samagotchi 0.170.0 → 0.171.0

data/lib/samagotchi/web/participant_review.rb

@@ -5,46 +5,35 @@ require_relative "token"
 require_relative "participant_stream_filter"
 require_relative "../participant_exposure"
 require_relative "../session_metrics"
-require_relative "../review_start"
-require_relative "../guardrails/review_paths"
 require_relative "../participant_mode"
 require_relative "../verify_fresh"
 
 module Samagotchi
   module Web
-    # What a participant reads, mixed into App (P4a): their page, its data
-    # (GET /api/sessions/:id/review) and their stream, each through
-    # ParticipantView. The owner reaches the same reads as "the participant
-    # view": the page at /?as=participant, the review route, and the stream
-    # with ?as=participant, through the same filter with no participant of
-    # their own (nothing is "mine", no composer). See
-    # docs/internals/participants.md (What a participant sees).
+    # What a participant reads, mixed into App: the reads their main page's
+    # show is made of (ParticipantShow: the viewer, their usage, the
+    # messages as they may read them) and their stream, each through
+    # ParticipantView. See docs/internals/participants.md (What a
+    # participant sees).
     module ParticipantReview
-      PARTICIPANT_VIEW = "participant"
       # The stream's query keys a filtered stream passes to the Bridge: its
       # cursor and its join. Not client_id (a stream named as a TUI's would
       # count as one), not raw.
       STREAM_KEYS = %w[from_seq snapshot].freeze
-      # How much of each review subject the page gets; the rest is cut
-      # (+truncated+).
-      SUBJECT_BYTES = 256 * 1024
-      MARKDOWN_EXT = %w[.md .markdown .mdown .mkd].freeze
 
       private
 
-      # Whether this request reads as a participant: a participant's, or
-      # the owner's with ?as=participant.
+      # Whether this request reads as a participant (their show, their
+      # filtered stream).
       def participant_view?(req)
-        !principal(req).owner? || req.params["as"] == PARTICIPANT_VIEW
+        !principal(req).owner?
       end
 
-      # Who reads: the participant (their author), or the owner through the
-      # participant view (nobody's own). The session's folder places tool
-      # paths; the owner's token is never shown, nor (LAN) its loopback
-      # cookie value.
+      # Who reads: the participant (their author). The session's folder
+      # places tool paths; the owner's token is never shown, nor (LAN) its
+      # loopback cookie value.
       def participant_viewer(req, session)
-        author = principal(req).owner? ? nil : principal(req).grant.author
-        Redact::Viewer.new(author: author, cwd: session.working_directory, secrets: owner_secrets)
+        Redact::Viewer.new(author: principal(req).grant.author, cwd: session.working_directory, secrets: owner_secrets)
       end
 
       def owner_secrets
@@ -52,82 +41,6 @@ module Samagotchi
         [token, @lan && Token.loopback_cookie(token)].compact
       end
 
