veryfront 0.1.1276 → 0.1.1277-rc.24331
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/esm/deno.js +1 -1
- package/esm/src/agent/hosted/chat-request-parser.d.ts +1 -0
- package/esm/src/agent/hosted/chat-request-parser.d.ts.map +1 -1
- package/esm/src/agent/hosted/chat-request-parser.js +11 -2
- package/esm/src/agent/hosted/child-fork-runtime-start.d.ts.map +1 -1
- package/esm/src/agent/hosted/child-fork-runtime-start.js +3 -0
- package/esm/src/agent/hosted/cloud-agent-chat-execution.d.ts.map +1 -1
- package/esm/src/agent/hosted/cloud-agent-chat-execution.js +50 -0
- package/esm/src/agent/hosted/default-chat-runtime.d.ts.map +1 -1
- package/esm/src/agent/hosted/default-chat-runtime.js +18 -11
- package/esm/src/agent/hosted/durable-child-fork-execution.d.ts.map +1 -1
- package/esm/src/agent/hosted/durable-child-fork-execution.js +13 -1
- package/esm/src/agent/hosted/platform-dependency-credential.d.ts +41 -0
- package/esm/src/agent/hosted/platform-dependency-credential.d.ts.map +1 -0
- package/esm/src/agent/hosted/platform-dependency-credential.js +134 -0
- package/esm/src/agent/hosted/terminal-credential.d.ts +4 -3
- package/esm/src/agent/hosted/terminal-credential.d.ts.map +1 -1
- package/esm/src/agent/hosted/terminal-credential.js +36 -7
- package/esm/src/agent/runtime/tool-helpers.d.ts.map +1 -1
- package/esm/src/agent/runtime/tool-helpers.js +86 -7
- package/esm/src/agent/service/auth.d.ts +45 -0
- package/esm/src/agent/service/auth.d.ts.map +1 -1
- package/esm/src/agent/service/auth.js +158 -1
- package/esm/src/agent/service/platform-tool-dependency-claims.d.ts +6 -0
- package/esm/src/agent/service/platform-tool-dependency-claims.d.ts.map +1 -0
- package/esm/src/agent/service/platform-tool-dependency-claims.js +43 -0
- package/esm/src/agent/service/routes.d.ts.map +1 -1
- package/esm/src/agent/service/routes.js +33 -4
- package/esm/src/agent/streaming/fork-runtime-stream.d.ts.map +1 -1
- package/esm/src/agent/streaming/fork-runtime-stream.js +5 -2
- package/esm/src/html/hydration-script-builder/hydration-runtime.generated.d.ts.map +1 -1
- package/esm/src/html/hydration-script-builder/hydration-runtime.generated.js +1 -1
- package/esm/src/internal-agents/control-plane-auth.d.ts +8 -0
- package/esm/src/internal-agents/control-plane-auth.d.ts.map +1 -1
- package/esm/src/internal-agents/control-plane-auth.js +75 -1
- package/esm/src/internal-agents/run-stream.d.ts.map +1 -1
- package/esm/src/internal-agents/run-stream.js +12 -3
- package/esm/src/platform/compat/http/pinned-fetch.d.ts +1 -1
- package/esm/src/platform/compat/http/pinned-fetch.d.ts.map +1 -1
- package/esm/src/platform/compat/process/env.d.ts +2 -2
- package/esm/src/platform/compat/process/env.d.ts.map +1 -1
- package/esm/src/platform/compat/process/env.js +5 -2
- package/esm/src/server/handlers/request/agent-stream.handler.d.ts +17 -0
- package/esm/src/server/handlers/request/agent-stream.handler.d.ts.map +1 -1
- package/esm/src/server/handlers/request/agent-stream.handler.js +90 -5
- package/esm/src/server/handlers/request/run-terminal-tool-source.d.ts.map +1 -1
- package/esm/src/server/handlers/request/run-terminal-tool-source.js +1 -21
- package/esm/src/tool/factory.d.ts +4 -0
- package/esm/src/tool/factory.d.ts.map +1 -1
- package/esm/src/tool/factory.js +35 -2
- package/esm/src/tool/host-tools.d.ts +2 -0
- package/esm/src/tool/host-tools.d.ts.map +1 -1
- package/esm/src/tool/host-tools.js +6 -0
- package/esm/src/tool/platform-tool-policy.d.ts +2 -0
- package/esm/src/tool/platform-tool-policy.d.ts.map +1 -1
- package/esm/src/tool/platform-tool-policy.js +22 -0
- package/esm/src/tool/registry.d.ts.map +1 -1
- package/esm/src/tool/registry.js +3 -2
- package/esm/src/tool/sleep.d.ts.map +1 -1
- package/esm/src/tool/sleep.js +9 -4
- package/esm/src/tool/types.d.ts +7 -1
- package/esm/src/tool/types.d.ts.map +1 -1
- package/esm/src/utils/version-constant.d.ts +1 -1
- package/esm/src/utils/version-constant.d.ts.map +1 -1
- package/esm/src/utils/version-constant.js +1 -1
- package/package.json +9 -9
package/esm/deno.js
CHANGED
|
@@ -92,6 +92,7 @@ export type ParseHostedChatRequestOptions = {
|
|
|
92
92
|
token: string;
|
|
93
93
|
projectId: string;
|
|
94
94
|
runId: string;
|
|
95
|
+
agentId?: string;
|
|
95
96
|
}) => Promise<RunEventAppendTokenVerification>;
|
|
96
97
|
};
|
|
97
98
|
/** Options accepted when parsing a signed control-plane runtime invocation. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"chat-request-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/chat-request-parser.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"chat-request-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/chat-request-parser.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EAEpB,aAAa,EAGb,wBAAwB,EACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,iBAAiB,EAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAE/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAO1E,OAAO,EACL,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EAEjC,MAAM,6BAA6B,CAAC;AAkBrC,OAAO,EACL,KAAK,4CAA4C,IAAI,+BAA+B,EAErF,MAAM,oBAAoB,CAAC;AA4D5B,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAC3E,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AAEpE,6DAA6D;AAC7D,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,kDAAkD;AAClD,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,uDAAuD;AACvD,MAAM,MAAM,6BAA6B,GACrC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,4BAA4B,CAAA;CAAE,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,sBAAsB,CAAC,EAAE,IAAI,CAAC;IAC9B;;;;OAIG;IACH,uCAAuC,CAAC,EAAE,OAAO,CAAC;IAClD,gNAAgN;IAChN,4CAA4C,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjE,qFAAqF;IACrF,4BAA4B,CAAC,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAC3E;;;;OAIG;IACH,oCAAoC,CAAC,EAAE,sBAAsB,CAAC;IAC9D;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gBAAgB,EAAE,kBAAkB,CAAC;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,4BAA4B,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,cAAc,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACpD,gBAAgB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,cAAc,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACrD,wCAAwC,EAAE,OAAO,CAAC;IAClD,WAAW,CAAC,EAAE,8BAA8B,CAAC;CAC9C,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,0BAA0B,GAAG,QAAQ,CAAC,CAAC;IACnF,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC7C,yBAAyB,CAAC,EAAE,CAAC,KAAK,EAAE;QAClC,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAChD,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,sDAAsD,GAC9D,6BAA6B,GAC7B;IACA,aAAa,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACvD;;;OAGG;IACH,0BAA0B,CAAC,EAAE,CAC3B,eAAe,EAAE,yBAAyB,KAExC,+BAA+B,GAC/B,SAAS,GACT,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC,CAAC;CAC1D,CAAC;AAuQJ;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,sBAAsB,GACjC,OAAO,CAAC,MAAM,CAAC,CAKjB;AAsOD,oDAAoD;AACpD,KAAK,iCAAiC,GAAG;IACvC,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;CAC5E,CAAC;AA4FF,4FAA4F;AAC5F,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,uBAAuB,GAAG,QAAQ,CAAC,CAE7C;AAED,0DAA0D;AAC1D,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,uBAAuB,GAAG,QAAQ,CAAC,CAmC7C;AAED,uFAAuF;AACvF,wBAAsB,0DAA0D,CAC9E,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,sDAAsD,GAC9D,OAAO,CAAC,uBAAuB,GAAG,QAAQ,CAAC,CAsF7C"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { registerHostedPlatformDependencyRequest } from "./platform-dependency-credential.js";
