@ai-ecoverse/slicc-agent 3.34.0 → 3.36.0

package/README.md

@@ -65,6 +65,23 @@ const agent = await openAgent({ models, model, storage, registry, env: kernelEnv
 
 A conversation without a `cwd` works in `/home`.
 
+**Kernel users.** A `KernelSource` may also have `users` (`add`, `remove`, `list`, as `kernel.users`), and its `connect` takes `{ user, agentId }` for a client bound to that user. The page builds the kernel's `connect({ user, tag })` from them, and so decides what the tag looks like. With `users`, the worker gets a second port next to the kernel's, for these calls (`kernelPorts(self)` resolves `{ kernel, admin? }`), and the `AgentHost` has `users`, a pool of one bound client per agent (`userClients`), which the agent doesn't use for conversations yet. Without `users` (or with `runAgentWorker(self, { users: false })`), nothing changes:
+
+```js
+const owner = await startAgent({
+  worker,
+  kernel: {
+    connect: (options) =>
+      options?.user
+        ? kernel.connect({ user: options.user, tag: JSON.stringify({ kind: 'agent', agentId: options.agentId }) })
+        : kernel.connect(),
+    users: kernel.users,
+  },
+});
+```
+
+At boot, the worker sets `/.slicc`, where the session database lives in OPFS, to `0700`, so that only root can read it through the kernel.
+
 ### The worker seven starts
 
 `@ai-ecoverse/slicc-agent/agent-worker` is a complete agent worker. It waits for the page kernel's port, then:
@@ -165,7 +182,7 @@ A **cone** is a top-level agent the user talks to; a **scoop** is a helper agent
 
 Each scoop is owned by a background durable task, its **anchor**, so Stop in its cone doesn't end it; `agent stop` and Drop do. They keep its transcript in durable storage and its reports in `/scoops/<handle>/reports/`, which report licks point at, and remove its working folder `/scoops/<handle>/workspace`. Each request handed to a scoop gets a **reporter** task that waits for the run, writes the answer to `/scoops/<handle>/reports/<task id>.md` and reports it to whoever asked. Requests from a cone's or a scoop's bash report into that agent's `pi.inbox` as a lick, through the licks outbox, so they steer and coalesce like any lick; requests from a terminal report nowhere, and a user typing in a scoop's chat gets the answer there. In a scoop's chat, a request someone else sent shows who sent it (`UserMessage.from`): the asking cone's or scoop's name, with `origin: 'agent'` so spectrum (≥ 1.26.0) shows it as that agent's request with an "Agent" badge, or `terminal` without an origin. Once the request is placed, the reporter appends a `slicc.from` entry (`{ from, entry }`) without model messages, and the adapter sets `from` on that entry's message. A request withdrawn before it was placed leaves no entry. The report lick's text is `[scoop <name> (<role>) <status>]`, and its body has the report's path and line count and a 1,000-character preview. A scoop's prompt has a `scoop` section with its name, its cone, its folders and its limits. The `agent` command is taught by the built-in `agent` skill (below), whose description says that roles exist and that `agent list --agents` lists them.
 
-**The `agent` command.** One bash script is installed as `agent` and `subagent` in the kernel's `$PNPM_HOME/bin` (the worker asks the kernel for `PNPM_HOME`: `/home/.local/share/pnpm` before kernel users, root's `/usr/local/share/pnpm`, whose commands every user finds, from kernel 1.47.1), so the user, a cone or a scoop runs it in any bash. It writes a request (NUL-separated fields: `slicc-agent/1`, the name it was called by, `$SLICC_AGENT`, the working directory, its pid, argc, the arguments and stdin) to `/var/lib/slicc/agent/requests/in/` and polls `out/` for the answer and exit code; the worker writes `<id>.ack` when it picks a request up, and the script gives up after 20 s without one ("the SLICC agent isn't running", exit 1). The kernel environment exports `SLICC_AGENT`, `PI_PROVIDER`, `PI_MODEL` and `PI_REASONING_LEVEL` into every agent command, so the worker knows the caller. `/var/lib/slicc/agent/scoops/<handle>/metadata.json` mirrors each scoop's state for scripts.
+**The `agent` command.** One bash script is installed as `agent` and `subagent` (and as `sprinkle`, `memory`, `gelatiere` and `freezer`) in `/usr/local/bin`, mode `0755`, which is on every user's `PATH`, so the user, a cone or a scoop runs it in any bash. Root's `$PNPM_HOME/bin` (`/usr/local/share/pnpm/bin`) is on root's `PATH` only: other users find root's installed packages in `/usr/bin`, but not loose scripts. Copies that earlier versions put in the kernel's `$PNPM_HOME/bin` are removed, so they can't shadow the new ones for root. It writes a request (NUL-separated fields: `slicc-agent/1`, the name it was called by, `$SLICC_AGENT`, the working directory, its pid, argc, the arguments and stdin) to `/var/lib/slicc/agent/requests/in/` and polls `out/` for the answer and exit code; the worker writes `<id>.ack` when it picks a request up, and the script gives up after 20 s without one ("the SLICC agent isn't running", exit 1). The kernel environment exports `SLICC_AGENT`, `PI_PROVIDER`, `PI_MODEL` and `PI_REASONING_LEVEL` into every agent command, so the worker knows the caller. `/var/lib/slicc/agent/scoops/<handle>/metadata.json` mirrors each scoop's state for scripts.
 - `agent [options] --prompt <text>` (or `--file <path>`, or `-` for stdin, or v6's `agent <cwd> <allowed-commands> <prompt>`) is **synchronous**: an ephemeral scoop runs, and the command prints its final answer and exits 0, or prints the reason on stderr and exits 1. Afterwards the scoop is stopped, its folder removed, its conversation marked dropped and its transcript archived as Markdown in `/tmp/agent-sessions/<handle>.md` (`/home/sessions/` with `--persist-session`, nowhere with `--no-persist-session`). The script traps TERM, INT and HUP and cancels the scoop, and the worker checks the script's pid in the kernel's process table every second for a SIGKILL. If the caller's run is still going when the bash call dies (a bash timeout), the scoop continues and its answer arrives as a `bash` lick; `--background-after <seconds>` does the same on purpose. Sync calls nest up to three deep. Allowed commands in v6's form are told to the scoop, not enforced.
 - `agent --async …` (= `subagent spawn …`) starts a persistent scoop and prints its handle; only cones start them. `list [--agents]`, `status`, `rename`, `send [--follow-up]`, `wait [--timeout <s>] [--notify]` (30 s by default; `--notify` returns at once and brings the answers together in one `scoop-wait` lick) and `stop` manage them. From a scoop, `agent send parent "<note>"` posts a progress note to its cone as a lick, coalesced per scoop.
 - Options: `--name`, `--agent <role>`, `--model <provider/model>`, `--thinking <level>` or `--effort low|medium|high|max`, `--tools <a,b>` (or `auto`/`full`), `--read-only <paths>`, `--system-prompt[-file]`. `--schema-b64`, `--tools output`, `--session`, `--resume`, `--image`, `--no-escalate`, `--minimal` and `--usage` answer "not supported in SLICC yet".
@@ -266,13 +283,15 @@ MCP servers reachable over Streamable HTTP become native agent tools. The client
 ```
 
 - **Fields.** `url`, `type` (`http` or `streamable-http`), `headers`, `exposure`, `toolExposure`, `enabled`, `timeout` (seconds, default 60; progress resets it) and `description`.
-- **Refused.** `command` (stdio), `type: "sse"`, `oauth`, `auth`, `!command` values, and literal secrets: a credential-like header (`Authorization`, `Cookie`, or a name with `token`, `key`, `secret`, `password` or `session`) or a URL with a password or a key in its query. The file is readable by every agent, so it holds only `${NAME}` placeholders.
+- **Refused.** `command` (stdio), `type: "sse"`, `auth`, the `oauth` fields that need a loopback or a client secret, `!command` values, and literal secrets: a credential-like header (`Authorization`, `Cookie`, or a name with `token`, `key`, `secret`, `password` or `session`) or a URL with a password or a key in its query. The file is readable by every agent, so it holds only `${NAME}` placeholders.
 - **Problems.** Each refused or broken entry is skipped and becomes one `warn` lick naming the server and the field; the other servers still connect.
 - **Reconcile.** The worker watches the file. An unchanged server keeps its session, a changed one reconnects, and a removed one is closed and loses its tools. A server added later posts a "connected" lick naming its URL.
 
 **Per agent.** Today every cone reads the one file in `/home` and gets every enabled server. A scoop doesn't read a file of its own: it inherits its cone's servers, and a role's `tools:` or `agent --tools` list narrows them. A list with no `mcp__` entry gets no MCP servers. A list with `mcp__docs__search` or `mcp__docs__*` keeps only those, and `codemode` is added so codemode tools stay reachable. The resource tools must be listed by name, and they reach only the servers the list names. A nested scoop without a list inherits its calling scoop's list. A `beforeTool` hook blocks the model's calls outside the list, and codemode scripts only get the tools on it. When kernel users give each cone its own home, each cone reads `~/.pi/agent/mcp.json` in that home, and scoops keep inheriting from their cone.
