shennian 0.3.72 → 0.3.74

package/node_modules/@shennian/wire/dist/agent-workspace.d.ts

@@ -1,5 +1,71 @@
 import type { AgentType, ManagerConfig, SessionMode } from './session.ts';
 import type { AgentRepairAction, AgentRuntimeAvailability, RoomActivationMode } from './room.ts';
+export declare const MANAGED_AGENT_PERMISSION_POLICY_VERSION = 1;
+export type ManagedAgentFileAccess = 'workspace-read' | 'workspace-write' | 'host-full';
+export type ManagedAgentExternalCapabilities = {
+    commandNetwork: boolean;
+    webSearch: boolean;
+    browser: boolean;
+    computerUse: boolean;
+    mcp: boolean;
+};
+export type ManagedAgentPermissionPolicy = {
+    /** Monotonic AgentIdentity policy revision, owned by the server. */
+    version: number;
+    fileAccess: ManagedAgentFileAccess;
+    externalCapabilities: ManagedAgentExternalCapabilities;
+};
+export type ManagedAgentEnforcementLevel = 'hard' | 'partial' | 'unverified';
+export type ManagedAgentRuntimeCapabilityMatrix = {
+    fileAccess: Record<ManagedAgentFileAccess, boolean>;
+    externalCapabilities: {
+        [Capability in keyof ManagedAgentExternalCapabilities]: {
+            allow: boolean;
+            deny: boolean;
+        };
+    };
+};
+export type ManagedAgentRuntimeProtection = {
+    level: ManagedAgentEnforcementLevel;
+    runtimeVersion: string;
+    platform: string;
+    /** Stable digest of the exact executable selected by the daemon. Absent on older daemons. */
+    executableFingerprint?: string;
+    unsupportedCapabilities: string[];
+    /** Directional native capability evidence; absent means the runtime is not trusted. */
+    capabilityMatrix?: ManagedAgentRuntimeCapabilityMatrix;
+};
+export type ManagedAgentEnforcement = ManagedAgentRuntimeProtection & {
+    effectivePolicy: ManagedAgentPermissionPolicy;
+};
+/** One-time request proving that the user accepted the currently displayed runtime risk. */
+export type ManagedAgentPermissionConfirmationRequest = {
+    runtimeAdapter: AgentType;
+    runtimeVersion: string;
+    platform: string;
+    executableFingerprint: string;
+    hostFullAccess: boolean;
+    limitedProtection: boolean;
+};
+/** Server-owned confirmation bound to one policy revision and one exact local runtime. */
+export type ManagedAgentPermissionConfirmation = ManagedAgentPermissionConfirmationRequest & {
+    policyVersion: number;
+    confirmedAt: string;
+};
+export declare const DEFAULT_MANAGED_AGENT_PERMISSION_POLICY: ManagedAgentPermissionPolicy;
+/**
+ * Compatibility projection for payloads created before managed permissions existed.
+ * Missing policy data must never be presented as if a restrictive sandbox were active.
+ */
+export declare const LEGACY_MANAGED_AGENT_PERMISSION_POLICY: ManagedAgentPermissionPolicy;
+/**
+ * Project the policy the runtime can actually guarantee. Missing directional
+ * evidence is treated as possible host-wide file and external access.
+ */
+export declare function resolveManagedAgentEffectivePermissionPolicy(requested: ManagedAgentPermissionPolicy, protection?: ManagedAgentRuntimeProtection | null): ManagedAgentPermissionPolicy;
+/** Strictly parse an explicit policy. Invalid or incomplete values are not silently repaired. */
+export declare function parseManagedAgentPermissionPolicy(value: unknown): ManagedAgentPermissionPolicy | null;
+export declare function resolveManagedAgentPermissionPolicy(value: unknown, fallback?: 'default' | 'legacy'): ManagedAgentPermissionPolicy;
 export type AgentWorkspaceRoomLink = {
     bindingId: string;
     status: string;
@@ -45,6 +111,10 @@ export type AgentWorkspace = {
     modelId: string | null;
     sessionMode: SessionMode;
     managerConfig: ManagerConfig | null;
+    /** Optional only for wire/cache compatibility. New servers always return an explicit policy. */
+    permissionPolicy?: ManagedAgentPermissionPolicy;
+    /** Null means this policy/runtime has no persisted high-risk or limited-protection approval. */
+    permissionConfirmation?: ManagedAgentPermissionConfirmation | null;
     createdAt: string;
     updatedAt: string;
     sessions: AgentWorkspaceSession[];