-      # GET /api/sessions/:id/review: the participant page's data, always
-      # filtered (the owner gets the participant view of it).
-      # @return {viewer, session, subjects, participants, messages,
-      #   current_turn, waiting_for_owner, queued: {mine, others}, last_event_id}
-      def handle_review(req, id)
-        session = @session_class.load(id, state_dir: default_state_dir)
-        features = ParticipantMode.live_features(session, default_state_dir)
-        mode = ParticipantMode.of(session, features: features).to_s
-        viewer = participant_viewer(req, session)
-        live = bridge_get_json(id, "snapshot")
-        turn_snapshot = live && live["snapshot"]
-        state = live && live["session_state_snapshot"]
-        raw = live_or_saved(turn_snapshot, "messages") { session.messages }
-        # No html here: ParticipantView drops a report and the owner's html; with_reply_html renders the redacted replies.
-        shown = messages_for_display(visible_replies(raw), parts: true, cwd: session.working_directory, markdown: false)
-        current = turn_snapshot && ParticipantView.current_turn(turn_snapshot["current_turn"], viewer)
-        automatic = automatic_turn_ids(id, session, shown, current, state)
-        waiting = !!(current&.dig("waiting_for_owner") || turn_snapshot&.dig("continue_offer") ||
-                     (turn_snapshot && !turn_snapshot["current_turn"] && turn_snapshot["pending_question"]))
-        queued = turn_snapshot && snapshot_list(turn_snapshot, "queued")
-        status = displayed_status(session, state)
-        status = Session::STATUS_IDLE if status == Session::STATUS_RUNNING && current.nil?
-        json_response(200, {
-          viewer: review_viewer(req, id, session: session, state: state, queued: queued, viewer: viewer, mode: mode),
-          session: { id: session.id, title: participant_title(session), status: status,
-                     verify_unavailable: VerifyAnchor.worker_unavailable?(features) },
-          subjects: review_subjects(session, viewer),
-          participants: participant_names(id).map { |entry| entry.slice(:id, :name, :kind) },
-          messages: with_reply_html(ParticipantView.messages(shown, viewer, automatic: automatic)),
-          current_turn: current,
-          waiting_for_owner: waiting,
-          queued: review_queue(queued || [], viewer),
-          verdicts: ParticipantView.verdicts(VerifyFresh.verdicts_of(session, Session.session_dir(id, state_dir: default_state_dir)), viewer),
-          # The verdicts a fresh check runs for now (their check_turn_id;
-          # never the child's id: a participant can't open it).
-          fresh_running: VerifyFresh.running(id, state_dir: default_state_dir).map { |row| row[:of] }.uniq,
-          last_event_id: turn_snapshot && turn_snapshot["event_id"]
-        })
-      end
-
-      # A review session's subjects as the page shows them (the Plan view):
-      # each {path, text, html (markdown only), truncated}, or {path,
-      # missing: true} for one that is gone or that ReviewPaths refuses now
-      # (it became a symlink out of the project, say): checked at every
-      # read, as a review turn's read is. The text is cut at SUBJECT_BYTES
-      # and redacted like everything else a participant gets; [] for a
-      # session that isn't a review session.
-      def review_subjects(session, viewer)
-        review = session.review or return []
-        root = ReviewStart.root_for(session.working_directory)
-        check = Guardrails::ReviewPaths.new(root: root)
-        review.subjects.map do |path|
-          # The real path is checked and read, the file with O_NOFOLLOW: a
-          # symlink swapped in for it after the check isn't followed. Only
-          # the last component: a folder swapped for a symlink in between
-          # still is, which takes write access to the project (the owner's).
-          real = File.realpath(File.expand_path(path, root))
-          next { path: path, missing: true } unless File.file?(real) && check.refusal([real]).nil?
-
-          review_subject(path, real, viewer)
-        rescue SystemCallError
-          { path: path, missing: true }
-        end
-      end
-
-      def review_subject(path, full, viewer)
-        raw = File.open(full, File::RDONLY | File::NOFOLLOW | File::BINARY) { |file| file.read(SUBJECT_BYTES + 1) }.to_s
-        text = Redact.text(raw.byteslice(0, SUBJECT_BYTES).force_encoding(Encoding::UTF_8).scrub, viewer)
-        entry = { path: path, text: text, truncated: raw.bytesize > SUBJECT_BYTES }
-        markdown = MARKDOWN_EXT.include?(File.extname(path).downcase)
-        entry[:html] = @markdown_renderer.render(text) if markdown && @markdown_renderer.available?
-        entry
-      rescue SystemCallError
-        { path: path, missing: true }
-      end
-
       # The saved messages with each model message's content as a
       # participant may read it (ParticipantView.visible_raw: no cut-off
       # thought or tool call left as text).
@@ -161,14 +74,10 @@ module Samagotchi
       def delegate_child?(session) = !session.parent_id.to_s.empty?
 
