@ai-ecoverse/slicc-agent 3.43.0 → 3.44.0

package/README.md

@@ -113,7 +113,7 @@ const owner = await startAgent({
 
 **Classifiers.** The Adobe provider also registers Cloudflare's Clef classifiers as `adobe/clef` and `adobe/clef-flash` (`adobeClassifiers()`): `type: 'classifier'` models on pi-ai's `cloudflare-workers-ai-system-one` API with `baseUrl: <proxy>/v1/ai`, so `models.classify(model, { state, questions })` posts `{ model: '@cf/cloudflare/clef', input }` to the proxy's `/v1/ai/run` with the IMS token as the bearer. The provider maps its short ids to the Workers AI names, and pi parses the answers and prices the usage ($0.24 per million input tokens for Clef, $0.09 for Clef Flash, nothing for output), which counts against the same weekly budget. They are classifiers only: `models.getModels()`, the settings `models` and the picker list chat models, and `models.getAvailableOfType('classifier', 'adobe')` returns them only while an Adobe token is stored.
 
-**Credentials.** They live in the IndexedDB database `slicc-agent-credentials`, sealed with AES-GCM under a non-extractable key that never leaves WebCrypto. They never enter the session database or the transcript, and followers never see them.
+**Model credentials.** They live in the IndexedDB database `slicc-agent-credentials`, sealed with AES-GCM under a non-extractable key that never leaves WebCrypto. They never enter the session database or the transcript, and followers never see them.
 
 **Settings.** The `slicc.agent.settings` service shows the models and accounts and takes `connect(providerId, apiKey)` and `disconnect(providerId)`.
 
@@ -363,9 +363,9 @@ pi core has no browser tooling, and Mario's pi-skills `browser-tools` launches i
 - **`curlwright`** (slicc-cdp ≥ 1.2.1) runs curl-style requests as a page-context `fetch()` in an open tab, with that tab's cookies and origin. The skill prefers it to UI clicks for reading data the app already fetches, and plain `curl` when no login is needed. Writes need the user's yes like clicks do, and response bodies are data.
 - **The `system` section** says the browser is connected when `SLICC_CDP_URL` is set and `playwright-cli` is on PATH (naming `curlwright` too when it's there), and lists it under "Not here yet" otherwise.
 - **Images:** durable's `read` doesn't return images, so a wrapper (`slicc-images`) answers `read` of a PNG, JPEG, GIF or WebP with image content. In a worker that can draw, images wider than 1600 px are scaled down, and an image over 1 MB of base64 is re-encoded as JPEG or refused with a hint. The adapter puts image content from a tool result on the tool card (`ToolCall.image`), so screenshots show in the chat.
-- **SLICC's own pages are off limits** (PRE-1). The `slicc-browser-guard` extension ([`src/browser/guard.ts`](src/browser/guard.ts)) refuses a `bash` call, direct or from codemode, that runs `playwright-cli` or `curlwright` and names a URL on SLICC's origin: `sliccy.ai`, `www.sliccy.ai`, any single-label `<name>.sliccy.ai` over https on port 443, and the origin the worker runs on (`location.origin`). It also refuses `*.kernel.localhost` names other than the agent's own kernel servers, `<port>.kernel.localhost` for a port 1–65535 other than the CDP facade's 9222. The answer is "SLICC's own pages can't be opened or driven from the browser tools.", and the `browser` skill says so too.
-  - **How it reads a command:** a shell tokenizer ([`src/browser/shell.ts`](src/browser/shell.ts)) removes quotes and escapes (`'…'`, `"…"`, `$'…'`, `$"…"`, `\`), and reads into `$(…)`, backticks, `<(…)` and words that are themselves scripts, such as `bash -c` and `eval` arguments, four levels deep. If any word is `playwright-cli` or `curlwright` (by its last path segment), every word is checked: as a URL, as `https://` plus the word, after a `NAME=` or `--flag=` prefix, and for URLs and `//host` inside it. `new URL()` normalises the host (case, IDNA, full-width characters, percent escapes, userinfo); a trailing dot is dropped, `ws:` counts as `http:`, `wss:` as `https:`, and `blob:`, `view-source:` and `filesystem:` are checked by their inner URL. A `http://` URL on a sliccy.ai name is refused too, since it redirects to https.
-  - **The list** lives in [`src/browser/origins.ts`](src/browser/origins.ts) (`protectedOrigins`, `isProtected(url, extra)`) until `@ai-ecoverse/slicc-browsers` ships it, with the same patterns and shape. `*.kernel.localhost` isn't on the shared list; that rule is this guard's own.
+- **SLICC's own pages are off limits** (PRE-1). The `slicc-browser-guard` extension ([`src/browser/guard.ts`](src/browser/guard.ts)) refuses a `bash` call, direct or from codemode, that runs `playwright-cli` or `curlwright` and names a protected URL: one that [`@ai-ecoverse/slicc-browsers`](https://github.com/ai-ecoverse/slicc-browsers#protected-origins)' `protectedOrigins` matcher protects, with the origin the worker runs on (`location.origin`) as its extra origin. That covers `sliccy.ai` and every name under it (including `www` and `vault`) over http or https on any port, the worker's origin, `devtools:`, and `blob:`, `filesystem:` and `view-source:` by their inner URL. It also refuses `*.kernel.localhost` names other than the agent's own kernel servers, `<port>.kernel.localhost` for a port 1–65535 other than the CDP facade's 9222. The answer is "SLICC's own pages can't be opened or driven from the browser tools.", and the `browser` skill says so too.
+  - **How it reads a command:** a shell tokenizer ([`src/browser/shell.ts`](src/browser/shell.ts)) removes quotes and escapes (`'…'`, `"…"`, `$'…'`, `$"…"`, `\`), and reads into `$(…)`, backticks, `<(…)` and words that are themselves scripts, such as `bash -c` and `eval` arguments, four levels deep. If any word is `playwright-cli` or `curlwright` (by its last path segment), every word is checked: as a URL, as `https://` plus the word, after a `NAME=` or `--flag=` prefix, and for URLs and `//host` inside it. Tabs and newlines are removed and surrounding spaces trimmed, as the URL parser does; the matcher parses with the WHATWG `URL`, so case, IDNA, full-width characters, percent escapes, backslashes and userinfo all count. `about:blank`, `about:srcdoc` and the empty URL are allowed: a tab `playwright-cli` opens has no SLICC opener, and a command that also names a protected URL is refused anyway.
+  - **The list** is slicc-browsers' `catalog.json` `protectedOrigins` with its reference matcher `protected.mjs`, wrapped by [`src/browser/origins.ts`](src/browser/origins.ts) (`protectedMatcher(extra)`); the unit tests run every URL and target vector in its `protected.json`. `*.kernel.localhost` isn't on the shared list; that rule is this guard's own. The build keeps the `with { type: 'json' }` import attribute, so the catalog loads unbundled.
   - **What it can't catch:** it's defence in depth, and the browser tools themselves (slicc-cdp, the kernel's CDP facade and slicc-cli's `cdp` link) enforce the rule. It doesn't see a URL built at run time (from a variable set elsewhere, `printf`, brace expansion or a file), a browser command whose name is built at run time, a script or program file that drives the browser, a tab id (`--tab`, `tab-select`) that points at a SLICC tab, or a page that navigates there by itself. It may refuse a command that only names a SLICC URL alongside a browser command, such as `curl https://seven.sliccy.ai && playwright-cli open https://example.com`.
 - There are no browser licks yet.
 
@@ -537,9 +537,19 @@ It prints the tab's stdout and stderr on their own streams and exits with its co
 - **What leaves the worker:** tool summaries of at most 200 characters (the tool's name and main argument), result summaries (a line count, or an error's first line), secrets redacted; never tool output.
 - **Bounds:** a stream nobody polls for two minutes is dropped, and one more than 10 000 events behind ends with `{ t: 'end', reason: 'error' }`.
 