package/node_modules/@shennian/wire/dist/agent-workspace.js

@@ -1,2 +1,112 @@
 // @arch docs/features/agent-workspaces.md
-export {};
+// @arch docs/features/managed-agent-restricted-runtime.md
+export const MANAGED_AGENT_PERMISSION_POLICY_VERSION = 1;
+export const DEFAULT_MANAGED_AGENT_PERMISSION_POLICY = {
+    version: MANAGED_AGENT_PERMISSION_POLICY_VERSION,
+    fileAccess: 'workspace-write',
+    externalCapabilities: {
+        commandNetwork: false,
+        webSearch: false,
+        browser: false,
+        computerUse: false,
+        mcp: false,
+    },
+};
+/**
+ * Compatibility projection for payloads created before managed permissions existed.
+ * Missing policy data must never be presented as if a restrictive sandbox were active.
+ */
+export const LEGACY_MANAGED_AGENT_PERMISSION_POLICY = {
+    version: MANAGED_AGENT_PERMISSION_POLICY_VERSION,
+    fileAccess: 'host-full',
+    externalCapabilities: {
+        commandNetwork: true,
+        webSearch: true,
+        browser: true,
+        computerUse: true,
+        mcp: true,
+    },
+};
+/**
+ * Project the policy the runtime can actually guarantee. Missing directional
+ * evidence is treated as possible host-wide file and external access.
+ */
+export function resolveManagedAgentEffectivePermissionPolicy(requested, protection) {
+    const matrix = protection?.capabilityMatrix;
+    if (!matrix) {
+        return {
+            version: requested.version,
+            fileAccess: 'host-full',
+            externalCapabilities: {
+                commandNetwork: true,
+                webSearch: true,
+                browser: true,
+                computerUse: true,
+                mcp: true,
+            },
+        };
+    }
+    const fileAccess = matrix.fileAccess[requested.fileAccess]
+        ? requested.fileAccess
+        : matrix.fileAccess['host-full']
+            ? 'host-full'
+            : requested.fileAccess;
+    const externalCapabilities = { ...requested.externalCapabilities };
+    for (const capability of Object.keys(externalCapabilities)) {
+        if (!externalCapabilities[capability] && !matrix.externalCapabilities[capability].deny) {
+            externalCapabilities[capability] = true;
+        }
+    }
+    return { version: requested.version, fileAccess, externalCapabilities };
+}
+function copyManagedAgentPermissionPolicy(policy) {
+    return {
+        ...policy,
+        externalCapabilities: { ...policy.externalCapabilities },
+    };
+}
+/** Strictly parse an explicit policy. Invalid or incomplete values are not silently repaired. */
+export function parseManagedAgentPermissionPolicy(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const policy = value;
+    if (!Number.isSafeInteger(policy.version) || Number(policy.version) < 1)
+        return null;
+    if (policy.fileAccess !== 'workspace-read' &&
+        policy.fileAccess !== 'workspace-write' &&
+        policy.fileAccess !== 'host-full') {
+        return null;
+    }
+    if (!policy.externalCapabilities ||
+        typeof policy.externalCapabilities !== 'object' ||
+        Array.isArray(policy.externalCapabilities)) {
+        return null;
+    }
+    const capabilities = policy.externalCapabilities;
+    if (typeof capabilities.commandNetwork !== 'boolean' ||
+        typeof capabilities.webSearch !== 'boolean' ||
+        typeof capabilities.browser !== 'boolean' ||
+        typeof capabilities.computerUse !== 'boolean' ||
+        typeof capabilities.mcp !== 'boolean') {
+        return null;
+    }
+    return {
+        version: Number(policy.version),
+        fileAccess: policy.fileAccess,
+        externalCapabilities: {
+            commandNetwork: capabilities.commandNetwork,
+            webSearch: capabilities.webSearch,
+            browser: capabilities.browser,
+            computerUse: capabilities.computerUse,
+            mcp: capabilities.mcp,
+        },
+    };
+}
+export function resolveManagedAgentPermissionPolicy(value, fallback = 'legacy') {
+    const parsed = parseManagedAgentPermissionPolicy(value);
+    if (parsed)
+        return parsed;
+    return copyManagedAgentPermissionPolicy(fallback === 'default'
+        ? DEFAULT_MANAGED_AGENT_PERMISSION_POLICY
+        : LEGACY_MANAGED_AGENT_PERMISSION_POLICY);
+}

