Update SDK and configuration

Change-Id: Iccd38f76d6e9c122ae867d3825476f58184896d9
Co-developed-by: Qoder <noreply@qoder.com>

Author: heimanba

.changeset/pairing-channel.md

@@ -0,0 +1,9 @@
+---
+"@openagentpack/sdk": minor
+"@openagentpack/cli": minor
+"@openagentpack/playground": minor
+---
+
+Add `mode: pairing` support for Qoder Channels.
+
+`channels[].mode` now accepts `fixed` (default) or `pairing`. Pairing-mode channels create a transport-only IM connection without binding to an Identity or Template, which is required for Forward Schedule sinks such as scheduled group broadcasts. Fixed-mode channels retain the existing behavior and continue to require `agent` and `identity`.

docs/reference/configuration.md

@@ -73,9 +73,10 @@ External references are verified and recorded but never updated or deleted.
 channels:
   support-dingtalk:
     provider: qoder                 # optional; inherits defaults.provider
-    agent: support-agent
-    identity: chen                  # optional; inherits defaults.identity
+    agent: support-agent            # required for mode: fixed; ignored for mode: pairing
+    identity: chen                  # optional; inherits defaults.identity. ignored for mode: pairing
     type: dingtalk
+    mode: fixed                     # optional; defaults to fixed
     name: Support DingTalk          # optional; defaults to the YAML key
     enabled: true                   # optional; defaults to true
     credentials:
@@ -86,7 +87,34 @@ channels:
       include_thinking: false
 ```
 
-The declaration intentionally uses logical `agent` and `identity` references. Provider adapters resolve remote ids and map `type`, `credentials`, and `options` to provider wire fields. Qoder Channels require the referenced Agent to use Forward delivery. Credential-based Qoder support currently covers DingTalk, Feishu, and WeCom; personal WeChat remains QR-only.
+| Field | Type | Required | Description |
+| ----- | ---- | -------- | ----------- |
+| `provider` | string | no | Provider name; inherits `defaults.provider`. |
+| `agent` | string | conditional | Logical Agent name. Required for `fixed` mode; ignored for `pairing` mode. |
+| `identity` | string | conditional | Logical Identity name; inherits `defaults.identity`. Required for `fixed` mode; ignored for `pairing` mode. |
+| `type` | string | yes | Provider-specific channel type. Qoder supports `dingtalk`, `feishu`, and `wecom`; `wechat` is QR-only. |
+| `mode` | `fixed` \| `pairing` | no | `fixed` (default) binds the channel to one Identity/Template. `pairing` creates a transport-only channel for Schedules/Sinks. |
+| `name` | string | no | Display name; defaults to the YAML key. |
+| `enabled` | boolean | no | Defaults to `true`. |
+| `credentials` | map | conditional | Provider-specific credentials. Required for credential-based channel types. |
+| `options` | map | no | Provider-specific response options, e.g. `include_tool_calls`, `include_thinking`. |
+
+The declaration intentionally uses logical `agent` and `identity` references. Provider adapters resolve remote ids and map `type`, `credentials`, and `options` to provider wire fields. Qoder Channels in `fixed` mode require the referenced Agent to use Forward delivery. `pairing` mode omits Identity/Template binding and is intended for Schedule sinks such as scheduled group broadcasts. Credential-based Qoder support currently covers DingTalk, Feishu, and WeCom; personal WeChat remains QR-only.
+
+### Managed tool config
+
+`managed_tool_config` declares the provider-operated tools an Agent Harness runs
+itself, rather than tools the model calls through the sandbox. Schedule
+management is the current use: enabling `create_forward_schedule`,
+`list_forward_schedules`, and `delete_forward_schedule` lets an end user create
+and cancel Schedules in natural language from a Web or IM Channel conversation.
+
+`enabled_tools` replaces the provider's whole enabled set, so an empty array
+turns every managed tool off. Omitting the field entirely sends nothing: because
+Qoder Forward Template updates are merge-style, an undeclared field leaves
+whatever the remote Template already had. Declare it whenever the tools matter —
+a Template recreated from scratch (after a destroy, a manual deletion, or lost
+state) otherwise comes back with no managed tools and no error.
