@ai-ecoverse/slicc-agent 3.41.0 → 3.42.1

package/README.md

@@ -31,7 +31,7 @@ await agent.prompt('What is in /home?');
 - `hostAgent(agent)` serves the agent with pi's protocol: a pi-server with one session, `agent`, whose Chord services are `slicc.agent.control` (send with `whenBusy` `steer`, `followUp` or `reject`, wait, withdraw, abort, compact) and `slicc.agent.transcript` (the conversation's durable view as replicated state, plus `deliveries`: how each user entry was delivered, `run`, `steer` or `follow-up`, derived by the host from where each send it accepted was placed: after a tool result it steered, queued first it's a follow-up or a late steer per its `whenBusy`, placed at once it started a run). `serveConnections(self, host)` hands it every `MessagePort` the page sends.
 - `@ai-ecoverse/slicc-agent/page` has what the page needs (`startAgent`, `connectAgent`) without the agent's runtime: no pi-durable, pi-ai, providers or SQLite, which load only in the worker. `@ai-ecoverse/slicc-agent/spectrum` is just as light, and a test keeps both that way.
 - `startAgent({ worker })` takes the Web Lock `slicc-agent`, so one tab at a time owns the agent worker, and waits while another tab holds it. `connect()` returns an `AgentConnection` (`control`, `transcript`, `prompt()`, and `webhook(name, { id?, headers?, body })`, which hands a webhook delivery, such as one from the tray hub, to the licks without a chord `Context`), `restart()` replaces the worker (durable resumes from SQLite), and `release()` stops it and lets the next tab take over. `port()` returns a raw `MessagePort` into the worker instead, for another tab: hand it over (through a SharedWorker, say), and that tab calls `connectAgent(port)`. A caller that already holds the lock passes `held: true`. A connection's `closed` resolves when its port ends (with the error, if any), and from then on its states keep their last values.
-- **Followers over a link** (PR 18): `port({ readOnly: true })` and `connect({ readOnly: true })` give a view-only connection.
+- **Followers over a link** (PR 18): `port({ readOnly: true })` and `connect({ readOnly: true })` give a view-only connection, and `port({ pages: false })` a full one that never takes `panel` requests (see Panels).
   - **What a view-only connection can do:** it sees the transcript, the agents, settings state and remote-control `watch`, and may call `wait` and `changesOpen`.
   - **What it can't:** every other `AgentControl` method, settings action and remote-control `prompt` or `abort` is refused with `EACCES` ("this follower can watch, but not send, steer or abort"). Send and compact answer `accepted: false` with that code. The worker serves view-only ports from a second pi-server whose session gets these narrowed services.
   - **Carrying the connection over a byte stream:** `linkEndpoint({ write, close })` is a `PortEndpoint` that `connectAgent` accepts. Feed it the stream's bytes with `receive(bytes)` and its end with `end(error?)`. On the owner's side, `bridgePort(port, { write, close })` does the same for the `MessagePort` from `port()`.
@@ -128,7 +128,7 @@ const agent = await owner.connect();
 app.model = { ...createKernelModel({ kernel, root }), ...createAgentModel(agent, { storage: localStorage }) };
 ```
 
-`createAgentModel()` returns the `agent`, `settings`, `tray`, `sprinkles`, `memory`, `changes` and `monitor` ports. Settings keeps the UI preferences in `storage`; model and thinking belong to the conversation, and accounts and models come from the worker.
+`createAgentModel()` returns the `agent`, `settings`, `tray`, `sprinkles`, `memory`, `changes` and `monitor` ports, and `page`, the tab's end of the `panel` bridge, when it's given `page: { tab, run }` (see Panels). Settings keeps the UI preferences in `storage`; model and thinking belong to the conversation, and accounts and models come from the worker.
 
 The adapter keeps the replicated transcript and maps it on every update. User, assistant and compaction entries become messages; tool results fill in the tool calls they answer; the generation in flight shows as a streaming message; retries and running compactions show as system messages. A failed generation ends in an error card whose action fits the error: credential errors (an invalid or missing key, 401/403, not authorized) open settings, a model the account can't use offers the model picker, and anything else offers Retry. A content-filter stop is different: every later request resends the content that tripped the filter, so Retry, and any new message, would be stopped again. Content-filter stops are Bedrock's `content_filtered` and `guardrail_intervened`, Anthropic's `sensitive` and refusals, and OpenAI's `content_filter`. Their card leads with "The model's content filter stopped this reply." and offers **Drop the last turn** (spectrum ≥ 1.12.0). `AgentControl.rewind(messageId)` finds the user turn before that message and forks the cone's conversation at the entry before it (`Conversation.fork`, so `pi.agent` comes back as it was there). It points the cone at the fork and returns the turn's prompt, which spectrum puts back into the composer. Forking the very first turn creates a fresh conversation with the same model and thinking level. The filtered branch stays in storage, off the active path. The fork starts with a `slicc.rewound` entry that shows as a "Rewound 1 turn" notice, and clicking the card of an earlier filtered turn rewinds that turn.
 
@@ -186,7 +186,7 @@ A **cone** is a top-level agent the user talks to; a **scoop** is a helper agent
 
 Each scoop is owned by a background durable task, its **anchor**, so Stop in its cone doesn't end it; `agent stop` and Drop do. They keep its transcript in durable storage and its reports in `/scoops/<handle>/reports/`, which report licks point at, and remove its working folder `/scoops/<handle>/workspace`. Each request handed to a scoop gets a **reporter** task that waits for the run, writes the answer to `/scoops/<handle>/reports/<task id>.md` and reports it to whoever asked. Requests from a cone's or a scoop's bash report into that agent's `pi.inbox` as a lick, through the licks outbox, so they steer and coalesce like any lick; requests from a terminal report nowhere, and a user typing in a scoop's chat gets the answer there. In a scoop's chat, a request someone else sent shows who sent it (`UserMessage.from`): the asking cone's or scoop's name, with `origin: 'agent'` so spectrum (≥ 1.26.0) shows it as that agent's request with an "Agent" badge, or `terminal` without an origin. Once the request is placed, the reporter appends a `slicc.from` entry (`{ from, entry }`) without model messages, and the adapter sets `from` on that entry's message. A request withdrawn before it was placed leaves no entry. The report lick's text is `[scoop <name> (<role>) <status>]`, and its body has the report's path and line count and a 1,000-character preview. A scoop's prompt has a `scoop` section with its name, its cone, its folders and its limits. The `agent` command is taught by the built-in `agent` skill (below), whose description says that roles exist and that `agent list --agents` lists them.
 
-**The `agent` command.** One bash script is installed under seven names, `agent`, `subagent`, `sprinkle`, `memory`, `gelatiere`, `freezer` and `models`, in `/usr/local/bin`, mode `0755`, which is on every user's `PATH`, so the user, a cone or a scoop runs it in any bash. A file at one of those paths that isn't slicc-agent's (it lacks the `slicc-agent/1` request marker), such as a root global package's `memory`, is left alone, with one warning per boot in the worker's console. Root's `$PNPM_HOME/bin` (`/usr/local/share/pnpm/bin`) is on root's `PATH` only: other users find root's installed packages in `/usr/bin`, but not loose scripts. Copies that earlier versions put in the kernel's `$PNPM_HOME/bin` are removed, so they can't shadow the new ones for root. It writes a request (NUL-separated fields: `slicc-agent/1`, the name it was called by, `$SLICC_AGENT`, the working directory, its pid, argc, the arguments and stdin) to `/var/lib/slicc/agent/requests/in/` and polls `out/` for the answer and exit code; the worker writes `<id>.ack` when it picks a request up, and the script gives up after 20 s without one ("the SLICC agent isn't running", exit 1). The kernel environment exports `SLICC_AGENT`, `PI_PROVIDER`, `PI_MODEL` and `PI_REASONING_LEVEL` into every agent command, so the worker knows the caller. `/var/lib/slicc/agent/scoops/<handle>/metadata.json` mirrors each scoop's state for scripts.
+**The `agent` command.** One bash script is installed under eight names, `agent`, `subagent`, `sprinkle`, `memory`, `gelatiere`, `freezer`, `models` and `panel`, in `/usr/local/bin`, mode `0755`, which is on every user's `PATH`, so the user, a cone or a scoop runs it in any bash. A file at one of those paths that isn't slicc-agent's (it lacks the `slicc-agent/1` request marker), such as a root global package's `memory`, is left alone, with one warning per boot in the worker's console. Root's `$PNPM_HOME/bin` (`/usr/local/share/pnpm/bin`) is on root's `PATH` only: other users find root's installed packages in `/usr/bin`, but not loose scripts. Copies that earlier versions put in the kernel's `$PNPM_HOME/bin` are removed, so they can't shadow the new ones for root. It writes a request (NUL-separated fields: `slicc-agent/1`, the name it was called by, `$SLICC_AGENT`, or `tab:$SLICC_TAB` from a terminal that has only that, the working directory, its pid, argc, the arguments and stdin) to `/var/lib/slicc/agent/requests/in/` and polls `out/` for the answer and exit code (with an optional `<id>.err`, the answer's stdout is `<id>.out` and its stderr `<id>.err`); the worker writes `<id>.ack` when it picks a request up, and the script gives up after 20 s without one ("the SLICC agent isn't running", exit 1). The kernel environment exports `SLICC_AGENT`, `PI_PROVIDER`, `PI_MODEL` and `PI_REASONING_LEVEL` into every agent command, so the worker knows the caller. `/var/lib/slicc/agent/scoops/<handle>/metadata.json` mirrors each scoop's state for scripts.