|
|
1
2
|
import { registerHostedTerminalCredential, RUN_TERMINAL_TOKEN_HEADER, } from "./terminal-credential.js";
|
|
2
3
|
import { registerHostedAgentPauseCredential } from "./manual-pause-credential.js";
|
|
3
4
|
import { readOwnDataProperty } from "../runtime/data-property-descriptor.js";
|
|
@@ -137,7 +138,12 @@ async function withVerifiedRunEventAppendToken(request, parsedRequest, verifyRun
|
|
|
137
138
|
const projectId = parsedRequest.projectId;
|
|
138
139
|
const runId = parsedRequest.durableRootRun?.runId;
|
|
139
140
|
const verification = projectId && runId && verifyRunEventAppendToken
|
|
140
|
-
? toRunEventAppendTokenResult(await verifyRunEventAppendToken({
|
|
141
|
+
? toRunEventAppendTokenResult(await verifyRunEventAppendToken({
|
|
142
|
+
token,
|
|
143
|
+
projectId,
|
|
144
|
+
runId,
|
|
145
|
+
...(parsedRequest.agentId ? { agentId: parsedRequest.agentId } : {}),
|
|
146
|
+
}))
|
|
141
147
|
: { verified: false };
|
|
142
148
|
if (!projectId || !runId || !verification.verified) {
|
|
143
149
|
return Response.json({ errorCode: "INVALID_RUN_EVENT_APPEND_TOKEN" }, { status: 403 });
|
|
@@ -220,13 +226,16 @@ async function withVerifiedRunEventAppendToken(request, parsedRequest, verifyRun
|
|
|
220
226
|
? parsedRequest.forwardedProps
|
|
221
227
|
: stripUnverifiedServerResolvedForwardedProps(parsedRequest.forwardedProps),
|
|
222
228
|
};
|
|
229
|
+
if (verifyRunEventAppendToken) {
|
|
230
|
+
registerHostedPlatformDependencyRequest(verifiedRequest, verification, { projectId, runId, ...(parsedRequest.agentId ? { agentId: parsedRequest.agentId } : {}) }, verifyRunEventAppendToken, parsedRequest.authToken);
|
|
231
|
+
}
|
|
223
232
|
registerHostedRunEventWriterToken(verifiedRequest, {
|
|
224
233
|
token,
|
|
225
234
|
projectId,
|
|
226
235
|
runId,
|
|
227
236
|
});
|
|
228
237
|
registerHostedInferenceCredential(verifiedRequest, inferenceAuthToken);
|
|
229
|
-
registerHostedTerminalCredential(verifiedRequest, readRequestHeader(request, RUN_TERMINAL_TOKEN_HEADER));
|
|
238
|
+
registerHostedTerminalCredential(verifiedRequest, readRequestHeader(request, RUN_TERMINAL_TOKEN_HEADER), token);
|
|
230
239
|
registerHostedAgentPauseCredential(verifiedRequest, readIngressCredential(request, INGRESS_RUN_STOP_TOKEN_HEADER) ?? undefined);
|
|
231
240
|
return verifiedRequest;
|
|
232
241
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"child-fork-runtime-start.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/child-fork-runtime-start.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"child-fork-runtime-start.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/child-fork-runtime-start.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,uCAAuC,EAC7C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,KAAK,yBAAyB,EAE9B,KAAK,gCAAgC,EACtC,MAAM,mBAAmB,CAAC;AAG3B,+DAA+D;AAC/D,MAAM,MAAM,2BAA2B,GAAG,CACxC,KAAK,EAAE,gCAAgC,KACpC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,yEAAyE;AACzE,MAAM,MAAM,6CAA6C,CACvD,WAAW,SAAS,uBAAuB,GAAG,uBAAuB,IACnE,uCAAuC,CAAC,WAAW,CAAC,GAAG;IACzD,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;CACrD,CAAC;AAEF,iEAAiE;AACjE,MAAM,WAAW,6BAA6B;IAC5C,yBAAyB,EAAE,eAAe,CAAC;IAC3C,8BAA8B,EAAE,eAAe,GAAG,IAAI,CAAC;IACvD,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,uBAAuB,CAAC;IACtC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wDAAwD;AACxD,wBAAgB,wCAAwC,CACtD,WAAW,SAAS,uBAAuB,GAAG,uBAAuB,EAErE,KAAK,EAAE,6CAA6C,CAAC,WAAW,CAAC,GAChE,6BAA6B,CAuD/B"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { bindHostedPlatformDependencyRuntime } from "./platform-dependency-credential.js";
|
|
1
2
|
import { hostedInheritedInferenceModelResolver } from "./terminal-credential.js";
|
|
2
3
|
import { inheritHostedChildInferenceAuthority } from "./inference-credential.js";
|
|
3
4
|
import { startAgentRuntimeForkWithHostTools, } from "../streaming/fork-runtime-stream.js";
|
|
@@ -41,6 +42,8 @@ export function startHostedChildForkRuntimeWithHostTools(input) {
|
|
|
41
42
|
abortSignal: forkStreamAbortSignal,
|
|
42
43
|
};
|
|
43
44
|
inheritHostedChildInferenceAuthority(forkInput, runtimeInput);
|
|
45
|
+
if (durableChildRun)
|
|
46
|
+
bindHostedPlatformDependencyRuntime(forkInput, durableChildRun);
|
|
44
47
|
const { streamResult, forkToolNames } = startAgentRuntimeForkWithHostTools(forkInput);
|
|
45
48
|
return {
|
|
46
49
|
forkStreamAbortController,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cloud-agent-chat-execution.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/cloud-agent-chat-execution.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"cloud-agent-chat-execution.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/cloud-agent-chat-execution.ts"],"names":[],"mappings":"AAMA,iFAAiF;AACjF,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,qBAAqB,CAAC;AAgBlE,OAAO,EAAE,KAAK,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAEL,KAAK,uCAAuC,EAC5C,KAAK,mCAAmC,EACzC,MAAM,2BAA2B,CAAC;AAMnC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAI5E,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACtC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAKxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAMxE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAYhF,OAAO,EAKL,KAAK,qCAAqC,EAE3C,MAAM,yBAAyB,CAAC;AA8DjC,qFAAqF;AACrF,MAAM,MAAM,+CAA+C,GAAG,2BAA2B,GAAG;IAC1F,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAChD,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAClD,cAAc,EAAE,gCAAgC,CAAC;CAClD,CAAC;AAEF,sEAAsE;AACtE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,qCAAqC,EAC9C,OAAO,EAAE,uCAAuC,EAChD,WAAW,EAAE,mCAAmC,GAC/C,WAAW,CA0Cb;AAED,wEAAwE;AACxE,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,qCAAqC,yIAU1F;AAED,6DAA6D;AAC7D,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,qCAAqC,EAC9C,OAAO,EAAE,uCAAuC,EAChD,cAAc,CAAC,EAAE,2BAA2B,EAC5C,eAAe,CAAC,EAAE,uBAAuB,GACxC,OAAO,CAAC,+BAA+B,CAAC,CAmJ1C;AA6DD,qFAAqF;AACrF,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,qCAAqC,EAC9C,GAAG,EAAE,uBAAuB,EAC5B,WAAW,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/B,WAAW,EAAE,WAAW,GACvB,8BAA8B,GAAG,SAAS,CAiC5C;AAED,0EAA0E;AAC1E,wBAAsB,wCAAwC,CAC5D,OAAO,EAAE,qCAAqC,EAC9C,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,+CAA+C,CAAC,CAwH1D;AAED,6EAA6E;AAC7E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,qCAAqC,EAC9C,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,+CAA+C,CAAC,CAK1D;AAED,sFAAsF;AACtF,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,qCAAqC,EAC9C,MAAM,EAAE,yBAAyB,oFAUlC;AAkBD,8EAA8E;AAC9E,wBAAsB,uCAAuC,CAC3D,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAsClD;AAED,oFAAoF;AACpF,wBAAgB,kDAAkD,CAChE,OAAO,EAAE,qCAAqC,GAC7C,gCAAgC,CAAC,+CAA+C,CAAC,CAyCnF;AAED,yDAAyD;AACzD,YAAY,EAAE,+CAA+C,IAAI,iBAAiB,EAAE,CAAC"}
