witnora 0.18.11 → 0.18.12

package/dist/gateway.js

@@ -61,6 +61,7 @@ export async function initializeCustomerGateway(options) {
         port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, 8787),
         storageDirectory: "data",
         privacyMode: "metadata_only",
+        ...(options.agentIdentity ? { agentIdentity: options.agentIdentity } : {}),
         coverage: runtimeKit
             ? { recorded: "configured", enforced: "configured", outcomeVerified: "configured" }
             : { recorded: "configured", enforced: "not_configured", outcomeVerified: "not_configured" },
@@ -136,14 +137,20 @@ export async function upgradeCustomerGatewayRuntime(options) {
     if (current.projectId !== options.authorization.projectId || current.server !== options.authorization.server)
         throw new Error("Existing Gateway project/server binding does not match this authorized Runtime upgrade.");
     const generatedClient = clientRaw === gatewayClient(current)
-        || (!current.runtimeWorker && clientRaw === recordedGatewayClient(current));
+        || (!current.runtimeWorker && (clientRaw === recordedGatewayClient(current)
+            || clientRaw === recordedGatewayClient({ ...current, agentIdentity: undefined })));
     if (!generatedClient || readmeRaw !== gatewayReadme(current))
         throw new Error("Existing Gateway files differ from the Witnora-generated version; refusing to overwrite them.");
     if (current.runtimeWorker && current.runtimeWorker.adapterId !== LOCAL_SANDBOX_ADAPTER_ID) {
         throw new Error("Existing Gateway already has a different Runtime worker; preserve it and reconfigure in Advanced mode.");
     }
     const runtimeKit = await prepareRuntimeSandboxKit(options.runtimeReferences, options.authorization, options.configHome, options.fetch ?? fetch, directory);
-    const next = { ...current, coverage: { recorded: "configured", enforced: "configured", outcomeVerified: "configured" }, runtimeWorker: runtimeKit.config };
+    const next = {
+        ...current,
+        ...(options.agentIdentity ? { agentIdentity: options.agentIdentity } : {}),
+        coverage: { recorded: "configured", enforced: "configured", outcomeVerified: "configured" },
+        runtimeWorker: runtimeKit.config,
+    };
     next.runtimeWorker.configDigestSha256 = gatewayConfigDigest(next);
     const replacingGeneratedRuntime = current.runtimeWorker?.adapterId === LOCAL_SANDBOX_ADAPTER_ID;
     if (replacingGeneratedRuntime) {
@@ -155,7 +162,8 @@ export async function upgradeCustomerGatewayRuntime(options) {
             || createHash("sha256").update(probeBytes).digest("hex") !== current.runtimeWorker.probeModuleSha256) {
             throw new Error("Existing generated Runtime modules were modified; refusing to overwrite them.");
         }
-        if (sameRuntimeGeneration(current.runtimeWorker, next.runtimeWorker)) {
+        if (sameRuntimeGeneration(current.runtimeWorker, next.runtimeWorker)
+            && JSON.stringify(current.agentIdentity) === JSON.stringify(next.agentIdentity)) {
             return { config: current, generatedFiles: [], changed: false, rollback: async () => undefined };
         }
     }
@@ -1358,6 +1366,8 @@ function parseConfig(raw) {
     }
     if (value.privacyMode !== "metadata_only")
         throw new Error("Gateway privacyMode must remain metadata_only.");
+    if (value.agentIdentity)
+        validateGatewayAgentIdentity(value.agentIdentity);
     if (!value.host || !Number.isSafeInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65_535)
         throw new Error("Gateway host and port are invalid.");
     if (value.runtimeWorker)
@@ -1368,6 +1378,13 @@ function parseConfig(raw) {
     }
     return config;
 }
+function validateGatewayAgentIdentity(value) {
+    for (const [key, item] of Object.entries(value)) {
+        if (typeof item !== "string" || item.trim().length === 0 || item.length > 200) {
+            throw new Error(`Gateway agentIdentity.${key} must be a non-empty string no longer than 200 characters.`);
+        }
+    }
+}
 export function parseManagedWorkflowHarnessConfig(raw) {
     const value = JSON.parse(raw);
     const workflowIds = value.workflowIds;
@@ -1652,7 +1669,11 @@ async function ed25519PublicKeyPem(handle) {
     return createPublicKey(key).export({ type: "spki", format: "pem" }).toString();
 }
 function recordedGatewayClient(config) {