 - `agent [options] --prompt <text>` (or `--file <path>`, or `-` for stdin, or v6's `agent <cwd> <allowed-commands> <prompt>`) is **synchronous**: an ephemeral scoop runs, and the command prints its final answer and exits 0, or prints the reason on stderr and exits 1. Afterwards the scoop is stopped, its folder removed, its conversation marked dropped and its transcript archived as Markdown in `/tmp/agent-sessions/<handle>.md` (`/home/sessions/` with `--persist-session`, nowhere with `--no-persist-session`). The script traps TERM, INT and HUP and cancels the scoop, and the worker checks the script's pid in the kernel's process table every second for a SIGKILL. If the caller's run is still going when the bash call dies (a bash timeout), the scoop continues and its answer arrives as a `bash` lick; `--background-after <seconds>` does the same on purpose. Sync calls nest up to three deep. Allowed commands in v6's form are told to the scoop, not enforced.
 - `agent --async …` (= `subagent spawn …`) starts a persistent scoop and prints its handle; only cones start them. `list [--agents]`, `status`, `rename`, `send [--follow-up]`, `wait [--timeout <s>] [--notify]` (30 s by default; `--notify` returns at once and brings the answers together in one `scoop-wait` lick) and `stop` manage them. From a scoop, `agent send parent "<note>"` posts a progress note to its cone as a lick, coalesced per scoop.
 - Options: `--name`, `--agent <role>`, `--model <provider/model>`, `--thinking <level>` or `--effort low|medium|high|max`, `--tools <a,b>` (or `auto`/`full`), `--read-only <paths>`, `--system-prompt[-file]`. `--schema-b64`, `--tools output`, `--session`, `--resume`, `--image`, `--no-escalate`, `--minimal` and `--usage` answer "not supported in SLICC yet".
@@ -363,6 +363,10 @@ pi core has no browser tooling, and Mario's pi-skills `browser-tools` launches i
 - **`curlwright`** (slicc-cdp ≥ 1.2.1) runs curl-style requests as a page-context `fetch()` in an open tab, with that tab's cookies and origin. The skill prefers it to UI clicks for reading data the app already fetches, and plain `curl` when no login is needed. Writes need the user's yes like clicks do, and response bodies are data.
 - **The `system` section** says the browser is connected when `SLICC_CDP_URL` is set and `playwright-cli` is on PATH (naming `curlwright` too when it's there), and lists it under "Not here yet" otherwise.
 - **Images:** durable's `read` doesn't return images, so a wrapper (`slicc-images`) answers `read` of a PNG, JPEG, GIF or WebP with image content. In a worker that can draw, images wider than 1600 px are scaled down, and an image over 1 MB of base64 is re-encoded as JPEG or refused with a hint. The adapter puts image content from a tool result on the tool card (`ToolCall.image`), so screenshots show in the chat.
+- **SLICC's own pages are off limits** (PRE-1). The `slicc-browser-guard` extension ([`src/browser/guard.ts`](src/browser/guard.ts)) refuses a `bash` call, direct or from codemode, that runs `playwright-cli` or `curlwright` and names a URL on SLICC's origin: `sliccy.ai`, `www.sliccy.ai`, any single-label `<name>.sliccy.ai` over https on port 443, and the origin the worker runs on (`location.origin`). It also refuses `*.kernel.localhost` names other than the agent's own kernel servers, `<port>.kernel.localhost` for a port 1–65535 other than the CDP facade's 9222. The answer is "SLICC's own pages can't be opened or driven from the browser tools.", and the `browser` skill says so too.
+  - **How it reads a command:** a shell tokenizer ([`src/browser/shell.ts`](src/browser/shell.ts)) removes quotes and escapes (`'…'`, `"…"`, `$'…'`, `$"…"`, `\`), and reads into `$(…)`, backticks, `<(…)` and words that are themselves scripts, such as `bash -c` and `eval` arguments, four levels deep. If any word is `playwright-cli` or `curlwright` (by its last path segment), every word is checked: as a URL, as `https://` plus the word, after a `NAME=` or `--flag=` prefix, and for URLs and `//host` inside it. `new URL()` normalises the host (case, IDNA, full-width characters, percent escapes, userinfo); a trailing dot is dropped, `ws:` counts as `http:`, `wss:` as `https:`, and `blob:`, `view-source:` and `filesystem:` are checked by their inner URL. A `http://` URL on a sliccy.ai name is refused too, since it redirects to https.
+  - **The list** lives in [`src/browser/origins.ts`](src/browser/origins.ts) (`protectedOrigins`, `isProtected(url, extra)`) until `@ai-ecoverse/slicc-browsers` ships it, with the same patterns and shape. `*.kernel.localhost` isn't on the shared list; that rule is this guard's own.
+  - **What it can't catch:** it's defence in depth, and the browser tools themselves (slicc-cdp, the kernel's CDP facade and slicc-cli's `cdp` link) enforce the rule. It doesn't see a URL built at run time (from a variable set elsewhere, `printf`, brace expansion or a file), a browser command whose name is built at run time, a script or program file that drives the browser, a tab id (`--tab`, `tab-select`) that points at a SLICC tab, or a page that navigates there by itself. It may refuse a command that only names a SLICC URL alongside a browser command, such as `curl https://seven.sliccy.ai && playwright-cli open https://example.com`.
 - There are no browser licks yet.
 
 ### The freezer
@@ -494,7 +498,7 @@ A sprinkle is a small HTML panel next to the chat. pi has nothing for this; it's
 - `sprinkle show <name>`: posts a `slicc.sprinkle` entry in the caller's chat, which the adapter shows as an inline sprinkle;
 - `sprinkle own <name> [<agent>]`.
 
-v6's `open`, `reload`, `close`, `send` and `chat` answer with what to do instead.
+`sprinkle open <name>` and `sprinkle close <name>` forward to `panel open|close sprinkle:<name>` (see Panels). v6's `reload`, `send` and `chat` answer with what to do instead.
 
 **Shipped sprinkles.** Only `welcome` and `suggestions`, with slicc-spectrum's reviewed copy.
 - **Welcome.** The worker posts it inline in the first cone's chat once per session. Its `onboarding-complete` send writes `/home/.welcomed`, which the card checks, and the profile to `/home/.welcome.json` for the gelatiere's catalog ranking, and the built-in `welcome` skill answers the lick.
@@ -502,6 +506,25 @@ v6's `open`, `reload`, `close`, `send` and `chat` answer with what to do instead
 
 The built-in `sprinkles` skill teaches the files, the bridge and the command.
 
+### Panels
+
+The `panel` command lets an agent, or the user in a terminal, list, open, close, focus and move the panels of a SLICC tab. slicc-spectrum owns the command: `panelCommand(app, argv, caller)` parses argv, knows the panel ids and the guard rails, and answers `{ stdout, stderr, code }` with codes 0, 1, 2 and 5. The agent only carries the request to one tab and brings the answer back, so new verbs and flags need no agent release. pi has nothing for this; it's SLICC's UI.
+
+**The command** is the same script as `agent`, installed as `panel`. It forwards argv untouched with the caller `{ agentId, cone, readOnly: false }`:
+- `agentId` is the calling cone or scoop (`cone`, `cone-2`, `scoop:<id>`), or `null` from a terminal;
+- `cone` is the caller's cone: a scoop's own cone, or the active cone for a terminal;
+- a terminal with `SLICC_TAB` set (bios sets it in each tab's terminals) sends that tab's id, and the request goes to that tab, with its cone.
+
+It prints the tab's stdout and stderr on their own streams and exits with its code. The script transport has an optional `.err` file next to `.out` for this. The agent owns two codes:
+- **3:** no open tab shows the caller's cone ("panel: no open SLICC tab shows cone <cone>; …"). Nothing is queued;
+- **4:** the tab didn't pick the request up within 5 s, didn't answer within 5 s more, or went away meanwhile. Late answers are dropped.
+
+**The bridge** is the `slicc.agent.pages` service, a sibling of `slicc.agent.remote` with the same long-poll stream: `open(tab)`, `report(stream, tab)`, `next(stream, waitMs)`, `answer(stream, id, result)` and `close(stream)`. A tab reports `{ tab, kinds: ['panel'], cone, visible, focused, lastActive }`. Each request goes to exactly one tab and is never retried elsewhere: the `SLICC_TAB` tab if it's open, otherwise the tab on the caller's cone that is visible and focused, then visible, then the latest active. A tab is dropped when it closes its stream, when its attachment goes, or after 30 s without a poll, and each attachment reaches only its own streams.
+
+**The page side.** `createAgentModel(connection, { page: { tab, run } })` starts a `PageAdapter`. It reports the tab's selected cone (`AgentAdapter.active()`, or a scoop's cone), `document.visibilityState`, `document.hasFocus()` and the time of the last pointer or key event, debounced by 250 ms. It answers each request with `run(argv, caller)`, which bios points at spectrum's `panelCommand`. Without `run` the tab never registers, so the bridge works with older spectrums too.
+
+**Followers never execute.** Read-only attachments (`owner.port({ readOnly: true })`) and attachments made with `owner.port({ pages: false })`, which bios uses for link followers, get a `slicc.agent.pages` whose `open` answers `{ error }`, so they are never chosen.
+
 ### Remote control
 
 `remoteControl(connection, { agent? })` from `@ai-ecoverse/slicc-agent/page` gives a linked CLI's `slicc prompt`, `slicc watch` and `slicc abort` (the `agent` stream of the slicc link protocol, §5.11) as plain objects the page writes to the link as NDJSON. `agent()` names the agent, by default the cone the worker treats as current.