|
|
@@ -1,4 +1,7 @@
|
|
|
1
1
|
import * as dntShim from "../../../_dnt.shims.js";
|
|
2
|
+
import { fetchHostedProjectAgentDefinition } from "./project-agent-definition-resolver.js";
|
|
3
|
+
import { configureHostedPlatformDependencySource } from "./platform-dependency-credential.js";
|
|
4
|
+
import { createHostedProjectRemoteToolSources } from "./project-remote-tool-source.js";
|
|
2
5
|
import { inheritHostedAgentPauseCapability } from "./manual-pause-credential.js";
|
|
3
6
|
import { hostedTerminalToolSourceFactory } from "./terminal-credential.js";
|
|
4
7
|
/** Chat execution preparation and runtime wiring for the cloud agent service. */
|
|
@@ -121,6 +124,53 @@ export async function createAgentRuntime(context, options, runtimeOptions, termi
|
|
|
121
124
|
DEFAULT_CHAT_STREAM_IDLE_TIMEOUT_MS, (message, metadata) => context.infrastructure.logger.warn(message, metadata));
|
|
122
125
|
// Delegated child runtimes inherit the same budgets through private authority.
|
|
123
126
|
bindHostedChildModelStreamTimeouts(options, hostedRuntimeOptions?.modelStreamTimeouts);
|
|
127
|
+
if (terminalRequest) {
|
|
128
|
+
const sourceFactory = getRemoteToolSourceFactory(context);
|
|
129
|
+
await configureHostedPlatformDependencySource(terminalRequest, async (scope, authToken, owner) => {
|
|
130
|
+
const agentConfig = owner === terminalRequest
|
|
131
|
+
? options.liveProjectSteering?.agent
|
|
132
|
+
: scope.projectId === (config.VERYFRONT_PROJECT_ID ?? options.projectId) &&
|
|
133
|
+
getProjectAgentRuntime(context).agents.has(scope.agentId)
|
|
134
|
+
? await resolveAgentConfig(context, scope.agentId)
|
|
135
|
+
: await fetchHostedProjectAgentDefinition({
|
|
136
|
+
apiUrl: config.VERYFRONT_API_URL,
|
|
137
|
+
authToken,
|
|
138
|
+
projectId: scope.projectId,
|
|
139
|
+
agentId: scope.agentId,
|
|
140
|
+
branchId: scope.projectId === options.projectId ? options.branchId : null,
|
|
141
|
+
runtimeTargetKind: scope.projectId === options.projectId
|
|
142
|
+
? options.runtimeTargetKind
|
|
143
|
+
: null,
|
|
144
|
+
});
|
|
145
|
+
if (!agentConfig)
|
|
146
|
+
return undefined;
|
|
147
|
+
// The private runner enforces the signed wrapper grant. Model inventory
|
|
148
|
+
// allow lists do not restrict it; service ceilings and explicit denials do.
|
|
149
|
+
const mcpServers = resolveMcpServers(context.options, agentConfig)
|
|
150
|
+
.filter((server) => server.kind === "veryfront-api")
|
|
151
|
+
.map((server) => ({
|
|
152
|
+
...server,
|
|
153
|
+
toolPolicy: {
|
|
154
|
+
...server.toolPolicy,
|
|
155
|
+
deny: [
|
|
156
|
+
...new Set([
|
|
157
|
+
...(server.toolPolicy?.deny ?? []),
|
|
158
|
+
...(agentConfig.deniedTools ?? []),
|
|
159
|
+
]),
|
|
160
|
+
],
|
|
161
|
+
allow: context.options.mcpServers?.find((host) => host.kind === server.kind && host.id === server.id)?.toolPolicy?.allow,
|
|
162
|
+
},
|
|
163
|
+
}));
|
|
164
|
+
return createHostedProjectRemoteToolSources({
|
|
165
|
+
authToken,
|
|
166
|
+
apiMcpUrl: config.VERYFRONT_MCP_URL,
|
|
167
|
+
mcpServers,
|
|
168
|
+
getProjectId: () => scope.projectId,
|
|
169
|
+
defaultProjectId: scope.projectId,
|
|
170
|
+
createRemoteToolSource: hostedTerminalToolSourceFactory(owner, config.VERYFRONT_MCP_URL, sourceFactory),
|
|
171
|
+
})[0];
|
|
172
|
+
});
|
|
173
|
+
}
|
|
124
174
|
const projectRuntime = getProjectAgentRuntime(context);
|
|
125
175
|
const refreshSystem = createProjectSteeringRefresh(context);
|
|
126
176
|
const localToolRuntime = createHostedRootLocalToolRuntime({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"default-chat-runtime.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/default-chat-runtime.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"default-chat-runtime.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/default-chat-runtime.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EAErB,KAAK,OAAO,EACb,MAAM,qBAAqB,CAAC;AAmB7B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAyBvE,OAAO,KAAK,EACV,gCAAgC,EAChC,+BAA+B,EAChC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,oBAAoB,EAEzB,KAAK,yCAAyC,EAC/C,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAKnF,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,KAAK,EACV,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAe,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAK3F,OAAO,EAEL,KAAK,sCAAsC,EAG5C,MAAM,mCAAmC,CAAC;AA4B3C,yDAAyD;AACzD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACrD,CAAC;AAEF,kEAAkE;AAClE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE,CAAC;AAEF,gEAAgE;AAChE,MAAM,MAAM,uCAAuC,GAC/C,gCAAgC,CAChC,8BAA8B,EAC9B,0BAA0B,CAC3B,GACC;IACA,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEJ,oDAAoD;AACpD,MAAM,MAAM,mCAAmC,GAAG,iCAAiC,GAAG;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,CAAC,EAAE,uCAAuC,CAAC,mBAAmB,CAAC,CAAC;IACjF,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,uCAAuC,CAAC,eAAe,CAAC,CAAC;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,mBAAmB,CAAC,EAAE,uCAAuC,CAAC,qBAAqB,CAAC,CAAC;IACrF,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,sBAAsB,CAAC,EAAE,uCAAuC,CAAC,wBAAwB,CAAC,CAAC;IAC3F,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,wBAAwB,CAAC,EAAE,uCAAuC,CAAC,0BAA0B,CAAC,CAAC;CAChG,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,0CAA0C,GAAG;IACvD,OAAO,EAAE,uCAAuC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,0CAA0C,GAAG;IACvD,WAAW,EAAE,mCAAmC,CAAC;IACjD,mBAAmB,EAAE,WAAW,CAAC,uCAAuC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjG,YAAY,EAAE,mCAAmC,CAAC;CACnD,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,6CAA6C,GAAG;IAC1D,QAAQ,EAAE,6BAA6B,CAAC;IACxC,WAAW,EAAE,mCAAmC,CAAC;CAClD,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,0CAA0C,GAAG;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,mCAAmC,CAAC;CAClD,