-    return `import { readFile } from "node:fs/promises";\n\nconst baseUrl = "http://${config.host}:${config.port}";\nlet gatewayToken;\n\nasync function token() {\n  if (gatewayToken) return gatewayToken;\n  const secrets = JSON.parse(await readFile(new URL("./secrets.json", import.meta.url), "utf8"));\n  if (typeof secrets.gatewayToken !== "string" || secrets.gatewayToken.length < 32) {\n    throw new Error("Witnora local Gateway token is missing or invalid.");\n  }\n  gatewayToken = secrets.gatewayToken;\n  return gatewayToken;\n}\n\nasync function post(runId, operation, body) {\n  if (!/^[A-Za-z0-9._:-]+$/.test(runId)) throw new Error("Witnora runId contains unsupported characters.");\n  const response = await fetch(\`\${baseUrl}/v1/runs/\${encodeURIComponent(runId)}/\${operation}\`, {\n    method: "POST",\n    headers: { authorization: \`Bearer \${await token()}\`, "content-type": "application/json" },\n    body: JSON.stringify(body),\n  });\n  const result = await response.json().catch(() => ({}));\n  if (!response.ok) throw new Error(result.error ?? \`Witnora Gateway returned HTTP \${response.status}.\`);\n  return result;\n}\n\nexport const witnoraGateway = {\n  start(runId, metadata = {}) {\n    return post(runId, "start", { payload: metadata, idempotencyKey: "run-start" });\n  },\n  event(runId, type, metadata = {}, idempotencyKey = \`\${type}-\${crypto.randomUUID()}\`) {\n    return post(runId, "events", { type, payload: metadata, idempotencyKey });\n  },\n  complete(runId, metadata = {}) {\n    return post(runId, "complete", {\n      payload: metadata,\n      evidenceStrength: {\n        schemaVersion: "agentcert.evidence_strength.v0.1",\n        level: "recorded",\n        claims: [],\n        limitations: ["No write-credential mediation or independent outcome probe is configured."],\n      },\n      idempotencyKey: "run-complete",\n    });\n  },\n};\n`;
+    const defaultAgent = config.agentIdentity ? JSON.stringify(config.agentIdentity) : undefined;
+    const startPayload = defaultAgent
+        ? `const payload = { ...metadata, agent: metadata.agent ?? ${defaultAgent} };\n    return post(runId, "start", { payload, idempotencyKey: "run-start" });`
+        : `return post(runId, "start", { payload: metadata, idempotencyKey: "run-start" });`;
+    return `import { readFile } from "node:fs/promises";\n\nconst baseUrl = "http://${config.host}:${config.port}";\nlet gatewayToken;\n\nasync function token() {\n  if (gatewayToken) return gatewayToken;\n  const secrets = JSON.parse(await readFile(new URL("./secrets.json", import.meta.url), "utf8"));\n  if (typeof secrets.gatewayToken !== "string" || secrets.gatewayToken.length < 32) {\n    throw new Error("Witnora local Gateway token is missing or invalid.");\n  }\n  gatewayToken = secrets.gatewayToken;\n  return gatewayToken;\n}\n\nasync function post(runId, operation, body) {\n  if (!/^[A-Za-z0-9._:-]+$/.test(runId)) throw new Error("Witnora runId contains unsupported characters.");\n  const response = await fetch(\`\${baseUrl}/v1/runs/\${encodeURIComponent(runId)}/\${operation}\`, {\n    method: "POST",\n    headers: { authorization: \`Bearer \${await token()}\`, "content-type": "application/json" },\n    body: JSON.stringify(body),\n  });\n  const result = await response.json().catch(() => ({}));\n  if (!response.ok) throw new Error(result.error ?? \`Witnora Gateway returned HTTP \${response.status}.\`);\n  return result;\n}\n\nexport const witnoraGateway = {\n  start(runId, metadata = {}) {\n    ${startPayload}\n  },\n  event(runId, type, metadata = {}, idempotencyKey = \`\${type}-\${crypto.randomUUID()}\`) {\n    return post(runId, "events", { type, payload: metadata, idempotencyKey });\n  },\n  complete(runId, metadata = {}) {\n    return post(runId, "complete", {\n      payload: metadata,\n      evidenceStrength: {\n        schemaVersion: "agentcert.evidence_strength.v0.1",\n        level: "recorded",\n        claims: [],\n        limitations: ["No write-credential mediation or independent outcome probe is configured."],\n      },\n      idempotencyKey: "run-complete",\n    });\n  },\n};\n`;
 }
 async function writeExclusive(path, content, force, mode) {
     if (!force && await exists(path))

package/dist/onboard.js

@@ -19,6 +19,12 @@ export async function runOnboard(options) {
     const server = normalizeServer(options.server ?? DEFAULT_WITNORA_SERVER);
     const repositoryPath = resolve(options.repository ?? process.cwd());
     const repository = await inspectRepository(repositoryPath, options.template);
+    const agentIdentity = {
+        externalId: repository.name,
+        name: humanizeAgentName(repository.name),
+        version: repository.version,
+        framework: frameworkForTemplate(repository.template),
+    };
     const connectionName = options.name ?? repository.slug;
     const token = await authorizeProjectConnection({
         projectId: options.projectId,
@@ -95,6 +101,24 @@ export async function runOnboard(options) {
