agentengine-sdk-python 0.8.4__py3-none-any.whl → 0.8.5__py3-none-any.whl

ksadk/plugins/providers/bundles/ksadk-dsh-companion-host/client.mjs

@@ -0,0 +1,133 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { randomUUID } from 'node:crypto'
+import { createConnection } from 'node:net'
+
+const MAX_BYTES = 1024 * 1024
+export class CompanionBridgeError extends Error {
+  constructor(code) { super(code); this.code = code }
+}
+const fail = code => new CompanionBridgeError(code)
+
+export class CompanionBridge {
+  #configuration
+  #context = new AsyncLocalStorage()
+  #tools = new Map()
+  #sockets = new Set()
+  #closed = false
+
+  constructor(config) {
+    if (!config || typeof config.socketPath !== 'string' || !config.socketPath.startsWith('/') ||
+        typeof config.secret !== 'string' || typeof config.generationId !== 'string') {
+      throw fail('COMPANION_CONFIGURATION_INVALID')
+    }
+    this.#configuration = config
+  }
+  get generationId() { return this.#configuration.generationId }
+  operationForTool(name) { return this.#tools.get(name) }
+
+  async registerComponent(pluginId, component) {
+    if (!this.#configuration.plugins?.[pluginId]?.components.includes(component)) {
+      throw fail('COMPANION_COMPONENT_INVALID')
+    }
+    const socket = await this.#request({
+      type: 'register', pluginId, component,
+      generationId: this.generationId, secret: this.#configuration.secret,
+    }, { keepOpen: true, deadline: Date.now() + 5000 })
+    return () => { this.#sockets.delete(socket); socket.destroy() }
+  }
+
+  registerTool(name, pluginId, operation) {
+    if (this.#tools.has(name) || !this.#configuration.plugins?.[pluginId]) {
+      throw fail('COMPANION_TOOL_INVALID')
+    }
+    const entry = Object.freeze({ pluginId, operation })
+    this.#tools.set(name, entry)
+    return () => { if (this.#tools.get(name) === entry) this.#tools.delete(name) }
+  }
+
+  withInvocation(context, callback) {
+    if (!context || context.generationId !== this.generationId ||
+        !/^[A-Za-z0-9_-]{32,256}$/.test(context.handle) ||
+        typeof context.callId !== 'string' || !context.callId || context.callId.length > 128 ||
+        !Number.isSafeInteger(context.deadline) || context.deadline <= Date.now()) {
+      throw fail('COMPANION_CONTEXT_REQUIRED')
+    }
+    return this.#context.run(Object.freeze({ ...context }), callback)
+  }
+
+  call(toolName, args, { signal } = {}) {
+    const context = this.#context.getStore()
+    const operation = this.#tools.get(toolName)
+    if (!context || !operation || operation.pluginId !== context.pluginId) {
+      throw fail('COMPANION_CONTEXT_REQUIRED')
+    }
+    const signals = [context.signal, signal].filter(Boolean)
+    return this.#request({
+      type: 'invoke', pluginId: operation.pluginId, operation: operation.operation,
+      handle: context.handle, callId: context.callId, arguments: args,
+      deadline: context.deadline,
+    }, { deadline: context.deadline, signal: signals.length ? AbortSignal.any(signals) : undefined })
+  }
+
+  #request(request, { keepOpen = false, deadline, signal }) {