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,qCAAqC,GAAG;IAClD,OAAO,EAAE,uCAAuC,CAAC;IACjD,2EAA2E;IAC3E,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,sCAAsC,CAAC;IACpE;;;OAGG;IACH,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,gCAAgC,CAAC,EAAE,WAAW,CAAC;IAC/C,uBAAuB,EAAE,+BAA+B,CAAC;IACzD,MAAM,EAAE,8BAA8B,CAAC;IACvC,eAAe,EAAE,CACf,WAAW,EAAE,mCAAmC,KAC7C,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,iBAAiB,CAAC,EAAE,CAClB,KAAK,EAAE,0CAA0C,KAC9C,mCAAmC,CAAC;IACzC,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,0CAA0C,KAC9C,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;IACxC,kBAAkB,CAAC,EAAE,CACnB,KAAK,EAAE,6CAA6C,KACjD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,qBAAqB,CAAC,EAAE,CACtB,KAAK,EAAE,0CAA0C,KAC9C,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAChC,8BAA8B,CAAC,EAC7B,yCAAyC,CAAC,gCAAgC,CAAC,CAAC;IAC9E,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,gBAAgB,CAAC;IACjF,eAAe,CAAC,EAAE,yCAAyC,CAAC,iBAAiB,CAAC,CAAC;IAC/E,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,MAAM,CAAC,EAAE,8BAA8B,CAAC;CACzC,CAAC;AA4BF,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,iCAAiC,GAAG,IAAI,CAE1F;AAyGD,gFAAgF;AAChF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,IAAI,CAAC,uCAAuC,EAAE,WAAW,CAAC,CAAC;IACpE,WAAW,EAAE,iCAAiC,CAAC;IAC/C,YAAY,EAAE,mCAAmC,CAAC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,+BAA+B,CAAC;IACzD,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;CAC1D,CAAC;AA0JF,mFAAmF;AACnF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA4BrE;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,mCAAmC,CAAC;IACjD,YAAY,EAAE,qBAAqB,CAAC;CACrC,GAAG,OAAO,CAuBV;AA6CD,0CAA0C;AAC1C,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,qCAAqC,EAC5C,cAAc,GAAE,2BAAgC,GAC/C,OAAO,CAAC,+BAA+B,CAAC,CA0L1C;AAED,oGAAoG;AACpG,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,iCAAiC,EACxC,cAAc,EAAE,2BAA2B,oCAkB5C"}
|
|
@@ -1,4 +1,6 @@
|
|
|
1
1
|
import * as dntShim from "../../../_dnt.shims.js";
|
|
2
|
+
import { captureHostedPlatformDependencyExecution } from "./platform-dependency-credential.js";
|
|
3
|
+
import { sealToolPlatformDependencies } from "../../tool/factory.js";
|
|
2
4
|
import { getToolResultReaderReservedToolSlots } from "../runtime/tool-result-context.js";
|
|
3
5
|
import { inheritFrameworkSkillLoader } from "../../skill/loader-provenance.js";
|
|
4
6
|
import { inheritHostedChildInferenceAuthority } from "./inference-credential.js";
|
|
@@ -292,7 +294,7 @@ export function scopeHostedRuntimeToolResults(tools) {
|
|
|
292
294
|
return mapOwnRecord(tools, (_toolName, tool) => {
|
|
293
295
|
const execute = tool.execute;
|
|
294
296
|
const preserveTrustedError = hasTrustedHostToolProvenance(tool);
|
|
295
|
-
|
|
297
|
+
const scopedTool = inheritRuntimeProviderSchemaHiddenTool(tool, inheritTrustedHostToolProvenance(tool, inheritFrameworkSkillLoader(tool, {
|
|
296
298
|
...tool,
|
|
297
299
|
execute: async (toolInput, context) => {
|
|
298
300
|
try {
|
|
@@ -305,19 +307,23 @@ export function scopeHostedRuntimeToolResults(tools) {
|
|
|
305
307
|
}
|
|
306
308
|
},
|
|
307
309
|
})));
|
|
310
|
+
return sealToolPlatformDependencies(scopedTool);
|
|
308
311
|
});
|
|
309
312
|
}
|
|
310
313
|
/** @internal Scope local tool execution and sanitize errors without trusted provenance. */
|
|
311
314
|
export function scopeHostedRuntimeTools(input) {
|
|
312
315
|
const scopedTools = scopeHostedRuntimeToolResults(input.tools);
|
|
313
|
-
return mapOwnRecord(scopedTools, (_toolName, tool) =>
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
|
|
320
|
-
|
|
316
|
+
return mapOwnRecord(scopedTools, (_toolName, tool) => {
|
|
317
|
+
const scopedTool = inheritRuntimeProviderSchemaHiddenTool(tool, inheritTrustedHostToolProvenance(tool, inheritFrameworkSkillLoader(tool, {
|
|
318
|
+
...tool,
|
|
319
|
+
execute: (toolInput, context) => withoutHostedCredentials({
|
|
320
|
+
taskContext: input.taskContext,
|
|
321
|
+
cloudContext: input.cloudContext,
|
|
322
|
+
operation: () => apply(tool.execute, tool, [toolInput, context]),
|
|
323
|
+
}),
|
|
324
|
+
})));
|
|
325
|
+
return sealToolPlatformDependencies(scopedTool);
|
|
326
|
+
});
|
|
321
327
|
}
|
|
322
328
|
function runWithDefaultHostedRequestContext(input) {
|
|
323
329
|
const requestContext = {
|
|
@@ -349,6 +355,7 @@ function runWithDefaultHostedRequestContext(input) {
|
|
|
349
355
|
const CATALOG_ALIAS_MAX_WAIT_MS = 3_000;
|
|
350
356
|
/** Create default hosted chat runtime. */
|
|
351
357
|
export async function createDefaultHostedChatRuntime(input, runtimeOptions = {}) {
|
|
358
|
+
const runWithPlatformDependencies = captureHostedPlatformDependencyExecution();
|
|
352
359
|
const effectiveRunEventWriterCapability = getActiveHostedRunEventWriterCapability();
|
|
353
360
|
return await runWithEffectiveSourceIntegrationPolicy(input.sourceIntegrationPolicy, async () => {
|
|
354
361
|
const cloudContext = createCloudContext({
|
|
@@ -468,11 +475,11 @@ export async function createDefaultHostedChatRuntime(input, runtimeOptions = {})
|
|
|
468
475
|
...(taskContext.projectId ? { projectId: taskContext.projectId } : {}),
|
|
469
476
|
...(taskContext.projectSlug ? { projectSlug: taskContext.projectSlug } : {}),
|
|
470
477
|
}),
|
|
471
|
-
runStream: (operation) => runWithDefaultHostedRequestContext({
|
|
478
|
+
runStream: (operation) => runWithPlatformDependencies(() => runWithDefaultHostedRequestContext({
|
|
472
479
|
taskContext,
|
|
473
480
|
cloudContext,
|
|
474
481
|
operation,
|
|
475
|
-
}),
|
|
482
|
+
})),
|
|
476
483
|
warnOrphanedToolInput: (message, metadata) => {
|
|
477
484
|
input.logger?.warn(message, {
|
|
478
485
|
...metadata,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"durable-child-fork-execution.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/durable-child-fork-execution.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"durable-child-fork-execution.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/durable-child-fork-execution.