       # Who is reading: a participant (their id, name, whether they may
-      # comment: not once their cap is reached, and their +usage+ as their
-      # grant's exposure shows it), or the owner looking through the
-      # participant view (no composer, no usage: the owner has /stats).
-      # +state+ the live worker's session state (nil without one), +queued+
-      # its queue.
-      def review_viewer(req, id, session:, state:, queued:, viewer:, mode:)
-        return { kind: "owner", can_comment: false, mode: mode } if principal(req).owner?
-
+      # comment: not once their cap is reached, their grant's mode, and
+      # their +usage+ as their grant's exposure shows it). +state+ the live
+      # worker's session state (nil without one), +queued+ its queue.
+      def review_viewer(req, id, session:, state:, queued:, viewer:)
         grant = principal(req).grant
         capped = !participant_cap_refusal(grant).nil?
         # Theirs: pair only when their grant was issued to act (ParticipantMode.live_for).
@@ -231,14 +140,6 @@ module Samagotchi
         nil
       end
 
-      # The queue as a participant sees it: their own queued turns (the
-      # enqueued id, for dequeue, and the text), and how many others wait.
-      def review_queue(queued, viewer)
-        mine, others = queued.partition { |entry| entry.is_a?(Hash) && viewer.own?(entry["author"]) }
-        { mine: mine.map { |entry| Redact.deep({ "enqueued_id" => entry["enqueued_id"].to_s, "prompt" => entry["prompt"].to_s }, viewer) },
-          others: others.size }
-      end
-
       # Each reply's rendered markdown, from its filtered (redacted) text.
       def with_reply_html(messages)
         return messages unless @markdown_renderer.available?
@@ -250,33 +151,13 @@ module Samagotchi
         end
       end
 
-      # The page a participant's link opens, and the owner's participant
-      # view (/?as=participant#s=<id>): the participant page's shell; its
-      # script reads everything through the review route and the filtered
-      # stream.
-      def participant_shell(req)
-        path = File.join(@public_dir, "participant.html")
-        return error_response(500, "missing_page", "participant.html is missing") unless File.file?(path)
-
-        attrs = { "version" => Samagotchi::VERSION }
-        if principal(req).owner?
-          attrs["viewer"] = "owner"
-        else
-          grant = principal(req).grant
-          attrs.merge!("viewer" => "participant", "session" => grant.session_id, "name" => grant.name)
-        end
-        # The owner's participant view has no composer; a participant's
-        # selection quotes with the same presets as the owner's page.
-        attrs.merge!(annotate_presets_data) unless principal(req).owner?
-        # A block: a name's \& or \' is text, never a backreference.
-        html_response(200, File.read(path).sub("<body>") { "<body #{body_data(attrs)}>" })
-      end
-
       # A filtered stream's frame filter (App#stream_filter), for the
       # session +id+.
       def participant_stream_filter(req, id)
         session = @session_class.load(id, state_dir: default_state_dir)
-        ParticipantStreamFilter.new(participant_viewer(req, session))
+        grant = principal(req).grant
+        own = ->(enqueued_id) { own_turn?(grant, id, enqueued_id) }
+        ParticipantStreamFilter.new(participant_viewer(req, session), own_enqueued: own)
       end
 