+### Credentials
+
+The agent never holds a secret's value. Values live in the vault (`vault.sliccy.ai`); the agent sees names and placeholders (`fnox_proxy_…`), and every text that could reach the model is scrubbed through the vault first. The design is secrets rev 4 (§3.15–§3.18), and this part is AGENT-S1.
+
+- **The port.** bios posts `{ kernel, admin, vault, scrub }` to the worker, where `vault` is a `MessagePort` to the vault frame (role `agent`) and `scrub` the last-known `{ needed, version }`, or `null` when no vault ever connected. On a vault reload it posts `{ vault, scrub }` again, and the worker resends its unanswered ops. Without a port, or with `needed: false`, nothing is sent and every scrub is the identity. A `version` newer than the last pair read counts as `needed` until the new pair arrives.
+- **The wire.** Requests are `{ id, op, ... }` and answers `{ id, ok }` or `{ id, error }`, in request order: `redact { texts }` (strings and `Uint8Array`s, answered in the same order and types, with `version`), and the stream ops `redactStream`, `push { chunk }`, `end` and `drop`, each with the worker's `stream` id. The vault may push `{ scrub }` and `{ locked }` at any time.
+- **`slicc-secrets`**, a built-in extension modelled on [pi-fnox](https://github.com/Bucurenciu-Cristian/pi-fnox) (MIT, © 2026 Kicky), with its hooks mapped to pi-durable: `secret list --json` in the home env at start and whenever `version` changes (pi-fnox's `fnox export`; nothing goes into the worker's environment); an `afterTool` hook scrubbing every result's text, diagnostics and string `details` (pi-fnox's `tool_result`); a `secrets` system section with the names, placeholders, where each works and how to use them (`before_agent_start`); and `/secrets`, answered locally as a `slicc.secrets` entry (`/fnox-list`; reloading is automatic). When at least one secret is `shell = true`, every conversation command runs as `fnox exec --shell-grants -- <argv>` (pi-fnox's `spawnHook`). slicc-agent doesn't depend on `@kickythrust/pi-fnox`. Every conversation keeps the extension: new ones are pinned at creation, and conversations stored with an extension list that lacks it get it back at start.
+- **Where text is scrubbed before anything keeps or cuts it:** command output, per stream, before the bash tool's tail window, the spill file and the live slot; `read`'s bytes (images aren't, and files over 8 MiB stream in 1 MiB chunks); MCP results before their middle cut and progress text; codemode output before its cut; user and remote sends after skill expansion; every lick (sprinkle sends and scoop results included) before triage and the outbox; and memory writes, before the pattern redaction. Remote-control summaries are built from stored entries only.
+- **The hold.** A vault that doesn't answer within 2 s reads as `waiting`. Nothing unscrubbed is appended: tool results, sends and licks wait in memory, model requests wait before they start, and command output held past 32 MiB kills the command with "output held: waiting for the vault". The state is the transcript's `vault` field (`{ port, needed, version, locked, held }`), and remote `watch` streams get a `notice` "waiting for the vault" and one when it answers again.
+
 ## The kernel
 
-`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.47.1 <2`, the first kernel with users and the H1 wasm commands; until 3.31.0 the floor was 1.26.3): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.47.1), and the unit and integration tests run on it with the H1 wasm commands as devDependencies. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`), with the wasm commands certified for it (`NEWEST_CERTIFIED_WASM`). Today the floor is 1.47.1 and the newest certified kernel 1.62.3; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
+`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.47.1 <2`, the first kernel with users and the H1 wasm commands; until 3.31.0 the floor was 1.26.3): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.47.1), and the unit and integration tests run on it with the H1 wasm commands as devDependencies. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`), with the wasm commands certified for it (`NEWEST_CERTIFIED_WASM`). Today the floor is 1.47.1 and the newest certified kernel 1.64.2; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
 
 ## Patched dependencies
 

package/dist/agent.js

@@ -33,6 +33,7 @@ async function openAgent(options) {
   );
   const root = await harness.root(context, { agent: { model: options.model } });
   const agents = await openAgents(harness, root, context);
+  await options.beforeResume?.(harness, context);
   harness.resume();
   return {
     harness,

package/dist/agent.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/agent.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Models } from '@earendil-works/pi-ai/models';\nimport {\n  AssistantEntry,\n  type Conversation,\n  createRegistry,\n  type EntryId,\n  Harness,\n  type HarnessOptions,\n  MemoryStorage,\n  type ModelRef,\n  type Registry,\n  type Storage,\n} from '@earendil-works/pi-durable';\nimport { type Agents, openAgents } from './agents.ts';\nimport type { Cones } from './cone.ts';\n\nexport interface AgentOptions {\n  models: Models;\n  model: ModelRef;\n  storage?: Storage;\n  registry?: Registry;\n  settings?: HarnessOptions['settings'];\n  env?: HarnessOptions['env'];\n  context?: Context;\n}\n\nexport interface Agent extends Cones {\n  readonly harness: Harness;\n  readonly root: Conversation;\n  readonly agents: Agents;\n  onCone(listener: (conversation: Conversation) => void | Promise<void>): () => void;\n  prompt(text: string): Promise<string>;\n  close(): Promise<void>;\n}\n\ninterface Block {\n  type: string;\n  text?: string;\n}\n\nexport function answerText(content: unknown): string {\n  if (typeof content === 'string') return content;\n  if (!Array.isArray(content)) return '';\n  return (content as Block[])\n    .filter((block) => block.type === 'text')\n    .map((block) => block.text ?? '')\n    .join('');\n}\n\nasync function prompt(root: Conversation, text: string, context: Context): Promise<string> {\n  const submission = await root.submit({ type: 'input', content: text }, context);\n  const settled = await submission.wait(context);\n  const { answer, reason } = settled as { answer?: EntryId; reason?: string };\n  if (answer === undefined) throw new Error(`unanswered: ${reason}`);\n  const entry = await root.commit((tx) => tx.entry(AssistantEntry, answer), context);\n  return answerText(entry?.model?.[0]?.content);\n}\n\nexport async function openAgent(options: AgentOptions): Promise<Agent> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const harness = await Harness.open(\n    options.storage ?? new MemoryStorage(),\n    {\n      models: options.models,\n      registry: options.registry ?? createRegistry(),\n      ...(options.settings ? { settings: options.settings } : {}),\n      ...(options.env ? { env: options.env } : {}),\n    },\n    context\n  );\n  const root = await harness.root(context, { agent: { model: options.model } });\n  const agents = await openAgents(harness, root, context);\n  harness.resume();\n  return {\n    harness,\n    root,\n    agents,\n    cone: () => agents.cone(),\n    switchCone: (conversation, switching) => agents.switchCone(conversation, switching),\n    onCone: (listener) => agents.onCone(listener),\n    prompt: (text) => prompt(agents.cone(), text, context),\n    close: () => harness.close(context),\n  };\n}\n"],
-  "mappings": "AACA,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,OAIK;AACP,SAAsB,kBAAkB;AA2BjC,SAAS,WAAW,SAA0B;AACnD,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO;AACpC,SAAQ,QACL,OAAO,CAAC,UAAU,MAAM,SAAS,MAAM,EACvC,IAAI,CAAC,UAAU,MAAM,QAAQ,EAAE,EAC/B,KAAK,EAAE;AACZ;AAEA,eAAe,OAAO,MAAoB,MAAc,SAAmC;AACzF,QAAM,aAAa,MAAM,KAAK,OAAO,EAAE,MAAM,SAAS,SAAS,KAAK,GAAG,OAAO;AAC9E,QAAM,UAAU,MAAM,WAAW,KAAK,OAAO;AAC7C,QAAM,EAAE,QAAQ,OAAO,IAAI;AAC3B,MAAI,WAAW,OAAW,OAAM,IAAI,MAAM,eAAe,MAAM,EAAE;AACjE,QAAM,QAAQ,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,OAAO;AACjF,SAAO,WAAW,OAAO,QAAQ,CAAC,GAAG,OAAO;AAC9C;AAEA,eAAsB,UAAU,SAAuC;AACrE,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,WAAW,IAAI,cAAc;AAAA,IACrC;AAAA,MACE,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ,YAAY,eAAe;AAAA,MAC7C,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MACzD,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,OAAO,MAAM,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC5E,QAAM,SAAS,MAAM,WAAW,SAAS,MAAM,OAAO;AACtD,UAAQ,OAAO;AACf,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,MAAM,OAAO,KAAK;AAAA,IACxB,YAAY,CAAC,cAAc,cAAc,OAAO,WAAW,cAAc,SAAS;AAAA,IAClF,QAAQ,CAAC,aAAa,OAAO,OAAO,QAAQ;AAAA,IAC5C,QAAQ,CAAC,SAAS,OAAO,OAAO,KAAK,GAAG,MAAM,OAAO;AAAA,IACrD,OAAO,MAAM,QAAQ,MAAM,OAAO;AAAA,EACpC;AACF;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Models } from '@earendil-works/pi-ai/models';\nimport {\n  AssistantEntry,\n  type Conversation,\n  createRegistry,\n  type EntryId,\n  Harness,\n  type HarnessOptions,\n  MemoryStorage,\n  type ModelRef,\n  type Registry,\n  type Storage,\n} from '@earendil-works/pi-durable';\nimport { type Agents, openAgents } from './agents.ts';\nimport type { Cones } from './cone.ts';\n\nexport interface AgentOptions {\n  models: Models;\n  model: ModelRef;\n  storage?: Storage;\n  registry?: Registry;\n  settings?: HarnessOptions['settings'];\n  env?: HarnessOptions['env'];\n  context?: Context;\n  beforeResume?: (harness: Harness, context: Context) => Promise<unknown>;\n}\n\nexport interface Agent extends Cones {\n  readonly harness: Harness;\n  readonly root: Conversation;\n  readonly agents: Agents;\n  onCone(listener: (conversation: Conversation) => void | Promise<void>): () => void;\n  prompt(text: string): Promise<string>;\n  close(): Promise<void>;\n}\n\ninterface Block {\n  type: string;\n  text?: string;\n}\n\nexport function answerText(content: unknown): string {\n  if (typeof content === 'string') return content;\n  if (!Array.isArray(content)) return '';\n  return (content as Block[])\n    .filter((block) => block.type === 'text')\n    .map((block) => block.text ?? '')\n    .join('');\n}\n\nasync function prompt(root: Conversation, text: string, context: Context): Promise<string> {\n  const submission = await root.submit({ type: 'input', content: text }, context);\n  const settled = await submission.wait(context);\n  const { answer, reason } = settled as { answer?: EntryId; reason?: string };\n  if (answer === undefined) throw new Error(`unanswered: ${reason}`);\n  const entry = await root.commit((tx) => tx.entry(AssistantEntry, answer), context);\n  return answerText(entry?.model?.[0]?.content);\n}\n\nexport async function openAgent(options: AgentOptions): Promise<Agent> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const harness = await Harness.open(\n    options.storage ?? new MemoryStorage(),\n    {\n      models: options.models,\n      registry: options.registry ?? createRegistry(),\n      ...(options.settings ? { settings: options.settings } : {}),\n      ...(options.env ? { env: options.env } : {}),\n    },\n    context\n  );\n  const root = await harness.root(context, { agent: { model: options.model } });\n  const agents = await openAgents(harness, root, context);\n  await options.beforeResume?.(harness, context);\n  harness.resume();\n  return {\n    harness,\n    root,\n    agents,\n    cone: () => agents.cone(),\n    switchCone: (conversation, switching) => agents.switchCone(conversation, switching),\n    onCone: (listener) => agents.onCone(listener),\n    prompt: (text) => prompt(agents.cone(), text, context),\n    close: () => harness.close(context),\n  };\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,OAIK;AACP,SAAsB,kBAAkB;AA4BjC,SAAS,WAAW,SAA0B;AACnD,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO;AACpC,SAAQ,QACL,OAAO,CAAC,UAAU,MAAM,SAAS,MAAM,EACvC,IAAI,CAAC,UAAU,MAAM,QAAQ,EAAE,EAC/B,KAAK,EAAE;AACZ;AAEA,eAAe,OAAO,MAAoB,MAAc,SAAmC;AACzF,QAAM,aAAa,MAAM,KAAK,OAAO,EAAE,MAAM,SAAS,SAAS,KAAK,GAAG,OAAO;AAC9E,QAAM,UAAU,MAAM,WAAW,KAAK,OAAO;AAC7C,QAAM,EAAE,QAAQ,OAAO,IAAI;AAC3B,MAAI,WAAW,OAAW,OAAM,IAAI,MAAM,eAAe,MAAM,EAAE;AACjE,QAAM,QAAQ,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,OAAO;AACjF,SAAO,WAAW,OAAO,QAAQ,CAAC,GAAG,OAAO;AAC9C;AAEA,eAAsB,UAAU,SAAuC;AACrE,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,WAAW,IAAI,cAAc;AAAA,IACrC;AAAA,MACE,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ,YAAY,eAAe;AAAA,MAC7C,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MACzD,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,OAAO,MAAM,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC5E,QAAM,SAAS,MAAM,WAAW,SAAS,MAAM,OAAO;AACtD,QAAM,QAAQ,eAAe,SAAS,OAAO;AAC7C,UAAQ,OAAO;AACf,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,MAAM,OAAO,KAAK;AAAA,IACxB,YAAY,CAAC,cAAc,cAAc,OAAO,WAAW,cAAc,SAAS;AAAA,IAClF,QAAQ,CAAC,aAAa,OAAO,OAAO,QAAQ;AAAA,IAC5C,QAAQ,CAAC,SAAS,OAAO,OAAO,KAAK,GAAG,MAAM,OAAO;AAAA,IACrD,OAAO,MAAM,QAAQ,MAAM,OAAO;AAAA,EACpC;AACF;",
   "names": []
 }