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,uBAAuB,EACvB,yBAAyB,EAC1B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,oBAAoB,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,uCAAuC,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,gCAAgC,EAChC,wCAAwC,EACzC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,yBAAyB,EAE9B,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EAElC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,8BAA8B,EAGpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAGL,KAAK,8BAA8B,EAEpC,MAAM,mCAAmC,CAAC;AAI3C,2FAA2F;AAC3F,qBAAa,+BAAgC,SAAQ,KAAK;;CAKzD;AAED,0DAA0D;AAC1D,MAAM,MAAM,kCAAkC,GAAG;IAC/C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,eAAe,CAAC,EAAE,yBAAyB,CAAC;CAC7C,CAAC;AAEF,wDAAwD;AACxD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACnD,WAAW,CAAC,EAAE,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACvD,oBAAoB,CAAC,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACzE,KAAK,CAAC,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACrD,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC9D,iBAAiB,CAAC,EAAE,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAChE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAiClD,CAAC;AAEH,0EAA0E;AAC1E,MAAM,MAAM,+CAA+C,GAAG;IAC5D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,MAAM,yBAAyB,CAAC,YAAY,SAAS,uBAAuB,IAAI;IACpF,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,WAAW,EAAE,yBAAyB,CAAC;IACvC,OAAO,EAAE,sBAAsB,CAAC;CACjC,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,4CAA4C,GAAG;IACzD,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,iCAAiC,GAAG;IAC9C,MAAM,EAAE,yBAAyB,CAAC;IAClC,WAAW,EAAE,yBAAyB,CAAC;IACvC,OAAO,EAAE,sBAAsB,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,kEAAkE;AAClE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,sBAAsB,CAAC;IAChC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,MAAM,kCAAkC,GAAG,UAAU,CACzD,OAAO,+BAA+B,CACvC,CAAC,CAAC,CAAC,CAAC;AAEL,sEAAsE;AACtE,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,kCAAkC,EAClC,gBAAgB,GAAG,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,cAAc,CACzE,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,sCAAsC,GAAG,OAAO,CAC1D,IAAI,CAAC,kCAAkC,EAAE,MAAM,iCAAiC,CAAC,CAClF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,MAAM,qCAAqC,GAAG,UAAU,CAC5D,OAAO,2CAA2C,CACnD,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,mCAAmC,GAAG;IAChD,iBAAiB,CAAC,YAAY,SAAS,uBAAuB,EAC5D,MAAM,EAAE,YAAY,GACnB,YAAY,CAAC;IAChB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF,2DAA2D;AAC3D,MAAM,MAAM,kCAAkC,GAAG;IAC/C,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC;IACzD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,mCAAmC,CAAC;IACnD,OAAO,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,GAAG,uBAAuB,CAAC;IAC1E,oBAAoB,CAAC,EAAE,MAAM,yBAAyB,GAAG,IAAI,CAAC;IAC9D,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAC5C,CAAC;AAkBF,sEAAsE;AACtE,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,+CAA+C,GACrD,8BAA8B,CAqBhC;AAED,+EAA+E;AAC/E,wBAAgB,kDAAkD,CAChE,KAAK,EAAE,iCAAiC,GACvC,8BAA8B,CAYhC;AAED,sEAAsE;AACtE,wBAAgB,0CAA0C,CACxD,YAAY,SAAS,uBAAuB,EAE5C,KAAK,EAAE,yBAAyB,CAAC,YAAY,CAAC,EAC9C,OAAO,GAAE,4CAAiD,GACzD,8BAA8B,CA2ChC;AAED,yDAAyD;AACzD,wBAAgB,2CAA2C,CAAC,KAAK,EAAE;IACjE,SAAS,EAAE,iCAAiC,CAAC;IAC7C,kBAAkB,EAAE,CAAC,UAAU,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC/D,mBAAmB,EAAE,MAAM,CAAC;CAC7B;2BAC8B,sCAAsC,KAAQ,IAAI;sBAW3D,YAAY,SAAS,uBAAuB,UACpD,YAAY,GACnB,YAAY;qCAYkB,MAAM,GAAG,IAAI;gCAQnC,8BAA8B,GACtC,8BAA8B;mCA2BtB,iCAAiC,GACzC,8BAA8B;kBAgBnB,YAAY,SAAS,uBAAuB,WAC/C,yBAAyB,CAAC,YAAY,CAAC,YACvC,4CAA4C,GACpD,8BAA8B;EAoBpC;AAED,yCAAyC;AACzC,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,kCAAkC,GACxC,OAAO,CAAC,uBAAuB,CAAC,CAqClC;AAED,kDAAkD;AAClD,MAAM,MAAM,kCAAkC,GAAG;IAC/C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,sBAAsB,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,oCAAoC,GAAG;IACjD,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9D,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,kCAAkC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvF,mBAAmB,CAAC,EAAE,CACpB,KAAK,EAAE,kCAAkC,GAAG;QAAE,WAAW,EAAE,yBAAyB,CAAA;KAAE,KACnF,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QACzB,KAAK,EAAE,OAAO,CAAC;QACf,oBAAoB,EAAE,MAAM,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,qCAAqC,GAAG;IAClD,iBAAiB,CAAC,EAAE,OAAO,uBAAuB,CAAC;IACnD,sBAAsB,CAAC,EAAE,OAAO,uCAAuC,CAAC;IACxE,YAAY,CAAC,EAAE,OAAO,gCAAgC,CAAC;IACvD,6BAA6B,CAAC,EAAE,OAAO,wCAAwC,CAAC;CACjF,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,kCAAkC,CAC5C,OAAO,EACP,YAAY,SAAS,uBAAuB,IAC1C;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,wBAAwB,CAAC,EAAE,8BAA8B,CAAC;IAC1D,SAAS,EAAE,wBAAwB,CAAC;IACpC,gBAAgB,EAAE;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,CAAC;IACF,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;IACxD,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,oBAAoB,CAAC,EAAE,MAAM,sBAAsB,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACrF,6BAA6B,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChE,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC3C,uBAAuB,CAAC,EAAE,8BAA8B,CAAC;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzF,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,gCAAgC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9F,yBAAyB,EAAE,MAAM,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,CACZ,OAAO,CAAC,EAAE,kCAAkC,KACzC,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;IAC1C,oBAAoB,EAAE,MAAM,yBAAyB,GAAG,IAAI,CAAC;IAC7D;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAChF,6BAA6B,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5D,uBAAuB,EAAE,CAAC,OAAO,EAAE,8BAA8B,KAAK,OAAO,CAAC;IAC9E,0BAA0B,EAAE,CAAC,OAAO,EAAE,iCAAiC,KAAK,OAAO,CAAC;IACpF,kBAAkB,EAAE,CAAC,OAAO,EAAE,yBAAyB,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC;IAClF,0BAA0B,CAAC,EAAE,CAC3B,OAAO,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,KACxD,OAAO,CAAC;IACb,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5D,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC7B,WAAW,EAAE,yBAAyB,CAAC;QACvC,MAAM,EAAE,WAAW,CAAC;KACrB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,oCAAoC,CAAC;IACjD,OAAO,CAAC,EAAE,qCAAqC,CAAC;CACjD,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,qCAAqC,GAC7C;IAAE,SAAS,EAAE,wBAAwB,CAAA;CAAE,GACvC;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC;AA2ShE,yCAAyC;AACzC,wBAAsB,6BAA6B,CACjD,OAAO,EACP,YAAY,SAAS,uBAAuB,EAE5C,KAAK,EAAE,kCAAkC,CAAC,OAAO,EAAE,YAAY,CAAC,GAC/D,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,2FAA2F;AAC3F,wBAAsB,8BAA8B,CAAC,OAAO,EAC1D,UAAU,EAAE,8BAA8B,GAAG,SAAS,EACtD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GACpD,OAAO,CAAC,OAAO,CAAC,CAmBlB"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { revokeHostedPlatformDependencies, runWithHostedPlatformDependencies, } from "./platform-dependency-credential.js";
|
|
1
2
|
import { boundChildResultTelemetry } from "../child-run/result-telemetry.js";
|
|
2
3
|
import { createPrivateWeakStore } from "../../security/private-weak-store.js";
|
|
3
4
|
import { hostedInheritedEventWriter, hostedInheritedTerminalReceipt, hostedTerminalRunFinalizer, transferHostedTerminalAuthority, withHostedInheritedLease, } from "./terminal-credential.js";
|
|
@@ -398,7 +399,18 @@ async function executeHostedDurableChildLifecycle(input) {
|
|
|
398
399
|