       # A filtered stream's query: only its cursor and its join.

data/lib/samagotchi/web/participant_show.rb

@@ -0,0 +1,240 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "participant_view"
+require_relative "viewer"
+require_relative "../bridge/turn_accumulator"
+require_relative "../participant_mode"
+require_relative "../verify_anchor"
+require_relative "../verify_fresh"
+
+module Samagotchi
+  module Web
+    # A participant's GET /api/sessions/:id, mixed into App: the main page's
+    # session read in the owner's shape (SessionShow#owner_show's keys), made
+    # from the same reads (SessionShow#show_reads) and every part passed
+    # through ParticipantView: the messages, each finished turn's drawing
+    # event by event, the turn in progress, the replay and the queue. What a
+    # participant never gets is there empty or nil (history, commands, cards,
+    # recap, the continue offer, the question, the warnings); the only keys
+    # the owner's show lacks are +viewer+'s own and the verdicts' (+fresh_running+,
+    # +session.verify_unavailable+). The light re-reads (?tail=1, ?timing=1,
+    # ?cards=1) answer in the owner's shape too, filtered; ?brief=1 is what
+    # SessionAccess::Remote#show reads with a participant's token.
+    # See docs/internals/participants.md (What a participant sees).
+    module ParticipantShow
+      private
+
+      def participant_show_read(req, id)
+        return participant_show(id) if req.params["brief"] == "1"
+        return participant_cards_read(id) if req.params["cards"] == "1"
+        return participant_tail_read(req, id) if req.params["tail"] == "1"
+        return participant_timing_read(req, id) if req.params["timing"] == "1"
+
+        session = @session_class.load(id, state_dir: default_state_dir)
+        participant_main_show(req, show_reads(id, session))
+      end
+
+      # The owner's show's keys, a participant's values (the class comment).
+      def participant_main_show(req, reads)
+        session = reads.session
+        viewer = participant_viewer(req, session)
+        turn_snapshot = reads.turn_snapshot
+        features = ParticipantMode.live_features(session, default_state_dir)
+        timing = participant_timing(reads.id, live_metrics: reads.state && reads.state["metrics"])
+        raw = visible_replies(reads.raw_messages)
+        drawn = drawn_lines(reads.id, raw, timing: {}, entries: [], cwd: session.working_directory,
+                                           skip_turn_id: reads.current_turn_id)
+        shown = messages_for_display(raw, parts: true, cwd: session.working_directory, markdown: false, drawings: drawn)
+        current = turn_snapshot && ParticipantView.current_turn(reads.current_turn, viewer)
+        automatic = automatic_turn_ids(reads.id, session, shown, current, reads.state)
+        messages = with_reply_html(ParticipantView.messages(shown, viewer, automatic: automatic))
+        queued = snapshot_list(turn_snapshot, "queued")
+        json_response(200, {
+          session: participant_session_json(reads, features, viewer),
+          history: [],
+          messages: messages,
+          **participant_drawings_field(drawn, messages, viewer),
+          failed_turn: nil,
+          current_turn: current,
+          replay: participant_replay(turn_snapshot, timing, viewer),
+          queued: participant_queued(queued, viewer),
+          queued_commands: [],
+          recap: nil,
+          saved_recap: nil,
+          continue_offer: nil,
+          guardrail_warning: nil,
+          plugin_warning: nil,
+          init_tasks: [],
+          cards: [],
+          commands: [],
+          # The owner's chi web's own setup notes: never a participant's.
+          markdown_warning: nil,
+          markdown_tip: nil,
+          **participant_capabilities,
+          viewer: participant_main_viewer(req, reads, queued: turn_snapshot && queued, viewer: viewer),
+          pending_question: nil,
+          last_event_seq: reads.event_seq,
+          last_event_id: reads.event_id,
+          timing: timing,
+          fresh_running: VerifyFresh.running(reads.id, state_dir: default_state_dir).map { |row| row[:of] }.uniq
+        })
+      end
+
+      # The show's session: who it is (id, the participant title), its status
+      # as a participant reads it (idle when a worker says running with no
+      # turn), whether a worker runs it and what it can do (the page's
+      # delivery line, the stale-worker badge), its verdicts (filtered) and whether Verify fresh can run.
+      def participant_session_json(reads, features, viewer)
+        session = reads.session
+        status = displayed_status(session, reads.state)
+        status = Session::STATUS_IDLE if status == Session::STATUS_RUNNING && reads.turn_snapshot && reads.current_turn.nil?
+        dir = Session.session_dir(reads.id, state_dir: default_state_dir)
+        { id: session.id, title: participant_title(session), status: status,
+          bridge_up: !reads.turn_snapshot.nil?, worker_features: Array(features),
+          verdicts: ParticipantView.verdicts(VerifyFresh.verdicts_of(session, dir), viewer),
+          verify_unavailable: VerifyAnchor.worker_unavailable?(features) }
+      end
+
+      # The show's capabilities (Capabilities, what the page renders): never
+      # the editor (it opens this machine's paths), whoever's machine it is.
+      def participant_capabilities
+        { capabilities: Capabilities.for(@markdown_renderer, editor: false).to_h, editor_url: nil }
+      end
+
+      # The show's viewer: Viewer's (kind, id, name, can, client_id) with what
+      # #review_viewer says (their mode, cap,
+      # usage) and whether the session is stopped (only the owner's message
+      # starts it again).
+      def participant_main_viewer(req, reads, queued:, viewer:)
+        session = reads.session
+        review = review_viewer(req, reads.id, session: session, state: reads.state, queued: queued, viewer: viewer)
+        Viewer.for(principal(req)).to_h.merge(
+          review.slice(:participant_kind, :mode, :cap_reached, :usage),
+          session_stopped: session.status == Session::STATUS_STOPPED,