package/node_modules/@shennian/wire/dist/machine.d.ts

@@ -24,6 +24,8 @@ export type Machine = {
     sessionSyncCapabilities?: import('./session-sync.ts').SessionSyncCapability[];
     /** Auto-upgrade policy configured on this machine */
     autoUpgrade?: AutoUpgradePolicy;
+    /** Set only after the daemon durably disables remote access on the machine. */
+    remoteAccessDisabledAt?: string | null;
     /** Ownership role — absent means owner (backward-compatible) */
     role?: 'owner' | 'granted';
     /** Non-null only when role === 'granted' */

package/node_modules/@shennian/wire/dist/methods.d.ts

@@ -1 +1 @@
-export type ReqMethod = 'chat.send' | 'chat.enqueue' | 'chat.queue.get' | 'chat.queue.edit' | 'chat.queue.delete' | 'chat.abort' | 'session.resume' | 'session.history' | 'session.history.open' | 'session.history.sync' | 'session.history.page' | 'session.history.close' | 'session.index.update' | 'session.deletions.sync' | 'session.deletions.ack' | 'session.message.status' | 'voice.session.body.window' | 'session.refresh' | 'session.tool.detail' | 'session.title.set' | 'session.title.generate' | 'fs.ls' | 'fs.read' | 'fs.write' | 'fs.export.markdown-pdf' | 'fs.export.markdown-pdf.setup' | 'fs.archive.zip' | 'fs.transfer.start' | 'fs.transfer.chunk' | 'fs.transfer.finish' | 'fs.transfer.abort' | 'fs.rename' | 'skill.list' | 'skill.install' | 'skill.doctor' | 'skill.setup' | 'skill.use' | 'region.probe' | 'region.switch' | 'upgrade.start' | 'upgrade.status' | 'upgrade.set-policy' | 'agents.refresh' | 'models.refresh' | 'agent.config.get' | 'agent.config.upsert' | 'agent.config.clear' | 'agent.config.test' | 'agent.capabilities.list' | 'manager.channel.get' | 'manager.channel.upsert' | 'session.wechat-rpa.channel.get' | 'session.wechat-rpa.channel.upsert' | 'session.wechat-rpa.channel.sync' | 'session.wechat-rpa.outbound.cancel' | 'manager.wechat-rpa.channel.get' | 'manager.wechat-rpa.channel.upsert' | 'manager.wechat-rpa.channel.sync' | 'manager.wechat-rpa.outbound.cancel' | 'wechat-rpa.helper.runtime' | 'wecom.send' | 'external.send' | 'room.sync' | 'room.send' | 'room.bind' | 'room.agent.bind-managed' | 'room.agent.restart-managed' | 'room.unbind';
+export type ReqMethod = 'chat.send' | 'chat.enqueue' | 'chat.queue.get' | 'chat.queue.edit' | 'chat.queue.delete' | 'chat.abort' | 'session.resume' | 'session.history' | 'session.history.open' | 'session.history.sync' | 'session.history.page' | 'session.history.close' | 'session.body.replica.subscribe' | 'session.body.replica.unsubscribe' | 'session.index.update' | 'session.deletions.sync' | 'session.deletions.ack' | 'session.message.status' | 'voice.session.body.window' | 'session.refresh' | 'session.tool.detail' | 'session.title.set' | 'session.title.generate' | 'fs.ls' | 'fs.read' | 'fs.write' | 'fs.export.markdown-pdf' | 'fs.export.markdown-pdf.setup' | 'fs.archive.zip' | 'fs.transfer.start' | 'fs.transfer.chunk' | 'fs.transfer.finish' | 'fs.transfer.abort' | 'fs.rename' | 'skill.list' | 'skill.install' | 'skill.doctor' | 'skill.setup' | 'skill.use' | 'region.probe' | 'region.switch' | 'upgrade.start' | 'upgrade.status' | 'upgrade.set-policy' | 'machine.remote-access.pause' | 'agents.refresh' | 'models.refresh' | 'agent.config.get' | 'agent.config.upsert' | 'agent.config.clear' | 'agent.config.test' | 'agent.capabilities.list' | 'manager.channel.get' | 'manager.channel.upsert' | 'session.wechat-rpa.channel.get' | 'session.wechat-rpa.channel.upsert' | 'session.wechat-rpa.channel.sync' | 'session.wechat-rpa.outbound.cancel' | 'manager.wechat-rpa.channel.get' | 'manager.wechat-rpa.channel.upsert' | 'manager.wechat-rpa.channel.sync' | 'manager.wechat-rpa.outbound.cancel' | 'wechat-rpa.helper.runtime' | 'wecom.send' | 'external.send' | 'room.sync' | 'room.send' | 'room.bind' | 'room.agent.bind-managed' | 'room.agent.restart-managed' | 'room.unbind';

