@ai-ecoverse/slicc-agent 3.34.0 → 3.36.0

package/dist/types/kernel/users.d.ts

@@ -0,0 +1,53 @@
+import type { PortEndpoint } from '../wire.ts';
+import type { KernelClient } from './client.ts';
+export interface KernelUser {
+    name: string;
+    uid: number;
+    gid: number;
+    home: string;
+    shell: string;
+    groups: number[];
+    umask?: number;
+}
+export interface UserSpec {
+    name: string;
+    home?: string;
+    groups?: string[];
+    umask?: number;
+    homeGroup?: string;
+}
+export interface KernelUsers {
+    add(spec: UserSpec): Promise<KernelUser>;
+    remove(name: string, options?: {
+        keepHome?: boolean;
+    }): Promise<boolean>;
+    list(): Promise<KernelUser[]>;
+}
+export interface UserConnect {
+    user?: string;
+    agentId?: string;
+}
+export interface KernelSource {
+    connect(options?: UserConnect): Promise<Transferable>;
+    users?: KernelUsers;
+}
+export interface KernelAdmin {
+    connect(options: UserConnect): Promise<MessagePort>;
+    users: KernelUsers;
+    close(): void;
+}
+export declare function serveAdmin(port: PortEndpoint, source: KernelSource): void;
+export declare function adminOver(port: PortEndpoint): KernelAdmin;
+export type UserClient = KernelClient & {
+    close?(options?: {
+        kill?: boolean;
+    }): unknown;
+    closed?: Promise<unknown>;
+};
+export interface UserClients {
+    readonly users: KernelUsers;
+    client(agentId: string, user: string): Promise<UserClient>;
+    drop(agentId: string): Promise<void>;
+    close(): Promise<void>;
+}
+export declare function userClients(admin: KernelAdmin, attach: (port: MessagePort) => Promise<UserClient>): UserClients;

package/dist/types/main.d.ts

@@ -2,6 +2,7 @@ import type { CredentialStore, Provider } from '@earendil-works/pi-ai';
 import { type ModelRef, type Storage } from '@earendil-works/pi-durable';
 import { type AgentHost } from './host.ts';
 import type { KernelClient } from './kernel/client.ts';
+import { type UserClients } from './kernel/users.ts';
 import { type Transport } from './net.ts';
 import { type Assets } from './scoops/index.ts';
 import { type WorkerScope } from './worker.ts';
@@ -24,6 +25,11 @@ export interface AgentWorkerOptions {
     codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;
     codemodeWorker?: string | URL;
     catalog?: string;
+    users?: boolean;
+    mcpRedirect?: string;
 }
+export declare function usersOf(admin: MessagePort | undefined, wanted: boolean | undefined, attach: KernelAttach): UserClients | undefined;
+export declare const STORE_DIR = "/.slicc";
+export declare const MCP_CALLBACK = "/oauth/mcp-callback";
 export declare function alive(client: KernelClient): (pid: number) => Promise<boolean>;
 export declare function runAgentWorker(scope: AgentWorkerScope, options?: AgentWorkerOptions): Promise<AgentHost>;

package/dist/types/mcp/accounts.d.ts

@@ -0,0 +1,20 @@
+import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { McpFetch } from '@earendil-works/pi-mcp';
+import type { AccountState } from '../services.ts';
+import type { McpCatalog } from './catalog.ts';
+import type { McpServerEntry } from './config.ts';
+import type { McpServerConnection } from './connection.ts';
+import { type McpSignIn, type StoredOAuth } from './oauth.ts';
+export interface McpAccounts {
+    accounts(): Promise<AccountState[]>;
+    signIn(id: string): Promise<McpSignIn>;
+    connect(id: string, secret: string): Promise<void>;
+    disconnect(id: string): Promise<void>;
+    onChange(listener: () => void): () => void;
+}
+export interface AccountSources {
+    credentials: CredentialStore;
+    oauth: (entry: McpServerEntry) => StoredOAuth;
+    fetch: McpFetch;
+}
+export declare function mcpAccounts(catalog: McpCatalog, sources: AccountSources, restart: (connection: McpServerConnection) => void, listeners: Set<() => void>): McpAccounts;