+          waiting_for_owner: participant_waiting(reads.turn_snapshot)
+        )
+      end
+
+      # What the session waits for the owner on (ParticipantView.waiting_kind),
+      # nil when it doesn't: the running turn's question or approval, a
+      # Continue offer, or a question between turns.
+      def participant_waiting(turn_snapshot)
+        return nil unless turn_snapshot.is_a?(Hash)
+
+        turn = turn_snapshot["current_turn"]
+        pending = turn.is_a?(Hash) ? turn["pending_question"] : turn_snapshot["pending_question"]
+        return ParticipantView.waiting_kind(pending) if pending
+        return ParticipantView::WAITING_CONTINUE if turn_snapshot["continue_offer"]
+
+        nil
+      end
+
+      # {turn_drawings: {turn_id => {events:, end:}}} as the owner's
+      # (SessionShow#turn_drawings_field), each event through
+      # ParticipantView.event (a dropped one is left out) and the end
+      # through ParticipantView.drawing_end. No cards. Its start's prompt is
+      # the filtered messages' (ParticipantView.drawing_start): a turn they
+      # show no person's prompt for (an automatic turn, a wake, a delegate
+      # child's task; a made drawing's start has no origin to say so)
+      # starts with none.
+      def participant_drawings_field(lines, messages, viewer)
+        stamped = messages.to_set { |item| item["drawn"] }
+        shown = lines.select { |line| stamped.include?(line.turn_id) }
+        return {} if shown.empty?
+
+        prompts = messages.each_with_object({}) do |message, by_turn|
+          next unless message["role"] == "user" && message["turn_id"] && !message["automatic"] && !message["merged"]
+
+          by_turn[message["turn_id"]] = message["content"]
+        end
+        { turn_drawings: shown.to_h do |line|
+          turn = Bridge::TurnAccumulator.from_wire(line.drawing)
+          events = participant_events(Bridge::TurnAccumulator.replay_events(turn, cards: false), viewer)
+          events = events.map { |event| ParticipantView.drawing_start(event, prompts[line.turn_id.to_s]) }
+          [line.turn_id, { events: events, end: ParticipantView.drawing_end(line.end || {}, line.turn_id) }]
+        end }
+      end
+
+      # The page's join (SessionShow#replay_events_for), each event through
+      # ParticipantView.event: another person's queued turn is a bare
+      # turn_enqueued (its entry holds their prompt).
+      def participant_replay(turn_snapshot, timing, viewer)
+        participant_events(replay_events_for(turn_snapshot, timing), viewer)
+      end
+
+      def participant_events(events, viewer)
+        Array(events).filter_map { |event| ParticipantView.event(JSON.parse(JSON.generate(event)), viewer) }
+      end
+
+      # The queue as the owner's show lists it, the viewer's own entries only
+      # (ParticipantView.queued_entry): another person's entry holds their
+      # prompt.
+      def participant_queued(queued, viewer)
+        queued.filter_map { |entry| ParticipantView.queued_entry(entry, viewer) }
+      end
+
+      # ?cards=1: a participant gets no cards.
+      def participant_cards_read(id)
+        return session_not_found(id) unless session_exists?(id)
+
+        json_response(200, { cards: [] })
+      end
+
+      # ?tail=1 as the owner's (SessionShow#handle_tail_read): the session's
+      # id and status, the turn's answer through ParticipantView (the last
+      # one, or ?turn_id='s), the timing filtered. Read from the live
+      # snapshot (the messages a participant may read are filtered as the
+      # full show's), else the file.
+      def participant_tail_read(req, id)
+        session = @session_class.load(id, state_dir: default_state_dir)
+        reads = show_reads(id, session)
+        viewer = participant_viewer(req, session)
+        turn_id = req.params["turn_id"].to_s.strip
+        raw = visible_replies(reads.raw_messages)
+        shown = messages_for_display(raw, parts: true, cwd: session.working_directory, markdown: false)
+        messages = ParticipantView.messages(shown, viewer)
+        answer = participant_answer(messages, turn_id.empty? ? nil : turn_id)
+        status = displayed_status(session, reads.state)
+        status = Session::STATUS_IDLE if status == Session::STATUS_RUNNING && reads.turn_snapshot && reads.current_turn.nil?
+        json_response(200, {
+          tail: true,
+          session: { id: id, status: status, used_memory_names: [], prompt_notes: [] },
+          messages: with_reply_html([answer].compact),
+          # The owner's chi web's own setup notes: never a participant's.
+          markdown_warning: nil,
+          markdown_tip: nil,
+          **participant_capabilities,
+          timing: participant_timing(id, live_metrics: reads.state && reads.state["metrics"])
+        })
+      end
+
+      # The answer of the turn +turn_id+ (the reply after its prompt), else
+      # the last reply with text.
+      def participant_answer(messages, turn_id)
+        if turn_id
+          start = messages.index { |message| message["role"] == "user" && message["turn_id"] == turn_id }
+          return nil unless start
+
+          turn = messages.drop(start + 1).take_while { |message| message["role"] != "user" || message["merged"] }
+          return turn.reverse.find { |message| message["role"] == "assistant" && !message["content"].strip.empty? }
+        end
+        messages.reverse.find { |message| message["role"] == "assistant" && !message["content"].strip.empty? }
+      end
+
+      # ?timing=1: the whole timing, filtered.
+      def participant_timing_read(_req, id)
+        return session_not_found(id) unless session_exists?(id)
+
+        state = bridge_get_json(id, "state")
+        json_response(200, { timing: participant_timing(id, live_metrics: state && state["session_state_snapshot"]&.fetch("metrics", nil)) })
+      end
+
+      # The show's timing (SessionShow#timing_payload) as a participant may
+      # read it (ParticipantView.timing: durations and speeds only).
+      def participant_timing(id, live_metrics:)
+        ParticipantView.timing(timing_payload(id, live_metrics: live_metrics))
+      end
+    end
+  end
+end