 
 ## Provider configuration
 
@@ -253,6 +281,7 @@ agents:
     vault: <string>
     memory_stores: [ <string> ]
     environment_variables: { <key>: <string> }  # Qoder only
+    managed_tool_config: { enabled_tools: [ <string> ] }  # Qoder Forward delivery only
     resources: [ SessionResource ]
     multiagent: { type: "coordinator", agents: [...] }
     metadata: { <key>: <string> }
@@ -274,6 +303,7 @@ agents:
 | `vault` | string | no | Vault name. |
 | `memory_stores` | string[] | no | Bound memory stores. |
 | `environment_variables` | map<string,string> | no | Qoder runtime variables. Managed Sessions use Qoder's `KEY=VALUE;...` wire format; Forward Templates store the map as defaults and Forward Sessions send it under `config.environment_variables`. |
+| `managed_tool_config.enabled_tools` | string[] | no | Provider-operated tools the Agent Harness exposes, e.g. `create_forward_schedule`, `list_forward_schedules`, `delete_forward_schedule`. Qoder Forward delivery only; declaring it on managed delivery is a validation error. |
 | `resources` | SessionResource[] | no | Resources attached to every managed Session created for the Agent. |
 | `multiagent.type` | `"coordinator"` | no | Declare a coordinator agent. |
 | `multiagent.agents` | string[] | yes (with multiagent) | Agents it orchestrates. |

packages/sdk/src/internal/core/validate-config.ts

@@ -113,7 +113,10 @@ export function collectReferenceDiagnostics(config: ProjectConfig, diagnostics:
 	}
 
 	for (const [name, channel] of Object.entries(config.channels ?? {})) {
-		if (!agentNames.has(channel.agent)) {
+		if (channel.mode === "pairing") continue;
+		if (!channel.agent) {
+			diagnostics.error("config.channel.agent.required", `channel.${name}: fixed-mode channels require agent`);
+		} else if (!agentNames.has(channel.agent)) {
 			diagnostics.error("config.channel.agent.unknown", `channel.${name}: references unknown agent '${channel.agent}'`);
 		}
 		const identity = channel.identity ?? config.defaults?.identity;
@@ -205,29 +208,31 @@ export function collectProviderCapabilities(
 			}
 
 			if (providerName === "qoder") {
-				const agent = config.agents?.[channel.agent];
-				if (agent?.provider && agent.provider !== providerName) {
-					diagnostics.error(
-						"config.channel.agent.provider_mismatch",
-						`channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
-						{ type: "channel", name, provider: providerName },
-					);
-				}
-				const identityName = channel.identity ?? config.defaults?.identity;
-				const identity = identityName ? config.identities?.[identityName] : undefined;
-				if (identity?.provider && identity.provider !== providerName) {
-					diagnostics.error(
-						"config.channel.identity.provider_mismatch",
-						`channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
-						{ type: "channel", name, provider: providerName },
-					);
-				}
-				if (agent && agent.delivery?.qoder?.type !== "forward") {
-					diagnostics.error(
-						"qoder.channel.forward_template.required",
-						`channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
-						{ type: "channel", name, provider: providerName },
-					);
+				if (channel.mode !== "pairing" && channel.agent) {
+					const agent = config.agents?.[channel.agent];
+					if (agent?.provider && agent.provider !== providerName) {
+						diagnostics.error(
+							"config.channel.agent.provider_mismatch",
+							`channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
+							{ type: "channel", name, provider: providerName },
+						);
+					}
+					const identityName = channel.identity ?? config.defaults?.identity;
+					const identity = identityName ? config.identities?.[identityName] : undefined;
+					if (identity?.provider && identity.provider !== providerName) {
+						diagnostics.error(
+							"config.channel.identity.provider_mismatch",
+							`channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
+							{ type: "channel", name, provider: providerName },
+						);
+					}
+					if (agent && agent.delivery?.qoder?.type !== "forward") {
+						diagnostics.error(
+							"qoder.channel.forward_template.required",