 
-**Secrets.** `${NAME}` placeholders are filled from the agent's encrypted credential store, under `mcp:<server>|<hash of the URL>`, when the worker connects. A server whose secret is missing comes up as needing one, with a lick. Pointing a server at another URL leaves it without its secret. Header values never reach SQLite, the transcript, licks or `~/.pi/agent/mcp.log`, and stored secrets are scrubbed from error texts and server log lines. **Settings › MCP servers** lists each server whose headers use a placeholder, under its own heading below Accounts, with the URL host. Connect takes the token, which fills every placeholder of a server that uses one name; a server whose headers use several different names can't be filled from Settings yet. The server then reconnects. A server that answers 401 shows as **Rejected**, with Reconnect, and Disconnect deletes the token. Tool cards and remote summaries label MCP calls `server · tool`, unless the name is ambiguous (a server name that starts or ends with `_`, or a name with more than two `__` separators); then they show the raw name.
+**Secrets.** `${NAME}` placeholders are filled from the agent's encrypted credential store, under `mcp:<server>|<hash of the URL>`, when the worker connects. A server whose secret is missing comes up as needing one, with a lick. Pointing a server at another URL leaves it without its secret. Header values never reach SQLite, the transcript, licks or `~/.pi/agent/mcp.log`, and stored secrets are scrubbed from error texts and server log lines. **OAuth.** A server without an `Authorization` header that answers 401 needs a sign-in, as in pi. Its row in Settings › MCP servers offers Connect, which opens a pop-up on the authorization server, found through the server's protected-resource metadata (RFC 9728) or `oauth.authServerMetadataUrl`. SLICC registers itself dynamically as a public client named `SLICC` (`oauth.clientName` changes it), or uses `oauth.clientId`, with PKCE S256 and the redirect URI `https://<origin>/oauth/mcp-callback`. slicc-bios serves that path from `dist/oauth/mcp-callback.html` in this package. The callback page hands the code back over the `slicc-mcp-oauth` BroadcastChannel and clears it from its address. The worker exchanges the code, checking `state` and `iss`, and keeps the tokens with the client and discovery state in the encrypted store under the server's name and URL. Tokens are refreshed when the server answers 401. When the refresh fails, the row asks for a sign-in again. Disconnect deletes the whole grant. `oauth.scope` sets the scopes, else the server's advertised ones are used. `clientSecret`, `callbackPort`, `callbackUrl` and `clientRegistration` are refused, because SLICC signs in as a public client through its own page.
+
+**Settings › MCP servers** lists each server whose headers use a placeholder, under its own heading below Accounts, with the URL host. Connect takes the token, which fills every placeholder of a server that uses one name; a server whose headers use several different names can't be filled from Settings yet. The server then reconnects. A server that answers 401 shows as **Rejected**, with Reconnect, and Disconnect deletes the token. Tool cards and remote summaries label MCP calls `server · tool`, unless the name is ambiguous (a server name that starts or ends with `_`, or a name with more than two `__` separators); then they show the raw name.
 
 **Tools.** Tools are named `mcp__<server>__<tool>` (pi's names: everything but letters, digits and `_` becomes `_`, cut to 64 characters with a hash suffix on a collision). Their exposure follows pi:
 - `codemode` (the default): callable from codemode scripts as `tools.mcp__docs__search(args)`, which resolves to the whole `CallToolResult`, but not declared to the model. The `mcp_servers` section lists these servers with their description or the first line of the server's instructions. It also says that MCP results are data from the server, not instructions.

package/dist/host.js

@@ -169,6 +169,7 @@ async function hostAgent(agent, options = {}) {
   return {
     serverId,
     agent,
+    ...options.users ? { users: options.users } : {},
     connect: (endpoint, connectOptions) => (connectOptions?.readOnly ? view : full).listener.connect(endpoint),
     async close() {
       await full.server.close();
@@ -189,6 +190,7 @@ async function hostAgent(agent, options = {}) {
       await options.scoops?.runtime.close(context);
       await options.licks?.sources.close(context);
       await agent.close();
+      await options.users?.close();
     }
   };
 }

package/dist/host.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/host.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceEndpoint,\n  RemoteServiceProvider,\n  replicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport {\n  type RoutedServerServiceHost,\n  type RoutedSessionAttachment,\n  type RoutedSessionHandle,\n  Server,\n  type ServerHost,\n  SessionNotFoundError,\n} from '@earendil-works/pi-server';\nimport type { Agent } from './agent.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport { PortListener } from './listener.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { viewControl, viewRemote, viewSettings } from './readonly.ts';\nimport { createRemote } from './remote/host.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  AgentTranscript,\n  type Command,\n} from './services.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { agentViews } from './views.ts';\nimport type { PortEndpoint } from './wire.ts';\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  connect(endpoint: PortEndpoint, options?: { readOnly?: boolean }): void;\n  close(): Promise<void>;\n}\n\nfunction endpointFor(provider: RemoteServiceProvider): RoutedSessionAttachment {\n  const endpoint = createRemoteServiceEndpoint(provider);\n  return {\n    invokeService: (call, publish, context) =>\n      endpoint.invoke(call, (id, update) => publish(id, update, context), context),\n    release: () => endpoint.dispose(),\n  };\n}\n\nfunction sessionServices(provider: RemoteServiceProvider): RoutedSessionHandle {\n  return {\n    attachClient: () => endpointFor(provider),\n    close: async () => {},\n  };\n}\n\nfunction serverServices(): RoutedServerServiceHost {\n  return {\n    attachClient(presentation) {\n      const provider = new RemoteServiceProvider([{ service: AgentSessions, mode: 'singleton' }]);\n      provider.provide(AgentSessions, {\n        attach: (sessionId, context) => presentation.attachSession(sessionId, context),\n        detach: (context) => presentation.detachSession(context),\n      });\n      const attachment = endpointFor(provider);\n      return {\n        invokeService: attachment.invokeService,\n        release(context) {\n          attachment.release(context);\n          provider.dispose();\n        },\n      };\n    },\n  };\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  signIn: async () => null,\n};\n\nasync function follow(agent: Agent, context: Context) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(attached.value);\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, value);\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, next.value);\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  const transcript = await follow(agent, context);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context);\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const provider = new RemoteServiceProvider([\n    { service: AgentControl, mode: 'singleton' },\n    { service: AgentTranscript, mode: 'singleton' },\n    { service: AgentSettings, mode: 'singleton' },\n    { service: AgentRemoteService, mode: 'singleton' },\n  ]);\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const control = createAgentControl(\n    agent.harness,\n    agent,\n    deliveries,\n    options.licks,\n    options.scoops,\n    options.skills,\n    options.sprinkles,\n    options.memory,\n    options.freezer,\n    options.changes\n  );\n  provider.provide(AgentControl, control);\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  provider.provide(AgentRemoteService, remote);\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n  };\n  provider.provide(AgentTranscript, transcriptService);\n  const settings = options.settings ?? noSettings;\n  provider.provide(AgentSettings, settings);\n  const viewer = new RemoteServiceProvider([\n    { service: AgentControl, mode: 'singleton' },\n    { service: AgentTranscript, mode: 'singleton' },\n    { service: AgentSettings, mode: 'singleton' },\n    { service: AgentRemoteService, mode: 'singleton' },\n  ]);\n  viewer.provide(AgentControl, viewControl(control));\n  viewer.provide(AgentTranscript, transcriptService);\n  viewer.provide(AgentSettings, viewSettings(settings));\n  viewer.provide(AgentRemoteService, viewRemote(remote));\n  const serve = async (id: string, services: RemoteServiceProvider) => {\n    const host: ServerHost = {\n      serverServices: serverServices(),\n      async resolveSession(sessionId) {\n        if (sessionId !