 function streamBounded(
 	response: Response,
 	signal: AbortSignal,
 	maxBytes: number,
 	secret: string,
 	onFailure: (error: unknown) => void,
+	watch?: (chunk: Uint8Array, done: boolean) => void,
 ): ReadableStream<Uint8Array> {
 	const reader = response.body?.getReader();
 	let total = 0;
@@ -157,6 +202,7 @@ function streamBounded(
 					throw new Error("Credential reflected");
 				total += result?.value?.byteLength ?? 0;
 				if (total > maxBytes) throw new Error("Response too large");
+				watch?.(result?.value ?? new Uint8Array(), !result || result.done);
 				if (!result || result.done) {
 					if (data.length) controller.enqueue(data);
 					controller.close();
@@ -632,6 +678,17 @@ export class PiSandboxBroker {
 							PI_MEDIA_LIMITS.totalFileBytes,
 							secret,
 							(error) => failed(secret, { status: upstream.status, error }),
+							upstream.status < 400 &&
+								(upstream.headers.get("content-type") ?? "").includes(
+									"text/event-stream",
+								)
+								? sseErrorWatcher((body) =>
+										failed(secret, {
+											status: upstream.status,
+											body: `stream error event: ${body}`,
+										}),
+									)
+								: undefined,
 						),
 				{ headers: outgoing, status: upstream.status },
 			);
@@ -725,11 +782,22 @@ export class PiSandboxBroker {
 			compactor.maxRequestBytes ?? PI_COMPACT_LIMITS.requestBytes;
 		if (Number(request.headers.get("content-length") ?? 0) > maxBytes)
 			return fallback(`the request is over ${maxBytes} bytes`);
-		let running: Promise<unknown> = Promise.resolve();
-		this.#compacting = running;
-		const timeout = AbortSignal.timeout(
+		// Pi's own summary must still fit after a compactor that runs out of time.
+		const left =
+			turn.context.deadline === undefined
+				? Number.POSITIVE_INFINITY
+				: turn.context.deadline - Date.now();
+		const timeoutMs = Math.min(
 			compactor.timeoutMs ?? PI_COMPACT_LIMITS.timeoutMs,
+			Math.floor(left / 2),
 		);
+		if (timeoutMs < 1000)
+			return fallback(
+				"the turn has too little time left for the host compactor",
+			);
+		let running: Promise<unknown> = Promise.resolve();
+		this.#compacting = running;
+		const timeout = AbortSignal.timeout(timeoutMs);
 		const signal = AbortSignal.any([
 			turn.context.signal,
 			request.signal,
@@ -797,7 +865,7 @@ export class PiSandboxBroker {
 		} catch (error) {
 			return fallback(
 				timeout.aborted
-					? `the compactor took over ${compactor.timeoutMs ?? PI_COMPACT_LIMITS.timeoutMs} ms`
+					? `the compactor took over ${timeoutMs} ms`
 					: signal.aborted
 						? "the compaction was aborted"
 						: `the compactor failed: ${scrubDiagnostic(errorText(error), 2000)}`,

package/src/pi-runtime.ts

@@ -351,10 +351,12 @@ export class PiSandboxRuntime {
 			return { ok: false, error: new AgentRunError("Channel is busy") };
 		const controller = new AbortController();
 		this.#active.set(turn.channel, controller);
+		const turnTimeoutMs = this.#options.turnTimeoutMs ?? 600_000;
+		const deadline = Date.now() + turnTimeoutMs;
 		const signal = AbortSignal.any([
 			controller.signal,
 			...(turn.signal ? [turn.signal] : []),
-			AbortSignal.timeout(this.#options.turnTimeoutMs ?? 600_000),
+			AbortSignal.timeout(turnTimeoutMs),
 		]);
 		signal.addEventListener("abort", () => controller.abort(), { once: true });
 		const timedOut = () =>
@@ -408,6 +410,7 @@ export class PiSandboxRuntime {
 				speaker: turn.author,
 				thinking,
 				signal,
+				deadline,
 			});
 			const body = await entry.broker.execute(request, signal);
 			signal.throwIfAborted();

package/src/precheck-runner.ts

@@ -51,6 +51,12 @@ export interface PrecheckScriptRunnerOptions {
 	grant(
 		scope: PrecheckScope,
 	): readonly PrecheckMcpServer[] | Promise<readonly PrecheckMcpServer[]>;
+	/**
+	 * The name the host's hold rules know `mcp.call(server, tool)` by, which is the name its own
+	 * agent calls that tool by; default `tool` itself. A script calling a tool the rules hold needs
+	 * the owner's approval to be saved.
+	 */
+	toolName?: (server: string, tool: string) => string;
 	/** The container's command; default the package's worker in the Pi image's layout. */
 	entrypoint?: readonly string[];
 	/** How long a script may run; default 60 seconds. */
@@ -286,6 +292,7 @@ function guide(servers: readonly PrecheckMcpServer[]): string {
 		"`result` is `{ wake: false, note? }` to skip the turn (the note, if any, is posted in small text) or `{ wake: true, context }` to wake you with `context`. Anything else, a throw, or running too long wakes you with the error.",
 		"`today` is the date in the host's time zone (YYYY-MM-DD); pass it to tools instead of computing dates in UTC. `firedAt` is a Date and `timeZone` an IANA zone.",
 		"Await each call before making the next; calls do not run in parallel. console output is discarded; only the returned result counts.",
+		'Write each call as mcp.call("server", "tool", args) or mcp.json(...), with server and tool as strings: the host reads them when the script is saved, and each run may call only those. A script that calls a tool needing the owner\'s approval waits for it when saved, once.',
 		"`await mcp.call(server, tool, args)` returns the MCP tool result; `await mcp.json(server, tool, args)` returns its structured content, or its first text content parsed as JSON. A tool error throws.",
 		"The script runs in a container with no network, no files of the host, and no credentials; it reaches only the tools below.",
 		reach,
@@ -315,6 +322,7 @@ export function precheckScriptRunner(
 			? {}
 			: { timeoutMs: options.timeoutMs }),
 		describe: async (scope) => guide(await grant(scope)),
+		toolName: options.toolName ?? ((_server, tool) => tool),
 		run: async (script, context) => runOne(script, context),
 	};
 
@@ -323,10 +331,21 @@ export function precheckScriptRunner(
 		context: PrecheckScriptContext,
 	): Promise<PrecheckResult> {
 		const { schedule, signal } = context;
-		const servers = await grant({
-			channel: schedule.channel,
-			target: schedule.target,
-			tier: schedule.createdTier,
+		// Only what the grant allows and the owner approved with the script: the broker refuses the rest.
+		const approved = new Set(
+			context.tools.map(({ server, tool }) => `${server}\u0000${tool}`),
+		);
+		const servers = (
+			await grant({
+				channel: schedule.channel,
+				target: schedule.target,
+				tier: schedule.createdTier,
+			})
+		).flatMap((server) => {
+			const tools = server.tools.filter((tool) =>
+				approved.has(`${server.name}\u0000${tool}`),
+			);
+			return tools.length > 0 ? [{ ...server, tools }] : [];
 		});
 		const dirs: string[] = [];
 		let listener: Awaited<ReturnType<typeof listenBroker>> | undefined;