package/dist/browser/guard.js

@@ -4,20 +4,14 @@ import {
   ToolTask,
   wrapTool
 } from "@earendil-works/pi-durable";
-import { isProtected } from "./origins.js";
+import { PROTECTED_RULES, protectedMatcher } from "./origins.js";
 import { words } from "./shell.js";
 const BROWSER_GUARD = "slicc-browser-guard";
 const REFUSAL = "SLICC's own pages can't be opened or driven from the browser tools.";
 const FACADE_PORT = 9222;
 const BROWSER = /* @__PURE__ */ new Set(["playwright-cli", "curlwright"]);
 const WEB = /* @__PURE__ */ new Set(["http:", "https:", "ws:", "wss:"]);
-const WRAPPED = /* @__PURE__ */ new Set(["blob:", "view-source:", "filesystem:"]);
-const SECURE = {
-  "http:": "http:",
-  "https:": "https:",
-  "ws:": "http:",
-  "wss:": "https:"
-};
+const INNER = new Set(PROTECTED_RULES.innerSchemes.map((scheme) => `${scheme}:`));
 const SCHEMED = /^[a-z][a-z0-9+.-]*:/i;
 const EMBEDDED = /[a-z][a-z0-9+.-]*:\/\/[^\s'"`<>(){}\\]+/gi;
 const RELATIVE = /(?<![:\w/])\/\/[^\s'"`<>(){}\\/]+/g;
@@ -35,20 +29,19 @@ function ownKernelServer(host) {
   const port = OWN_KERNEL.exec(host)?.[1];
   return port !== void 0 && Number(port) <= 65535 && Number(port) !== FACADE_PORT;
 }
-function forbidden(url, origins, depth = 0) {
-  const parsed = parse(url);
-  if (!parsed) return false;
-  if (WRAPPED.has(parsed.protocol)) {
-    const inner = parsed.href.slice(parsed.protocol.length);
-    return depth < 2 && [inner, `https://${inner}`].some((each) => forbidden(each, origins, depth + 1));
-  }
-  if (!WEB.has(parsed.protocol) || !parsed.hostname) return false;
+function foreignKernel(url) {
+  let parsed = parse(url);
+  for (let depth = 0; parsed && INNER.has(parsed.protocol) && depth < 8; depth++)
+    parsed = parse(parsed.href.slice(parsed.protocol.length));
+  if (!parsed || !WEB.has(parsed.protocol)) return false;
   const host = parsed.hostname.replace(/\.+$/, "");
-  if (host === KERNEL || host.endsWith(`.${KERNEL}`)) return !ownKernelServer(host);
-  const port = parsed.port ? `:${parsed.port}` : "";
-  return isProtected(`${SECURE[parsed.protocol]}//${host}${port}`, origins) || isProtected(`https://${host}${port}`);
+  return (host === KERNEL || host.endsWith(`.${KERNEL}`)) && !ownKernelServer(host);
+}
+function forbidden(url, matcher) {
+  return matcher.url(url) || foreignKernel(url);
 }
-function candidates(word) {
+function candidates(raw) {
+  const word = raw.replace(/[\t\n\r]/g, "").replace(/^[\0- ]+|[\0- ]+$/g, "");
   const value = word.replace(PREFIX, "");
   const found = [
     word,
@@ -64,10 +57,10 @@ function candidates(word) {
 function browserCommand(word) {
   return BROWSER.has(word.slice(word.lastIndexOf("/") + 1));
 }
-function refused(command, origins) {
+function refused(command, matcher) {
   const all = words(command);
   if (!all.some(browserCommand)) return false;
-  return all.some((word) => candidates(word).some((url) => forbidden(url, origins)));
+  return all.some((word) => candidates(word).some((url) => forbidden(url, matcher)));
 }
 function commandOf(args) {
   const command = args?.command;
@@ -75,18 +68,19 @@ function commandOf(args) {
 }
 function browserGuard(origins, tools) {
   const bash = tools.find((tool) => tool.name === "bash");
+  const matcher = protectedMatcher(origins);
   return defineExtension({
     name: BROWSER_GUARD,
     hooks: [
       hook(ToolTask, {
-        beforeTool: (call) => call.name === bash.name && refused(commandOf(call.arguments), origins) ? { block: REFUSAL } : void 0
+        beforeTool: (call) => call.name === bash.name && refused(commandOf(call.arguments), matcher) ? { block: REFUSAL } : void 0
       })
     ],
     wraps: [
       wrapTool(bash, (inner) => ({
         ...inner,
         execute(args, api, context) {
-          if (!refused(commandOf(args), origins)) return inner.execute(args, api, context);
+          if (!refused(commandOf(args), matcher)) return inner.execute(args, api, context);
           return Promise.resolve({ content: [{ type: "text", text: REFUSAL }], isError: true });
         }
       }))
@@ -100,6 +94,7 @@ export {
   browserGuard,
   candidates,
   forbidden,
+  foreignKernel,
   ownKernelServer,
   refused
 };