     };
     let assuranceHarnessChanged = false;
     let continuousService;
+    const prepareRuntime = async (operation) => {
+        const delays = [250, 500, 1_000, 2_000, 4_000, 8_000];
+        let lastError;
+        for (let attempt = 0; attempt <= delays.length; attempt += 1) {
+            try {
+                return await operation();
+            }
+            catch (error) {
+                if (!(error instanceof RuntimeSetupNotReadyError))
+                    throw error;
+                lastError = error;
+                if (attempt === delays.length)
+                    break;
+                await (options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))))(delays[attempt]);
+            }
+        }
+        throw lastError;
+    };
     await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
@@ -137,11 +161,12 @@ export async function runOnboard(options) {
         if (gatewayState.status === "absent") {
             let gateway;
             try {
-                gateway = await initializeCustomerGateway({
+                gateway = await prepareRuntime(() => initializeCustomerGateway({
                     projectId: token.projectId, server, repository: repositoryPath, authorization: token,
                     runtimeReferences: localRuntime.references,
+                    agentIdentity,
                     fetch: requestFetch, configHome: options.configHome, output,
-                });
+                }));
             }
             catch (error) {
                 if (!(error instanceof RuntimeSetupNotReadyError) || !localRuntime.references)
@@ -157,7 +182,7 @@ export async function runOnboard(options) {
                 await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey }, { configHome: options.configHome });
                 if (localRuntime.references) {
                     try {
-                        runtimeUpgrade = await upgradeCustomerGatewayRuntime({ repository: repositoryPath, authorization: token, runtimeReferences: localRuntime.references, configHome: options.configHome, fetch: requestFetch });
+                        runtimeUpgrade = await prepareRuntime(() => upgradeCustomerGatewayRuntime({ repository: repositoryPath, authorization: token, runtimeReferences: localRuntime.references, agentIdentity, configHome: options.configHome, fetch: requestFetch }));
                         if (runtimeUpgrade.changed) {
                             const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
                             if (stopped.state !== "STOPPED" || stopped.healthy)
@@ -187,11 +212,12 @@ export async function runOnboard(options) {
                 await assertGatewayStopped(requestFetch, binding.host, binding.port, binding.projectId, token.projectId);
                 gatewayMigration = await archiveGateway(gatewayState.directory, repositoryPath, binding.projectId);
                 output(`\nExisting Gateway belongs to project ${binding.projectId}; archived it at ${gatewayMigration.archiveDirectory}.\n`);
-                const gateway = await initializeCustomerGateway({
+                const gateway = await prepareRuntime(() => initializeCustomerGateway({
                     projectId: token.projectId, server, repository: repositoryPath, authorization: token,
                     runtimeReferences: localRuntime.references,
+                    agentIdentity,
                     fetch: requestFetch, configHome: options.configHome, output,
-                });
+                }));
                 generatedFiles.push(...gateway.generatedFiles);
             }
         }
@@ -252,7 +278,7 @@ export async function runOnboard(options) {
             : { state: "RECORDED_ONLY", checkedAt: new Date().toISOString(), limitations: [runtimeLimitation ?? "The local sandbox Runtime worker has not established exact adapter, probe, source-key, identity, mandate, and readiness bindings."] };
         await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, {
             status: "verified", attemptId, generatedFiles: relativeGeneratedFiles(repositoryPath, generatedFiles), runtimeReadiness,
-            connectedAgent: { externalId: repository.name, name: humanizeAgentName(repository.name), version: repository.version, framework: frameworkForTemplate(repository.template) },
+            connectedAgent: agentIdentity,
             ...(runtimeBinding ? { runtimeBinding } : {}),
         });
         output(`\nWitnora Setup Autopilot completed for ${repository.name}.\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.18.11",
+  "version": "0.18.12",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",