package/bin/agent

@@ -1,15 +1,17 @@
 #!/bin/bash
 dir=/var/lib/slicc/agent/requests
 as=$(basename "$0")
-case "$as" in subagent|sprinkle|memory|gelatiere|freezer|models) ;; *) as=agent ;; esac
+case "$as" in subagent|sprinkle|memory|gelatiere|freezer|models|panel) ;; *) as=agent ;; esac
 mkdir -p "$dir/in" "$dir/out" 2>/dev/null
+who="${SLICC_AGENT:-}"
+if [ -z "$who" ] && [ -n "${SLICC_TAB:-}" ]; then who="tab:$SLICC_TAB"; fi
 
 submit() {
   local id="$1"
   shift
   local tmp="$dir/in/.tmp-$id"
   {
-    printf '%s\0' "slicc-agent/1" "$as" "${SLICC_AGENT:-}" "$PWD" "$$" "$#"
+    printf '%s\0' "slicc-agent/1" "$as" "$who" "$PWD" "$$" "$#"
     if [ $# -gt 0 ]; then printf '%s\0' "$@"; fi
     if [ "$stdin" = 1 ]; then cat; fi
   } > "$tmp" && mv "$tmp" "$dir/in/$id"
@@ -67,10 +69,13 @@ while [ ! -f "$dir/out/$id.code" ]; do
   fi
 done
 code=$(cat "$dir/out/$id.code")
-if [ "$code" = 0 ]; then
+if [ -f "$dir/out/$id.err" ]; then
+  cat "$dir/out/$id.out"
+  cat "$dir/out/$id.err" >&2
+elif [ "$code" = 0 ]; then
   cat "$dir/out/$id.out"
 else
   cat "$dir/out/$id.out" >&2
 fi
-rm -f "$dir/out/$id.out" "$dir/out/$id.code" "$dir/out/$id.ack"
+rm -f "$dir/out/$id.out" "$dir/out/$id.err" "$dir/out/$id.code" "$dir/out/$id.ack"
 exit "$code"

package/dist/browser/guard.js

@@ -0,0 +1,106 @@
+import {
+  defineExtension,
+  hook,
+  ToolTask,
+  wrapTool
+} from "@earendil-works/pi-durable";
+import { isProtected } from "./origins.js";
+import { words } from "./shell.js";
+const BROWSER_GUARD = "slicc-browser-guard";
+const REFUSAL = "SLICC's own pages can't be opened or driven from the browser tools.";
+const FACADE_PORT = 9222;
+const BROWSER = /* @__PURE__ */ new Set(["playwright-cli", "curlwright"]);
+const WEB = /* @__PURE__ */ new Set(["http:", "https:", "ws:", "wss:"]);
+const WRAPPED = /* @__PURE__ */ new Set(["blob:", "view-source:", "filesystem:"]);
+const SECURE = {
+  "http:": "http:",
+  "https:": "https:",
+  "ws:": "http:",
+  "wss:": "https:"
+};
+const SCHEMED = /^[a-z][a-z0-9+.-]*:/i;
+const EMBEDDED = /[a-z][a-z0-9+.-]*:\/\/[^\s'"`<>(){}\\]+/gi;
+const RELATIVE = /(?<![:\w/])\/\/[^\s'"`<>(){}\\/]+/g;
+const PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;
+const KERNEL = "kernel.localhost";
+const OWN_KERNEL = /^([1-9][0-9]{0,4})\.kernel\.localhost$/;
+function parse(url) {
+  try {
+    return new URL(url);
+  } catch {
+    return void 0;
+  }
+}
+function ownKernelServer(host) {
+  const port = OWN_KERNEL.exec(host)?.[1];
+  return port !== void 0 && Number(port) <= 65535 && Number(port) !== FACADE_PORT;
+}
+function forbidden(url, origins, depth = 0) {
+  const parsed = parse(url);
+  if (!parsed) return false;
+  if (WRAPPED.has(parsed.protocol)) {
+    const inner = parsed.href.slice(parsed.protocol.length);
+    return depth < 2 && [inner, `https://${inner}`].some((each) => forbidden(each, origins, depth + 1));
+  }
+  if (!WEB.has(parsed.protocol) || !parsed.hostname) return false;
+  const host = parsed.hostname.replace(/\.+$/, "");
+  if (host === KERNEL || host.endsWith(`.${KERNEL}`)) return !ownKernelServer(host);
+  const port = parsed.port ? `:${parsed.port}` : "";
+  return isProtected(`${SECURE[parsed.protocol]}//${host}${port}`, origins) || isProtected(`https://${host}${port}`);
+}
+function candidates(word) {
+  const value = word.replace(PREFIX, "");
+  const found = [
+    word,
+    value,
+    ...value.match(EMBEDDED) ?? [],
+    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`)
+  ];
+  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+    found.push(`https://${value}`);
+  if (value.startsWith("//")) found.push(`https:${value}`);
+  return found.filter((each) => SCHEMED.test(each));
+}
+function browserCommand(word) {
+  return BROWSER.has(word.slice(word.lastIndexOf("/") + 1));
+}
+function refused(command, origins) {
+  const all = words(command);
+  if (!all.some(browserCommand)) return false;
+  return all.some((word) => candidates(word).some((url) => forbidden(url, origins)));
+}
+function commandOf(args) {
+  const command = args?.command;
+  return typeof command === "string" ? command : "";
+}
+function browserGuard(origins, tools) {
+  const bash = tools.find((tool) => tool.name === "bash");
+  return defineExtension({
+    name: BROWSER_GUARD,
+    hooks: [
+      hook(ToolTask, {
+        beforeTool: (call) => call.name === bash.name && refused(commandOf(call.arguments), origins) ? { block: REFUSAL } : void 0
+      })
+    ],
+    wraps: [
+      wrapTool(bash, (inner) => ({
+        ...inner,
+        execute(args, api, context) {
+          if (!refused(commandOf(args), origins)) return inner.execute(args, api, context);
+          return Promise.resolve({ content: [{ type: "text", text: REFUSAL }], isError: true });
+        }
+      }))
+    ]
+  });
+}
+export {
+  BROWSER_GUARD,
+  FACADE_PORT,
+  REFUSAL,
+  browserGuard,
+  candidates,
+  forbidden,
+  ownKernelServer,
+  refused
+};
+//# sourceMappingURL=guard.js.map

package/dist/browser/guard.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/guard.ts"],
+  "sourcesContent": ["import {\n  defineExtension,\n  type Extension,\n  hook,\n  type ToolRegistration,\n  ToolTask,\n  wrapTool,\n} from '@earendil-works/pi-durable';\nimport { isProtected } from './origins.ts';\nimport { words } from './shell.ts';\n\nexport const BROWSER_GUARD = 'slicc-browser-guard';\nexport const REFUSAL = \"SLICC's own pages can't be opened or driven from the browser tools.\";\nexport const FACADE_PORT = 9222;\n\nconst BROWSER = new Set(['playwright-cli', 'curlwright']);\nconst WEB = new Set(['http:', 'https:', 'ws:', 'wss:']);\nconst WRAPPED = new Set(['blob:', 'view-source:', 'filesystem:']);\nconst SECURE: Record<string, string> = {\n  'http:': 'http:',\n  'https:': 'https:',\n  'ws:': 'http:',\n  'wss:': 'https:',\n};\nconst SCHEMED = /^[a-z][a-z0-9+.-]*:/i;\nconst EMBEDDED = /[a-z][a-z0-9+.-]*:\\/\\/[^\\s'\"`<>(){}\\\\]+/gi;\nconst RELATIVE = /(?<![:\\w/])\\/\\/[^\\s'\"`<>(){}\\\\/]+/g;\nconst PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;\nconst KERNEL = 'kernel.localhost';\nconst OWN_KERNEL = /^([1-9][0-9]{0,4})\\.kernel\\.localhost$/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function ownKernelServer(host: string): boolean {\n  const port = OWN_KERNEL.exec(host)?.[1];\n  return port !== undefined && Number(port) <= 65535 && Number(port) !== FACADE_PORT;\n}\n\nexport function forbidden(url: string, origins: readonly string[], depth = 0): boolean {\n  const parsed = parse(url);\n  if (!parsed) return false;\n  if (WRAPPED.has(parsed.protocol)) {\n    const inner = parsed.href.slice(parsed.protocol.length);\n    return (\n      depth < 2 && [inner, `https://${inner}`].some((each) => forbidden(each, origins, depth + 1))\n    );\n  }\n  if (!WEB.has(parsed.protocol) || !parsed.hostname) return false;\n  const host = parsed.hostname.replace(/\\.+$/, '');\n  if (host === KERNEL || host.endsWith(`.${KERNEL}`)) return !ownKernelServer(host);\n  const port = parsed.port ? `:${parsed.port}` : '';\n  return (\n    isProtected(`${SECURE[parsed.protocol]}//${host}${port}`, origins) ||\n    isProtected(`https://${host}${port}`)\n  );\n}\n\nexport function candidates(word: string): string[] {\n  const value = word.replace(PREFIX, '');\n  const found = [\n    word,\n    value,\n    ...