package/dist/browser/guard.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/browser/guard.ts"],
-  "sourcesContent": ["import {\n  defineExtension,\n  type Extension,\n  hook,\n  type ToolRegistration,\n  ToolTask,\n  wrapTool,\n} from '@earendil-works/pi-durable';\nimport { isProtected } from './origins.ts';\nimport { words } from './shell.ts';\n\nexport const BROWSER_GUARD = 'slicc-browser-guard';\nexport const REFUSAL = \"SLICC's own pages can't be opened or driven from the browser tools.\";\nexport const FACADE_PORT = 9222;\n\nconst BROWSER = new Set(['playwright-cli', 'curlwright']);\nconst WEB = new Set(['http:', 'https:', 'ws:', 'wss:']);\nconst WRAPPED = new Set(['blob:', 'view-source:', 'filesystem:']);\nconst SECURE: Record<string, string> = {\n  'http:': 'http:',\n  'https:': 'https:',\n  'ws:': 'http:',\n  'wss:': 'https:',\n};\nconst SCHEMED = /^[a-z][a-z0-9+.-]*:/i;\nconst EMBEDDED = /[a-z][a-z0-9+.-]*:\\/\\/[^\\s'\"`<>(){}\\\\]+/gi;\nconst RELATIVE = /(?<![:\\w/])\\/\\/[^\\s'\"`<>(){}\\\\/]+/g;\nconst PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;\nconst KERNEL = 'kernel.localhost';\nconst OWN_KERNEL = /^([1-9][0-9]{0,4})\\.kernel\\.localhost$/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function ownKernelServer(host: string): boolean {\n  const port = OWN_KERNEL.exec(host)?.[1];\n  return port !== undefined && Number(port) <= 65535 && Number(port) !== FACADE_PORT;\n}\n\nexport function forbidden(url: string, origins: readonly string[], depth = 0): boolean {\n  const parsed = parse(url);\n  if (!parsed) return false;\n  if (WRAPPED.has(parsed.protocol)) {\n    const inner = parsed.href.slice(parsed.protocol.length);\n    return (\n      depth < 2 && [inner, `https://${inner}`].some((each) => forbidden(each, origins, depth + 1))\n    );\n  }\n  if (!WEB.has(parsed.protocol) || !parsed.hostname) return false;\n  const host = parsed.hostname.replace(/\\.+$/, '');\n  if (host === KERNEL || host.endsWith(`.${KERNEL}`)) return !ownKernelServer(host);\n  const port = parsed.port ? `:${parsed.port}` : '';\n  return (\n    isProtected(`${SECURE[parsed.protocol]}//${host}${port}`, origins) ||\n    isProtected(`https://${host}${port}`)\n  );\n}\n\nexport function candidates(word: string): string[] {\n  const value = word.replace(PREFIX, '');\n  const found = [\n    word,\n    value,\n    ...(value.match(EMBEDDED) ?? []),\n    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`),\n  ];\n  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value))\n    found.push(`https://${value}`);\n  if (value.startsWith('//')) found.push(`https:${value}`);\n  return found.filter((each) => SCHEMED.test(each));\n}\n\nfunction browserCommand(word: string): boolean {\n  return BROWSER.has(word.slice(word.lastIndexOf('/') + 1));\n}\n\nexport function refused(command: string, origins: readonly string[]): boolean {\n  const all = words(command);\n  if (!all.some(browserCommand)) return false;\n  return all.some((word) => candidates(word).some((url) => forbidden(url, origins)));\n}\n\nfunction commandOf(args: unknown): string {\n  const command = (args as { command?: unknown } | undefined)?.command;\n  return typeof command === 'string' ? command : '';\n}\n\nexport function browserGuard(\n  origins: readonly string[],\n  tools: readonly ToolRegistration[]\n): Extension {\n  const bash = tools.find((tool) => tool.name === 'bash') as ToolRegistration;\n  return defineExtension({\n    name: BROWSER_GUARD,\n    hooks: [\n      hook(ToolTask, {\n        beforeTool: (call) =>\n          call.name === bash.name && refused(commandOf(call.arguments), origins)\n            ? { block: REFUSAL }\n            : undefined,\n      }),\n    ],\n    wraps: [\n      wrapTool(bash, (inner) => ({\n        ...inner,\n        execute(args, api, context) {\n          if (!refused(commandOf(args), origins)) return inner.execute(args, api, context);\n          return Promise.resolve({ content: [{ type: 'text', text: REFUSAL }], isError: true });\n        },\n      })),\n    ],\n  });\n}\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AAEf,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAChB,MAAM,cAAc;AAE3B,MAAM,UAAU,oBAAI,IAAI,CAAC,kBAAkB,YAAY,CAAC;AACxD,MAAM,MAAM,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,MAAM,CAAC;AACtD,MAAM,UAAU,oBAAI,IAAI,CAAC,SAAS,gBAAgB,aAAa,CAAC;AAChE,MAAM,SAAiC;AAAA,EACrC,SAAS;AAAA,EACT,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AACA,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,aAAa;AAEnB,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,MAAuB;AACrD,QAAM,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC;AACtC,SAAO,SAAS,UAAa,OAAO,IAAI,KAAK,SAAS,OAAO,IAAI,MAAM;AACzE;AAEO,SAAS,UAAU,KAAa,SAA4B,QAAQ,GAAY;AACrF,QAAM,SAAS,MAAM,GAAG;AACxB,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,QAAQ,IAAI,OAAO,QAAQ,GAAG;AAChC,UAAM,QAAQ,OAAO,KAAK,MAAM,OAAO,SAAS,MAAM;AACtD,WACE,QAAQ,KAAK,CAAC,OAAO,WAAW,KAAK,EAAE,EAAE,KAAK,CAAC,SAAS,UAAU,MAAM,SAAS,QAAQ,CAAC,CAAC;AAAA,EAE/F;AACA,MAAI,CAAC,IAAI,IAAI,OAAO,QAAQ,KAAK,CAAC,OAAO,SAAU,QAAO;AAC1D,QAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAC/C,MAAI,SAAS,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,EAAG,QAAO,CAAC,gBAAgB,IAAI;AAChF,QAAM,OAAO,OAAO,OAAO,IAAI,OAAO,IAAI,KAAK;AAC/C,SACE,YAAY,GAAG,OAAO,OAAO,QAAQ,CAAC,KAAK,IAAI,GAAG,IAAI,IAAI,OAAO,KACjE,YAAY,WAAW,IAAI,GAAG,IAAI,EAAE;AAExC;AAEO,SAAS,WAAW,MAAwB;AACjD,QAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE;AACrC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,GAAI,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,IAC9B,IAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,QAAQ,EAAE;AAAA,EACxE;AACA,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,2BAA2B,KAAK,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,EAAE;AAC/B,MAAI,MAAM,WAAW,IAAI,EAAG,OAAM,KAAK,SAAS,KAAK,EAAE;AACvD,SAAO,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClD;AAEA,SAAS,eAAe,MAAuB;AAC7C,SAAO,QAAQ,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAC1D;AAEO,SAAS,QAAQ,SAAiB,SAAqC;AAC5E,QAAM,MAAM,MAAM,OAAO;AACzB,MAAI,CAAC,IAAI,KAAK,cAAc,EAAG,QAAO;AACtC,SAAO,IAAI,KAAK,CAAC,SAAS,WAAW,IAAI,EAAE,KAAK,CAAC,QAAQ,UAAU,KAAK,OAAO,CAAC,CAAC;AACnF;AAEA,SAAS,UAAU,MAAuB;AACxC,QAAM,UAAW,MAA4C;AAC7D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEO,SAAS,aACd,SACA,OACW;AACX,QAAM,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM;AACtD,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,OAAO;AAAA,MACL,KAAK,UAAU;AAAA,QACb,YAAY,CAAC,SACX,KAAK,SAAS,KAAK,QAAQ,QAAQ,UAAU,KAAK,SAAS,GAAG,OAAO,IACjE,EAAE,OAAO,QAAQ,IACjB;AAAA,MACR,CAAC;AAAA,IACH;AAAA,IACA,OAAO;AAAA,MACL,SAAS,MAAM,CAAC,WAAW;AAAA,QACzB,GAAG;AAAA,QACH,QAAQ,MAAM,KAAK,SAAS;AAC1B,cAAI,CAAC,QAAQ,UAAU,IAAI,GAAG,OAAO,EAAG,QAAO,MAAM,QAAQ,MAAM,KAAK,OAAO;AAC/E,iBAAO,QAAQ,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC,GAAG,SAAS,KAAK,CAAC;AAAA,QACtF;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import {\n  defineExtension,\n  type Extension,\n  hook,\n  type ToolRegistration,\n  ToolTask,\n  wrapTool,\n} from '@earendil-works/pi-durable';\nimport { PROTECTED_RULES, type ProtectedMatcher, protectedMatcher } from './origins.ts';\nimport { words } from './shell.ts';\n\nexport const BROWSER_GUARD = 'slicc-browser-guard';\nexport const REFUSAL = \"SLICC's own pages can't be opened or driven from the browser tools.\";\nexport const FACADE_PORT = 9222;\n\nconst BROWSER = new Set(['playwright-cli', 'curlwright']);\nconst WEB = new Set(['http:', 'https:', 'ws:', 'wss:']);\nconst INNER = new Set(PROTECTED_RULES.innerSchemes.map((scheme) => `${scheme}:`));\nconst SCHEMED = /^[a-z][a-z0-9+.-]*:/i;\nconst EMBEDDED = /[a-z][a-z0-9+.-]*:\\/\\/[^\\s'\"`<>(){}\\\\]+/gi;\nconst RELATIVE = /(?<![:\\w/])\\/\\/[^\\s'\"`<>(){}\\\\/]+/g;\nconst PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;\nconst KERNEL = 'kernel.localhost';\nconst OWN_KERNEL = /^([1-9][0-9]{0,4})\\.kernel\\.localhost$/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function ownKernelServer(host: string): boolean {\n  const port = OWN_KERNEL.exec(host)?.[1];\n  return port !== undefined && Number(port) <= 65535 && Number(port) !== FACADE_PORT;\n}\n\nexport function foreignKernel(url: string): boolean {\n  let parsed = parse(url);\n  for (let depth = 0; parsed && INNER.has(parsed.protocol) && depth < 8; depth++)\n    parsed = parse(parsed.href.slice(parsed.protocol.length));\n  if (!parsed || !WEB.has(parsed.protocol)) return false;\n  const host = parsed.hostname.replace(/\\.+$/, '');\n  return (host === KERNEL || host.endsWith(`.${KERNEL}`)) && !ownKernelServer(host);\n}\n\nexport function forbidden(url: string, matcher: ProtectedMatcher): boolean {\n  return matcher.url(url) || foreignKernel(url);\n}\n\nexport function candidates(raw: string): string[] {\n  const word = raw.replace(/[\\t\\n\\r]/g, '').replace(/^[\\0- ]+|[\\0- ]+$/g, '');\n  const value = word.replace(PREFIX, '');\n  const found = [\n    word,\n    value,\n    ...(value.match(EMBEDDED) ?? []),\n    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`),\n  ];\n  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value))\n    found.push(`https://${value}`);\n  if (value.startsWith('//')) found.push(`https:${value}`);\n  return found.filter((each) => SCHEMED.test(each));\n}\n\nfunction browserCommand(word: string): boolean {\n  return BROWSER.has(word.slice(word.lastIndexOf('/') + 1));\n}\n\nexport function refused(command: string, matcher: ProtectedMatcher): boolean {\n  const all = words(command);\n  if (!all.some(browserCommand)) return false;\n  return all.some((word) => candidates(word).some((url) => forbidden(url, matcher)));\n}\n\nfunction commandOf(args: unknown): string {\n  const command = (args as { command?: unknown } | undefined)?.command;\n  return typeof command === 'string' ? command : '';\n}\n\nexport function browserGuard(\n  origins: readonly string[],\n  tools: readonly ToolRegistration[]\n): Extension {\n  const bash = tools.find((tool) => tool.name === 'bash') as ToolRegistration;\n  const matcher = protectedMatcher(origins);\n  return defineExtension({\n    name: BROWSER_GUARD,\n    hooks: [\n      hook(ToolTask, {\n        beforeTool: (call) =>\n          call.name === bash.name && refused(commandOf(call.arguments), matcher)\n            ? { block: REFUSAL }\n            : undefined,\n      }),\n    ],\n    wraps: [\n      wrapTool(bash, (inner) => ({\n        ...inner,\n        execute(args, api, context) {\n          if (!refused(commandOf(args), matcher)) return inner.execute(args, api, context);\n          return Promise.resolve({ content: [{ type: 'text', text: REFUSAL }], isError: true });\n        },\n      })),\n    ],\n  });\n}\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAwC,wBAAwB;AACzE,SAAS,aAAa;AAEf,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAChB,MAAM,cAAc;AAE3B,MAAM,UAAU,oBAAI,IAAI,CAAC,kBAAkB,YAAY,CAAC;AACxD,MAAM,MAAM,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,MAAM,CAAC;AACtD,MAAM,QAAQ,IAAI,IAAI,gBAAgB,aAAa,IAAI,CAAC,WAAW,GAAG,MAAM,GAAG,CAAC;AAChF,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,aAAa;AAEnB,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,MAAuB;AACrD,QAAM,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC;AACtC,SAAO,SAAS,UAAa,OAAO,IAAI,KAAK,SAAS,OAAO,IAAI,MAAM;AACzE;AAEO,SAAS,cAAc,KAAsB;AAClD,MAAI,SAAS,MAAM,GAAG;AACtB,WAAS,QAAQ,GAAG,UAAU,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACrE,aAAS,MAAM,OAAO,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;AAC1D,MAAI,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAG,QAAO;AACjD,QAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAC/C,UAAQ,SAAS,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,MAAM,CAAC,gBAAgB,IAAI;AAClF;AAEO,SAAS,UAAU,KAAa,SAAoC;AACzE,SAAO,QAAQ,IAAI,GAAG,KAAK,cAAc,GAAG;AAC9C;AAEO,SAAS,WAAW,KAAuB;AAChD,QAAM,OAAO,IAAI,QAAQ,aAAa,EAAE,EAAE,QAAQ,sBAAsB,EAAE;AAC1E,QAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE;AACrC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,GAAI,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,IAC9B,IAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,QAAQ,EAAE;AAAA,EACxE;AACA,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,2BAA2B,KAAK,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,EAAE;AAC/B,MAAI,MAAM,WAAW,IAAI,EAAG,OAAM,KAAK,SAAS,KAAK,EAAE;AACvD,SAAO,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClD;AAEA,SAAS,eAAe,MAAuB;AAC7C,SAAO,QAAQ,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAC1D;AAEO,SAAS,QAAQ,SAAiB,SAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO;AACzB,MAAI,CAAC,IAAI,KAAK,cAAc,EAAG,QAAO;AACtC,SAAO,IAAI,KAAK,CAAC,SAAS,WAAW,IAAI,EAAE,KAAK,CAAC,QAAQ,UAAU,KAAK,OAAO,CAAC,CAAC;AACnF;AAEA,SAAS,UAAU,MAAuB;AACxC,QAAM,UAAW,MAA4C;AAC7D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEO,SAAS,aACd,SACA,OACW;AACX,QAAM,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM;AACtD,QAAM,UAAU,iBAAiB,OAAO;AACxC,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,OAAO;AAAA,MACL,KAAK,UAAU;AAAA,QACb,YAAY,CAAC,SACX,KAAK,SAAS,KAAK,QAAQ,QAAQ,UAAU,KAAK,SAAS,GAAG,OAAO,IACjE,EAAE,OAAO,QAAQ,IACjB;AAAA,MACR,CAAC;AAAA,IACH;AAAA,IACA,OAAO;AAAA,MACL,SAAS,MAAM,CAAC,WAAW;AAAA,QACzB,GAAG;AAAA,QACH,QAAQ,MAAM,KAAK,SAAS;AAC1B,cAAI,CAAC,QAAQ,UAAU,IAAI,GAAG,OAAO,EAAG,QAAO,MAAM,QAAQ,MAAM,KAAK,OAAO;AAC/E,iBAAO,QAAQ,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC,GAAG,SAAS,KAAK,CAAC;AAAA,QACtF;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/browser/origins.js