== AGENT_SESSION)\n          throw new SessionNotFoundError(`unknown session ${sessionId}`);\n        return { id: sessionId };\n      },\n      openSession: async () => sessionServices(services),\n    };\n    const listener = new PortListener(id);\n    const server = await new Server(host, { serverId: id, listeners: [listener] }).start();\n    return { listener, server };\n  };\n  const full = await serve(serverId, provider);\n  const view = await serve(crypto.randomUUID(), viewer);\n  return {\n    serverId,\n    agent,\n    connect: (endpoint, connectOptions) =>\n      (connectOptions?.readOnly ? view : full).listener.connect(endpoint),\n    async close() {\n      await full.server.close();\n      await view.server.close();\n      viewer.dispose();\n      await remote.dispose();\n      provider.dispose();\n      deliveries.dispose();\n      transcript.dispose();\n      mounted.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n    },\n  };\n}\n"],
-  "mappings": "AAAA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAEnC;AAAA,EAIE;AAAA,EAEA;AAAA,OACK;AAIP,SAAS,0BAA2D;AACpE,SAAS,uBAAuB;AAEhC,SAAS,oBAAoB;AAI7B,SAAS,aAAa,YAAY,oBAAoB;AACtD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAIP,SAAS,kBAAkB;AAU3B,SAAS,YAAY,UAA0D;AAC7E,QAAM,WAAW,4BAA4B,QAAQ;AACrD,SAAO;AAAA,IACL,eAAe,CAAC,MAAM,SAAS,YAC7B,SAAS,OAAO,MAAM,CAAC,IAAI,WAAW,QAAQ,IAAI,QAAQ,OAAO,GAAG,OAAO;AAAA,IAC7E,SAAS,MAAM,SAAS,QAAQ;AAAA,EAClC;AACF;AAEA,SAAS,gBAAgB,UAAsD;AAC7E,SAAO;AAAA,IACL,cAAc,MAAM,YAAY,QAAQ;AAAA,IACxC,OAAO,YAAY;AAAA,IAAC;AAAA,EACtB;AACF;AAEA,SAAS,iBAA0C;AACjD,SAAO;AAAA,IACL,aAAa,cAAc;AACzB,YAAM,WAAW,IAAI,sBAAsB,CAAC,EAAE,SAAS,eAAe,MAAM,YAAY,CAAC,CAAC;AAC1F,eAAS,QAAQ,eAAe;AAAA,QAC9B,QAAQ,CAAC,WAAW,YAAY,aAAa,cAAc,WAAW,OAAO;AAAA,QAC7E,QAAQ,CAAC,YAAY,aAAa,cAAc,OAAO;AAAA,MACzD,CAAC;AACD,YAAM,aAAa,YAAY,QAAQ;AACvC,aAAO;AAAA,QACL,eAAe,WAAW;AAAA,QAC1B,QAAQ,SAAS;AACf,qBAAW,QAAQ,OAAO;AAC1B,mBAAS,QAAQ;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAA4B;AAAA,EAChC,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnD,SAAS,YAAY;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,YAAY,YAAY;AAAA,EAAC;AAAA,EACzB,QAAQ,YAAY;AACtB;AAEA,eAAe,OAAO,OAAc,SAAkB;AACpD,MAAI,WAAW,MAAM,MAAM,KAAK,EAAE,UAAU,OAAO;AACnD,QAAM,QAAQ,gBAAkC,SAAS,KAAK;AAC9D,QAAM,SAAS,CAAC,OAAyB,SAAkB,MAAM,QAAQ,MAAM,KAAK;AACpF,MAAI,MAAM,SAAS,UAAU,MAAM;AACnC,QAAM,OAAO,MAAM,OAAO,OAAO,iBAAiB;AAChD,UAAM,OAAO,MAAM,aAAa,UAAU,OAAO;AACjD,QAAI;AACJ,aAAS,QAAQ;AACjB,eAAW;AACX,UAAM,QAAQ,SAAS,KAAK,KAAK;AACjC,UAAM,KAAK,UAAU,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AACR,WAAK;AACL,UAAI;AACJ,eAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;AAEA,eAAsB,UACpB,OACA,UAYI,CAAC,GACe;AACpB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY,OAAO,WAAW;AACvD,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO;AAC9C,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,OAAO;AAC/C,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAC3C,QAAM,UAAU,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,MAAM,UAAU,KAAK,CAAC;AACvE,QAAM,WAAW,IAAI,sBAAsB;AAAA,IACzC,EAAE,SAAS,cAAc,MAAM,YAAY;AAAA,IAC3C,EAAE,SAAS,iBAAiB,MAAM,YAAY;AAAA,IAC9C,EAAE,SAAS,eAAe,MAAM,YAAY;AAAA,IAC5C,EAAE,SAAS,oBAAoB,MAAM,YAAY;AAAA,EACnD,CAAC;AACD,QAAM,aAAa,gBAAgB,MAAM,SAAS,OAAO,OAAO;AAChE,QAAM,UAAU;AAAA,IACd,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACA,WAAS,QAAQ,cAAc,OAAO;AACtC,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,SAAS,UAAU,QAAQ,KAAK,SAAS,KAAK;AAAA,IACrD,MAAM,aAAa,SAAS,OAAO;AACjC,UAAI,CAAC,QAAS,QAAO,MAAM,KAAK;AAChC,YAAM,QAAQ,MAAM,MAAM,OAAO,aAAa,SAAS,KAAK;AAC5D,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG;AAC3D,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,WAAS,QAAQ,oBAAoB,MAAM;AAC3C,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,UAAU,QAAQ,QAAQ,YAAY,gBAA2B,CAAC,CAAC;AAAA,IACnE,WAAW,QAAQ,WAAW,aAAa,gBAA4B,CAAC,CAAC;AAAA,IACzE,UAAU,QAAQ,QAAQ,YAAY,gBAA+B,CAAC,CAAC;AAAA,IACvE,cAAc,QAAQ,QAAQ,UAAU,gBAA+B,CAAC,CAAC;AAAA,IACzE,QAAQ,QAAQ,SAAS,UAAU,gBAA8B,CAAC,CAAC;AAAA,IACnE,SACE,QAAQ,SAAS,QAAQ,gBAA6B,EAAE,aAAa,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,EAC5F;AACA,WAAS,QAAQ,iBAAiB,iBAAiB;AACnD,QAAM,WAAW,QAAQ,YAAY;AACrC,WAAS,QAAQ,eAAe,QAAQ;AACxC,QAAM,SAAS,IAAI,sBAAsB;AAAA,IACvC,EAAE,SAAS,cAAc,MAAM,YAAY;AAAA,IAC3C,EAAE,SAAS,iBAAiB,MAAM,YAAY;AAAA,IAC9C,EAAE,SAAS,eAAe,MAAM,YAAY;AAAA,IAC5C,EAAE,SAAS,oBAAoB,MAAM,YAAY;AAAA,EACnD,CAAC;AACD,SAAO,QAAQ,cAAc,YAAY,OAAO,CAAC;AACjD,SAAO,QAAQ,iBAAiB,iBAAiB;AACjD,SAAO,QAAQ,eAAe,aAAa,QAAQ,CAAC;AACpD,SAAO,QAAQ,oBAAoB,WAAW,MAAM,CAAC;AACrD,QAAM,QAAQ,OAAO,IAAY,aAAoC;AACnE,UAAM,OAAmB;AAAA,MACvB,gBAAgB,eAAe;AAAA,MAC/B,MAAM,eAAe,WAAW;AAC9B,YAAI,cAAc;AAChB,gBAAM,IAAI,qBAAqB,mBAAmB,SAAS,EAAE;AAC/D,eAAO,EAAE,IAAI,UAAU;AAAA,MACzB;AAAA,MACA,aAAa,YAAY,gBAAgB,QAAQ;AAAA,IACnD;AACA,UAAM,WAAW,IAAI,aAAa,EAAE;AACpC,UAAM,SAAS,MAAM,IAAI,OAAO,MAAM,EAAE,UAAU,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM;AACrF,WAAO,EAAE,UAAU,OAAO;AAAA,EAC5B;AACA,QAAM,OAAO,MAAM,MAAM,UAAU,QAAQ;AAC3C,QAAM,OAAO,MAAM,MAAM,OAAO,WAAW,GAAG,MAAM;AACpD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,CAAC,UAAU,oBACjB,gBAAgB,WAAW,OAAO,MAAM,SAAS,QAAQ,QAAQ;AAAA,IACpE,MAAM,QAAQ;AACZ,YAAM,KAAK,OAAO,MAAM;AACxB,YAAM,KAAK,OAAO,MAAM;AACxB,aAAO,QAAQ;AACf,YAAM,OAAO,QAAQ;AACrB,eAAS,QAAQ;AACjB,iBAAW,QAAQ;AACnB,iBAAW,QAAQ;AACnB,cAAQ,QAAQ;AAChB,iBAAW,OAAO,QAAS,KAAI;AAC/B,cAAQ,SAAS,MAAM;AACvB,YAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,WAAW,MAAM,OAAO;AACtC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAChC,YAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO;AAC3C,YAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM;AAAA,IACpB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceEndpoint,\n  RemoteServiceProvider,\n  replicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport {\n  type RoutedServerServiceHost,\n  type RoutedSessionAttachment,\n  type RoutedSessionHandle,\n  Server,\n  type ServerHost,\n  SessionNotFoundError,\n} from '@earendil-works/pi-server';\nimport type { Agent } from './agent.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport type { UserClients } from './kernel/users.ts';\nimport { PortListener } from './listener.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { viewControl, viewRemote, viewSettings } from './readonly.ts';\nimport { createRemote } from './remote/host.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  AgentTranscript,\n  type Command,\n} from './services.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { agentViews } from './views.ts';\nimport type { PortEndpoint } from './wire.ts';\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  readonly users?: UserClients;\n  connect(endpoint: PortEndpoint, options?: { readOnly?: boolean }): void;\n  close(): Promise<void>;\n}\n\nfunction endpointFor(provider: RemoteServiceProvider): RoutedSessionAttachment {\n  const endpoint = createRemoteServiceEndpoint(provider);\n  return {\n    invokeService: (call, publish, context) =>\n      endpoint.invoke(call, (id, update) => publish(id, update, context), context),\n    release: () => endpoint.dispose(),\n  };\n}\n\nfunction sessionServices(provider: RemoteServiceProvider): RoutedSessionHandle {\n  return {\n    attachClient: () => endpointFor(provider),\n    close: async () => {},\n  };\n}\n\nfunction serverServices(): RoutedServerServiceHost {\n  return {\n    attachClient(presentation) {\n      const provider = new RemoteServiceProvider([{ service: AgentSessions, mode: 'singleton' }]);\n      provider.provide(AgentSessions, {\n        attach: (sessionId, context) => presentation.attachSession(sessionId, context),\n        detach: (context) => presentation.detachSession(context),\n      });\n      const attachment = endpointFor(provider);\n      return {\n        invokeService: attachment.invokeService,\n        release(context) {\n          attachment.release(context);\n          provider.dispose();\n        },\n      };\n    },\n  };\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  signIn: async () => null,\n};\n\nasync function follow(agent: Agent, context: Context) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(attached.value);\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, value);\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, next.value);\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n    users?: UserClients;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  const transcript = await follow(agent, context);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context);\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const provider = new RemoteServiceProvider([\n    { service: AgentControl, mode: 'singleton' },\n    { service: AgentTranscript, mode: 'singleton' },\n    { service: AgentSettings, mode: 'singleton' },\n    { service: AgentRemoteService, mode: 'singleton' },\n  ]);\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const control = createAgentControl(\n    agent.harness,\n    agent,\n    deliveries,\n    options.licks,\n    options.scoops,\n    options.skills,\n    options.sprinkles,\n    options.memory,\n    options.freezer,\n    options.changes\n  );\n  provider.provide(AgentControl, control);\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  provider.provide(AgentRemoteService, remote);\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n  };\n  provider.provide(AgentTranscript, transcriptService);\n  const settings = options.settings ?? noSettings;\n  provider.provide(AgentSettings, settings);\n  const viewer = new RemoteServiceProvider([\n    { service: AgentControl, mode: 'singleton' },\n    { service: AgentTranscript, mode: 'singleton' },\n    { service: AgentSettings, mode: 'singleton' },\n    { service: AgentRemoteService, mode: 'singleton' },\n  ]);\n  viewer.provide(AgentControl, viewControl(control));\n  viewer.provide(AgentTranscript, transcriptService);\n  viewer.provide(AgentSettings, viewSettings(settings));\n  viewer.provide(AgentRemoteService, viewRemote(remote));\n  const serve = async (id: string, services: RemoteServiceProvider) => {\n    const host: ServerHost = {\n      serverServices: serverServices(),\n      async resolveSession(sessionId) {\n        if (sessionId !== AGENT_SESSION)\n          throw new SessionNotFoundError(`unknown session ${sessionId}`);\n        return { id: sessionId };\n      },\n      openSession: async () => sessionServices(services),\n    };\n    const listener = new PortListener(id);\n    const server = await new Server(host, { serverId: id, listeners: [listener] }).start();\n    return { listener, server };\n  };\n  const full = await serve(serverId, provider);\n  const view = await serve(crypto.randomUUID(), viewer);\n  return {\n    serverId,\n    agent,\n    ...(options.users ? { users: options.users } : {}),\n    connect: (endpoint, connectOptions) =>\n      (connectOptions?.readOnly ? view : full).listener.connect(endpoint),\n    async close() {\n      await full.server.close();\n      await view.server.close();\n      viewer.dispose();\n      await remote.dispose();\n      provider.dispose();\n      deliveries.dispose();\n      transcript.dispose();\n      mounted.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n      await options.users?.close();\n    },\n  };\n}\n"],
+  "mappings": "AAAA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAEnC;AAAA,EAIE;AAAA,EAEA;AAAA,OACK;AAIP,SAAS,0BAA2D;AACpE,SAAS,uBAAuB;AAGhC,SAAS,oBAAoB;AAI7B,SAAS,aAAa,YAAY,oBAAoB;AACtD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAIP,SAAS,kBAAkB;AAW3B,SAAS,YAAY,UAA0D;AAC7E,QAAM,WAAW,4BAA4B,QAAQ;AACrD,SAAO;AAAA,IACL,eAAe,CAAC,MAAM,SAAS,YAC7B,SAAS,OAAO,MAAM,CAAC,IAAI,WAAW,QAAQ,IAAI,QAAQ,OAAO,GAAG,OAAO;AAAA,IAC7E,SAAS,MAAM,SAAS,QAAQ;AAAA,EAClC;AACF;AAEA,SAAS,gBAAgB,UAAsD;AAC7E,SAAO;AAAA,IACL,cAAc,MAAM,YAAY,QAAQ;AAAA,IACxC,OAAO,YAAY;AAAA,IAAC;AAAA,EACtB;AACF;AAEA,SAAS,iBAA0C;AACjD,SAAO;AAAA,IACL,aAAa,cAAc;AACzB,YAAM,WAAW,IAAI,sBAAsB,CAAC,EAAE,SAAS,eAAe,MAAM,YAAY,CAAC,CAAC;AAC1F,eAAS,QAAQ,eAAe;AAAA,QAC9B,QAAQ,CAAC,WAAW,YAAY,aAAa,cAAc,WAAW,OAAO;AAAA,QAC7E,QAAQ,CAAC,YAAY,aAAa,cAAc,OAAO;AAAA,MACzD,CAAC;AACD,YAAM,aAAa,YAAY,QAAQ;AACvC,aAAO;AAAA,QACL,eAAe,WAAW;AAAA,QAC1B,QAAQ,SAAS;AACf,qBAAW,QAAQ,OAAO;AAC1B,mBAAS,QAAQ;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAA4B;AAAA,EAChC,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnD,SAAS,YAAY;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,YAAY,YAAY;AAAA,EAAC;AAAA,EACzB,QAAQ,YAAY;AACtB;AAEA,eAAe,OAAO,OAAc,SAAkB;AACpD,MAAI,WAAW,MAAM,MAAM,KAAK,EAAE,UAAU,OAAO;AACnD,QAAM,QAAQ,gBAAkC,SAAS,KAAK;AAC9D,QAAM,SAAS,CAAC,OAAyB,SAAkB,MAAM,QAAQ,MAAM,KAAK;AACpF,MAAI,MAAM,SAAS,UAAU,MAAM;AACnC,QAAM,OAAO,MAAM,OAAO,OAAO,iBAAiB;AAChD,UAAM,OAAO,MAAM,aAAa,UAAU,OAAO;AACjD,QAAI;AACJ,aAAS,QAAQ;AACjB,eAAW;AACX,UAAM,QAAQ,SAAS,KAAK,KAAK;AACjC,UAAM,KAAK,UAAU,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AACR,WAAK;AACL,UAAI;AACJ,eAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;AAEA,eAAsB,UACpB,OACA,UAaI,CAAC,GACe;AACpB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY,OAAO,WAAW;AACvD,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO;AAC9C,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,OAAO;AAC/C,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAC3C,QAAM,UAAU,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,MAAM,UAAU,KAAK,CAAC;AACvE,QAAM,WAAW,IAAI,sBAAsB;AAAA,IACzC,EAAE,SAAS,cAAc,MAAM,YAAY;AAAA,IAC3C,EAAE,SAAS,iBAAiB,MAAM,YAAY;AAAA,IAC9C,EAAE,SAAS,eAAe,MAAM,YAAY;AAAA,IAC5C,EAAE,SAAS,oBAAoB,MAAM,YAAY;AAAA,EACnD,CAAC;AACD,QAAM,aAAa,gBAAgB,MAAM,SAAS,OAAO,OAAO;AAChE,QAAM,UAAU;AAAA,IACd,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACA,WAAS,QAAQ,cAAc,OAAO;AACtC,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,SAAS,UAAU,QAAQ,KAAK,SAAS,KAAK;AAAA,IACrD,MAAM,aAAa,SAAS,OAAO;AACjC,UAAI,CAAC,QAAS,QAAO,MAAM,KAAK;AAChC,YAAM,QAAQ,MAAM,MAAM,OAAO,aAAa,SAAS,KAAK;AAC5D,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG;AAC3D,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,WAAS,QAAQ,oBAAoB,MAAM;AAC3C,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,UAAU,QAAQ,QAAQ,YAAY,gBAA2B,CAAC,CAAC;AAAA,IACnE,WAAW,QAAQ,WAAW,aAAa,gBAA4B,CAAC,CAAC;AAAA,IACzE,UAAU,QAAQ,QAAQ,YAAY,gBAA+B,CAAC,CAAC;AAAA,IACvE,cAAc,QAAQ,QAAQ,UAAU,gBAA+B,CAAC,CAAC;AAAA,IACzE,QAAQ,QAAQ,SAAS,UAAU,gBAA8B,CAAC,CAAC;AAAA,IACnE,SACE,QAAQ,SAAS,QAAQ,gBAA6B,EAAE,aAAa,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,EAC5F;AACA,WAAS,QAAQ,iBAAiB,iBAAiB;AACnD,QAAM,WAAW,QAAQ,YAAY;AACrC,WAAS,QAAQ,eAAe,QAAQ;AACxC,QAAM,SAAS,IAAI,sBAAsB;AAAA,IACvC,EAAE,SAAS,cAAc,MAAM,YAAY;AAAA,IAC3C,EAAE,SAAS,iBAAiB,MAAM,YAAY;AAAA,IAC9C,EAAE,SAAS,eAAe,MAAM,YAAY;AAAA,IAC5C,EAAE,SAAS,oBAAoB,MAAM,YAAY;AAAA,EACnD,CAAC;AACD,SAAO,QAAQ,cAAc,YAAY,OAAO,CAAC;AACjD,SAAO,QAAQ,iBAAiB,iBAAiB;AACjD,SAAO,QAAQ,eAAe,aAAa,QAAQ,CAAC;AACpD,SAAO,QAAQ,oBAAoB,WAAW,MAAM,CAAC;AACrD,QAAM,QAAQ,OAAO,IAAY,aAAoC;AACnE,UAAM,OAAmB;AAAA,MACvB,gBAAgB,eAAe;AAAA,MAC/B,MAAM,eAAe,WAAW;AAC9B,YAAI,cAAc;AAChB,gBAAM,IAAI,qBAAqB,mBAAmB,SAAS,EAAE;AAC/D,eAAO,EAAE,IAAI,UAAU;AAAA,MACzB;AAAA,MACA,aAAa,YAAY,gBAAgB,QAAQ;AAAA,IACnD;AACA,UAAM,WAAW,IAAI,aAAa,EAAE;AACpC,UAAM,SAAS,MAAM,IAAI,OAAO,MAAM,EAAE,UAAU,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM;AACrF,WAAO,EAAE,UAAU,OAAO;AAAA,EAC5B;AACA,QAAM,OAAO,MAAM,MAAM,UAAU,QAAQ;AAC3C,QAAM,OAAO,MAAM,MAAM,OAAO,WAAW,GAAG,MAAM;AACpD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,SAAS,CAAC,UAAU,oBACjB,gBAAgB,WAAW,OAAO,MAAM,SAAS,QAAQ,QAAQ;AAAA,IACpE,MAAM,QAAQ;AACZ,YAAM,KAAK,OAAO,MAAM;AACxB,YAAM,KAAK,OAAO,MAAM;AACxB,aAAO,QAAQ;AACf,YAAM,OAAO,QAAQ;AACrB,eAAS,QAAQ;AACjB,iBAAW,QAAQ;AACnB,iBAAW,QAAQ;AACnB,cAAQ,QAAQ;AAChB,iBAAW,OAAO,QAAS,KAAI;AAC/B,cAAQ,SAAS,MAAM;AACvB,YAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,WAAW,MAAM,OAAO;AACtC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAChC,YAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO;AAC3C,YAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM;AAClB,YAAM,QAAQ,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/index.js

@@ -12,6 +12,11 @@ import { createAgentControl } from "./control.js";
 import { CREDENTIALS_DATABASE, EncryptedCredentialStore } from "./credentials.js";
 import { hostAgent } from "./host.js";
 import { HOME, kernelEnvironment, SliccKernelEnv } from "./kernel/env.js";
+import {
+  adminOver,
+  serveAdmin,
+  userClients
+} from "./kernel/users.js";
 import { PortListener } from "./listener.js";
 import {
   runAgentWorker
@@ -47,7 +52,11 @@ import {
 } from "./sqlite.js";
 import { systemSection } from "./system.js";
 import { PortChannel, withUnrefTimers } from "./wire.js";
-import { kernelPort, serveConnections } from "./worker.js";
+import {
+  kernelPort,
+  kernelPorts,
+  serveConnections
+} from "./worker.js";
 export {
   ADOBE,
   ADOBE_PROXY,
@@ -69,6 +78,7 @@ export {
   SliccKernelEnv,
   SliccPrompt,
   WasmSqliteDatabase,
+  adminOver,
   adobeConfig,
   adobeModel,
   adobeProvider,
@@ -82,17 +92,20 @@ export {
   hostAgent,
   kernelEnvironment,
   kernelPort,
+  kernelPorts,
   openAgent,
   openMemorySqliteStorage,
   openOpfsSqliteStorage,
   patchServerAccept,
   runAgentWorker,
+  serveAdmin,
   serveConnections,
   sliccPrompt,
   sliccProviders,
   startAgent,