adapter: lifecycleAdapter,
|
|
399
400
|
executionFailedCode: input.executionFailedCode,
|
|
400
401
|
abortSignal: input.executionOptions.abortSignal,
|
|
401
|
-
execute: () => runWithHostedRunEventWriterCapability(input.childRunEventWriterCapability, () => withHostedInheritedLease(identifiers, (abortSignal) =>
|
|
402
|
+
execute: () => runWithHostedRunEventWriterCapability(input.childRunEventWriterCapability, () => withHostedInheritedLease(identifiers, async (abortSignal) => {
|
|
403
|
+
const onAbort = () => revokeHostedPlatformDependencies(identifiers);
|
|
404
|
+
abortSignal?.addEventListener("abort", onAbort, { once: true });
|
|
405
|
+
try {
|
|
406
|
+
abortSignal?.throwIfAborted();
|
|
407
|
+
return await runWithHostedPlatformDependencies(identifiers, async () => await input.executeLocal({ durableChildRun: identifiers, abortSignal }));
|
|
408
|
+
}
|
|
409
|
+
finally {
|
|
410
|
+
revokeHostedPlatformDependencies(identifiers);
|
|
411
|
+
abortSignal?.removeEventListener("abort", onAbort);
|
|
412
|
+
}
|
|
413
|
+
}, input.executionOptions.abortSignal)),
|
|
402
414
|
getExecutionSnapshot: input.getExecutionSnapshot,
|
|
403
415
|
onLifecycleError: input.onLifecycleError,
|
|
404
416
|
skipTerminalPersistence,
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
import type { ParsedHostedChatRequest } from "./chat-request-parser.js";
|
|
2
|
+
import type { ConversationRunProjection } from "../conversation/durable.js";
|
|
3
|
+
import type { HostedInferenceAuthorityOwner } from "./inference-credential.js";
|
|
4
|
+
export type HostedPlatformDependencyOwner = ParsedHostedChatRequest | Pick<ConversationRunProjection, "runId"> | {
|
|
5
|
+
readonly childRunId: string;
|
|
6
|
+
};
|
|
7
|
+
import type { RemoteToolSource } from "../../tool/types.js";
|
|
8
|
+
import { type HostedServiceRunEventAppendTokenInput, type HostedServiceRunEventAppendTokenResult, type HostedServiceRunEventAppendTokenVerification } from "../service/auth.js";
|
|
9
|
+
type Scope = Readonly<{
|
|
10
|
+
projectId: string;
|
|
11
|
+
runId: string;
|
|
12
|
+
agentId: string;
|
|
13
|
+
}>;
|
|
14
|
+
type WriterScope = Readonly<{
|
|
15
|
+
projectId: string;
|
|
16
|
+
runId: string;
|
|
17
|
+
agentId?: string;
|
|
18
|
+
}>;
|
|
19
|
+
type Verifier = (input: HostedServiceRunEventAppendTokenInput) => Promise<HostedServiceRunEventAppendTokenVerification>;
|
|
20
|
+
type SourceFactory = (scope: Scope, authToken: string, owner: HostedPlatformDependencyOwner) => Promise<RemoteToolSource | undefined>;
|
|
21
|
+
/** Retain ingress proof at its original private request identity, never in request JSON. */
|
|
22
|
+
export declare function registerHostedPlatformDependencyRequest(owner: HostedPlatformDependencyOwner, verification: HostedServiceRunEventAppendTokenResult, scope: WriterScope, verify: Verifier, authToken: string): void;
|
|
23
|
+
/** Configure transport only through the original host-owned parsed request. */
|
|
24
|
+
export declare function configureHostedPlatformDependencySource(owner: HostedPlatformDependencyOwner, factory: SourceFactory): Promise<void>;
|
|
25
|
+
/** Verify the authenticated admission's exact child JWT; parent grants never become child grants. */
|
|
26
|
+
export declare function registerHostedChildPlatformDependencies(parent: HostedPlatformDependencyOwner, child: HostedPlatformDependencyOwner, scope: Scope, eventToken: string, authToken: string): Promise<void>;
|
|
27
|
+
/** Transfer only the private admission descriptor association. */
|
|
28
|
+
export declare function transferHostedPlatformDependencies(source: HostedPlatformDependencyOwner, target: HostedPlatformDependencyOwner): void;
|
|
29
|
+
/** Enter preparation or actual execution using an original request/admission descriptor. */
|
|
30
|
+
export declare function runWithHostedPlatformDependencies<T>(owner: HostedPlatformDependencyOwner, operation: () => Promise<T>): Promise<T>;
|
|
31
|
+
/** Capture preparation's private authority for the runtime's later stream execution. */
|
|
32
|
+
export declare function captureHostedPlatformDependencyExecution(): <T>(operation: () => Promise<T>) => Promise<T>;
|
|
33
|
+
export declare function revokeHostedPlatformDependencies(owner: HostedPlatformDependencyOwner): void;
|
|
34
|
+
/** Bind runtime identity only from a genuine admitted child descriptor. */
|
|
35
|
+
export declare function bindHostedPlatformDependencyRuntime(target: HostedInferenceAuthorityOwner, descriptor: HostedPlatformDependencyOwner): void;
|
|
36
|
+
/** Preserve the private association across host-created fork runtime inputs. */
|
|
37
|
+
export declare function inheritHostedPlatformDependencyRuntime(target: HostedInferenceAuthorityOwner, source: HostedInferenceAuthorityOwner): void;
|
|
38
|
+
/** Runtime identity is data; the original runner remains the authority. */
|
|
39
|
+
export declare function hostedPlatformDependencyRuntimeContext(input: HostedInferenceAuthorityOwner, projectId: string | null): Scope | undefined;
|
|
40
|
+
export {};
|
|
41
|
+
//# sourceMappingURL=platform-dependency-credential.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"platform-dependency-credential.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/platform-dependency-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAE/E,MAAM,MAAM,6BAA6B,GACrC,uBAAuB,GACvB,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,GACxC;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAKpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAIL,KAAK,qCAAqC,EAC1C,KAAK,sCAAsC,EAC3C,KAAK,4CAA4C,EAElD,MAAM,oBAAoB,CAAC;AAE5B,KAAK,KAAK,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC7E,KAAK,WAAW,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACpF,KAAK,QAAQ,GAAG,CACd,KAAK,EAAE,qCAAqC,KACzC,OAAO,CAAC,4CAA4C,CAAC,CAAC;AAC3D,KAAK,aAAa,GAAG,CACnB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,6BAA6B,KACjC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAmB3C,4FAA4F;AAC5F,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,6BAA6B,EACpC,YAAY,EAAE,sCAAsC,EACpD,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,QAAQ,EAChB,SAAS,EAAE,MAAM,GAChB,IAAI,CAoBN;AAED,+EAA+E;AAC/E,wBAAsB,uCAAuC,CAC3D,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,qGAAqG;AACrG,wBAAsB,uCAAuC,CAC3D,MAAM,EAAE,6BAA6B,EACrC,KAAK,EAAE,6BAA6B,EACpC,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,kEAAkE;AAClE,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,6BAA6B,EACrC,MAAM,EAAE,6BAA6B,GACpC,IAAI,CAGN;AAgBD,4FAA4F;AAC5F,wBAAgB,iCAAiC,CAAC,CAAC,EACjD,KAAK,EAAE,6BAA6B,EACpC,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,wFAAwF;AACxF,wBAAgB,wCAAwC,KAE9C,CAAC,EAAE,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CACpD;AAUD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,IAAI,CAG3F;AAED,2EAA2E;AAC3E,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,6BAA6B,EACrC,UAAU,EAAE,6BAA6B,GACxC,IAAI,CAGN;AAED,gFAAgF;AAChF,wBAAgB,sCAAsC,CACpD,MAAM,EAAE,6BAA6B,EACrC,MAAM,EAAE,6BAA6B,GACpC,IAAI,CAGN;AAED,2EAA2E;AAC3E,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,6BAA6B,EACpC,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,KAAK,GAAG,SAAS,CAOnB"}