@@ -1,41 +1,11 @@
-const protectedOrigins = {
-  patterns: ["https://sliccy.ai", "https://www.sliccy.ai", "https://*.sliccy.ai"]
-};
-const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-function parse(url) {
-  try {
-    return new URL(url);
-  } catch {
-    return void 0;
-  }
-}
-function hostOf(url) {
-  return url.hostname.replace(/\.+$/, "");
-}
-function originOf(url) {
-  const parsed = parse(url);
-  if (!parsed || !["http:", "https:"].includes(parsed.protocol) || !parsed.hostname)
-    return void 0;
-  return `${parsed.protocol}//${hostOf(parsed)}${parsed.port ? `:${parsed.port}` : ""}`;
-}
-function matches(pattern, url) {
-  const host = hostOf(url);
-  const wanted = pattern.slice("https://".length);
-  if (!wanted.startsWith("*.")) return host === wanted;
-  const suffix = wanted.slice(1);
-  return host.endsWith(suffix) && LABEL.test(host.slice(0, -suffix.length));
-}
-function isProtected(url, extra = []) {
-  const origin = originOf(url);
-  if (!origin) return false;
-  if (extra.some((other) => originOf(other) === origin)) return true;
-  const parsed = parse(url);
-  if (parsed.protocol !== "https:" || parsed.port) return false;
-  return protectedOrigins.patterns.some((pattern) => matches(pattern, parsed));
+import catalog from "@ai-ecoverse/slicc-browsers/catalog.json" with { type: "json" };
+import { protectedOrigins } from "@ai-ecoverse/slicc-browsers/protected.mjs";
+const PROTECTED_RULES = catalog.protectedOrigins;
+function protectedMatcher(extra = []) {
+  return protectedOrigins(PROTECTED_RULES, [...extra]);
 }
 export {
-  isProtected,
-  originOf,
-  protectedOrigins
+  PROTECTED_RULES,
+  protectedMatcher
 };
 //# sourceMappingURL=origins.js.map