(value.match(EMBEDDED) ?? []),\n    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`),\n  ];\n  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value))\n    found.push(`https://${value}`);\n  if (value.startsWith('//')) found.push(`https:${value}`);\n  return found.filter((each) => SCHEMED.test(each));\n}\n\nfunction browserCommand(word: string): boolean {\n  return BROWSER.has(word.slice(word.lastIndexOf('/') + 1));\n}\n\nexport function refused(command: string, origins: readonly string[]): boolean {\n  const all = words(command);\n  if (!all.some(browserCommand)) return false;\n  return all.some((word) => candidates(word).some((url) => forbidden(url, origins)));\n}\n\nfunction commandOf(args: unknown): string {\n  const command = (args as { command?: unknown } | undefined)?.command;\n  return typeof command === 'string' ? command : '';\n}\n\nexport function browserGuard(\n  origins: readonly string[],\n  tools: readonly ToolRegistration[]\n): Extension {\n  const bash = tools.find((tool) => tool.name === 'bash') as ToolRegistration;\n  return defineExtension({\n    name: BROWSER_GUARD,\n    hooks: [\n      hook(ToolTask, {\n        beforeTool: (call) =>\n          call.name === bash.name && refused(commandOf(call.arguments), origins)\n            ? { block: REFUSAL }\n            : undefined,\n      }),\n    ],\n    wraps: [\n      wrapTool(bash, (inner) => ({\n        ...inner,\n        execute(args, api, context) {\n          if (!refused(commandOf(args), origins)) return inner.execute(args, api, context);\n          return Promise.resolve({ content: [{ type: 'text', text: REFUSAL }], isError: true });\n        },\n      })),\n    ],\n  });\n}\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AAEf,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAChB,MAAM,cAAc;AAE3B,MAAM,UAAU,oBAAI,IAAI,CAAC,kBAAkB,YAAY,CAAC;AACxD,MAAM,MAAM,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,MAAM,CAAC;AACtD,MAAM,UAAU,oBAAI,IAAI,CAAC,SAAS,gBAAgB,aAAa,CAAC;AAChE,MAAM,SAAiC;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AACA,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,aAAa;AAEnB,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,MAAuB;AACrD,QAAM,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC;AACtC,SAAO,SAAS,UAAa,OAAO,IAAI,KAAK,SAAS,OAAO,IAAI,MAAM;AACzE;AAEO,SAAS,UAAU,KAAa,SAA4B,QAAQ,GAAY;AACrF,QAAM,SAAS,MAAM,GAAG;AACxB,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,QAAQ,IAAI,OAAO,QAAQ,GAAG;AAChC,UAAM,QAAQ,OAAO,KAAK,MAAM,OAAO,SAAS,MAAM;AACtD,WACE,QAAQ,KAAK,CAAC,OAAO,WAAW,KAAK,EAAE,EAAE,KAAK,CAAC,SAAS,UAAU,MAAM,SAAS,QAAQ,CAAC,CAAC;AAAA,EAE/F;AACA,MAAI,CAAC,IAAI,IAAI,OAAO,QAAQ,KAAK,CAAC,OAAO,SAAU,QAAO;AAC1D,QAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAC/C,MAAI,SAAS,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,EAAG,QAAO,CAAC,gBAAgB,IAAI;AAChF,QAAM,OAAO,OAAO,OAAO,IAAI,OAAO,IAAI,KAAK;AAC/C,SACE,YAAY,GAAG,OAAO,OAAO,QAAQ,CAAC,KAAK,IAAI,GAAG,IAAI,IAAI,OAAO,KACjE,YAAY,WAAW,IAAI,GAAG,IAAI,EAAE;AAExC;AAEO,SAAS,WAAW,MAAwB;AACjD,QAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE;AACrC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,GAAI,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,IAC9B,IAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,QAAQ,EAAE;AAAA,EACxE;AACA,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,2BAA2B,KAAK,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,EAAE;AAC/B,MAAI,MAAM,WAAW,IAAI,EAAG,OAAM,KAAK,SAAS,KAAK,EAAE;AACvD,SAAO,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClD;AAEA,SAAS,eAAe,MAAuB;AAC7C,SAAO,QAAQ,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAC1D;AAEO,SAAS,QAAQ,SAAiB,SAAqC;AAC5E,QAAM,MAAM,MAAM,OAAO;AACzB,MAAI,CAAC,IAAI,KAAK,cAAc,EAAG,QAAO;AACtC,SAAO,IAAI,KAAK,CAAC,SAAS,WAAW,IAAI,EAAE,KAAK,CAAC,QAAQ,UAAU,KAAK,OAAO,CAAC,CAAC;AACnF;AAEA,SAAS,UAAU,MAAuB;AACxC,QAAM,UAAW,MAA4C;AAC7D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEO,SAAS,aACd,SACA,OACW;AACX,QAAM,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM;AACtD,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,OAAO;AAAA,MACL,KAAK,UAAU;AAAA,QACb,YAAY,CAAC,SACX,KAAK,SAAS,KAAK,QAAQ,QAAQ,UAAU,KAAK,SAAS,GAAG,OAAO,IACjE,EAAE,OAAO,QAAQ,IACjB;AAAA,MACR,CAAC;AAAA,IACH;AAAA,IACA,OAAO;AAAA,MACL,SAAS,MAAM,CAAC,WAAW;AAAA,QACzB,GAAG;AAAA,QACH,QAAQ,MAAM,KAAK,SAAS;AAC1B,cAAI,CAAC,QAAQ,UAAU,IAAI,GAAG,OAAO,EAAG,QAAO,MAAM,QAAQ,MAAM,KAAK,OAAO;AAC/E,iBAAO,QAAQ,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC,GAAG,SAAS,KAAK,CAAC;AAAA,QACtF;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/browser/origins.js

@@ -0,0 +1,41 @@
+const protectedOrigins = {
+  patterns: ["https://sliccy.ai", "https://www.sliccy.ai", "https://*.sliccy.ai"]
+};
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function parse(url) {
+  try {
+    return new URL(url);
+  } catch {
+    return void 0;
+  }
+}
+function hostOf(url) {
+  return url.hostname.replace(/\.+$/, "");
+}
+function originOf(url) {
+  const parsed = parse(url);
+  if (!parsed || !["http:", "https:"].includes(parsed.protocol) || !parsed.hostname)
+    return void 0;
+  return `${parsed.protocol}//${hostOf(parsed)}${parsed.port ? `:${parsed.port}` : ""}`;
+}
+function matches(pattern, url) {
+  const host = hostOf(url);
+  const wanted = pattern.slice("https://".length);
+  if (!wanted.startsWith("*.")) return host === wanted;
+  const suffix = wanted.slice(1);
+  return host.endsWith(suffix) && LABEL.test(host.slice(0, -suffix.length));
+}
+function isProtected(url, extra = []) {
+  const origin = originOf(url);
+  if (!origin) return false;
+  if (extra.some((other) => originOf(other) === origin)) return true;
+  const parsed = parse(url);
+  if (parsed.protocol !== "https:" || parsed.port) return false;
+  return protectedOrigins.patterns.some((pattern) => matches(pattern, parsed));
+}
+export {
+  isProtected,
+  originOf,
+  protectedOrigins
+};
+//# sourceMappingURL=origins.js.map

package/dist/browser/origins.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/origins.ts"],
+  "sourcesContent": ["export const protectedOrigins = {\n  patterns: ['https://sliccy.ai', 'https://www.sliccy.ai', 'https://*.sliccy.ai'],\n} as const;\n\nconst LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction hostOf(url: URL): string {\n  return url.hostname.replace(/\\.+$/, '');\n}\n\nexport function originOf(url: string): string | undefined {\n  const parsed = parse(url);\n  if (!parsed || !['http:', 'https:'].includes(parsed.protocol) || !parsed.hostname)\n    return undefined;\n  return `${parsed.protocol}//${hostOf(parsed)}${parsed.port ? `:${parsed.port}` : ''}`;\n}\n\nfunction matches(pattern: string, url: URL): boolean {\n  const host = hostOf(url);\n  const wanted = pattern.slice('https://'.length);\n  if (!wanted.startsWith('*.')) return host === wanted;\n  const suffix = wanted.slice(1);\n  return host.endsWith(suffix) && LABEL.test(host.slice(0, -suffix.length));\n}\n\nexport function isProtected(url: string, extra: readonly string[] = []): boolean {\n  const origin = originOf(url);\n  if (!origin) return false;\n  if (extra.some((other) => originOf(other) === origin)) return true;\n  const parsed = parse(url) as URL;\n  if (parsed.protocol !== 'https:' || parsed.port) return false;\n  return protectedOrigins.patterns.some((pattern) => matches(pattern, parsed));\n}\n"],
+  "mappings": "AAAO,MAAM,mBAAmB;AAAA,EAC9B,UAAU,CAAC,qBAAqB,yBAAyB,qBAAqB;AAChF;AAEA,MAAM,QAAQ;AAEd,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,OAAO,KAAkB;AAChC,SAAO,IAAI,SAAS,QAAQ,QAAQ,EAAE;AACxC;AAEO,SAAS,SAAS,KAAiC;AACxD,QAAM,SAAS,MAAM,GAAG;AACxB,MAAI,CAAC,UAAU,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,OAAO,QAAQ,KAAK,CAAC,OAAO;AACvE,WAAO;AACT,SAAO,GAAG,OAAO,QAAQ,KAAK,OAAO,MAAM,CAAC,GAAG,OAAO,OAAO,IAAI,OAAO,IAAI,KAAK,EAAE;AACrF;AAEA,SAAS,QAAQ,SAAiB,KAAmB;AACnD,QAAM,OAAO,OAAO,GAAG;AACvB,QAAM,SAAS,QAAQ,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,OAAO,WAAW,IAAI,EAAG,QAAO,SAAS;AAC9C,QAAM,SAAS,OAAO,MAAM,CAAC;AAC7B,SAAO,KAAK,SAAS,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC;AAC1E;AAEO,SAAS,YAAY,KAAa,QAA2B,CAAC,GAAY;AAC/E,QAAM,SAAS,SAAS,GAAG;AAC3B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,MAAM,EAAG,QAAO;AAC9D,QAAM,SAAS,MAAM,GAAG;AACxB,MAAI,OAAO,aAAa,YAAY,OAAO,KAAM,QAAO;AACxD,SAAO,iBAAiB,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,MAAM,CAAC;AAC7E;",