|
|
@@ -0,0 +1,134 @@
|
|
|
1
|
+
import { appendPrivateArray } from "../../security/private-array.js";
|
|
2
|
+
import { AsyncLocalStorage } from "node:async_hooks";
|
|
3
|
+
import { createPrivateWeakStore } from "../../security/private-weak-store.js";
|
|
4
|
+
import { createVerifiedPlatformToolDependencyRunner, getVerifiedPlatformToolDependencies, hasVerifiedHostedPlatformDependencyWriter, toRunEventAppendTokenResult, } from "../service/auth.js";
|
|
5
|
+
const owners = createPrivateWeakStore();
|
|
6
|
+
const runtimeOwners = createPrivateWeakStore();
|
|
7
|
+
const execution = new AsyncLocalStorage();
|
|
8
|
+
const Run = AsyncLocalStorage.prototype.run;
|
|
9
|
+
const Get = AsyncLocalStorage.prototype.getStore;
|
|
10
|
+
const Apply = Reflect.apply;
|
|
11
|
+
const Freeze = Object.freeze;
|
|
12
|
+
/** Retain ingress proof at its original private request identity, never in request JSON. */
|
|
13
|
+
export function registerHostedPlatformDependencyRequest(owner, verification, scope, verify, authToken) {
|
|
14
|
+
if (!hasVerifiedHostedPlatformDependencyWriter(verification, scope))
|
|
15
|
+
return;
|
|
16
|
+
const dependencies = scope.agentId
|
|
17
|
+
? getVerifiedPlatformToolDependencies(verification, { ...scope, agentId: scope.agentId })
|
|
18
|
+
: undefined;
|
|
19
|
+
owners.set(owner, {
|
|
20
|
+
scope: Freeze({ ...scope }),
|
|
21
|
+
verify,
|
|
22
|
+
authToken,
|
|
23
|
+
...(dependencies !== undefined && scope.agentId
|
|
24
|
+
? {
|
|
25
|
+
runner: createVerifiedPlatformToolDependencyRunner(verification, {
|
|
26
|
+
...scope,
|
|
27
|
+
agentId: scope.agentId,
|
|
28
|
+
}),
|
|
29
|
+
}
|
|
30
|
+
: {}),
|
|
31
|
+
active: true,
|
|
32
|
+
children: [],
|
|
33
|
+
});
|
|
34
|
+
}
|
|
35
|
+
/** Configure transport only through the original host-owned parsed request. */
|
|
36
|
+
export async function configureHostedPlatformDependencySource(owner, factory) {
|
|
37
|
+
const authority = owners.get(owner);
|
|
38
|
+
if (!authority?.active)
|
|
39
|
+
return;
|
|
40
|
+
authority.sourceFactory = factory;
|
|
41
|
+
if (authority.runner && authority.scope.agentId) {
|
|
42
|
+
const source = await factory({ ...authority.scope, agentId: authority.scope.agentId }, authority.authToken, owner);
|
|
43
|
+
if (source)
|
|
44
|
+
authority.runner.captureSource(source);
|
|
45
|
+
}
|
|
46
|
+
}
|
|
47
|
+
/** Verify the authenticated admission's exact child JWT; parent grants never become child grants. */
|
|
48
|
+
export async function registerHostedChildPlatformDependencies(parent, child, scope, eventToken, authToken) {
|
|
49
|
+
const authority = owners.get(parent);
|
|
50
|
+
if (!authority?.active)
|
|
51
|
+
return;
|
|
52
|
+
const verification = toRunEventAppendTokenResult(await authority.verify({ token: eventToken, ...scope }));
|
|
53
|
+
if (!authority.active)
|
|
54
|
+
throw new Error("Hosted parent dependency authority is no longer active");
|
|
55
|
+
if (!verification.verified)
|
|
56
|
+
throw new Error("Inherited child writer verification failed");
|
|
57
|
+
registerHostedPlatformDependencyRequest(child, verification, scope, authority.verify, authToken);
|
|
58
|
+
const childAuthority = owners.get(child);
|
|
59
|
+
if (!childAuthority)
|
|
60
|
+
throw new Error("Inherited child writer provenance is unavailable");
|
|
61
|
+
appendPrivateArray(authority.children, [childAuthority]);
|
|
62
|
+
try {
|
|
63
|
+
if (authority.sourceFactory) {
|
|
64
|
+
await configureHostedPlatformDependencySource(child, authority.sourceFactory);
|
|
65
|
+
}
|
|
66
|
+
if (!authority.active || !childAuthority.active) {
|
|
67
|
+
throw new Error("Hosted child dependency authority is no longer active");
|
|
68
|
+
}
|
|
69
|
+
}
|
|
70
|
+
catch (error) {
|
|
71
|
+
revokeAuthority(childAuthority);
|
|
72
|
+
throw error;
|
|
73
|
+
}
|
|
74
|
+
}
|
|
75
|
+
/** Transfer only the private admission descriptor association. */
|
|
76
|
+
export function transferHostedPlatformDependencies(source, target) {
|
|
77
|
+
const authority = owners.get(source);
|
|
78
|
+
if (authority)
|
|
79
|
+
owners.set(target, authority);
|
|
80
|
+
}
|
|
81
|
+
function runAuthority(authority, operation) {
|
|
82
|
+
if (!authority)
|
|
83
|
+
return operation();
|
|
84
|
+
if (!authority.active) {
|
|
85
|
+
throw new Error("Hosted platform dependency authority is no longer active");
|
|
86
|
+
}
|
|
87
|
+
return Apply(Run, execution, [
|
|
88
|
+
authority,
|
|
89
|
+
() => authority.runner ? authority.runner.run(operation) : operation(),
|
|
90
|
+
]);
|
|
91
|
+
}
|
|
92
|
+
/** Enter preparation or actual execution using an original request/admission descriptor. */
|
|
93
|
+
export function runWithHostedPlatformDependencies(owner, operation) {
|
|
94
|
+
return runAuthority(owners.get(owner), operation);
|
|
95
|
+
}
|
|
96
|
+
/** Capture preparation's private authority for the runtime's later stream execution. */
|
|
97
|
+
export function captureHostedPlatformDependencyExecution() {
|
|
98
|
+
const authority = Apply(Get, execution, []);
|
|
99
|
+
return (operation) => runAuthority(authority, operation);
|
|
100
|
+
}
|
|
101
|
+
function revokeAuthority(authority) {
|
|
102
|
+
authority.active = false;
|
|
103
|
+
authority.runner?.revoke();
|
|
104
|
+
for (let index = 0; index < authority.children.length; index++) {
|
|
105
|
+
revokeAuthority(authority.children[index]);
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
export function revokeHostedPlatformDependencies(owner) {
|
|
109
|
+
const authority = owners.get(owner);
|
|
110
|
+
if (authority)
|
|
111
|
+
revokeAuthority(authority);
|
|
112
|
+
}
|
|
113
|
+
/** Bind runtime identity only from a genuine admitted child descriptor. */
|
|
114
|
+
export function bindHostedPlatformDependencyRuntime(target, descriptor) {
|
|
115
|
+
const authority = owners.get(descriptor);
|
|
116
|
+
if (authority?.active && authority.runner)
|
|
117
|
+
runtimeOwners.set(target, authority);
|
|
118
|
+
}
|
|
119
|
+
/** Preserve the private association across host-created fork runtime inputs. */
|
|
120
|
+
export function inheritHostedPlatformDependencyRuntime(target, source) {
|
|
121
|
+
const authority = runtimeOwners.get(source);
|
|
122
|