package/dist/browser/origins.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/browser/origins.ts"],
-  "sourcesContent": ["export const protectedOrigins = {\n  patterns: ['https://sliccy.ai', 'https://www.sliccy.ai', 'https://*.sliccy.ai'],\n} as const;\n\nconst LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction hostOf(url: URL): string {\n  return url.hostname.replace(/\\.+$/, '');\n}\n\nexport function originOf(url: string): string | undefined {\n  const parsed = parse(url);\n  if (!parsed || !['http:', 'https:'].includes(parsed.protocol) || !parsed.hostname)\n    return undefined;\n  return `${parsed.protocol}//${hostOf(parsed)}${parsed.port ? `:${parsed.port}` : ''}`;\n}\n\nfunction matches(pattern: string, url: URL): boolean {\n  const host = hostOf(url);\n  const wanted = pattern.slice('https://'.length);\n  if (!wanted.startsWith('*.')) return host === wanted;\n  const suffix = wanted.slice(1);\n  return host.endsWith(suffix) && LABEL.test(host.slice(0, -suffix.length));\n}\n\nexport function isProtected(url: string, extra: readonly string[] = []): boolean {\n  const origin = originOf(url);\n  if (!origin) return false;\n  if (extra.some((other) => originOf(other) === origin)) return true;\n  const parsed = parse(url) as URL;\n  if (parsed.protocol !== 'https:' || parsed.port) return false;\n  return protectedOrigins.patterns.some((pattern) => matches(pattern, parsed));\n}\n"],
-  "mappings": "AAAO,MAAM,mBAAmB;AAAA,EAC9B,UAAU,CAAC,qBAAqB,yBAAyB,qBAAqB;AAChF;AAEA,MAAM,QAAQ;AAEd,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,OAAO,KAAkB;AAChC,SAAO,IAAI,SAAS,QAAQ,QAAQ,EAAE;AACxC;AAEO,SAAS,SAAS,KAAiC;AACxD,QAAM,SAAS,MAAM,GAAG;AACxB,MAAI,CAAC,UAAU,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,OAAO,QAAQ,KAAK,CAAC,OAAO;AACvE,WAAO;AACT,SAAO,GAAG,OAAO,QAAQ,KAAK,OAAO,MAAM,CAAC,GAAG,OAAO,OAAO,IAAI,OAAO,IAAI,KAAK,EAAE;AACrF;AAEA,SAAS,QAAQ,SAAiB,KAAmB;AACnD,QAAM,OAAO,OAAO,GAAG;AACvB,QAAM,SAAS,QAAQ,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,OAAO,WAAW,IAAI,EAAG,QAAO,SAAS;AAC9C,QAAM,SAAS,OAAO,MAAM,CAAC;AAC7B,SAAO,KAAK,SAAS,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC;AAC1E;AAEO,SAAS,YAAY,KAAa,QAA2B,CAAC,GAAY;AAC/E,QAAM,SAAS,SAAS,GAAG;AAC3B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,MAAM,EAAG,QAAO;AAC9D,QAAM,SAAS,MAAM,GAAG;AACxB,MAAI,OAAO,aAAa,YAAY,OAAO,KAAM,QAAO;AACxD,SAAO,iBAAiB,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,MAAM,CAAC;AAC7E;",
+  "sourcesContent": ["import catalog from '@ai-ecoverse/slicc-browsers/catalog.json' with { type: 'json' };\nimport { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs';\n\nexport const PROTECTED_RULES = catalog.protectedOrigins;\n\nexport interface ProtectedMatcher {\n  url(text: string): boolean;\n  target(target: { url: string; previous?: boolean; opener?: string }): boolean;\n  cookieDomain(domain: string): boolean;\n  storageKey(key: string): boolean;\n}\n\nexport function protectedMatcher(extra: readonly string[] = []): ProtectedMatcher {\n  return protectedOrigins(PROTECTED_RULES, [...extra]);\n}\n"],
+  "mappings": "AAAA,OAAO,aAAa,2CAA2C,KAAK,EAAE,MAAM,OAAO;AACnF,SAAS,wBAAwB;AAE1B,MAAM,kBAAkB,QAAQ;AAShC,SAAS,iBAAiB,QAA2B,CAAC,GAAqB;AAChF,SAAO,iBAAiB,iBAAiB,CAAC,GAAG,KAAK,CAAC;AACrD;",
   "names": []
 }

package/dist/client.js

@@ -83,7 +83,8 @@ async function connectAgent(endpoint, options = {}) {
     memoryScopes,
     frozen,
     changes,
-    monitor
+    monitor,
+    vault
   } = session.use(AgentTranscript);
   const settings = session.use(AgentSettings);
   const remote = session.use(AgentRemoteService);
@@ -116,6 +117,7 @@ async function connectAgent(endpoint, options = {}) {
     frozen: hold(frozen),
     changes: hold(changes),
     monitor: hold(monitor),
+    vault: hold(vault),
     settings: lastingSettings(settings, hold),
     remote,
     pages,