package/node_modules/@shennian/wire/dist/session-sync.d.ts

@@ -21,9 +21,9 @@ export declare const SESSION_SYNC_REQUIRED_CAPABILITIES: readonly ["session_inde
  * epoch-wide minimum gate. This lets the App roll out background replication
  * while old daemons keep serving the compatible visible-session snapshot path.
  */
-export declare const SESSION_SYNC_ADDITIVE_CAPABILITIES: readonly ["session_body_replica_v1"];
-export declare const SESSION_SYNC_ADVERTISED_CAPABILITIES: readonly ["session_index_v1", "session_body_revision_v1", "session_history_subscription_v1", "local_canonical_v1", "session_title_authority_v1", "session_title_seed_v1", "session_tool_detail_v1", "voice_session_body_relay_v1", "native_source_tombstone_v1", "session_durable_send_v1", "daemon_installation_identity_v1", "session_user_boundary_v1", "session_terminal_outbox_v1", "session_list_preview_v1", "session_attention_v1", "session_data_epoch_v2", "session_structured_rejection_v2", "machine_personal_authority_v2", "session_body_replica_v1"];
-export declare const SESSION_SYNC_EVENT_NAMES: readonly ["session.index.updated", "session.body.delta"];
+export declare const SESSION_SYNC_ADDITIVE_CAPABILITIES: readonly ["session_body_replica_v1", "session_body_replica_stream_v1"];
+export declare const SESSION_SYNC_ADVERTISED_CAPABILITIES: readonly ["session_index_v1", "session_body_revision_v1", "session_history_subscription_v1", "local_canonical_v1", "session_title_authority_v1", "session_title_seed_v1", "session_tool_detail_v1", "voice_session_body_relay_v1", "native_source_tombstone_v1", "session_durable_send_v1", "daemon_installation_identity_v1", "session_user_boundary_v1", "session_terminal_outbox_v1", "session_list_preview_v1", "session_attention_v1", "session_data_epoch_v2", "session_structured_rejection_v2", "machine_personal_authority_v2", "session_body_replica_v1", "session_body_replica_stream_v1"];
+export declare const SESSION_SYNC_EVENT_NAMES: readonly ["session.index.updated", "session.body.delta", "session.body.replica.delta", "session.body.replica.error"];
 export declare const SESSION_HISTORY_LIMITS: {
     readonly defaultSnapshotMessages: 100;
     readonly maxSnapshotMessages: 500;
@@ -34,6 +34,7 @@ export declare const SESSION_HISTORY_LIMITS: {
     readonly maxReplicaPageBytes: number;
     readonly maxSubscriptionsPerClient: 4;
     readonly maxSubscriptionsPerSession: 8;
+    readonly maxReplicaStreamsPerDaemon: 8;
 };
 export type SessionSyncCapability = (typeof SESSION_SYNC_ADVERTISED_CAPABILITIES)[number];
 export type SessionSyncEventName = (typeof SESSION_SYNC_EVENT_NAMES)[number];
@@ -257,6 +258,55 @@ export type SessionHistorySyncPage = PersonalSyncIdentity & {
     hasMore: boolean;
     mutations: SessionBodyMutation[];
 };
+/**
+ * One foreground App installation owns at most one body replica stream for a
+ * daemon generation. The daemon registers the stream before capturing these
+ * high-water marks, so mutations committed during subscribe cannot be lost.
+ */
+export type SessionBodyReplicaSubscribeParams = PersonalSyncIdentity & {
+    appInstallationId: string;
+    streamId: string;
+    generation: number;
+};
+export type SessionBodyReplicaHighWater = {
+    sessionId: string;
+    bodyRevision: number;
+};
+export type SessionBodyReplicaSubscribeResponse = PersonalSyncIdentity & {
+    appInstallationId: string;
+    streamId: string;
+    generation: number;
+    highWatermarks: SessionBodyReplicaHighWater[];
+};
+export type SessionBodyReplicaUnsubscribeParams = PersonalSyncIdentity & {
+    appInstallationId: string;
+    streamId: string;
+    generation: number;
+};
+export type SessionBodyReplicaUnsubscribeResponse = PersonalSyncIdentity & {
+    appInstallationId: string;
+    streamId: string;
+    generation: number;
+    closed: true;
+};
+export type SessionBodyReplicaDeltaBatch = {
+    sessionId: string;
+    fromRevision: number;
+    toRevision: number;
+    mutations: SessionBodyMutation[];
+};
+export type SessionBodyReplicaDeltaEvent = PersonalSyncIdentity & {
+    appInstallationId: string;
+    streamId: string;
+    generation: number;
+    batches: SessionBodyReplicaDeltaBatch[];
+};
+export type SessionBodyReplicaErrorEvent = {
+    streamId: string;
+    generation?: number;
+    appInstallationId?: string;
+    rejection: SessionSyncRejection;
+};
 /**
  * Machine-authored personal-session projection. Ownership, machine display
  * fields and viewer permissions are server authority and therefore never