+    if (this.#closed) throw fail('COMPANION_CLOSED')
+    if (this.#sockets.size >= 96) throw fail('COMPANION_BUSY')
+    const requestId = randomUUID()
+    const body = Buffer.from(JSON.stringify({ v: 1, requestId, ...request }))
+    if (body.length > MAX_BYTES) throw fail('COMPANION_REQUEST_INVALID')
+    const prefix = Buffer.alloc(4)
+    prefix.writeUInt32BE(body.length)
+    return new Promise((resolve, reject) => {
+      const socket = createConnection({ path: this.#configuration.socketPath })
+      this.#sockets.add(socket)
+      let received = Buffer.alloc(0), expected, settled = false
+      const finish = (error, result) => {
+        if (settled) return
+        settled = true
+        clearTimeout(timer)
+        signal?.removeEventListener('abort', abort)
+        if (!keepOpen || error) { this.#sockets.delete(socket); socket.destroy() }
+        if (error) reject(error); else resolve(keepOpen ? socket : result)
+      }
+      const abort = () => finish(fail('COMPANION_CANCELLED'))
+      const timer = setTimeout(() => finish(fail('COMPANION_OUTCOME_UNCERTAIN')), Math.max(1, deadline - Date.now()))
+      if (signal?.aborted) { abort(); return }
+      signal?.addEventListener('abort', abort, { once: true })
+      socket.once('connect', () => socket.write(Buffer.concat([prefix, body])))
+      socket.on('error', () => finish(fail('COMPANION_OUTCOME_UNCERTAIN')))
+      socket.once('close', () => {
+        this.#sockets.delete(socket)
+        finish(fail('COMPANION_OUTCOME_UNCERTAIN'))
+      })
+      socket.on('data', chunk => {
+        if (settled) return
+        if (received.length + chunk.length > MAX_BYTES + 4) return finish(fail('COMPANION_RESPONSE_INVALID'))
+        received = Buffer.concat([received, chunk])
+        if (expected === undefined && received.length >= 4) {
+          expected = received.readUInt32BE(0)
+          if (!expected || expected > MAX_BYTES) return finish(fail('COMPANION_RESPONSE_INVALID'))
+        }
+        if (expected === undefined || received.length < expected + 4) return
+        if (received.length !== expected + 4) return finish(fail('COMPANION_RESPONSE_INVALID'))
+        try {
+          const response = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(received.subarray(4)))
+          if (response?.v !== 1 || response.requestId !== requestId) throw fail('COMPANION_RESPONSE_INVALID')
+          if (response.error) throw fail(/^COMPANION_[A-Z_]+$/.test(response.error.code)
+            ? response.error.code : 'COMPANION_RESPONSE_INVALID')
+          if (!response.result || typeof response.result !== 'object' || Array.isArray(response.result)) {
+            throw fail('COMPANION_RESPONSE_INVALID')
+          }
+          finish(null, response.result)
+        } catch (error) { finish(error instanceof CompanionBridgeError ? error : fail('COMPANION_RESPONSE_INVALID')) }
+      })
+    })
+  }
+
+  dispose() {
+    this.#closed = true
+    for (const socket of this.#sockets) socket.destroy()
+    this.#sockets.clear()
+    this.#tools.clear()
+    this.#context.disable()
+  }
+}