+							`channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
+							{ type: "channel", name, provider: providerName },
+						);
+					}
 				}
 				const requiredCredentials: Record<string, string[]> = {
 					dingtalk: ["client_id", "client_secret"],
@@ -306,6 +311,13 @@ export function collectProviderCapabilities(
 					address,
 				);
 			}
+			if (delivery !== "forward" && agent.managed_tool_config) {
+				diagnostics.error(
+					`${providerName}.agent.managed_tool_config.forward_required`,
+					`agent.${name}: managed_tool_config applies to Forward Templates; set delivery.${providerName}.type: forward or remove it.`,
+					address,
+				);
+			}
 			if (delivery === "forward" && !isSupported(caps, "template")) {
 				diagnostics.error(
 					`${providerName}.agent.delivery.forward.unsupported`,
@@ -386,6 +398,13 @@ export function collectProviderCapabilities(
 						{ type: "agent", name, provider: providerName },
 					);
 				}
+				if (agent.managed_tool_config && (!agent.provider || agent.provider === providerName)) {
+					diagnostics.error(
+						`${providerName}.agent.managed_tool_config.unsupported`,
+						`agent.${name}: managed_tool_config is supported only by Qoder; remove it or pin this agent to qoder.`,
+						{ type: "agent", name, provider: providerName },
+					);
+				}
 				if (agent.tunnel && (!agent.provider || agent.provider === providerName)) {
 					diagnostics.error(
 						`${providerName}.agent.tunnel.unsupported`,

packages/sdk/src/internal/executor/resolver.ts

@@ -179,6 +179,13 @@ export function resolveChannelRefs(
 	const channel = config.channels?.[channelName];
 	if (!channel) throw new UserError(`Channel '${channelName}' not found in config`);
 
+	if (channel.mode === "pairing") {
+		return {};
+	}
+
+	if (!channel.agent) {
+		throw new UserError(`Channel '${channelName}' is fixed mode and must declare agent`);
+	}
 	const agent = config.agents?.[channel.agent];
 	if (!agent) throw new UserError(`Channel '${channelName}' references unknown agent '${channel.agent}'`);
 	const agentType = agent.delivery?.[provider]?.type === "forward" ? "template" : "agent";

packages/sdk/src/internal/graph/dependency.ts

@@ -190,6 +190,8 @@ export function buildDependencyGraph(config: ProjectConfig, targetProviders: str
 				const channelAddr: ResourceAddress = { type: "channel", name, provider };
 				addNode(channelAddr);
 
+				if (decl.mode === "pairing" || !decl.agent) continue;
+
 				const agentDecl = config.agents?.[decl.agent];
 				const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
 				const agentAddr: ResourceAddress = { type: agentType, name: decl.agent, provider };

packages/sdk/src/internal/parser/schema.ts

@@ -231,6 +231,10 @@ const agentDeliverySchema = z.object({
 	type: z.enum(["managed", "forward"]),
 });
 
+const managedToolConfigSchema = z.object({
+	enabled_tools: z.array(z.string().min(1)),
+});
+
 const sessionGithubRepoResourceSchema = z.object({
 	type: z.literal("github_repository"),
 	url: z.string().url(),
@@ -261,15 +265,17 @@ const agentSchema = z.object({
 	multiagent: multiagentSchema.optional(),
 	metadata: z.record(z.string(), z.string()).optional(),
 	environment_variables: z.record(z.string().min(1), z.string()).optional(),
+	managed_tool_config: managedToolConfigSchema.optional(),
 	delivery: z.record(z.string(), agentDeliverySchema).optional(),
 });
 
 const channelSchema = z.object({
 	provider: z.string().optional(),
-	agent: z.string().min(1),
+	agent: z.string().min(1).optional(),
 	identity: z.string().min(1).optional(),
 	type: z.string().min(1),
 	name: z.string().trim().min(1).optional(),
+	mode: z.enum(["fixed", "pairing"]).optional().default("fixed"),
 	enabled: z.boolean().optional(),
 	credentials: z.record(z.string(), coerceString).optional(),
 	options: z.record(z.string(), z.unknown()).optional(),

packages/sdk/src/internal/planner/hasher.ts

@@ -56,15 +56,18 @@ export function computeReplacementFingerprint(address: ResourceAddress, config:
 	if (address.type !== "channel") return undefined;
 	const decl = config.channels?.[address.name];
 	if (!decl) return undefined;
-	return contentHash({ channel_type: decl.type, credentials: decl.credentials ?? {} });