   systemSection,
   transportFetch,
+  userClients,
   withDefaultRegions,
   withUnrefTimers
 };

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeConfig,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport { CREDENTIALS_DATABASE, EncryptedCredentialStore } from './credentials.ts';\nexport { type AgentHost, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport { PortListener } from './listener.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport { type Transport, type TransportResponse, transportFetch } from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { applyPatches, patchServerAccept } from './patches.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AccountState,\n  AGENT_SESSION,\n  AgentControl,\n  AgentSessions,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { PortChannel, type PortEndpoint, withUnrefTimers } from './wire.ts';\nexport { kernelPort, serveConnections, type WorkerScope } from './worker.ts';\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAwC,YAAY,iBAAiB;AACrE,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAyB,iBAAiB;AAQ1C,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E,SAAS,oBAAoB;AAC7B;AAAA,EAIE;AAAA,OACK;AACP,SAAiD,sBAAsB;AACvE;AAAA,EACE;AAAA,EAIA;AAAA,OACK;AACP,SAAS,cAAc,yBAAyB;AAChD,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,aAAgC,uBAAuB;AAChE,SAAS,YAAY,wBAA0C;",
+  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeConfig,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport { CREDENTIALS_DATABASE, EncryptedCredentialStore } from './credentials.ts';\nexport { type AgentHost, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport {\n  adminOver,\n  type KernelAdmin,\n  type KernelUser,\n  type KernelUsers,\n  serveAdmin,\n  type UserClient,\n  type UserClients,\n  type UserConnect,\n  type UserSpec,\n  userClients,\n} from './kernel/users.ts';\nexport { PortListener } from './listener.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport { type Transport, type TransportResponse, transportFetch } from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type KernelSource,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { applyPatches, patchServerAccept } from './patches.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AccountState,\n  AGENT_SESSION,\n  AgentControl,\n  AgentSessions,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { PortChannel, type PortEndpoint, withUnrefTimers } from './wire.ts';\nexport {\n  type KernelPorts,\n  kernelPort,\n  kernelPorts,\n  serveConnections,\n  type WorkerScope,\n} from './worker.ts';\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAwC,YAAY,iBAAiB;AACrE,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAyB,iBAAiB;AAQ1C,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EAIA;AAAA,EAKA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EAIE;AAAA,OACK;AACP,SAAiD,sBAAsB;AACvE;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AACP,SAAS,cAAc,yBAAyB;AAChD,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,aAAgC,uBAAuB;AAChE;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;",
   "names": []
 }

package/dist/kernel/users.js

@@ -0,0 +1,113 @@
+function failure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = error?.code;
+  return typeof code === "string" ? { message, code } : { message };
+}
+async function perform(source, call) {
+  const users = source.users;
+  if (call.op === "connect") return source.connect(call.args[0]);
+  if (!users) throw Object.assign(new Error("this kernel has no users"), { code: "ENOSYS" });
+  if (call.op === "users.add") return users.add(call.args[0]);
+  if (call.op === "users.remove")
+    return users.remove(call.args[0], call.args[1]);
+  return users.list();
+}
+function serveAdmin(port, source) {
+  port.addEventListener("message", (event) => {
+    const call = event.data;
+    perform(source, call).then(
+      (value) => {
+        const transfer = call.op === "connect" ? [value] : [];
+        port.postMessage({ id: call.id, value }, transfer);
+      },
+      (error) => port.postMessage({ id: call.id, error: failure(error) })
+    );
+  });
+  port.start?.();
+}
+function adminOver(port) {
+  const pending = /* @__PURE__ */ new Map();
+  let next = 0;
+  let shut = false;
+  port.addEventListener("message", (event) => {
+    const reply = event.data;
+    const waiting = pending.get(reply.id);
+    if (!waiting) return;
+    pending.delete(reply.id);
+    if (reply.error) waiting.reject(Object.assign(new Error(reply.error.message), reply.error));
+    else waiting.resolve(reply.value);
+  });
+  port.start?.();
+  const call = (op, ...args) => new Promise((resolve, reject) => {
+    if (shut) {
+      reject(new Error("the kernel admin closed"));
+      return;
+    }
+    const id = ++next;
+    pending.set(id, { resolve, reject });
+    port.postMessage({ id, op, args });
+  });
+  return {
+    connect: (options) => call("connect", options),
+    users: {
+      add: (spec) => call("users.add", spec),
+      remove: (name, options) => call("users.remove", name, options),
+      list: () => call("users.list")
+    },
+    close() {
+      shut = true;
+      for (const waiting of pending.values()) waiting.reject(new Error("the kernel admin closed"));
+      pending.clear();
+      port.close?.();
+    }
+  };
+}
+function userClients(admin, attach) {
+  const held = /* @__PURE__ */ new Map();
+  const forget = (agentId, entry) => {
+    if (held.get(agentId) === entry) held.delete(agentId);
+  };
+  const end = async (entry, kill) => {
+    const client = await entry.client.catch(() => void 0);
+    await client?.close?.({ kill });
+  };
+  return {
+    users: admin.users,
+    client(agentId, user) {
+      const known = held.get(agentId);
+      if (known?.user === user) return known.client;
+      if (known) void end(known, true);
+      const entry = {
+        user,
+        client: admin.connect({ user, agentId }).then(attach)
+      };
+      held.set(agentId, entry);
+      entry.client.then(
+        (client) => client.closed?.then(
+          () => forget(agentId, entry),
+          () => forget(agentId, entry)
+        ),
+        () => forget(agentId, entry)
+      );
+      return entry.client;
+    },
+    async drop(agentId) {
+      const entry = held.get(agentId);
+      if (!entry) return;
+      held.delete(agentId);
+      await end(entry, true);
+    },
+    async close() {
+      const entries = [...held.values()];
+      held.clear();
+      await Promise.all(entries.map((entry) => end(entry, false)));
+      admin.close();
+    }
+  };
+}
+export {
+  adminOver,
+  serveAdmin,
+  userClients
+};
+//# sourceMappingURL=users.js.map

package/dist/kernel/users.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/kernel/users.ts"],
+  "sourcesContent": ["import type { PortEndpoint } from '../wire.ts';\nimport type { KernelClient } from './client.ts';\n\nexport interface KernelUser {\n  name: string;\n  uid: number;\n  gid: number;\n  home: string;\n  shell: string;\n  groups: number[];\n  umask?: number;\n}\n\nexport interface UserSpec {\n  name: string;\n  home?: string;\n  groups?: string[];\n  umask?: number;\n  homeGroup?: string;\n}\n\nexport interface KernelUsers {\n  add(spec: UserSpec): Promise<KernelUser>;\n  remove(name: string, options?: { keepHome?: boolean }): Promise<boolean>;\n  list(): Promise<KernelUser[]>;\n}\n\nexport interface UserConnect {\n  user?: string;\n  agentId?: string;\n}\n\nexport interface KernelSource {\n  connect(options?: UserConnect): Promise<Transferable>;\n  users?: KernelUsers;\n}\n\nexport interface KernelAdmin {\n  connect(options: UserConnect): Promise<MessagePort>;\n  users: KernelUsers;\n  close(): void;\n}\n\ntype Op = 'connect' | 'users.add' | 'users.remove' | 'users.list';\ntype Call = { id: number; op: Op; args: unknown[] };\ntype Reply = { id: number; value?: unknown; error?: { message: string; code?: string } };\n\nfunction failure(error: unknown): { message: string; code?: string } {\n  const message = error instanceof Error ? error.message : String(error);\n  const code = (error as { code?: unknown } | null)?.code;\n  return typeof code === 'string' ? { message, code } : { message };\n}\n\nasync function perform(source: KernelSource, call: Call): Promise<unknown> {\n  const users = source.users;\n  if (call.op === 'connect') return source.connect(call.args[0] as UserConnect);\n  if (!users) throw Object.assign(new Error('this kernel has no users'), { code: 'ENOSYS' });\n  if (call.op === 'users.add') return users.add(call.args[0] as UserSpec);\n  if (call.op === 'users.remove')\n    return users.remove(call.args[0] as string, call.args[1] as { keepHome?: boolean });\n  return users.list();\n}\n\nexport function serveAdmin(port: PortEndpoint, source: KernelSource): void {\n  port.addEventListener('message', (event: MessageEvent) => {\n    const call = event.data as Call;\n    perform(source, call).then(\n      (value) => {\n        const transfer = call.op === 'connect' ? [value as Transferable] : [];\n        port.postMessage({ id: call.id, value } satisfies Reply, transfer);\n      },\n      (error: unknown) => port.postMessage({ id: call.id, error: failure(error) } satisfies Reply)\n    );\n  });\n  port.start?.