package/dist/client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/client.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceBinding,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport { Client, createClientServiceTransport } from '@earendil-works/pi-client';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  type Command,\n  type Delivered,\n  type MonitorFeed,\n  type SendMode,\n} from './services.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { PortChannel, type PortEndpoint } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly pages?: AgentPages;\n  readonly closed: Promise<Error | undefined>;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, region, context) =>\n      settings.connect(providerId, secret, region, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n  };\n}\n\nfunction attached(client: Client): Promise<void> {\n  return new Promise((resolve) => {\n    const stop = client.onAttachmentChange(() => {\n      stop();\n      resolve();\n    });\n  });\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const channel = new PortChannel(endpoint);\n  const serverId = await channel.hello;\n  const client = await Client.connect({ serverId, transportFactory: channel.transport });\n  const server = createRemoteServiceBinding({\n    services: [AgentSessions],\n    transport: createClientServiceTransport(client, () => ({ serverId })),\n    bound: true,\n  });\n  const ready = attached(client);\n  await server.use(AgentSessions).attach(AGENT_SESSION, context);\n  await ready;\n  const session = createRemoteServiceBinding({\n    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService, AgentPagesService],\n    transport: createClientServiceTransport(client, () => client.attachment),\n    bound: true,\n  });\n  const control = session.use(AgentControl);\n  const {\n    state: transcript,\n    deliveries,\n    agents,\n    views,\n    commands,\n    sprinkles,\n    memories,\n    memoryScopes,\n    frozen,\n    changes,\n    monitor,\n  } = session.use(AgentTranscript);\n  const settings = session.use(AgentSettings);\n  const remote = session.use(AgentRemoteService);\n  const pages = session.use(AgentPagesService);\n  await session.ready(context);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  const freeze = () => {\n    for (const kept of held) kept.freeze();\n  };\n  const closed = channel.ended.then((reason) => {\n    freeze();\n    return reason;\n  });\n  return {\n    serverId,\n    control,\n    transcript: hold(transcript),\n    deliveries: hold(deliveries),\n    agents: hold(agents),\n    views: hold(views),\n    commands: hold(commands),\n    sprinkles: hold(sprinkles),\n    memories: hold(memories),\n    memoryScopes: hold(memoryScopes),\n    frozen: hold(frozen),\n    changes: hold(changes),\n    monitor: hold(monitor),\n    settings: lastingSettings(settings, hold),\n    remote,\n    pages,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      freeze();\n      await server.use(AgentSessions).detach(context);\n      await session.dispose(context);\n      await server.dispose(context);\n      await client.dispose();\n    },\n  };\n}\n"],
-  "mappings": "AAAA;AAAA,EAEE;AAAA,OAEK;AACP,SAAS,0BAA0B;AACnC,SAAS,QAAQ,oCAAoC;AAOrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAKK;AAEP,SAAS,mBAAsC;AAiCxC,SAAS,QAAW,OAAuC;AAChE,MAAI;AACJ,MAAI,SAAS;AACb,QAAM,OAAO,MAAM;AACjB,QAAI,OAAQ,QAAO;AACnB,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,IAAI,QAAQ;AACV,eAAO,KAAK;AAAA,MACd;AAAA,MACA,WAAW,CAAC,aAAc,SAAS,MAAM,SAAY,MAAM,UAAU,QAAQ;AAAA,IAC/E;AAAA,IACA,SAAS;AACP,WAAK;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,SAAS,gBACP,UACA,MACe;AACf,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,KAAK;AAAA,IAC1B,SAAS,CAAC,YAAY,QAAQ,QAAQ,YACpC,SAAS,QAAQ,YAAY,QAAQ,QAAQ,OAAO;AAAA,IACtD,YAAY,CAAC,YAAY,YAAY,SAAS,WAAW,YAAY,OAAO;AAAA,IAC5E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,EACtE;AACF;AAEA,SAAS,SAAS,QAA+B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,OAAO,OAAO,mBAAmB,MAAM;AAC3C,WAAK;AACL,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,aACpB,UACA,UAAiC,CAAC,GACR;AAC1B,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,IAAI,YAAY,QAAQ;AACxC,QAAM,WAAW,MAAM,QAAQ;AAC/B,QAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,UAAU,kBAAkB,QAAQ,UAAU,CAAC;AACrF,QAAM,SAAS,2BAA2B;AAAA,IACxC,UAAU,CAAC,aAAa;AAAA,IACxB,WAAW,6BAA6B,QAAQ,OAAO,EAAE,SAAS,EAAE;AAAA,IACpE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,QAAQ,SAAS,MAAM;AAC7B,QAAM,OAAO,IAAI,aAAa,EAAE,OAAO,eAAe,OAAO;AAC7D,QAAM;AACN,QAAM,UAAU,2BAA2B;AAAA,IACzC,UAAU,CAAC,cAAc,iBAAiB,eAAe,oBAAoB,iBAAiB;AAAA,IAC9F,WAAW,6BAA6B,QAAQ,MAAM,OAAO,UAAU;AAAA,IACvE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,QAAM;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,QAAQ,IAAI,eAAe;AAC/B,QAAM,WAAW,QAAQ,IAAI,aAAa;AAC1C,QAAM,SAAS,QAAQ,IAAI,kBAAkB;AAC7C,QAAM,QAAQ,QAAQ,IAAI,iBAAiB;AAC3C,QAAM,QAAQ,MAAM,OAAO;AAC3B,QAAM,OAA2B,CAAC;AAClC,QAAM,OAAO,CAAI,UAAkD;AACjE,UAAM,OAAO,QAAQ,KAAK;AAC1B,SAAK,KAAK,IAAwB;AAClC,WAAO,KAAK;AAAA,EACd;AACA,QAAM,SAAS,MAAM;AACnB,eAAW,QAAQ,KAAM,MAAK,OAAO;AAAA,EACvC;AACA,QAAM,SAAS,QAAQ,MAAM,KAAK,CAAC,WAAW;AAC5C,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,KAAK,UAAU;AAAA,IAC3B,YAAY,KAAK,UAAU;AAAA,IAC3B,QAAQ,KAAK,MAAM;AAAA,IACnB,OAAO,KAAK,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,WAAW,KAAK,SAAS;AAAA,IACzB,UAAU,KAAK,QAAQ;AAAA,IACvB,cAAc,KAAK,YAAY;AAAA,IAC/B,QAAQ,KAAK,MAAM;AAAA,IACnB,SAAS,KAAK,OAAO;AAAA,IACrB,SAAS,KAAK,OAAO;AAAA,IACrB,UAAU,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,UAAU;AACtB,aAAO,QAAQ;AAAA,QACb;AAAA,QACA,EAAE,IAAI,SAAS,MAAM,MAAM,SAAS,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,WAAW,YAAY;AACxC,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,UAAU,WAAW,KAAK,GAAG,OAAO;AAC5E,UAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,OAAO,EAAE;AAC/E,YAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO;AAC7D,UAAI,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,eAAe,QAAQ,MAAM,EAAE;AAC9E,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ;AACZ,aAAO;AACP,YAAM,OAAO,IAAI,aAAa,EAAE,OAAO,OAAO;AAC9C,YAAM,QAAQ,QAAQ,OAAO;AAC7B,YAAM,OAAO,QAAQ,OAAO;AAC5B,YAAM,OAAO,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceBinding,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport { Client, createClientServiceTransport } from '@earendil-works/pi-client';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  type Command,\n  type Delivered,\n  type MonitorFeed,\n  type SendMode,\n} from './services.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { PortChannel, type PortEndpoint } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly vault?: ReplicatedState<VaultState>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly pages?: AgentPages;\n  readonly closed: Promise<Error | undefined>;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, region, context) =>\n      settings.connect(providerId, secret, region, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n  };\n}\n\nfunction attached(client: Client): Promise<void> {\n  return new Promise((resolve) => {\n    const stop = client.onAttachmentChange(() => {\n      stop();\n      resolve();\n    });\n  });\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const channel = new PortChannel(endpoint);\n  const serverId = await channel.hello;\n  const client = await Client.connect({ serverId, transportFactory: channel.transport });\n  const server = createRemoteServiceBinding({\n    services: [AgentSessions],\n    transport: createClientServiceTransport(client, () => ({ serverId })),\n    bound: true,\n  });\n  const ready = attached(client);\n  await server.use(AgentSessions).attach(AGENT_SESSION, context);\n  await ready;\n  const session = createRemoteServiceBinding({\n    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService, AgentPagesService],\n    transport: createClientServiceTransport(client, () => client.attachment),\n    bound: true,\n  });\n  const control = session.use(AgentControl);\n  const {\n    state: transcript,\n    deliveries,\n    agents,\n    views,\n    commands,\n    sprinkles,\n    memories,\n    memoryScopes,\n    frozen,\n    changes,\n    monitor,\n    vault,\n  } = session.use(AgentTranscript);\n  const settings = session.use(AgentSettings);\n  const remote = session.use(AgentRemoteService);\n  const pages = session.use(AgentPagesService);\n  await session.ready(context);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  const freeze = () => {\n    for (const kept of held) kept.freeze();\n  };\n  const closed = channel.ended.then((reason) => {\n    freeze();\n    return reason;\n  });\n  return {\n    serverId,\n    control,\n    transcript: hold(transcript),\n    deliveries: hold(deliveries),\n    agents: hold(agents),\n    views: hold(views),\n    commands: hold(commands),\n    sprinkles: hold(sprinkles),\n    memories: hold(memories),\n    memoryScopes: hold(memoryScopes),\n    frozen: hold(frozen),\n    changes: hold(changes),\n    monitor: hold(monitor),\n    vault: hold(vault),\n    settings: lastingSettings(settings, hold),\n    remote,\n    pages,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      freeze();\n      await server.use(AgentSessions).detach(context);\n      await session.dispose(context);\n      await server.dispose(context);\n      await client.dispose();\n    },\n  };\n}\n"],
+  "mappings": "AAAA;AAAA,EAEE;AAAA,OAEK;AACP,SAAS,0BAA0B;AACnC,SAAS,QAAQ,oCAAoC;AAQrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAKK;AAEP,SAAS,mBAAsC;AAkCxC,SAAS,QAAW,OAAuC;AAChE,MAAI;AACJ,MAAI,SAAS;AACb,QAAM,OAAO,MAAM;AACjB,QAAI,OAAQ,QAAO;AACnB,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,IAAI,QAAQ;AACV,eAAO,KAAK;AAAA,MACd;AAAA,MACA,WAAW,CAAC,aAAc,SAAS,MAAM,SAAY,MAAM,UAAU,QAAQ;AAAA,IAC/E;AAAA,IACA,SAAS;AACP,WAAK;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,SAAS,gBACP,UACA,MACe;AACf,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,KAAK;AAAA,IAC1B,SAAS,CAAC,YAAY,QAAQ,QAAQ,YACpC,SAAS,QAAQ,YAAY,QAAQ,QAAQ,OAAO;AAAA,IACtD,YAAY,CAAC,YAAY,YAAY,SAAS,WAAW,YAAY,OAAO;AAAA,IAC5E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,EACtE;AACF;AAEA,SAAS,SAAS,QAA+B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,OAAO,OAAO,mBAAmB,MAAM;AAC3C,WAAK;AACL,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,aACpB,UACA,UAAiC,CAAC,GACR;AAC1B,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,IAAI,YAAY,QAAQ;AACxC,QAAM,WAAW,MAAM,QAAQ;AAC/B,QAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,UAAU,kBAAkB,QAAQ,UAAU,CAAC;AACrF,QAAM,SAAS,2BAA2B;AAAA,IACxC,UAAU,CAAC,aAAa;AAAA,IACxB,WAAW,6BAA6B,QAAQ,OAAO,EAAE,SAAS,EAAE;AAAA,IACpE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,QAAQ,SAAS,MAAM;AAC7B,QAAM,OAAO,IAAI,aAAa,EAAE,OAAO,eAAe,OAAO;AAC7D,QAAM;AACN,QAAM,UAAU,2BAA2B;AAAA,IACzC,UAAU,CAAC,cAAc,iBAAiB,eAAe,oBAAoB,iBAAiB;AAAA,IAC9F,WAAW,6BAA6B,QAAQ,MAAM,OAAO,UAAU;AAAA,IACvE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,QAAM;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,QAAQ,IAAI,eAAe;AAC/B,QAAM,WAAW,QAAQ,IAAI,aAAa;AAC1C,QAAM,SAAS,QAAQ,IAAI,kBAAkB;AAC7C,QAAM,QAAQ,QAAQ,IAAI,iBAAiB;AAC3C,QAAM,QAAQ,MAAM,OAAO;AAC3B,QAAM,OAA2B,CAAC;AAClC,QAAM,OAAO,CAAI,UAAkD;AACjE,UAAM,OAAO,QAAQ,KAAK;AAC1B,SAAK,KAAK,IAAwB;AAClC,WAAO,KAAK;AAAA,EACd;AACA,QAAM,SAAS,MAAM;AACnB,eAAW,QAAQ,KAAM,MAAK,OAAO;AAAA,EACvC;AACA,QAAM,SAAS,QAAQ,MAAM,KAAK,CAAC,WAAW;AAC5C,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,KAAK,UAAU;AAAA,IAC3B,YAAY,KAAK,UAAU;AAAA,IAC3B,QAAQ,KAAK,MAAM;AAAA,IACnB,OAAO,KAAK,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,WAAW,KAAK,SAAS;AAAA,IACzB,UAAU,KAAK,QAAQ;AAAA,IACvB,cAAc,KAAK,YAAY;AAAA,IAC/B,QAAQ,KAAK,MAAM;AAAA,IACnB,SAAS,KAAK,OAAO;AAAA,IACrB,SAAS,KAAK,OAAO;AAAA,IACrB,OAAO,KAAK,KAAK;AAAA,IACjB,UAAU,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,UAAU;AACtB,aAAO,QAAQ;AAAA,QACb;AAAA,QACA,EAAE,IAAI,SAAS,MAAM,MAAM,SAAS,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,WAAW,YAAY;AACxC,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,UAAU,WAAW,KAAK,GAAG,OAAO;AAC5E,UAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,OAAO,EAAE;AAC/E,YAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO;AAC7D,UAAI,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,eAAe,QAAQ,MAAM,EAAE;AAC9E,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ;AACZ,aAAO;AACP,YAAM,OAAO,IAAI,aAAa,EAAE,OAAO,OAAO;AAC9C,YAAM,QAAQ,QAAQ,OAAO;AAC7B,YAAM,OAAO,QAAQ,OAAO;AAC5B,YAAM,OAAO,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/codemode/index.js