package/dist/types/mcp/config.d.ts

@@ -7,6 +7,13 @@ export interface McpServerConfig {
     enabled?: boolean;
     timeout?: number;
     description?: string;
+    oauth?: McpOAuthConfig;
+}
+export interface McpOAuthConfig {
+    clientId?: string;
+    clientName?: string;
+    scope?: string;
+    authServerMetadataUrl?: string;
 }
 export interface McpServerEntry {
     name: string;
@@ -25,6 +32,7 @@ export declare const DEFAULT_TIMEOUT_SECONDS = 60;
 export declare function placeholders(value: string): string[];
 export declare function literalSecret(header: string, value: string): boolean;
 type Checked = McpServerConfig | McpConfigProblem;
+export declare function usesOAuth(config: McpServerConfig): boolean;
 export declare function validateServer(name: string, raw: unknown): Checked;
 export declare function parseMcpConfig(text: string | undefined): McpConfig;
 export declare function nameMatcher(entries: readonly string[]): (name: string) => boolean;

package/dist/types/mcp/connection.d.ts

@@ -9,6 +9,7 @@ export type TransportFactory = (entry: McpServerEntry) => Promise<{
 }>;
 export declare const CONNECT_RETRY_DELAYS_MS: number[];
 export declare const CLIENT_NAME = "slicc";
+export declare function signInNeeded(error: unknown): boolean;
 export declare function errorMessage(error: unknown): string;
 export declare function isTransient(error: unknown): boolean;
 export declare function isMcpApp(item: {

package/dist/types/mcp/oauth.d.ts

@@ -0,0 +1,57 @@
+import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { AuthProvider, McpFetch } from '@earendil-works/pi-mcp';
+import { authorizeMcp, McpOAuthAuthorizationRequiredError, type McpOAuthState } from '@earendil-works/pi-mcp/oauth';
+import type { McpSignIn } from '../services.ts';
+import type { McpServerConfig } from './config.ts';
+type Provider = Parameters<typeof authorizeMcp>[0];
+type Tokens = Awaited<ReturnType<Provider['tokens']>>;
+type Client = Awaited<ReturnType<Provider['clientInformation']>>;
+type Discovery = NonNullable<McpOAuthState['discovery']>;
+export declare const CLIENT_NAME = "SLICC";
+export declare function secureUrl(url: URL): boolean;
+export declare function signInRequired(cause?: unknown): McpOAuthAuthorizationRequiredError;
+export declare function authProvider(provider: StoredOAuth, server: OAuthServer): AuthProvider;
+export declare function pkce(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+export declare function randomState(): string;
+export interface OAuthServer {
+    name: string;
+    config: McpServerConfig;
+}
+export declare class StoredOAuth implements Provider {
+    #private;
+    readonly redirectUrl: string;
+    readonly clientMetadata: Provider['clientMetadata'];
+    constructor(server: OAuthServer, credentials: CredentialStore, redirectUrl: string);
+    get serverUrl(): string;
+    load(): Promise<McpOAuthState>;
+    update(change: (state: McpOAuthState) => McpOAuthState): Promise<void>;
+    signedIn(): Promise<boolean>;
+    state(): string;
+    clientInformation(): Promise<Client>;
+    saveClientInformation(information: NonNullable<Client>): Promise<void>;
+    tokens(): Promise<Tokens>;
+    saveTokens(tokens: NonNullable<Tokens>): Promise<void>;
+    redirectToAuthorization(): void;
+    saveCodeVerifier(verifier: string): Promise<void>;
+    codeVerifier(): Promise<string>;
+    invalidateCredentials(kind: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): Promise<void>;
+    saveDiscoveryState(discovery: Discovery): Promise<void>;
+    discoveryState(): Promise<Discovery | undefined>;
+    forget(): Promise<void>;
+}
+export type { McpSignIn } from '../services.ts';
+export declare function beginSignIn(provider: StoredOAuth, server: OAuthServer, options: {
+    fetch: McpFetch;
+    resourceMetadataUrl?: URL;
+}): Promise<McpSignIn>;
+export interface Callback {
+    code?: string;
+    state?: string;
+    iss?: string;
+    error?: string;
+    error_description?: string;
+}
+export declare function finishSignIn(provider: StoredOAuth, server: OAuthServer, answer: string, fetch: McpFetch): Promise<void>;