+  "names": []
+}

package/dist/browser/shell.js

@@ -0,0 +1,179 @@
+const MAX_DEPTH = 4;
+const BREAKS = /* @__PURE__ */ new Set([" ", "	", "\n", ";", "&", "|", "(", ")", "<", ">"]);
+const NESTING = /[\s;&|`$()<>'"\\]/;
+const ESCAPES = {
+  n: "\n",
+  t: "	",
+  r: "\r",
+  a: "\x07",
+  b: "\b",
+  e: "\x1B",
+  f: "\f",
+  v: "\v"
+};
+function closing(source, start, open, close) {
+  let depth = 1;
+  let index = start;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "\\") index += 2;
+    else if (char === "'" || char === '"') {
+      const end = source.indexOf(char, index + 1);
+      index = end < 0 ? source.length : end + 1;
+    } else {
+      if (char === open) depth++;
+      else if (char === close && --depth === 0) return index;
+      index++;
+    }
+  }
+  return source.length;
+}
+function ansi(source, start) {
+  let text = "";
+  let index = start;
+  while (index < source.length && source[index] !== "'") {
+    const char = source[index];
+    if (char !== "\\") {
+      text += char;
+      index++;
+      continue;
+    }
+    const next = source[index + 1] ?? "";
+    const hex = /^(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8})|([0-7]{1,3}))/.exec(
+      source.slice(index + 1)
+    );
+    if (hex) {
+      const code = hex[4] ? Number.parseInt(hex[4], 8) : Number.parseInt(hex.slice(1).join(""), 16);
+      text += String.fromCodePoint(Math.min(code, 1114111));
+      index += 1 + hex[0].length;
+    } else {
+      text += ESCAPES[next] ?? next;
+      index += 2;
+    }
+  }
+  return { text, end: index + 1 };
+}
+class Scanner {
+  words = [];
+  nested = [];
+  #word;
+  #index = 0;
+  source;
+  constructor(source) {
+    this.source = source;
+  }
+  #at(offset = 0) {
+    return this.source[this.#index + offset] ?? "";
+  }
+  #append(text) {
+    this.#word = (this.#word ?? "") + text;
+  }
+  #end() {
+    if (this.#word !== void 0) this.words.push(this.#word);
+    this.#word = void 0;
+  }
+  #substitute(from, open, close, prefix) {
+    const stop = closing(this.source, from, open, close);
+    const inner = this.source.slice(from, stop);
+    this.nested.push(inner);
+    this.#append(`${prefix}${inner}${close}`);
+    this.#index = stop + 1;
+  }
+  #backtick() {
+    let stop = this.#index + 1;
+    while (stop < this.source.length && this.source[stop] !== "`")
+      stop += this.source[stop] === "\\" ? 2 : 1;
+    this.nested.push(this.source.slice(this.#index + 1, stop).replace(/\\(.)/g, "$1"));
+    this.#append(this.source.slice(this.#index, stop + 1));
+    this.#index = stop + 1;
+  }
+  #dollar() {
+    const next = this.#at(1);
+    if (next === "(") this.#substitute(this.#index + 2, "(", ")", "$(");
+    else if (next === "{") this.#substitute(this.#index + 2, "{", "}", "${");
+    else return false;
+    return true;
+  }
+  #single() {
+    const stop = this.source.indexOf("'", this.#index + 1);
+    const last = stop < 0 ? this.source.length : stop;
+    this.#append(this.source.slice(this.#index + 1, last));
+    this.#index = last + 1;
+  }
+  #double() {
+    this.#append("");
+    this.#index++;
+    while (this.#index < this.source.length && this.#at() !== '"') {
+      const char = this.#at();
+      if (char === "\\" && '$`"\\\n'.includes(this.#at(1) || "x")) {
+        if (this.#at(1) !== "\n") this.#append(this.#at(1));
+        this.#index += 2;
+      } else if (char === "`") this.#backtick();
+      else if (!(char === "$" && this.#dollar())) this.#plain(char);
+    }
+    this.#index++;
+  }
+  #plain(char) {
+    this.#append(char);
+    this.#index++;
+  }
+  #comment() {
+    const stop = this.source.indexOf("\n", this.#index);
+    this.#index = stop < 0 ? this.source.length : stop;
+  }
+  #escape() {
+    if (this.#at(1) !== "\n") this.#append(this.#at(1));
+    this.#index += 2;
+  }
+  #quote(char) {
+    if (char === "'") this.#single();
+    else if (char === '"') this.#double();
+    else if (char === "$" && this.#at(1) === "'") {
+      const quoted = ansi(this.source, this.#index + 2);
+      this.#append(quoted.text);
+      this.#index = quoted.end;
+    } else if (char === "$" && this.#at(1) === '"') {
+      this.#index++;
+      this.#double();
+    } else return false;
+    return true;
+  }
+  #step(char) {
+    if ((char === "<" || char === ">") && this.#at(1) === "(") {
+      this.#end();
+      this.#substitute(this.#index + 2, "(", ")", `${char}(`);
+      this.#end();
+    } else if (char === "#" && this.#word === void 0) this.#comment();
+    else if (BREAKS.has(char)) {
+      this.#end();
+      this.#index++;
+    } else if (char === "\\") this.#escape();
+    else if (this.#quote(char)) return;
+    else if (char === "`") this.#backtick();
+    else if (!(char === "$" && this.#dollar())) this.#plain(char);
+  }
+  scan() {
+    while (this.#index < this.source.length) this.#step(this.#at());
+    this.#end();
+    return { words: this.words, nested: this.nested };
+  }
+}
+function split(source) {
+  return new Scanner(source).scan();
+}
+function words(source, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  seen.add(source);
+  const { words: found, nested } = split(source);
+  if (depth >= MAX_DEPTH) return found;
+  const deeper = [...nested, ...found.filter((word) => NESTING.test(word))].filter(
+    (inner) => !seen.has(inner)
+  );
+  for (const inner of deeper) seen.add(inner);
+  return [...found, ...deeper.flatMap((inner) => words(inner, depth + 1, seen))];
+}
+export {
+  MAX_DEPTH,
+  split,
+  words
+};
+//# sourceMappingURL=shell.js.map

package/dist/browser/shell.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/browser/shell.ts"],
+  "sourcesContent": ["export const MAX_DEPTH = 4;\n\nconst BREAKS = new Set([' ', '\\t', '\\n', ';', '&', '|', '(', ')', '<', '>']);\nconst NESTING = /[\\s;&|`$()<>'\"\\\\]/;\nconst ESCAPES: Record<string, string> = {\n  n: '\\n',\n  t: '\\t',\n  r: '\\r',\n  a: '\\x07',\n  b: '\\b',\n  e: '\\x1b',\n  f: '\\f',\n  v: '\\v',\n};\n\nexport interface Split {\n  words: string[];\n  nested: string[];\n}\n\nfunction closing(source: string, start: number, open: string, close: string): number {\n  let depth = 1;\n  let index = start;\n  while (index < source.length) {\n    const char = source[index] as string;\n    if (char === '\\\\') index += 2;\n    else if (char === \"'\" || char === '\"') {\n      const end = source.indexOf(char, index + 1);\n      index = end < 0 ? source.length : end + 1;\n    } else {\n      if (char === open) depth++;\n      else if (char === close && --depth === 0) return index;\n      index++;\n    }\n  }\n  return source.length;\n}\n\nfunction ansi(source: string, start: number): { text: string; end: number } {\n  let text = '';\n  let index = start;\n  while (index < source.length && source[index] !== \"'\") {\n    const char = source[index] as string;\n    if (char !