ksadk/plugins/providers/bundles/ksadk-dsh-companion-host/index.mjs

@@ -0,0 +1,14 @@
+import { CompanionBridge } from './client.mjs'
+
+export const name = 'ksadk-plugin-companions'
+
+// Private supervisor material never enters Loader entry.config or the client
+// boot graph. Remove it before plugins can launch delegated child processes.
+const configuration = JSON.parse(process.env.KSADK_DSH_COMPANION_CONFIGURATION || 'null')
+delete process.env.KSADK_DSH_COMPANION_CONFIGURATION
+
+export function apply(ctx) {
+  const bridge = new CompanionBridge(configuration)
+  ctx.provide('pluginCompanions', bridge)
+  ctx.effect(() => () => bridge.dispose())
+}

ksadk/plugins/providers/bundles/ksadk-dsh-studio/client.js

@@ -25,6 +25,12 @@ window.__ModuleLoader__.load({
       const mounts = new Map();
       const listeners = new Set();
       const notify = () => listeners.forEach(listener => listener());
+      const workspaceListeners = new Set();
+      const notifyWorkspace = () => {
+        workspaceListeners.forEach(listener => listener());
+        notify();
+        window.dispatchEvent?.(new Event('studio:workspace-changed'));
+      };
       function packageForSection(entry) {
         const registrant = entry.registrant || entry.options.registrant;
         if (!registrant) return undefined;
@@ -49,7 +55,20 @@ window.__ModuleLoader__.load({
         subscribe: listener => { listeners.add(listener); return () => listeners.delete(listener); },
         attach: (id, container, close) => {
           const key = Symbol(id);
-          mounts.set(key, { id, container, close }); notify();
+          mounts.set(key, { id, container, props: { close }, slot: 'settings.section' }); notify();
+          return () => { mounts.delete(key); notify(); };
+        },
+        workspacePages: () => ctx.slots.entriesOfSlot('studio.workspace.page')
+          .filter(entry => typeof entry.options.id === 'string')
+          .sort((a, b) => (a.options.order || 0) - (b.options.order || 0))
+          .map(entry => ({ id: entry.options.id, label: sectionLabel(entry),
+            pluginId: packageForSection(entry), order: entry.options.order || 0 })),
+        subscribeWorkspace: listener => {
+          workspaceListeners.add(listener); return () => workspaceListeners.delete(listener);
+        },
+        attachWorkspace: (id, container, props = {}) => {
+          const key = Symbol(id);
+          mounts.set(key, { id, container, props, slot: 'studio.workspace.page' }); notify();
           return () => { mounts.delete(key); notify(); };
         },
       };
@@ -62,7 +81,9 @@ window.__ModuleLoader__.load({
           const redraw = () => update(value => value + 1);
           const detach = bridge.subscribe(redraw);
           const unsubscribe = ctx.slots.subscribe('settings.section', notify);
+          const unsubscribeWorkspace = ctx.slots.subscribe('studio.workspace.page', notifyWorkspace);
           window.__STUDIO_DSH__ = bridge;
+          window.dispatchEvent?.(new Event('studio:bridge-ready'));
           const mount = () => {
             if (!window.__STUDIO_APP__ || !container.current) return;
             window.removeEventListener('studio:app-ready', mount);
@@ -72,19 +93,21 @@ window.__ModuleLoader__.load({
           };
           window.addEventListener('studio:app-ready', mount); mount();
           return () => {
-            disposed = true; detach(); unsubscribe(); unmount?.();
+            disposed = true; detach(); unsubscribe(); unsubscribeWorkspace(); unmount?.();
             window.removeEventListener('studio:app-ready', mount);
             if (window.__STUDIO_DSH__ === bridge) delete window.__STUDIO_DSH__;
+            window.dispatchEvent?.(new Event('studio:workspace-changed'));
           };
         }, []);
         return createElement(Fragment, null,
           createElement('div', { ref: container, className: 'studio-native-root', style: { height: '100vh' } }, error || null),
-          ...[...mounts.values()].map(({ id, container, close }) => createPortal(
-            createElement(PluginSurfaceBoundary, { key: id }, renderSlot('settings.section', { close }, { only: id })), container, id)),
+          ...[...mounts.values()].map(({ id, container, props, slot }) => createPortal(
+            createElement(PluginSurfaceBoundary, { key: id }, renderSlot(slot, props, { only: id })), container, id)),
         );
       }
       ctx.slots.register({ name: 'root', priority: -100, children: {
         'settings.section': { kind: 'list', scope: 'root' },
+        'studio.workspace.page': { kind: 'list', scope: 'root' },
       } }, StudioRoot);
     }
     return { name: 'studio-app', inject: ['slots'], apply };

ksadk/plugins/providers/bundles/ksadk-dsh-studio/index.mjs

@@ -1,15 +1,19 @@
-import { readFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
 
 export const name = 'studio-app';
 export const inject = ['webServer'];
 