package/dist/types/mcp/runtime.d.ts

@@ -3,7 +3,7 @@ import type { CredentialStore } from '@earendil-works/pi-ai';
 import type { Registry } from '@earendil-works/pi-durable';
 import type { ExecutionEnv } from '@earendil-works/pi-durable/env';
 import type { LickEvent, Licks } from '../licks/licks.ts';
-import type { AccountState } from '../services.ts';
+import { type McpAccounts } from './accounts.ts';
 import { McpCatalog } from './catalog.ts';
 import { type McpConfigProblem } from './config.ts';
 import { McpServerConnection } from './connection.ts';
@@ -20,6 +20,7 @@ export interface McpAttach {
     reloadMs: number;
     codemode: boolean;
     cors: boolean;
+    redirect: string;
 }
 export interface ServerStatus {
     name: string;
@@ -27,12 +28,7 @@ export interface ServerStatus {
     tools: number;
     error?: string;
 }
-export interface McpAccounts {
-    accounts(): Promise<AccountState[]>;
-    connect(id: string, secret: string): Promise<void>;
-    disconnect(id: string): Promise<void>;
-    onChange(listener: () => void): () => void;
-}
+export type { McpAccounts } from './accounts.ts';
 export interface McpRuntime extends McpAccounts {
     status(): ServerStatus[];
     reload(context: Context): Promise<void>;
@@ -42,7 +38,6 @@ export declare function problemLick(problem: McpConfigProblem, home: string): Li
 export declare function stateLick(connection: McpServerConnection, cors: boolean): LickEvent | undefined;
 export declare function connectedLick(connection: McpServerConnection): LickEvent;
 export declare function logLine(server: string, params: unknown, secrets: readonly string[], at: Date): string;
-export declare function mcpAccounts(catalog: McpCatalog, credentials: CredentialStore, restart: (connection: McpServerConnection) => void, listeners: Set<() => void>): McpAccounts;
 export declare function attachMcp(catalog: McpCatalog, options: McpAttach, context: Context): Promise<McpRuntime>;
 export declare function startMcp(registry: Registry, options: McpAttach, context: Context): Promise<{
     catalog: McpCatalog;

package/dist/types/owner.d.ts

@@ -1,4 +1,5 @@
 import { type AgentConnection } from './client.ts';
+import { type KernelSource } from './kernel/users.ts';
 import type { PortEndpoint } from './wire.ts';
 export declare const AGENT_LOCK = "slicc-agent";
 export interface AgentWorker {
@@ -14,9 +15,7 @@ export interface AgentOwner {
     restart(): Promise<void>;
     release(): Promise<void>;
 }
-export interface KernelSource {
-    connect(): Promise<Transferable>;
-}
+export type { KernelSource } from './kernel/users.ts';
 export interface OwnerOptions {
     worker: () => AgentWorker;
     kernel?: KernelSource;

package/dist/types/scoops/index.d.ts

@@ -10,6 +10,7 @@ import { type ControlPlane } from './requests.ts';
 import { type Scoops } from './service.ts';
 export declare const BUILTIN_ROLES: string[];
 export declare const PNPM_HOME = "/home/.local/share/pnpm";
+export declare const BIN_DIR = "/usr/local/bin";
 export type Assets = (path: string) => Promise<string>;
 export declare function packageAssets(base?: URL): Assets;
 export interface AttachOptions {
@@ -19,7 +20,7 @@ export interface AttachOptions {
     env: ExecutionEnv;
     home: string;
     assets?: Assets;
-    pnpmHome?: string;
+    binDir?: string;
     controlDir?: string;
     sweepEvery?: number;
     alive?: (pid: number) => Promise<boolean>;
@@ -42,5 +43,7 @@ export interface ScoopsSetup {
 }
 export declare const COMMANDS: string[];
 export declare function pnpmHomeOf(env: ExecutionEnv, context: Context): Promise<string>;
+export declare function installCommands(env: ExecutionEnv, script: string, binDir: string, context: Context): Promise<boolean>;
+export declare function retire(env: ExecutionEnv, binDir: string, context: Context): Promise<void>;
 export declare function setupScoops(registry: Registry, licks: Licks, fileTools?: readonly ToolRegistration[]): ScoopsSetup;
 export type { Rewound, Scoops } from './service.ts';