+	return contentHash({ channel_type: decl.type, mode: decl.mode ?? "fixed", credentials: decl.credentials ?? {} });
 }
 
 function resolveChannelReferenceIds(
-	decl: { agent: string; identity?: string },
+	decl: { agent?: string; identity?: string; mode?: "fixed" | "pairing" },
 	config: ProjectConfig,
 	provider: string,
 	state?: HashStateLookup,
 ): Record<string, string | null | undefined> {
+	if (decl.mode === "pairing" || !decl.agent) {
+		return { mode: "pairing" };
+	}
 	const agent = config.agents?.[decl.agent];
 	const agentType = agent?.delivery?.[provider]?.type === "forward" ? "template" : "agent";
 	const identity = decl.identity ?? config.defaults?.identity;

packages/sdk/src/internal/providers/interface.ts

@@ -97,8 +97,8 @@ export interface ResolvedDeploymentRefs {
 }
 
 export interface ResolvedChannelRefs {
-	identity_id: string;
-	agent_id: string;
+	identity_id?: string;
+	agent_id?: string;
 }
 
 export interface DeploymentContext {

packages/sdk/src/internal/providers/qoder/adapter.ts

@@ -353,16 +353,21 @@ export class QoderAdapter implements ProviderAdapter {
 		}
 		if (type === "channel") {
 			const channelConfig = (raw.channel_config ?? {}) as Record<string, unknown>;
-			return compactDeep({
-				identity_id: raw.identity_id,
-				template_id: raw.template_id,
+			const mode = (raw.identity_resolution as { mode?: string } | undefined)?.mode ?? "fixed";
+			const normalized: Record<string, unknown> = {
+				identity_resolution: { mode },
 				channel_type: raw.channel_type,
 				name: raw.name,
 				enabled: raw.enabled,
 				channel_config: {
 					response_options: channelConfig.response_options ?? {},
 				},
-			});
+			};
+			if (mode === "fixed") {
+				normalized.identity_id = raw.identity_id;
+				normalized.template_id = raw.template_id;
+			}
+			return compactDeep(normalized);
 		}
 
 		return compactDeep({
@@ -563,12 +568,14 @@ export class QoderAdapter implements ProviderAdapter {
 
 	async updateChannel(id: string, name: string, decl: ChannelDecl, refs: ResolvedChannelRefs): Promise<RemoteResource> {
 		const current = (await this.forwardClient.get(`/channels/${id}`)) as Record<string, unknown>;
-		if (current.channel_type !== decl.type) {
+		const currentMode = (current.identity_resolution as { mode?: string } | undefined)?.mode ?? "fixed";
+		if (current.channel_type !== decl.type || currentMode !== (decl.mode ?? "fixed")) {
 			await this.deleteChannel(id);
 			return this.createChannel(name, decl, refs);
 		}
 		const body = this.mapChannel(name, decl, refs);
 		delete body.channel_type;
+		delete body.identity_resolution;
 		const res = (await this.forwardClient.post(`/channels/${id}`, body)) as Record<string, unknown>;
 		return toRemoteResource(res);
 	}
@@ -578,9 +585,8 @@ export class QoderAdapter implements ProviderAdapter {
 	}
 
 	private mapChannel(name: string, decl: ChannelDecl, refs: ResolvedChannelRefs): Record<string, unknown> {
-		return {
-			identity_id: refs.identity_id,
-			template_id: refs.agent_id,
+		const mode = decl.mode ?? "fixed";
+		const body: Record<string, unknown> = {
 			channel_type: decl.type,
 			name: decl.name ?? name,
 			enabled: decl.enabled ?? true,
@@ -593,6 +599,13 @@ export class QoderAdapter implements ProviderAdapter {
 				},
 			},
 		};
+		if (mode === "pairing") {
+			body.identity_resolution = { mode: "pairing" };
+		} else {
+			body.identity_id = refs.identity_id;
+			body.template_id = refs.agent_id;
+		}
+		return body;
 	}
 
 	private async registerForwardVaults(vaultIds: string[]): Promise<void> {

packages/sdk/src/internal/providers/qoder/mapper.ts

@@ -493,6 +493,9 @@ export function mapForwardTemplate(
 	if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
 	else body.metadata = decl.metadata ?? {};
 	if (decl.environment_variables) body.environment_variables = decl.environment_variables;
+	// Sent on create and on update: Forward updates are merge-style, so omitting
+	// the field would silently keep whatever the Template already had.
+	if (decl.managed_tool_config) body.managed_tool_config = decl.managed_tool_config;
 
 	if (decl.tools) {
 		body.tools = [