data/lib/samagotchi/web/participant_stream_filter.rb

@@ -46,8 +46,30 @@ module Samagotchi
       PEM_BEGIN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/
       PEM_END = /-----END [A-Z0-9 ]*PRIVATE KEY-----/
 
-      def initialize(viewer)
+      # The enqueued ids of the viewer's own turns: those whose
+      # :turn_enqueued this stream sent them as theirs, and any +known+
+      # names (chi web's record of who sent a turn, ParticipantAccess#own_turn?).
+      class OwnEnqueued
+        MAX_IDS = 1000
+
+        def initialize(known)
+          @known = known
+          @ids = []
+        end
+
+        def add(id)
+          @ids << id
+          @ids.shift while @ids.size > MAX_IDS
+        end
+
+        def include?(id) = @ids.include?(id) || (!@known.nil? && @known.call(id) == true)
+      end
+
+      # @param own_enqueued [#call, nil] (enqueued_id) -> whether the viewer
+      #   sent that turn, for one this stream didn't see queued
+      def initialize(viewer, own_enqueued: nil)
         @viewer = viewer
+        @own = OwnEnqueued.new(own_enqueued)
         @buffer = +""
         @skipping = false
         @held = +""
@@ -97,7 +119,8 @@ module Samagotchi
           end
         end
         event = parse(data.join("\n")) or return ""
-        shown = ParticipantView.event(event, @viewer) or return ""
+        shown = ParticipantView.event(event, @viewer, own_enqueued: @own) or return ""
+        @own.add(shown["enqueued_id"]) if shown["type"] == "turn_enqueued" && shown["enqueued_id"]
         id = nil unless id && EVENT_ID.match?(id)
         return chunk(event, shown, id) if shown["type"] == "generation_chunk"