package/node_modules/@shennian/wire/dist/session-sync.js

@@ -1,4 +1,4 @@
-// @arch docs/architecture/data-sync.md#目标架构-v3
+// @arch docs/architecture/data-sync.md#8-app-级统一正文副本与列表发布屏障
 // @test src/__tests__/session-sync.test.ts
 export const SESSION_SYNC_PROTOCOL_VERSION = 2;
 /**
@@ -37,6 +37,7 @@ export const SESSION_SYNC_REQUIRED_CAPABILITIES = [
  */
 export const SESSION_SYNC_ADDITIVE_CAPABILITIES = [
     'session_body_replica_v1',
+    'session_body_replica_stream_v1',
 ];
 export const SESSION_SYNC_ADVERTISED_CAPABILITIES = [
     ...SESSION_SYNC_REQUIRED_CAPABILITIES,
@@ -45,6 +46,8 @@ export const SESSION_SYNC_ADVERTISED_CAPABILITIES = [
 export const SESSION_SYNC_EVENT_NAMES = [
     'session.index.updated',
     'session.body.delta',
+    'session.body.replica.delta',
+    'session.body.replica.error',
 ];
 export const SESSION_HISTORY_LIMITS = {
     defaultSnapshotMessages: 100,
@@ -56,6 +59,7 @@ export const SESSION_HISTORY_LIMITS = {
     maxReplicaPageBytes: 4 * 1024 * 1024,
     maxSubscriptionsPerClient: 4,
     maxSubscriptionsPerSession: 8,
+    maxReplicaStreamsPerDaemon: 8,
 };
 export const SESSION_TITLE_SOURCE_PRIORITY = {
     first_user_fallback: 0,

package/node_modules/@shennian/wire/dist/session.d.ts

@@ -56,6 +56,8 @@ export type AgentInfo = {
     config?: AgentConfigSummary;
     /** Non-secret runtime version and compatibility summary. */
     runtime?: AgentRuntimeSummary;
+    /** Conservative per-machine protection baseline; absent on older daemons. */
+    managedAgentProtection?: import('./agent-workspace.ts').ManagedAgentRuntimeProtection;
 };
 export type SessionMode = 'standard' | 'manager';
 export type ManagerConfig = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shennian",
-  "version": "0.3.72",
+  "version": "0.3.74",
   "description": "Shennian — AI Agent Control Plane CLI",
   "type": "module",
   "bin": {
@@ -57,6 +57,8 @@
   "scripts": {
     "build": "tsc && node -e \"require('node:fs').chmodSync('dist/bin/shennian.js', 0o755)\"",
     "build:publish": "pnpm --filter @shennian/wire build:publish && node -e \"const fs=require('node:fs'); fs.rmSync('dist', { recursive: true, force: true }); fs.rmSync('.tsbuildinfo.publish', { force: true })\" && tsc -p tsconfig.publish.json && node scripts/minify-publish-js.mjs && node -e \"require('node:fs').chmodSync('dist/bin/shennian.js', 0o755)\" && node scripts/check-publish-artifact.mjs",
+    "test:security:codex": "tsx scripts/verify-managed-codex-sandbox.ts",
+    "test:security:codex-tools": "tsx scripts/verify-managed-codex-dynamic-tools.ts",
     "dev": "tsc --watch"
   }
 }