package/dist/types/services.d.ts

@@ -194,6 +194,10 @@ export interface SignIn {
     scopes: string;
     imsEnvironment: string;
 }
+export interface McpSignIn {
+    url: string;
+    state: string;
+}
 export interface SettingsState {
     models: ModelChoice[];
     accounts: AccountState[];
@@ -203,6 +207,6 @@ export interface AgentSettings {
     readonly state: ReplicatedState<SettingsState>;
     connect(providerId: string, secret: string, region: string | null, context: Context): Promise<void>;
     disconnect(providerId: string, context: Context): Promise<void>;
-    signIn(providerId: string, context: Context): Promise<SignIn | null>;
+    signIn(providerId: string, context: Context): Promise<SignIn | McpSignIn | null>;
 }
 export declare const AgentSettings: import("@earendil-works/chord").Service<AgentSettings>;

package/dist/types/settings.d.ts

@@ -12,6 +12,7 @@ export declare const DEFAULT_REGIONS: Readonly<Record<string, string>>;
 export declare function sliccProviders(): Provider[];
 export declare function withDefaultRegions(credentials: CredentialStore): CredentialStore;
 export declare function createSliccModels(credentials: CredentialStore, providers?: Provider<import("@earendil-works/pi-ai").Api>[]): MutableModels;
+export declare function shown<T>(run: () => Promise<T>): Promise<T>;
 export type UsageReader = (token: string) => Promise<Budget | null>;
 export declare function createAgentSettings(models: MutableModels, credentials: CredentialStore, providers?: Provider<import("@earendil-works/pi-ai").Api>[], options?: {
     usage?: UsageReader;

package/dist/types/spectrum/mcp-login.d.ts

@@ -0,0 +1,26 @@
+import type { McpSignIn, SignIn } from '../services.ts';
+export declare const MCP_CHANNEL = "slicc-mcp-oauth";
+export declare const MCP_NAME_KEY = "slicc-mcp-oauth:";
+export declare const SIGN_IN_TIMEOUT_MS: number;
+export interface Popup {
+    location: {
+        href: string;
+    };
+    close(): void;
+}
+export interface Channel {
+    onmessage: ((event: {
+        data: unknown;
+    }) => void) | null;
+    close(): void;
+}
+export interface McpLoginHost {
+    open(): Popup | null;
+    channel(): Channel;
+    remember?(state: string, name: string | null): void;
+    timeoutMs?: number;
+}
+export declare function safeAuthorizationUrl(value: string): boolean;
+export declare function mcpLogin(host?: McpLoginHost): (providerId: string, signIn: () => Promise<SignIn | McpSignIn | null>, options: {
+    signal: AbortSignal;
+}) => Promise<string>;

package/dist/types/spectrum/settings-port.d.ts

@@ -8,7 +8,7 @@ export type Login = (providerId: string, signIn: () => Promise<SignIn | null>, o
 }) => Promise<string>;
 export declare class SettingsAdapter extends Emitter<SettingsEvents> implements SettingsPort {
     #private;
-    constructor(settings: AgentSettings, agent: AgentAdapter, storage: Pick<Storage, 'getItem' | 'setItem'> | null, login?: Login | null);
+    constructor(settings: AgentSettings, agent: AgentAdapter, storage: Pick<Storage, 'getItem' | 'setItem'> | null, login?: Login | null, mcp?: Login);
     get(): Settings;
     update(patch: Partial<Settings>): void;
     models(): readonly ModelOption[];

package/dist/types/worker.d.ts

@@ -3,4 +3,9 @@ export interface WorkerScope {
     addEventListener(type: 'message', listener: (event: MessageEvent) => void): void;
 }
 export declare function serveConnections(scope: WorkerScope, host: Promise<AgentHost>): void;
+export interface KernelPorts {
+    kernel: MessagePort;
+    admin?: MessagePort;
+}
+export declare function kernelPorts(scope: WorkerScope): Promise<KernelPorts>;
 export declare function kernelPort(scope: WorkerScope): Promise<MessagePort>;