();\n}\n\nexport function adminOver(port: PortEndpoint): KernelAdmin {\n  const pending = new Map<number, { resolve(value: unknown): void; reject(error: Error): void }>();\n  let next = 0;\n  let shut = false;\n  port.addEventListener('message', (event: MessageEvent) => {\n    const reply = event.data as Reply;\n    const waiting = pending.get(reply.id);\n    if (!waiting) return;\n    pending.delete(reply.id);\n    if (reply.error) waiting.reject(Object.assign(new Error(reply.error.message), reply.error));\n    else waiting.resolve(reply.value);\n  });\n  port.start?.();\n  const call = <T>(op: Op, ...args: unknown[]) =>\n    new Promise<T>((resolve, reject) => {\n      if (shut) {\n        reject(new Error('the kernel admin closed'));\n        return;\n      }\n      const id = ++next;\n      pending.set(id, { resolve: resolve as (value: unknown) => void, reject });\n      port.postMessage({ id, op, args } satisfies Call);\n    });\n  return {\n    connect: (options) => call<MessagePort>('connect', options),\n    users: {\n      add: (spec) => call<KernelUser>('users.add', spec),\n      remove: (name, options) => call<boolean>('users.remove', name, options),\n      list: () => call<KernelUser[]>('users.list'),\n    },\n    close() {\n      shut = true;\n      for (const waiting of pending.values()) waiting.reject(new Error('the kernel admin closed'));\n      pending.clear();\n      port.close?.();\n    },\n  };\n}\n\nexport type UserClient = KernelClient & {\n  close?(options?: { kill?: boolean }): unknown;\n  closed?: Promise<unknown>;\n};\n\nexport interface UserClients {\n  readonly users: KernelUsers;\n  client(agentId: string, user: string): Promise<UserClient>;\n  drop(agentId: string): Promise<void>;\n  close(): Promise<void>;\n}\n\ntype Held = { user: string; client: Promise<UserClient> };\n\nexport function userClients(\n  admin: KernelAdmin,\n  attach: (port: MessagePort) => Promise<UserClient>\n): UserClients {\n  const held = new Map<string, Held>();\n  const forget = (agentId: string, entry: Held) => {\n    if (held.get(agentId) === entry) held.delete(agentId);\n  };\n  const end = async (entry: Held, kill: boolean) => {\n    const client = await entry.client.catch(() => undefined);\n    await client?.close?.({ kill });\n  };\n  return {\n    users: admin.users,\n    client(agentId, user) {\n      const known = held.get(agentId);\n      if (known?.user === user) return known.client;\n      if (known) void end(known, true);\n      const entry: Held = {\n        user,\n        client: admin.connect({ user, agentId }).then(attach),\n      };\n      held.set(agentId, entry);\n      entry.client.then(\n        (client) =>\n          client.closed?.then(\n            () => forget(agentId, entry),\n            () => forget(agentId, entry)\n          ),\n        () => forget(agentId, entry)\n      );\n      return entry.client;\n    },\n    async drop(agentId) {\n      const entry = held.get(agentId);\n      if (!entry) return;\n      held.delete(agentId);\n      await end(entry, true);\n    },\n    async close() {\n      const entries = [...held.values()];\n      held.clear();\n      await Promise.all(entries.map((entry) => end(entry, false)));\n      admin.close();\n    },\n  };\n}\n"],
+  "mappings": "AA+CA,SAAS,QAAQ,OAAoD;AACnE,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAM,OAAQ,OAAqC;AACnD,SAAO,OAAO,SAAS,WAAW,EAAE,SAAS,KAAK,IAAI,EAAE,QAAQ;AAClE;AAEA,eAAe,QAAQ,QAAsB,MAA8B;AACzE,QAAM,QAAQ,OAAO;AACrB,MAAI,KAAK,OAAO,UAAW,QAAO,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAgB;AAC5E,MAAI,CAAC,MAAO,OAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,MAAM,SAAS,CAAC;AACzF,MAAI,KAAK,OAAO,YAAa,QAAO,MAAM,IAAI,KAAK,KAAK,CAAC,CAAa;AACtE,MAAI,KAAK,OAAO;AACd,WAAO,MAAM,OAAO,KAAK,KAAK,CAAC,GAAa,KAAK,KAAK,CAAC,CAA2B;AACpF,SAAO,MAAM,KAAK;AACpB;AAEO,SAAS,WAAW,MAAoB,QAA4B;AACzE,OAAK,iBAAiB,WAAW,CAAC,UAAwB;AACxD,UAAM,OAAO,MAAM;AACnB,YAAQ,QAAQ,IAAI,EAAE;AAAA,MACpB,CAAC,UAAU;AACT,cAAM,WAAW,KAAK,OAAO,YAAY,CAAC,KAAqB,IAAI,CAAC;AACpE,aAAK,YAAY,EAAE,IAAI,KAAK,IAAI,MAAM,GAAmB,QAAQ;AAAA,MACnE;AAAA,MACA,CAAC,UAAmB,KAAK,YAAY,EAAE,IAAI,KAAK,IAAI,OAAO,QAAQ,KAAK,EAAE,CAAiB;AAAA,IAC7F;AAAA,EACF,CAAC;AACD,OAAK,QAAQ;AACf;AAEO,SAAS,UAAU,MAAiC;AACzD,QAAM,UAAU,oBAAI,IAA2E;AAC/F,MAAI,OAAO;AACX,MAAI,OAAO;AACX,OAAK,iBAAiB,WAAW,CAAC,UAAwB;AACxD,UAAM,QAAQ,MAAM;AACpB,UAAM,UAAU,QAAQ,IAAI,MAAM,EAAE;AACpC,QAAI,CAAC,QAAS;AACd,YAAQ,OAAO,MAAM,EAAE;AACvB,QAAI,MAAM,MAAO,SAAQ,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC;AAAA,QACrF,SAAQ,QAAQ,MAAM,KAAK;AAAA,EAClC,CAAC;AACD,OAAK,QAAQ;AACb,QAAM,OAAO,CAAI,OAAW,SAC1B,IAAI,QAAW,CAAC,SAAS,WAAW;AAClC,QAAI,MAAM;AACR,aAAO,IAAI,MAAM,yBAAyB,CAAC;AAC3C;AAAA,IACF;AACA,UAAM,KAAK,EAAE;AACb,YAAQ,IAAI,IAAI,EAAE,SAA8C,OAAO,CAAC;AACxE,SAAK,YAAY,EAAE,IAAI,IAAI,KAAK,CAAgB;AAAA,EAClD,CAAC;AACH,SAAO;AAAA,IACL,SAAS,CAAC,YAAY,KAAkB,WAAW,OAAO;AAAA,IAC1D,OAAO;AAAA,MACL,KAAK,CAAC,SAAS,KAAiB,aAAa,IAAI;AAAA,MACjD,QAAQ,CAAC,MAAM,YAAY,KAAc,gBAAgB,MAAM,OAAO;AAAA,MACtE,MAAM,MAAM,KAAmB,YAAY;AAAA,IAC7C;AAAA,IACA,QAAQ;AACN,aAAO;AACP,iBAAW,WAAW,QAAQ,OAAO,EAAG,SAAQ,OAAO,IAAI,MAAM,yBAAyB,CAAC;AAC3F,cAAQ,MAAM;AACd,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AACF;AAgBO,SAAS,YACd,OACA,QACa;AACb,QAAM,OAAO,oBAAI,IAAkB;AACnC,QAAM,SAAS,CAAC,SAAiB,UAAgB;AAC/C,QAAI,KAAK,IAAI,OAAO,MAAM,MAAO,MAAK,OAAO,OAAO;AAAA,EACtD;AACA,QAAM,MAAM,OAAO,OAAa,SAAkB;AAChD,UAAM,SAAS,MAAM,MAAM,OAAO,MAAM,MAAM,MAAS;AACvD,UAAM,QAAQ,QAAQ,EAAE,KAAK,CAAC;AAAA,EAChC;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,OAAO,SAAS,MAAM;AACpB,YAAM,QAAQ,KAAK,IAAI,OAAO;AAC9B,UAAI,OAAO,SAAS,KAAM,QAAO,MAAM;AACvC,UAAI,MAAO,MAAK,IAAI,OAAO,IAAI;AAC/B,YAAM,QAAc;AAAA,QAClB;AAAA,QACA,QAAQ,MAAM,QAAQ,EAAE,MAAM,QAAQ,CAAC,EAAE,KAAK,MAAM;AAAA,MACtD;AACA,WAAK,IAAI,SAAS,KAAK;AACvB,YAAM,OAAO;AAAA,QACX,CAAC,WACC,OAAO,QAAQ;AAAA,UACb,MAAM,OAAO,SAAS,KAAK;AAAA,UAC3B,MAAM,OAAO,SAAS,KAAK;AAAA,QAC7B;AAAA,QACF,MAAM,OAAO,SAAS,KAAK;AAAA,MAC7B;AACA,aAAO,MAAM;AAAA,IACf;AAAA,IACA,MAAM,KAAK,SAAS;AAClB,YAAM,QAAQ,KAAK,IAAI,OAAO;AAC9B,UAAI,CAAC,MAAO;AACZ,WAAK,OAAO,OAAO;AACnB,YAAM,IAAI,OAAO,IAAI;AAAA,IACvB;AAAA,IACA,MAAM,QAAQ;AACZ,YAAM,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC;AACjC,WAAK,MAAM;AACX,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,CAAC;AAC3D,YAAM,MAAM;AAAA,IACd;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/main.js

@@ -22,6 +22,7 @@ import { imageReads } from "./images/index.js";
 import { createActivity } from "./kernel/activity.js";
 import { HOME, kernelEnvironment, SliccKernelEnv } from "./kernel/env.js";
 import { processGroups } from "./kernel/groups.js";
+import { adminOver, userClients } from "./kernel/users.js";
 import { setupLicks } from "./licks/index.js";
 import { setupMcp } from "./mcp/index.js";
 import { setupMemory } from "./memory/index.js";
@@ -46,7 +47,25 @@ import {
   kernelBoot,
   transportName
 } from "./system.js";
-import { kernelPort, serveConnections } from "./worker.js";
+import { kernelPorts, serveConnections } from "./worker.js";
+function usersOf(admin, wanted, attach) {
+  if (!admin) return void 0;
+  if (wanted === false) {
+    admin.close();
+    return void 0;
+  }
+  return userClients(adminOver(admin), attach);
+}
+const STORE_DIR = "/.slicc";
+async function attached(ports, options) {
+  const attach = options.attach ?? attachKernel;
+  const { kernel, admin } = await ports;
+  const client = await attach(kernel);
+  return { client, users: usersOf(admin, options.users, attach) };
+}
+function privateStore(env) {
+  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, void 0, BACKGROUND_CONTEXT);
+}
 async function codemodeTools(client, options, native, extra) {
   const settings = await client.fs.readFile(`${HOME}/.pi/agent/settings.json`).catch(() => void 0);
   if (disabledBySettings(settings === void 0 ? void 0 : new TextDecoder().decode(settings)))
@@ -59,9 +78,11 @@ async function codemodeTools(client, options, native, extra) {
     codemodeTool({ declared: CodingTools.tools, sandbox, extra })
   ];
 }
-async function start(scope, port, options) {
-  const attach = options.attach ?? attachKernel;
-  const client = await attach(await port);
+const MCP_CALLBACK = "/oauth/mcp-callback";
+async function start(scope, ports, options) {