== '\\\\') {\n      text += char;\n      index++;\n      continue;\n    }\n    const next = source[index + 1] ?? '';\n    const hex =\n      /^(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8})|([0-7]{1,3}))/.exec(\n        source.slice(index + 1)\n      );\n    if (hex) {\n      const code = hex[4] ? Number.parseInt(hex[4], 8) : Number.parseInt(hex.slice(1).join(''), 16);\n      text += String.fromCodePoint(Math.min(code, 0x10ffff));\n      index += 1 + hex[0].length;\n    } else {\n      text += ESCAPES[next] ?? next;\n      index += 2;\n    }\n  }\n  return { text, end: index + 1 };\n}\n\nclass Scanner {\n  readonly words: string[] = [];\n  readonly nested: string[] = [];\n  #word: string | undefined;\n  #index = 0;\n\n  readonly source: string;\n\n  constructor(source: string) {\n    this.source = source;\n  }\n\n  #at(offset = 0): string {\n    return this.source[this.#index + offset] ?? '';\n  }\n\n  #append(text: string): void {\n    this.#word = (this.#word ?? '') + text;\n  }\n\n  #end(): void {\n    if (this.#word !== undefined) this.words.push(this.#word);\n    this.#word = undefined;\n  }\n\n  #substitute(from: number, open: string, close: string, prefix: string): void {\n    const stop = closing(this.source, from, open, close);\n    const inner = this.source.slice(from, stop);\n    this.nested.push(inner);\n    this.#append(`${prefix}${inner}${close}`);\n    this.#index = stop + 1;\n  }\n\n  #backtick(): void {\n    let stop = this.#index + 1;\n    while (stop < this.source.length && this.source[stop] !== '`')\n      stop += this.source[stop] === '\\\\' ? 2 : 1;\n    this.nested.push(this.source.slice(this.#index + 1, stop).replace(/\\\\(.)/g, '$1'));\n    this.#append(this.source.slice(this.#index, stop + 1));\n    this.#index = stop + 1;\n  }\n\n  #dollar(): boolean {\n    const next = this.#at(1);\n    if (next === '(') this.#substitute(this.#index + 2, '(', ')', '$(');\n    else if (next === '{') this.#substitute(this.#index + 2, '{', '}', '${');\n    else return false;\n    return true;\n  }\n\n  #single(): void {\n    const stop = this.source.indexOf(\"'\", this.#index + 1);\n    const last = stop < 0 ? this.source.length : stop;\n    this.#append(this.source.slice(this.#index + 1, last));\n    this.#index = last + 1;\n  }\n\n  #double(): void {\n    this.#append('');\n    this.#index++;\n    while (this.#index < this.source.length && this.#at() !== '\"') {\n      const char = this.#at();\n      if (char === '\\\\' && '$`\"\\\\\\n'.includes(this.#at(1) || 'x')) {\n        if (this.#at(1) !== '\\n') this.#append(this.#at(1));\n        this.#index += 2;\n      } else if (char === '`') this.#backtick();\n      else if (!(char === '$' && this.#dollar())) this.#plain(char);\n    }\n    this.#index++;\n  }\n\n  #plain(char: string): void {\n    this.#append(char);\n    this.#index++;\n  }\n\n  #comment(): void {\n    const stop = this.source.indexOf('\\n', this.#index);\n    this.#index = stop < 0 ? this.source.length : stop;\n  }\n\n  #escape(): void {\n    if (this.#at(1) !== '\\n') this.#append(this.#at(1));\n    this.#index += 2;\n  }\n\n  #quote(char: string): boolean {\n    if (char === \"'\") this.#single();\n    else if (char === '\"') this.#double();\n    else if (char === '$' && this.#at(1) === \"'\") {\n      const quoted = ansi(this.source, this.#index + 2);\n      this.#append(quoted.text);\n      this.#index = quoted.end;\n    } else if (char === '$' && this.#at(1) === '\"') {\n      this.#index++;\n      this.#double();\n    } else return false;\n    return true;\n  }\n\n  #step(char: string): void {\n    if ((char === '<' || char === '>') && this.#at(1) === '(') {\n      this.#end();\n      this.#substitute(this.#index + 2, '(', ')', `${char}(`);\n      this.#end();\n    } else if (char === '#' && this.#word === undefined) this.#comment();\n    else if (BREAKS.has(char)) {\n      this.#end();\n      this.#index++;\n    } else if (char === '\\\\') this.#escape();\n    else if (this.#quote(char)) return;\n    else if (char === '`') this.#backtick();\n    else if (!(char === '$' && this.#dollar())) this.#plain(char);\n  }\n\n  scan(): Split {\n    while (this.#index < this.source.length) this.#step(this.#at());\n    this.#end();\n    return { words: this.words, nested: this.nested };\n  }\n}\n\nexport function split(source: string): Split {\n  return new Scanner(source).scan();\n}\n\nexport function words(source: string, depth = 0, seen = new Set<string>()): string[] {\n  seen.add(source);\n  const { words: found, nested } = split(source);\n  if (depth >= MAX_DEPTH) return found;\n  const deeper = [...nested, ...found.filter((word) => NESTING.test(word))].filter(\n    (inner) => !seen.has(inner)\n  );\n  for (const inner of deeper) seen.add(inner);\n  return [...found, ...deeper.flatMap((inner) => words(inner, depth + 1, seen))];\n}\n"],
+  "mappings": "AAAO,MAAM,YAAY;AAEzB,MAAM,SAAS,oBAAI,IAAI,CAAC,KAAK,KAAM,MAAM,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAC3E,MAAM,UAAU;AAChB,MAAM,UAAkC;AAAA,EACtC,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAOA,SAAS,QAAQ,QAAgB,OAAe,MAAc,OAAuB;AACnF,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,SAAO,QAAQ,OAAO,QAAQ;AAC5B,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,SAAS,KAAM,UAAS;AAAA,aACnB,SAAS,OAAO,SAAS,KAAK;AACrC,YAAM,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC;AAC1C,cAAQ,MAAM,IAAI,OAAO,SAAS,MAAM;AAAA,IAC1C,OAAO;AACL,UAAI,SAAS,KAAM;AAAA,eACV,SAAS,SAAS,EAAE,UAAU,EAAG,QAAO;AACjD;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,KAAK,QAAgB,OAA8C;AAC1E,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,SAAO,QAAQ,OAAO,UAAU,OAAO,KAAK,MAAM,KAAK;AACrD,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,SAAS,MAAM;AACjB,cAAQ;AACR;AACA;AAAA,IACF;AACA,UAAM,OAAO,OAAO,QAAQ,CAAC,KAAK;AAClC,UAAM,MACJ,gFAAgF;AAAA,MAC9E,OAAO,MAAM,QAAQ,CAAC;AAAA,IACxB;AACF,QAAI,KAAK;AACP,YAAM,OAAO,IAAI,CAAC,IAAI,OAAO,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,SAAS,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE;AAC5F,cAAQ,OAAO,cAAc,KAAK,IAAI,MAAM,OAAQ,CAAC;AACrD,eAAS,IAAI,IAAI,CAAC,EAAE;AAAA,IACtB,OAAO;AACL,cAAQ,QAAQ,IAAI,KAAK;AACzB,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO,EAAE,MAAM,KAAK,QAAQ,EAAE;AAChC;AAEA,MAAM,QAAQ;AAAA,EACH,QAAkB,CAAC;AAAA,EACnB,SAAmB,CAAC;AAAA,EAC7B;AAAA,EACA,SAAS;AAAA,EAEA;AAAA,EAET,YAAY,QAAgB;AAC1B,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,SAAS,GAAW;AACtB,WAAO,KAAK,OAAO,KAAK,SAAS,MAAM,KAAK;AAAA,EAC9C;AAAA,EAEA,QAAQ,MAAoB;AAC1B,SAAK,SAAS,KAAK,SAAS,MAAM;AAAA,EACpC;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,UAAU,OAAW,MAAK,MAAM,KAAK,KAAK,KAAK;AACxD,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,YAAY,MAAc,MAAc,OAAe,QAAsB;AAC3E,UAAM,OAAO,QAAQ,KAAK,QAAQ,MAAM,MAAM,KAAK;AACnD,UAAM,QAAQ,KAAK,OAAO,MAAM,MAAM,IAAI;AAC1C,SAAK,OAAO,KAAK,KAAK;AACtB,SAAK,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,EAAE;AACxC,SAAK,SAAS,OAAO;AAAA,EACvB;AAAA,EAEA,YAAkB;AAChB,QAAI,OAAO,KAAK,SAAS;AACzB,WAAO,OAAO,KAAK,OAAO,UAAU,KAAK,OAAO,IAAI,MAAM;AACxD,cAAQ,KAAK,OAAO,IAAI,MAAM,OAAO,IAAI;AAC3C,SAAK,OAAO,KAAK,KAAK,OAAO,MAAM,KAAK,SAAS,GAAG,IAAI,EAAE,QAAQ,UAAU,IAAI,CAAC;AACjF,SAAK,QAAQ,KAAK,OAAO,MAAM,KAAK,QAAQ,OAAO,CAAC,CAAC;AACrD,SAAK,SAAS,OAAO;AAAA,EACvB;AAAA,EAEA,UAAmB;AACjB,UAAM,OAAO,KAAK,IAAI,CAAC;AACvB,QAAI,SAAS,IAAK,MAAK,YAAY,KAAK,SAAS,GAAG,KAAK,KAAK,IAAI;AAAA,aACzD,SAAS,IAAK,MAAK,YAAY,KAAK,SAAS,GAAG,KAAK,KAAK,IAAI;AAAA,QAClE,QAAO;AACZ,WAAO;AAAA,EACT;AAAA,EAEA,UAAgB;AACd,UAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,KAAK,SAAS,CAAC;AACrD,UAAM,OAAO,OAAO,IAAI,KAAK,OAAO,SAAS;AAC7C,SAAK,QAAQ,KAAK,OAAO,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;AACrD,SAAK,SAAS,OAAO;AAAA,EACvB;AAAA,EAEA,UAAgB;AACd,SAAK,QAAQ,EAAE;AACf,SAAK;AACL,WAAO,KAAK,SAAS,KAAK,OAAO,UAAU,KAAK,IAAI,MAAM,KAAK;AAC7D,YAAM,OAAO,KAAK,IAAI;AACtB,UAAI,SAAS,QAAQ,UAAU,SAAS,KAAK,IAAI,CAAC,KAAK,GAAG,GAAG;AAC3D,YAAI,KAAK,IAAI,CAAC,MAAM,KAAM,MAAK,QAAQ,KAAK,IAAI,CAAC,CAAC;AAClD,aAAK,UAAU;AAAA,MACjB,WAAW,SAAS,IAAK,MAAK,UAAU;AAAA,eAC/B,EAAE,SAAS,OAAO,KAAK,QAAQ,GAAI,MAAK,OAAO,IAAI;AAAA,IAC9D;AACA,SAAK;AAAA,EACP;AAAA,EAEA,OAAO,MAAoB;AACzB,SAAK,QAAQ,IAAI;AACjB,SAAK;AAAA,EACP;AAAA,EAEA,WAAiB;AACf,UAAM,OAAO,KAAK,OAAO,QAAQ,MAAM,KAAK,MAAM;AAClD,SAAK,SAAS,OAAO,IAAI,KAAK,OAAO,SAAS;AAAA,EAChD;AAAA,EAEA,UAAgB;AACd,QAAI,KAAK,IAAI,CAAC,MAAM,KAAM,MAAK,QAAQ,KAAK,IAAI,CAAC,CAAC;AAClD,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,OAAO,MAAuB;AAC5B,QAAI,SAAS,IAAK,MAAK,QAAQ;AAAA,aACtB,SAAS,IAAK,MAAK,QAAQ;AAAA,aAC3B,SAAS,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAC5C,YAAM,SAAS,KAAK,KAAK,QAAQ,KAAK,SAAS,CAAC;AAChD,WAAK,QAAQ,OAAO,IAAI;AACxB,WAAK,SAAS,OAAO;AAAA,IACvB,WAAW,SAAS,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAC9C,WAAK;AACL,WAAK,QAAQ;AAAA,IACf,MAAO,QAAO;AACd,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAoB;AACxB,SAAK,SAAS,OAAO,SAAS,QAAQ,KAAK,IAAI,CAAC,MAAM,KAAK;AACzD,WAAK,KAAK;AACV,WAAK,YAAY,KAAK,SAAS,GAAG,KAAK,KAAK,GAAG,IAAI,GAAG;AACtD,WAAK,KAAK;AAAA,IACZ,WAAW,SAAS,OAAO,KAAK,UAAU,OAAW,MAAK,SAAS;AAAA,aAC1D,OAAO,IAAI,IAAI,GAAG;AACzB,WAAK,KAAK;AACV,WAAK;AAAA,IACP,WAAW,SAAS,KAAM,MAAK,QAAQ;AAAA,aAC9B,KAAK,OAAO,IAAI,EAAG;AAAA,aACnB,SAAS,IAAK,MAAK,UAAU;AAAA,aAC7B,EAAE,SAAS,OAAO,KAAK,QAAQ,GAAI,MAAK,OAAO,IAAI;AAAA,EAC9D;AAAA,EAEA,OAAc;AACZ,WAAO,KAAK,SAAS,KAAK,OAAO,OAAQ,MAAK,MAAM,KAAK,IAAI,CAAC;AAC9D,SAAK,KAAK;AACV,WAAO,EAAE,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,EAClD;AACF;AAEO,SAAS,MAAM,QAAuB;AAC3C,SAAO,IAAI,QAAQ,MAAM,EAAE,KAAK;AAClC;AAEO,SAAS,MAAM,QAAgB,QAAQ,GAAG,OAAO,oBAAI,IAAY,GAAa;AACnF,OAAK,IAAI,MAAM;AACf,QAAM,EAAE,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM;AAC7C,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,SAAS,CAAC,GAAG,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,CAAC,EAAE;AAAA,IACxE,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK;AAAA,EAC5B;AACA,aAAW,SAAS,OAAQ,MAAK,IAAI,KAAK;AAC1C,SAAO,CAAC,GAAG,OAAO,GAAG,OAAO,QAAQ,CAAC,UAAU,MAAM,OAAO,QAAQ,GAAG,IAAI,CAAC,CAAC;AAC/E;",
+  "names": []
+}

package/dist/client.js

@@ -6,6 +6,7 @@ import { Client, createClientServiceTransport } from "@earendil-works/pi-client"
 import {
   AGENT_SESSION,
   AgentControl,
+  AgentPagesService,
   AgentRemoteService,
   AgentSessions,
   AgentSettings,
@@ -66,7 +67,7 @@ async function connectAgent(endpoint, options = {}) {
   await server.use(AgentSessions).attach(AGENT_SESSION, context);
   await ready;
   const session = createRemoteServiceBinding({
-    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService],
+    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService, AgentPagesService],
     transport: createClientServiceTransport(client, () => client.attachment),
     bound: true
   });
@@ -86,6 +87,7 @@ async function connectAgent(endpoint, options = {}) {
   } = session.use(AgentTranscript);
   const settings = session.use(AgentSettings);
   const remote = session.use(AgentRemoteService);
+  const pages = session.use(AgentPagesService);
   await session.ready(context);
   const held = [];
   const hold = (state) => {
@@ -116,6 +118,7 @@ async function connectAgent(endpoint, options = {}) {
     monitor: hold(monitor),
     settings: lastingSettings(settings, hold),
     remote,
+    pages,
     closed,
     webhook(name, delivery) {
       return control.webhook(

package/dist/client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/client.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceBinding,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport { Client, createClientServiceTransport } from '@earendil-works/pi-client';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  type Command,\n  type Delivered,\n  type MonitorFeed,\n  type SendMode,\n} from './services.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { PortChannel, type PortEndpoint } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly closed: Promise<Error | undefined>;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, region, context) =>\n      settings.connect(providerId, secret, region, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n  };\n}\n\nfunction attached(client: Client): Promise<void> {\n  return new Promise((resolve) => {\n    const stop = client.onAttachmentChange(() => {\n      stop();\n      resolve();\n    });\n  });\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const channel = new PortChannel(endpoint);\n  const serverId = await channel.hello;\n  const client = await Client.connect({ serverId, transportFactory: channel.transport });\n  const server = createRemoteServiceBinding({\n    services: [AgentSessions],\n    transport: createClientServiceTransport(client, () => ({ serverId })),\n    bound: true,\n  });\n  const ready = attached(client);\n  await server.use(AgentSessions).attach(AGENT_SESSION, context);\n  await ready;\n  const session = createRemoteServiceBinding({\n    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService],\n    transport: createClientServiceTransport(client, () => client.attachment),\n    bound: true,\n  });\n  const control = session.use(AgentControl);\n  const {\n    state: transcript,\n    deliveries,\n    agents,\n    views,\n    commands,\n    sprinkles,\n    memories,\n    memoryScopes,\n    frozen,\n    changes,\n    monitor,\n  } = session.use(AgentTranscript);\n  const settings = session.use(AgentSettings);\n  const remote = session.use(AgentRemoteService);\n  await session.ready(context);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  const freeze = () => {\n    for (const kept of held) kept.freeze();\n  };\n  const closed = channel.ended.then((reason) => {\n    freeze();\n    return reason;\n  });\n  return {\n    serverId,\n    control,\n    transcript: hold(transcript),\n    deliveries: hold(deliveries),\n    agents: hold(agents),\n    views: hold(views),\n    commands: hold(commands),\n    sprinkles: hold(sprinkles),\n    memories: hold(memories),\n    memoryScopes: hold(memoryScopes),\n    frozen: hold(frozen),\n    changes: hold(changes),\n    monitor: hold(monitor),\n    settings: lastingSettings(settings, hold),\n    remote,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      freeze();\n      await server.use(AgentSessions).detach(context);\n      await session.dispose(context);\n      await server.dispose(context);\n      await client.dispose();\n    },\n  };\n}\n"],
-  "mappings": "AAAA;AAAA,EAEE;AAAA,OAEK;AACP,SAAS,0BAA0B;AACnC,SAAS,QAAQ,oCAAoC;AAMrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAKK;AAEP,SAAS,mBAAsC;AAgCxC,SAAS,QAAW,OAAuC;AAChE,MAAI;AACJ,MAAI,SAAS;AACb,QAAM,OAAO,MAAM;AACjB,QAAI,OAAQ,QAAO;AACnB,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,IAAI,QAAQ;AACV,eAAO,KAAK;AAAA,MACd;AAAA,MACA,WAAW,CAAC,aAAc,SAAS,MAAM,SAAY,MAAM,UAAU,QAAQ;AAAA,IAC/E;AAAA,IACA,SAAS;AACP,WAAK;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,SAAS,gBACP,UACA,MACe;AACf,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,KAAK;AAAA,IAC1B,SAAS,CAAC,YAAY,QAAQ,QAAQ,YACpC,SAAS,QAAQ,YAAY,QAAQ,QAAQ,OAAO;AAAA,IACtD,YAAY,CAAC,YAAY,YAAY,SAAS,WAAW,YAAY,OAAO;AAAA,IAC5E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,EACtE;AACF;AAEA,SAAS,SAAS,QAA+B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,OAAO,OAAO,mBAAmB,MAAM;AAC3C,WAAK;AACL,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,aACpB,UACA,UAAiC,CAAC,GACR;AAC1B,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,IAAI,YAAY,QAAQ;AACxC,QAAM,WAAW,MAAM,QAAQ;AAC/B,QAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,UAAU,kBAAkB,QAAQ,UAAU,CAAC;AACrF,QAAM,SAAS,2BAA2B;AAAA,IACxC,UAAU,CAAC,aAAa;AAAA,IACxB,WAAW,6BAA6B,QAAQ,OAAO,EAAE,SAAS,EAAE;AAAA,IACpE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,QAAQ,SAAS,MAAM;AAC7B,QAAM,OAAO,IAAI,aAAa,EAAE,OAAO,eAAe,OAAO;AAC7D,QAAM;AACN,QAAM,UAAU,2BAA2B;AAAA,IACzC,UAAU,CAAC,cAAc,iBAAiB,eAAe,kBAAkB;AAAA,IAC3E,WAAW,6BAA6B