package/dist/worker.js

@@ -9,16 +9,22 @@ function serveConnections(scope, host) {
     );
   });
 }
-function kernelPort(scope) {
+function kernelPorts(scope) {
   return new Promise((resolve) => {
     scope.addEventListener("message", ({ data }) => {
-      const port = data?.kernel;
-      if (port) resolve(port);
+      const message = data;
+      const kernel = message?.kernel;
+      if (!kernel) return;
+      resolve(message.admin ? { kernel, admin: message.admin } : { kernel });
     });
   });
 }
+function kernelPort(scope) {
+  return kernelPorts(scope).then((ports) => ports.kernel);
+}
 export {
   kernelPort,
+  kernelPorts,
   serveConnections
 };
 //# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/worker.ts"],
-  "sourcesContent": ["import type { AgentHost } from './host.ts';\nimport type { PortEndpoint } from './wire.ts';\n\nexport interface WorkerScope {\n  addEventListener(type: 'message', listener: (event: MessageEvent) => void): void;\n}\n\nexport function serveConnections(scope: WorkerScope, host: Promise<AgentHost>): void {\n  scope.addEventListener('message', ({ data }) => {\n    const message = data as { connect?: PortEndpoint; readOnly?: boolean } | null;\n    const port = message?.connect;\n    if (!port) return;\n    host.then(\n      (ready) => ready.connect(port, { readOnly: message?.readOnly === true }),\n      () => port.close?.()\n    );\n  });\n}\n\nexport function kernelPort(scope: WorkerScope): Promise<MessagePort> {\n  return new Promise((resolve) => {\n    scope.addEventListener('message', ({ data }) => {\n      const port = (data as { kernel?: MessagePort } | null)?.kernel;\n      if (port) resolve(port);\n    });\n  });\n}\n"],
-  "mappings": "AAOO,SAAS,iBAAiB,OAAoB,MAAgC;AACnF,QAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,UAAM,UAAU;AAChB,UAAM,OAAO,SAAS;AACtB,QAAI,CAAC,KAAM;AACX,SAAK;AAAA,MACH,CAAC,UAAU,MAAM,QAAQ,MAAM,EAAE,UAAU,SAAS,aAAa,KAAK,CAAC;AAAA,MACvE,MAAM,KAAK,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,WAAW,OAA0C;AACnE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,YAAM,OAAQ,MAA0C;AACxD,UAAI,KAAM,SAAQ,IAAI;AAAA,IACxB,CAAC;AAAA,EACH,CAAC;AACH;",
+  "sourcesContent": ["import type { AgentHost } from './host.ts';\nimport type { PortEndpoint } from './wire.ts';\n\nexport interface WorkerScope {\n  addEventListener(type: 'message', listener: (event: MessageEvent) => void): void;\n}\n\nexport function serveConnections(scope: WorkerScope, host: Promise<AgentHost>): void {\n  scope.addEventListener('message', ({ data }) => {\n    const message = data as { connect?: PortEndpoint; readOnly?: boolean } | null;\n    const port = message?.connect;\n    if (!port) return;\n    host.then(\n      (ready) => ready.connect(port, { readOnly: message?.readOnly === true }),\n      () => port.close?.()\n    );\n  });\n}\n\nexport interface KernelPorts {\n  kernel: MessagePort;\n  admin?: MessagePort;\n}\n\nexport function kernelPorts(scope: WorkerScope): Promise<KernelPorts> {\n  return new Promise((resolve) => {\n    scope.addEventListener('message', ({ data }) => {\n      const message = data as { kernel?: MessagePort; admin?: MessagePort } | null;\n      const kernel = message?.kernel;\n      if (!kernel) return;\n      resolve(message.admin ? { kernel, admin: message.admin } : { kernel });\n    });\n  });\n}\n\nexport function kernelPort(scope: WorkerScope): Promise<MessagePort> {\n  return kernelPorts(scope).then((ports) => ports.kernel);\n}\n"],
+  "mappings": "AAOO,SAAS,iBAAiB,OAAoB,MAAgC;AACnF,QAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,UAAM,UAAU;AAChB,UAAM,OAAO,SAAS;AACtB,QAAI,CAAC,KAAM;AACX,SAAK;AAAA,MACH,CAAC,UAAU,MAAM,QAAQ,MAAM,EAAE,UAAU,SAAS,aAAa,KAAK,CAAC;AAAA,MACvE,MAAM,KAAK,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAOO,SAAS,YAAY,OAA0C;AACpE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,YAAM,UAAU;AAChB,YAAM,SAAS,SAAS;AACxB,UAAI,CAAC,OAAQ;AACb,cAAQ,QAAQ,QAAQ,EAAE,QAAQ,OAAO,QAAQ,MAAM,IAAI,EAAE,OAAO,CAAC;AAAA,IACvE,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,WAAW,OAA0C;AACnE,SAAO,YAAY,KAAK,EAAE,KAAK,CAAC,UAAU,MAAM,MAAM;AACxD;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "3.34.0",
+  "version": "3.36.0",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",