+  const { client, users } = await attached(ports, options);
+  const home = new SliccKernelEnv(client, { cwd: HOME });
+  await privateStore(home);
   const native = scope.fetch.bind(scope);
   scope.fetch = transportFetch(client.transport, scope.location.origin, native);
   const facts = {
@@ -108,7 +129,6 @@ async function start(scope, port, options) {
     env: environment
   });
   opened = agent;
-  const home = new SliccKernelEnv(client, { cwd: HOME });
   const sources = licks.attach(agent, { env: home, home: HOME, activity });
   await sources.start(BACKGROUND_CONTEXT);
   await sources.boot(
@@ -129,7 +149,8 @@ async function start(scope, port, options) {
       version: facts.version,
       reloadMs: RELOAD_MS,
       codemode: codemode.length > 0,
-      cors: client.transport.traits?.crossOrigin === "cors"
+      cors: client.transport.traits?.crossOrigin === "cors",
+      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href
     },
     BACKGROUND_CONTEXT
   );
@@ -210,7 +231,8 @@ async function start(scope, port, options) {
     memory: memoryRuntime,
     freezer,
     changes,
-    mcp: mcpRuntime
+    mcp: mcpRuntime,
+    ...users ? { users } : {}
   });
 }
 function alive(client) {
@@ -220,13 +242,16 @@ function alive(client) {
   };
 }
 function runAgentWorker(scope, options = {}) {
-  const host = start(scope, kernelPort(scope), options);
+  const host = start(scope, kernelPorts(scope), options);
   host.catch(() => void 0);
   serveConnections(scope, host);
   return host;
 }
 export {
+  MCP_CALLBACK,
+  STORE_DIR,
   alive,
-  runAgentWorker
+  runAgentWorker,
+  usersOf
 };
 //# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/main.ts"],
-  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, openAgent } from './agent.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { EncryptedCredentialStore } from './credentials.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { settingsText, titler } from './freezer/title.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { setupLicks } from './licks/index.ts';\nimport { setupMcp } from './mcp/index.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { type Transport, transportFetch } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport {\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { kernelPort, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  credentials?: () => Promise<CredentialStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra']\n) {\n  const settings = await client.fs\n    .readFile(`${HOME}/.pi/agent/settings.json`)\n    .catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nasync function start(\n  scope: AgentWorkerScope,\n  port: Promise<MessagePort>,\n  options: AgentWorkerOptions\n): Promise<AgentHost> {\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const client = await attach(await port);\n  const native = scope.fetch.bind(scope);\n  scope.fetch = transportFetch(client.transport, scope.location.origin, native);\n  const facts = {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n  const credentials = await (options.credentials ?? (() => EncryptedCredentialStore.open()))();\n  const providers = options.providers ?? sliccProviders();\n  const models = createSliccModels(credentials, providers);\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(sliccPrompt(facts));\n  registry.install(\n    imageReads(\n      (CodingTools.tools as readonly ToolRegistration[]).find(\n        (tool) => tool.name === 'read'\n      ) as ToolRegistration\n    )\n  );\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry);\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  const activity = createActivity();\n  const groups = processGroups(client);\n  const model = options.model ?? DEFAULT_MODEL;\n  let opened: Agent | undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    identify: identity(() => opened?.agents, model),\n  });\n  const agent = await openAgent({\n    models,\n    model,\n    storage: await (options.storage ?? (() => openOpfsSqliteStorage()))(),\n    registry,\n    env: environment,\n  });\n  opened = agent;\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  const sources = licks.attach(agent, { env: home, home: HOME, activity });\n  await sources.start(BACKGROUND_CONTEXT);\n  await sources.boot(\n    { version: facts.version, boot: await kernelBoot(client) },\n    BACKGROUND_CONTEXT\n  );\n  const skillsRuntime = await skills.attach(\n    { env: home, home: HOME, assets: options.assets ?? packageAssets(), reloadMs: RELOAD_MS },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      home: HOME,\n      credentials,\n      licks: licks.licks,\n      fetch: scope.fetch,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: client.transport.traits?.crossOrigin === 'cors',\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n    },\n    BACKGROUND_CONTEXT\n  );\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      home: HOME,\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titler(models, settingsText(home, HOME)),\n  });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await createAgentSettings(models, credentials, providers, { mcp: mcpRuntime });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      home: HOME,\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      sprinkle: sprinkles.command,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsCommand({ agents: agent.agents, settings, catalog: models }),\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  const changes = attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS });\n  return hostAgent(agent, {\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes,\n    mcp: mcpRuntime,\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const host = start(scope, kernelPort(scope), options);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAqB,iBAAiB;AACtC,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,cAAc,cAAc;AACrC,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAE/B,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AACzB,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAyB,sBAAsB;AAC/C,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY,wBAA0C;AAqB/D,eAAe,cACb,QACA,SACA,QACA,OACA;AACA,QAAM,WAAW,MAAM,OAAO,GAC3B,SAAS,GAAG,IAAI,0BAA0B,EAC1C,MAAM,MAAM,MAAS;AACxB,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEA,eAAe,MACb,OACA,MACA,SACoB;AACpB,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,SAAS,MAAM,OAAO,MAAM,IAAI;AACtC,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,QAAQ,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,MAAM;AAC5E,QAAM,QAAQ;AAAA,IACZ,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACA,QAAM,cAAc,OAAO,QAAQ,gBAAgB,MAAM,yBAAyB,KAAK,IAAI;AAC3F,QAAM,YAAY,QAAQ,aAAa,eAAe;AACtD,QAAM,SAAS,kBAAkB,aAAa,SAAS;AACvD,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,WAAS;AAAA,IACP;AAAA,MACG,YAAY,MAAsC;AAAA,QACjD,CAAC,SAAS,KAAK,SAAS;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,QAAQ;AAC1E,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,QAAQ;AACjC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,QAAM,WAAW,eAAe;AAChC,QAAM,SAAS,cAAc,MAAM;AACnC,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAChD,CAAC;AACD,QAAM,QAAQ,MAAM,UAAU;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,SAAS,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAAA,IACpE;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AACD,WAAS;AACT,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,UAAU,MAAM,OAAO,OAAO,EAAE,KAAK,MAAM,MAAM,MAAM,SAAS,CAAC;AACvE,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,QAAQ;AAAA,IACZ,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AAAA,IACzD;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC,EAAE,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,UAAU,cAAc,GAAG,UAAU,UAAU;AAAA,IACxF;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,OAAO,UAAU,QAAQ,gBAAgB;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACA,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,CAAC;AAAA,EAChD,CAAC;AACD,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,oBAAoB,QAAQ,aAAa,WAAW,EAAE,KAAK,WAAW,CAAC;AAC9F,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,MAAM;AAAA,MACN,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,UAAU,UAAU;AAAA,MACpB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAAA,MACzE,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,QAAM,UAAU,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AACvF,SAAO,UAAU,OAAO;AAAA,IACtB;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,OAAO,MAAM,OAAO,WAAW,KAAK,GAAG,OAAO;AACpD,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