 // Application composition only. All plugin services remain owned by Core.
 export async function apply(ctx, config) {
-  const html = await readFile(config.indexPath, 'utf8');
-  const assets = html.match(/<script\b[^>]*type="module"[^>]*><\/script>|<link\b[^>]*rel="(?:stylesheet|modulepreload)"[^>]*>/g) || [];
-  if (!assets.length) throw new Error('Studio frontend assets are missing; build Studio first');
+  const assetTags = () => {
+    const html = readFileSync(config.indexPath, 'utf8');
+    const assets = html.match(/<script\b[^>]*type="module"[^>]*><\/script>|<link\b[^>]*rel="(?:stylesheet|modulepreload)"[^>]*>/g) || [];
+    if (!assets.length) throw new Error('Studio frontend assets are missing; build Studio first');
+    return assets.join('');
+  };
+  assetTags(); // Validate at boot, but do not retain filenames across frontend rebuilds.
   ctx.on('webserver/index-inject', table => table.push({
     kind: 'html', placement: 'head',
-    html: '<script>window.__STUDIO_DSH_BOOT__=true</script>' + assets.join(''),
+    html: '<script>window.__STUDIO_DSH_BOOT__=true</script>' + assetTags(),
   }));
 }

ksadk/plugins/providers/bundles/ksadk-harness/index.mjs

@@ -14,6 +14,6 @@ export function apply(ctx) {
   // The DSH Profile owns discovery and lifecycle. KsADK consumes this
   // contribution through its frozen provider-host bridge; the existing
   // RuntimeAdapter remains the execution backend during migration.
-  ctx.provide('ksadkAgentProvider', contribution)
+  ctx.provide('ksadkHarnessAgentProvider', contribution)
   ctx.effect(() => () => {})
 }

ksadk/plugins/providers/codex.py

@@ -647,14 +647,22 @@ def _resolve_bundle_config(
         "sandbox": str(execution.get("sandbox") or "workspace_write_auto"),
         "approval_mode": str(execution.get("approvalMode") or execution.get("approval_mode") or ""),
         "turn_timeout_seconds": int(
-            execution.get("timeoutSeconds") or execution.get("timeout_seconds") or 120
+            execution.get("timeoutSeconds") or execution.get("timeout_seconds") or 300
         ),
         "mcp_servers": mcp_servers,
         "skills": skills,
         "env": {**mcp_env, **model_env},
     }
     if local_launch is not None:
-        launch_config.update(local_launch.config)
+        # local_launch.config 自带 env（桌面 runtime 变量等），整体 update 会
+        # 把上面组装的 mcp_env（MCP bearer 凭证，如 Authorization）覆盖丢失，
+        # 导致 codex 子进程读不到 bearer_token_env_var 指向的变量，MCP server
+        # 401 被静默丢弃。env 必须合并且 mcp/model 凭证优先。
+        local_config = dict(local_launch.config)
+        local_env = dict(local_config.get("env") or {})
+        merged_env = {**local_env, **mcp_env, **model_env}
+        launch_config.update(local_config)
+        launch_config["env"] = merged_env
     # Local launch compatibility never replaces immutable Bundle Skill bytes.
     launch_config["skills"] = skills
     launch_config["enforce_bound_skills"] = True

ksadk/plugins/providers/dsh_capabilities.py

@@ -335,6 +335,34 @@ class DshMcpConnectorLease:
 