,QAAQ,MAAM,OAAO,UAAU;AAAA,IACvE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,QAAM;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,QAAQ,IAAI,eAAe;AAC/B,QAAM,WAAW,QAAQ,IAAI,aAAa;AAC1C,QAAM,SAAS,QAAQ,IAAI,kBAAkB;AAC7C,QAAM,QAAQ,MAAM,OAAO;AAC3B,QAAM,OAA2B,CAAC;AAClC,QAAM,OAAO,CAAI,UAAkD;AACjE,UAAM,OAAO,QAAQ,KAAK;AAC1B,SAAK,KAAK,IAAwB;AAClC,WAAO,KAAK;AAAA,EACd;AACA,QAAM,SAAS,MAAM;AACnB,eAAW,QAAQ,KAAM,MAAK,OAAO;AAAA,EACvC;AACA,QAAM,SAAS,QAAQ,MAAM,KAAK,CAAC,WAAW;AAC5C,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,KAAK,UAAU;AAAA,IAC3B,YAAY,KAAK,UAAU;AAAA,IAC3B,QAAQ,KAAK,MAAM;AAAA,IACnB,OAAO,KAAK,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,WAAW,KAAK,SAAS;AAAA,IACzB,UAAU,KAAK,QAAQ;AAAA,IACvB,cAAc,KAAK,YAAY;AAAA,IAC/B,QAAQ,KAAK,MAAM;AAAA,IACnB,SAAS,KAAK,OAAO;AAAA,IACrB,SAAS,KAAK,OAAO;AAAA,IACrB,UAAU,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,UAAU;AACtB,aAAO,QAAQ;AAAA,QACb;AAAA,QACA,EAAE,IAAI,SAAS,MAAM,MAAM,SAAS,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,WAAW,YAAY;AACxC,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,UAAU,WAAW,KAAK,GAAG,OAAO;AAC5E,UAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,OAAO,EAAE;AAC/E,YAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO;AAC7D,UAAI,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,eAAe,QAAQ,MAAM,EAAE;AAC9E,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ;AACZ,aAAO;AACP,YAAM,OAAO,IAAI,aAAa,EAAE,OAAO,OAAO;AAC9C,YAAM,QAAQ,QAAQ,OAAO;AAC7B,YAAM,OAAO,QAAQ,OAAO;AAC5B,YAAM,OAAO,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceBinding,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport { Client, createClientServiceTransport } from '@earendil-works/pi-client';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  type Command,\n  type Delivered,\n  type MonitorFeed,\n  type SendMode,\n} from './services.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { PortChannel, type PortEndpoint } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly pages?: AgentPages;\n  readonly closed: Promise<Error | undefined>;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, region, context) =>\n      settings.connect(providerId, secret, region, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n  };\n}\n\nfunction attached(client: Client): Promise<void> {\n  return new Promise((resolve) => {\n    const stop = client.onAttachmentChange(() => {\n      stop();\n      resolve();\n    });\n  });\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const channel = new PortChannel(endpoint);\n  const serverId = await channel.hello;\n  const client = await Client.connect({ serverId, transportFactory: channel.transport });\n  const server = createRemoteServiceBinding({\n    services: [AgentSessions],\n    transport: createClientServiceTransport(client, () => ({ serverId })),\n    bound: true,\n  });\n  const ready = attached(client);\n  await server.use(AgentSessions).attach(AGENT_SESSION, context);\n  await ready;\n  const session = createRemoteServiceBinding({\n    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService, AgentPagesService],\n    transport: createClientServiceTransport(client, () => client.attachment),\n    bound: true,\n  });\n  const control = session.use(AgentControl);\n  const {\n    state: transcript,\n    deliveries,\n    agents,\n    views,\n    commands,\n    sprinkles,\n    memories,\n    memoryScopes,\n    frozen,\n    changes,\n    monitor,\n  } = session.use(AgentTranscript);\n  const settings = session.use(AgentSettings);\n  const remote = session.use(AgentRemoteService);\n  const pages = session.use(AgentPagesService);\n  await session.ready(context);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  const freeze = () => {\n    for (const kept of held) kept.freeze();\n  };\n  const closed = channel.ended.then((reason) => {\n    freeze();\n    return reason;\n  });\n  return {\n    serverId,\n    control,\n    transcript: hold(transcript),\n    deliveries: hold(deliveries),\n    agents: hold(agents),\n    views: hold(views),\n    commands: hold(commands),\n    sprinkles: hold(sprinkles),\n    memories: hold(memories),\n    memoryScopes: hold(memoryScopes),\n    frozen: hold(frozen),\n    changes: hold(changes),\n    monitor: hold(monitor),\n    settings: lastingSettings(settings, hold),\n    remote,\n    pages,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      freeze();\n      await server.use(AgentSessions).detach(context);\n      await session.dispose(context);\n      await server.dispose(context);\n      await client.dispose();\n    },\n  };\n}\n"],
+  "mappings": "AAAA;AAAA,EAEE;AAAA,OAEK;AACP,SAAS,0BAA0B;AACnC,SAAS,QAAQ,oCAAoC;AAOrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAKK;AAEP,SAAS,mBAAsC;AAiCxC,SAAS,QAAW,OAAuC;AAChE,MAAI;AACJ,MAAI,SAAS;AACb,QAAM,OAAO,MAAM;AACjB,QAAI,OAAQ,QAAO;AACnB,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,IAAI,QAAQ;AACV,eAAO,KAAK;AAAA,MACd;AAAA,MACA,WAAW,CAAC,aAAc,SAAS,MAAM,SAAY,MAAM,UAAU,QAAQ;AAAA,IAC/E;AAAA,IACA,SAAS;AACP,WAAK;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,SAAS,gBACP,UACA,MACe;AACf,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,KAAK;AAAA,IAC1B,SAAS,CAAC,YAAY,QAAQ,QAAQ,YACpC,SAAS,QAAQ,YAAY,QAAQ,QAAQ,OAAO;AAAA,IACtD,YAAY,CAAC,YAAY,YAAY,SAAS,WAAW,YAAY,OAAO;AAAA,IAC5E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,EACtE;AACF;AAEA,SAAS,SAAS,QAA+B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,OAAO,OAAO,mBAAmB,MAAM;AAC3C,WAAK;AACL,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,aACpB,UACA,UAAiC,CAAC,GACR;AAC1B,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,IAAI,YAAY,QAAQ;AACxC,QAAM,WAAW,MAAM,QAAQ;AAC/B,QAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,UAAU,kBAAkB,QAAQ,UAAU,CAAC;AACrF,QAAM,SAAS,2BAA2B;AAAA,IACxC,UAAU,CAAC,aAAa;AAAA,IACxB,WAAW,6BAA6B,QAAQ,OAAO,EAAE,SAAS,EAAE;AAAA,IACpE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,QAAQ,SAAS,MAAM;AAC7B,QAAM,OAAO,IAAI,aAAa,EAAE,OAAO,eAAe,OAAO;AAC7D,QAAM;AACN,QAAM,UAAU,2BAA2B;AAAA,IACzC,UAAU,CAAC,cAAc,iBAAiB,eAAe,oBAAoB,iBAAiB;AAAA,IAC9F,WAAW,6BAA6B,QAAQ,MAAM,OAAO,UAAU;AAAA,IACvE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,QAAM;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,QAAQ,IAAI,eAAe;AAC/B,QAAM,WAAW,QAAQ,IAAI,aAAa;AAC1C,QAAM,SAAS,QAAQ,IAAI,kBAAkB;AAC7C,QAAM,QAAQ,QAAQ,IAAI,iBAAiB;AAC3C,QAAM,QAAQ,MAAM,OAAO;AAC3B,QAAM,OAA2B,CAAC;AAClC,QAAM,OAAO,CAAI,UAAkD;AACjE,UAAM,OAAO,QAAQ,KAAK;AAC1B,SAAK,KAAK,IAAwB;AAClC,WAAO,KAAK;AAAA,EACd;AACA,QAAM,SAAS,MAAM;AACnB,eAAW,QAAQ,KAAM,MAAK,OAAO;AAAA,EACvC;AACA,QAAM,SAAS,QAAQ,MAAM,KAAK,CAAC,WAAW;AAC5C,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,KAAK,UAAU;AAAA,IAC3B,YAAY,KAAK,UAAU;AAAA,IAC3B,QAAQ,KAAK,MAAM;AAAA,IACnB,OAAO,KAAK,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,WAAW,KAAK,SAAS;AAAA,IACzB,UAAU,KAAK,QAAQ;AAAA,IACvB,cAAc,KAAK,YAAY;AAAA,IAC/B,QAAQ,KAAK,MAAM;AAAA,IACnB,SAAS,KAAK,OAAO;AAAA,IACrB,SAAS,KAAK,OAAO;AAAA,IACrB,UAAU,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,UAAU;AACtB,aAAO,QAAQ;AAAA,QACb;AAAA,QACA,EAAE,IAAI,SAAS,MAAM,MAAM,SAAS,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,WAAW,YAAY;AACxC,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,UAAU,WAAW,KAAK,GAAG,OAAO;AAC5E,UAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,OAAO,EAAE;AAC/E,YAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO;AAC7D,UAAI,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,eAAe,QAAQ,MAAM,EAAE;AAC9E,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ;AACZ,aAAO;AACP,YAAM,OAAO,IAAI,aAAa,EAAE,OAAO,OAAO;AAC9C,YAAM,QAAQ,QAAQ,OAAO;AAC7B,YAAM,OAAO,QAAQ,OAAO;AAC5B,YAAM,OAAO,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;",
   "names": []
 }