+  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, openAgent } from './agent.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { EncryptedCredentialStore } from './credentials.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { settingsText, titler } from './freezer/title.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { adminOver, type UserClient, type UserClients, userClients } from './kernel/users.ts';\nimport { setupLicks } from './licks/index.ts';\nimport { setupMcp } from './mcp/index.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { type Transport, transportFetch } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport {\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { type KernelPorts, kernelPorts, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  credentials?: () => Promise<CredentialStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n  users?: boolean;\n  mcpRedirect?: string;\n}\n\nexport function usersOf(\n  admin: MessagePort | undefined,\n  wanted: boolean | undefined,\n  attach: KernelAttach\n): UserClients | undefined {\n  if (!admin) return undefined;\n  if (wanted === false) {\n    admin.close();\n    return undefined;\n  }\n  return userClients(adminOver(admin), attach as (port: MessagePort) => Promise<UserClient>);\n}\n\nexport const STORE_DIR = '/.slicc';\n\nasync function attached(ports: Promise<KernelPorts>, options: AgentWorkerOptions) {\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const { kernel, admin } = await ports;\n  const client = await attach(kernel);\n  return { client, users: usersOf(admin, options.users, attach) };\n}\n\nfunction privateStore(env: SliccKernelEnv): Promise<unknown> {\n  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, undefined, BACKGROUND_CONTEXT);\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra']\n) {\n  const settings = await client.fs\n    .readFile(`${HOME}/.pi/agent/settings.json`)\n    .catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nexport const MCP_CALLBACK = '/oauth/mcp-callback';\n\nasync function start(\n  scope: AgentWorkerScope,\n  ports: Promise<KernelPorts>,\n  options: AgentWorkerOptions\n): Promise<AgentHost> {\n  const { client, users } = await attached(ports, options);\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  await privateStore(home);\n  const native = scope.fetch.bind(scope);\n  scope.fetch = transportFetch(client.transport, scope.location.origin, native);\n  const facts = {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n  const credentials = await (options.credentials ?? (() => EncryptedCredentialStore.open()))();\n  const providers = options.providers ?? sliccProviders();\n  const models = createSliccModels(credentials, providers);\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(sliccPrompt(facts));\n  registry.install(\n    imageReads(\n      (CodingTools.tools as readonly ToolRegistration[]).find(\n        (tool) => tool.name === 'read'\n      ) as ToolRegistration\n    )\n  );\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry);\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  const activity = createActivity();\n  const groups = processGroups(client);\n  const model = options.model ?? DEFAULT_MODEL;\n  let opened: Agent | undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    identify: identity(() => opened?.agents, model),\n  });\n  const agent = await openAgent({\n    models,\n    model,\n    storage: await (options.storage ?? (() => openOpfsSqliteStorage()))(),\n    registry,\n    env: environment,\n  });\n  opened = agent;\n  const sources = licks.attach(agent, { env: home, home: HOME, activity });\n  await sources.start(BACKGROUND_CONTEXT);\n  await sources.boot(\n    { version: facts.version, boot: await kernelBoot(client) },\n    BACKGROUND_CONTEXT\n  );\n  const skillsRuntime = await skills.attach(\n    { env: home, home: HOME, assets: options.assets ?? packageAssets(), reloadMs: RELOAD_MS },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      home: HOME,\n      credentials,\n      licks: licks.licks,\n      fetch: scope.fetch,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: client.transport.traits?.crossOrigin === 'cors',\n      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href,\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n    },\n    BACKGROUND_CONTEXT\n  );\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      home: HOME,\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titler(models, settingsText(home, HOME)),\n  });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await createAgentSettings(models, credentials, providers, { mcp: mcpRuntime });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      home: HOME,\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      sprinkle: sprinkles.command,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsCommand({ agents: agent.agents, settings, catalog: models }),\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  const changes = attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS });\n  return hostAgent(agent, {\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes,\n    mcp: mcpRuntime,\n    ...(users ? { users } : {}),\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const host = start(scope, kernelPorts(scope), options);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAqB,iBAAiB;AACtC,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,cAAc,cAAc;AACrC,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAE/B,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,WAA8C,mBAAmB;AAC1E,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AACzB,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAyB,sBAAsB;AAC/C,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,aAAa,wBAA0C;AAuB3E,SAAS,QACd,OACA,QACA,QACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY,UAAU,KAAK,GAAG,MAAoD;AAC3F;AAEO,MAAM,YAAY;AAEzB,eAAe,SAAS,OAA6B,SAA6B;AAChF,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM;AAChC,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,SAAO,EAAE,QAAQ,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAAE;AAChE;AAEA,SAAS,aAAa,KAAuC;AAC3D,SAAO,IAAI,KAAK,YAAY,SAAS,iBAAiB,SAAS,IAAI,QAAW,kBAAkB;AAClG;AAEA,eAAe,cACb,QACA,SACA,QACA,OACA;AACA,QAAM,WAAW,MAAM,OAAO,GAC3B,SAAS,GAAG,IAAI,0BAA0B,EAC1C,MAAM,MAAM,MAAS;AACxB,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEO,MAAM,eAAe;AAE5B,eAAe,MACb,OACA,OACA,SACoB;AACpB,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,SAAS,OAAO,OAAO;AACvD,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,aAAa,IAAI;AACvB,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,QAAQ,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,MAAM;AAC5E,QAAM,QAAQ;AAAA,IACZ,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACA,QAAM,cAAc,OAAO,QAAQ,gBAAgB,MAAM,yBAAyB,KAAK,IAAI;AAC3F,QAAM,YAAY,QAAQ,aAAa,eAAe;AACtD,QAAM,SAAS,kBAAkB,aAAa,SAAS;AACvD,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,WAAS;AAAA,IACP;AAAA,MACG,YAAY,MAAsC;AAAA,QACjD,CAAC,SAAS,KAAK,SAAS;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,QAAQ;AAC1E,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,QAAQ;AACjC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,QAAM,WAAW,eAAe;AAChC,QAAM,SAAS,cAAc,MAAM;AACnC,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAChD,CAAC;AACD,QAAM,QAAQ,MAAM,UAAU;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,SAAS,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAAA,IACpE;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AACD,WAAS;AACT,QAAM,UAAU,MAAM,OAAO,OAAO,EAAE,KAAK,MAAM,MAAM,MAAM,SAAS,CAAC;AACvE,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,QAAQ;AAAA,IACZ,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AAAA,IACzD;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC,EAAE,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,UAAU,cAAc,GAAG,UAAU,UAAU;AAAA,IACxF;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,OAAO,UAAU,QAAQ,gBAAgB;AAAA,MAC/C,UAAU,QAAQ,eAAe,IAAI,IAAI,cAAc,MAAM,SAAS,MAAM,EAAE;AAAA,IAChF;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACA,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,CAAC;AAAA,EAChD,CAAC;AACD,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,oBAAoB,QAAQ,aAAa,WAAW,EAAE,KAAK,WAAW,CAAC;AAC9F,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,MAAM;AAAA,MACN,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,UAAU,UAAU;AAAA,MACpB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAAA,MACzE,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,QAAM,UAAU,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AACvF,SAAO,UAAU,OAAO;AAAA,IACtB;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,EAC3B,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,OAAO;AACrD,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
   "names": []
 }