+
if (authority)
|
|
123
|
+
runtimeOwners.set(target, authority);
|
|
124
|
+
}
|
|
125
|
+
/** Runtime identity is data; the original runner remains the authority. */
|
|
126
|
+
export function hostedPlatformDependencyRuntimeContext(input, projectId) {
|
|
127
|
+
const authority = runtimeOwners.get(input);
|
|
128
|
+
if (!authority)
|
|
129
|
+
return undefined;
|
|
130
|
+
if (!authority.active || authority.scope.projectId !== projectId || !authority.scope.agentId) {
|
|
131
|
+
throw new Error("Hosted platform dependency runtime binding mismatch");
|
|
132
|
+
}
|
|
133
|
+
return Freeze({ ...authority.scope, agentId: authority.scope.agentId });
|
|
134
|
+
}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { type HostedPlatformDependencyOwner } from "./platform-dependency-credential.js";
|
|
1
2
|
import type { BoundConversationAgentRunFinalizer, ConversationRunProjection, createConversationAgentRun } from "../conversation/durable.js";
|
|
2
3
|
import { RUN_TERMINAL_TOOL_CALL_ID_HEADER } from "../runtime/terminal-run-control.js";
|
|
3
4
|
import { type RemoteMCPToolSourceConfig } from "../../tool/remote-mcp.js";
|
|
@@ -20,7 +21,7 @@ type InheritedTerminalReceipt = {
|
|
|
20
21
|
/** Read the original terminal outcome returned by authenticated child admission. */
|
|
21
22
|
export declare function hostedInheritedTerminalReceipt(descriptor: HostedTerminalDescriptor): InheritedTerminalReceipt | undefined;
|
|
22
23
|
/** Keep terminal authority out of parsed request fields and executor-visible context. */
|
|
23
|
-
export declare function registerHostedTerminalCredential(request: ParsedHostedChatRequest, token: string | undefined): void;
|
|
24
|
+
export declare function registerHostedTerminalCredential(request: ParsedHostedChatRequest, token: string | undefined, eventToken?: string): void;
|
|
24
25
|
/** Canonical routing identity from the existing private terminal capability. */
|
|
25
26
|
export declare function hostedTerminalCanonicalRunId(request: ParsedHostedChatRequest): string | undefined;
|
|
26
27
|
/** Transfer the verified request capability to its private durable run descriptor. */
|
|
@@ -35,7 +36,7 @@ export declare function hostedTerminalRunFinalizer(run: {
|
|
|
35
36
|
runId: string;
|
|
36
37
|
} | null): BoundConversationAgentRunFinalizer | undefined;
|
|
37
38
|
/** The credential only reaches the bound platform endpoint through the trusted deployment transport. */
|
|
38
|
-
export declare function hostedTerminalToolSourceFactory(request:
|
|
39
|
+
export declare function hostedTerminalToolSourceFactory(request: HostedPlatformDependencyOwner | undefined, apiMcpUrl: string, fallback: (config: RemoteMCPToolSourceConfig) => RemoteToolSource): (config: RemoteMCPToolSourceConfig, server?: AgentServiceMcpServerConfig) => RemoteToolSource;
|
|
39
40
|
/** Build an inherited admission transport bound to an authentic parent capability. */
|
|
40
41
|
export declare function hostedInheritedRunAdmitter(request: ParsedHostedChatRequest | HostedTerminalDescriptor, transport: {
|
|
41
42
|
apiUrl: string;
|
|
@@ -62,7 +63,7 @@ export declare function acceptInheritedRunAdmission(response: Response, binding:
|
|
|
62
63
|
agentId?: string;
|
|
63
64
|
apiUrl: string;
|
|
64
65
|
fetch: typeof globalThis.fetch;
|
|
65
|
-
}): Promise<ConversationRunProjection>;
|
|
66
|
+
}, dependencyParent?: HostedPlatformDependencyOwner): Promise<ConversationRunProjection>;
|
|
66
67
|
/** Create inference transport only from this inherited child's private admission authority. */
|
|
67
68
|
export declare function hostedInheritedInferenceModelResolver(descriptor: HostedTerminalDescriptor): import("../runtime/model-transport.js").AgentModelRuntimeResolver | undefined;
|
|
68
69
|
/** Preserve exact private authority when a trusted adapter projects its descriptor. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"terminal-credential.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/terminal-credential.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"terminal-credential.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/hosted/terminal-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,6BAA6B,EAGnC,MAAM,qCAAqC,CAAC;AAU7C,OAAO,KAAK,EACV,kCAAkC,EAClC,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,4BAA4B,CAAC;AAQpC,OAAO,EAIL,gCAAgC,EAEjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAGnF,eAAO,MAAM,yBAAyB,mCAAmC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAK5C,KAAK,wBAAwB,GACzB,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,GACxC;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBpC,KAAK,wBAAwB,GAAG;IAC9B,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C,CAAC;AAGF,oFAAoF;AACpF,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,wBAAwB,GACnC,wBAAwB,GAAG,SAAS,CAEtC;AAED,yFAAyF;AACzF,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI,CAWN;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,GAAG,SAAS,CAQjG;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC7B,SAAS,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAAE,GAC7D,IAAI,CAUN;AAED,0FAA0F;AAC1F,wBAAgB,0BAA0B,CACxC,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAC5B,kCAAkC,GAAG,SAAS,CAgBhD;AAED,wGAAwG;AACxG,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,6BAA6B,GAAG,SAAS,EAClD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,gBAAgB,GAChE,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,CAAC,EAAE,2BAA2B,KAAK,gBAAgB,CA8F/F;AAED,sFAAsF;AACtF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,uBAAuB,GAAG,wBAAwB,EAC3D,SAAS,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAAE,GAE5D,CAAC,CACD,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CACH,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,KACE,OAAO,CAAC,yBAAyB,CAAC,CAAC,GACtC,SAAS,CAuCZ;AAyDD,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAExF,wFAAwF;AACxF,wBAAsB,mCAAmC,CACvD,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC,GACA,OAAO,CAAC,yBAAyB,GAAG,kBAAkB,CAAC,CAyBzD;AAED,0GAA0G;AAC1G,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC,EACD,gBAAgB,CAAC,EAAE,6BAA6B,GAC/C,OAAO,CAAC,yBAAyB,CAAC,CA2EpC;AAED,+FAA+F;AAC/F,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,wBAAwB,iFASzF;AAED,uFAAuF;AACvF,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,wBAAwB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,IAAI,CAQN;AAED,8EAA8E;AAC9E,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,UAAU,EAAE,wBAAwB,EACpC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACxD,YAAY,CAAC,EAAE,WAAW,GACzB,OAAO,CAAC,CAAC,CAAC,CAwGZ;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,mBAOxE,WAAW,+EASlC;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,0FAe9E"}
|