         return {"Authorization": f"Bearer {self._bearer_token}"}
 
+    def companion_bearer_token(
+        self, *, plugin_id: str, generation_id: str, handle: str,
+        tool_name: str, call_id: str, ttl_seconds: int = 60,
+    ) -> str:
+        """Sign only an opaque Python grant and one exact native tool call."""
+        if (not re.fullmatch(r"[A-Za-z0-9_.-]{1,128}", plugin_id)
+            or not re.fullmatch(r"dshgen_[A-Za-z0-9_-]{24,96}", generation_id)
+            or not re.fullmatch(r"[A-Za-z0-9_-]{32,256}", handle)
+            or not _TOOL_NAME.fullmatch(tool_name)
+            or not re.fullmatch(r"[A-Za-z0-9_.:-]{1,128}", call_id)
+            or not 1 <= ttl_seconds <= 120):
+            raise ValueError("invalid companion invocation scope")
+        payload = {
+            "v": 3, "profileDigest": self.profile_digest,
+            "pluginId": plugin_id, "generationId": generation_id,
+            "handle": handle, "callId": call_id,
+            "aliases": {tool_name: tool_name},
+            "exp": int(time.time()) + ttl_seconds,
+            "jti": secrets.token_urlsafe(24),
+        }
+        raw = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode()
+        encoded = base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+        message = f"ks3.{encoded}"
+        signature = base64.urlsafe_b64encode(
+            hmac.new(self._bearer_token.encode(), message.encode(), hashlib.sha256).digest()
+        ).rstrip(b"=").decode()
+        return f"{message}.{signature}"
+
     def resource_bearer_token(self, tool_aliases: Mapping[str, str], resource_leases) -> str:
         """Mint scope v2 from host-issued, activation-bound resource leases."""
         from ksadk.resource_runtime.leases import ResourceLease
@@ -632,6 +660,7 @@ class DshProfileCapabilityHost:
         self._core_token_future: asyncio.Future[str] | None = None
         self._runtime_dir: Path | None = None
         self._resource_socket_path: Path | None = None
+        self._companion_configuration: dict[str, Any] | None = None
         self._lease: DshMcpConnectorLease | None = None
         self._descriptor: DshProfileCapabilityDescriptor | None = None
         self._stdout_tail: deque[str] = deque(maxlen=64)
@@ -705,6 +734,11 @@ class DshProfileCapabilityHost:
                         "KSADK_DSH_VERSION": self._projection.host_version,
                     }
                 )
+                environment.pop("KSADK_DSH_COMPANION_CONFIGURATION", None)
+                if self._companion_configuration is not None:
+                    environment["KSADK_DSH_COMPANION_CONFIGURATION"] = json.dumps(
+                        self._companion_configuration, separators=(",", ":")
+                    )
                 process = await asyncio.create_subprocess_exec(
                     *self._command,
                     "--profile",
@@ -856,6 +890,26 @@ class DshProfileCapabilityHost:
             self._state = "stopped"
             self._resource_socket_path = path
 
+    async def configure_companions(self, configuration: Mapping[str, Any] | None) -> None:
+        """Bind private companion IPC to the next Core generation."""
+        import stat
+
+        if configuration is not None:
+            path = Path(str(configuration.get("socketPath", "")))
+            if (not path.is_absolute() or path.is_symlink()
+                or not stat.S_ISSOCK(path.stat().st_mode)
+                or path.stat().st_mode & 0o077 or path.parent.stat().st_mode & 0o077):
+                raise PluginHostError(
+                    "dsh_companion_socket_invalid", "Companion IPC must be private"
+                )
+        async with self._lifecycle_lock:
+            if self._disposed:
+                raise PluginHostError("dsh_companion_host_disposed", "Companion host is disposed")
+            if self._process is not None:
+                await self._terminate()
+            self._state = "stopped"
+            self._companion_configuration = dict(configuration) if configuration else None
+
     def _overlay_text(self) -> str:
         entrypoint = json.dumps(self._bundle.entrypoint.as_uri())
         overlay = (
@@ -876,6 +930,13 @@ class DshProfileCapabilityHost:
                 "  config:\n"
                 f"    socketPath: {json.dumps(str(self._resource_socket_path))}\n"
             )
+        if self._companion_configuration is not None:
+            companion = self._bundle.root.parent / "ksadk-dsh-companion-host" / "index.mjs"
+            overlay += (
+                "- insert:\n"
+                "    - id: ksadk-plugin-companions\n"
+                f"      name: {json.dumps(companion.as_uri())}\n"
+            )
         if self._studio_index is not None:
             app = self._bundle.root.parent / "ksadk-dsh-studio" / "index.mjs"
             overlay += (