@@ -12,6 +12,7 @@ import {
   defineExtension,
   defineTool
 } from "@earendil-works/pi-durable";
+import { scrubItems } from "../secrets/scrub.js";
 const CODEMODE = "codemode";
 const DEFAULT_MAX_OUTPUT_TOKENS = 1e4;
 const MEMORY_LIMIT_BYTES = 256 * 1024 * 1024;
@@ -217,7 +218,7 @@ function codemodeTool(options) {
 ${formatError(result.error, result.calls)}`
         });
       const cut = truncate(
-        joinText(items),
+        await scrubItems(joinText(items)),
         parsed.options.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS
       );
       const path = cut.full === null ? "" : await spill(api, cut.full, context);

package/dist/codemode/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/codemode/index.ts"],
-  "sourcesContent": ["import type { Context, JsonValue } from '@earendil-works/chord';\nimport { withAbortSignal } from '@earendil-works/chord/context';\nimport { Type } from '@earendil-works/pi-ai';\nimport { validateToolArguments } from '@earendil-works/pi-ai/utils/validation';\nimport {\n  type CodemodeError,\n  type CodemodeJsonSchema,\n  type CodemodeOutputItem,\n  type CodemodeResult,\n  CodemodeSandbox,\n  type CodemodeSandboxOptions,\n  type CodemodeTool,\n  loadQuickJSWasm,\n  parseCodemodeSource,\n  renderDeclarations,\n} from '@earendil-works/pi-codemode';\nimport {\n  type Agent,\n  defineDoc,\n  defineExtension,\n  defineTool,\n  type Extension,\n  type ToolExecutionApi,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\n\nexport const CODEMODE = 'codemode';\nexport const DEFAULT_MAX_OUTPUT_TOKENS = 10_000;\nexport const MEMORY_LIMIT_BYTES = 256 * 1024 * 1024;\nconst CHARS_PER_TOKEN = 4;\n\nexport const CodemodeDoc = defineDoc<{ store: Record<string, JsonValue> }>({\n  kind: 'slicc.codemode',\n  version: 1,\n  scope: 'conversation',\n  history: 'rewindable',\n  fork: 'asOf',\n  initial: () => ({ store: {} }),\n});\n\nexport interface Sandbox {\n  execute(\n    code: string,\n    options: { signal?: AbortSignal; store?: Record<string, unknown> }\n  ): Promise<CodemodeResult>;\n  close(): Promise<void>;\n}\n\nexport type SandboxFactory = (options: CodemodeSandboxOptions) => Sandbox;\n\nexport interface CodemodeExtra {\n  tools: CodemodeTool[];\n  globals: CodemodeTool[];\n}\n\nexport interface CodemodeOptions {\n  sandbox: SandboxFactory;\n  declared: readonly ToolRegistration[];\n  extra?: (api: ToolExecutionApi, agent: Agent, context: Context) => Promise<CodemodeExtra>;\n}\n\nconst INTRO = `Run JavaScript that calls other tools. The input is raw JavaScript (not JSON, no code fence), run as an async function body in a QuickJS sandbox: top-level \\`await\\` and \\`return\\` work. No Node, file system, network, or timers.\n- \\`await tools.<name>({ ...args })\\` resolves to a string, or an object if the tool's declaration says so, and rejects with an Error on failure. Calls still running when the script ends are cancelled.\n- Optional first line: \\`// @options: {\"max_output_tokens\": 10000, \"timeout_ms\": 60000}\\``;\n\nconst GLOBALS = [\n  'Globals:',\n  '- `text(value)`, `image(dataUrlOrImageBlock)`, `console.log(...)`, and top-level `return` add output; `exit()` ends the script. With several text items, each starts with a `==> text N/M <==` line, and `console` lines follow the other output in one `<console_output>` block.',\n  '- `store(key, value)` and `load(key)` keep JSON values across codemode calls in this conversation.',\n  '- `ALL_TOOLS` lists every tool scripts can call.',\n].join('\\n');\n\nconst DISCOVERY =\n  '- `await searchTools(query, { limit?, namespace? })`, `await describeTool(name)`, `await describeNamespace(name)`: find unlisted tools, such as MCP tools.';\n\nconst BASH_OUTPUT: CodemodeJsonSchema = {\n  type: 'object',\n  properties: { output: { type: 'string' }, exit_code: { type: 'number' } },\n  required: ['output', 'exit_code'],\n};\n\nfunction scriptTool(tool: ToolRegistration): Omit<CodemodeTool, 'execute'> {\n  return {\n    name: tool.name,\n    description: tool.description,\n    inputSchema: tool.parameters as CodemodeJsonSchema,\n    ...(tool.name === 'bash' ? { outputSchema: BASH_OUTPUT } : {}),\n  };\n}\n\nexport function codemodeDescription(\n  declared: readonly ToolRegistration[],\n  discovery = false\n): string {\n  const tools = declared\n    .filter((tool) => tool.name !== CODEMODE)\n    .map((tool) => ({ ...scriptTool(tool), execute: () => undefined }));\n  const sections = [INTRO, discovery ? `${GLOBALS}\\n${DISCOVERY}` : GLOBALS];\n  if (tools.length) sections.push(`Nested tools:\\n${renderDeclarations({ tools })}`);\n  return sections.join('\\n\\n');\n}\n\nfunction textOf(content: readonly { type: string; text?: string }[] | undefined): string {\n  return (content ?? [])\n    .filter((part) => part.type === 'text')\n    .map((part) => part.text)\n    .join('\\n');\n}\n\nexport async function callNested(\n  tool: ToolRegistration,\n  args: unknown,\n  api: ToolExecutionApi,\n  context: Context,\n  id: string\n): Promise<unknown> {\n  const prepared = tool.prepareArguments ? tool.prepareArguments(args) : args;\n  const valid = validateToolArguments(tool, {\n    type: 'toolCall',\n    id,\n    name: tool.name,\n    arguments: prepared as never,\n  });\n  const decoder = new TextDecoder();\n  let output = '';\n  const nested: ToolExecutionApi = {\n    ...api,\n    callId: id,\n    outputWindow: undefined,\n    output: (chunk) => {\n      output += typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });\n    },\n    diagnostic: () => undefined,\n    details: async () => undefined,\n  };\n  const bash = tool.name === 'bash';\n  try {\n    const result = await tool.execute(valid, nested, context);\n    const text = result.content ? textOf(result.content) : output;\n    if (result.isError) throw new Error(text || `Tool \"${tool.name}\" failed`);\n    return bash ? { output: text, exit_code: 0 } : text;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    const exit = /exited with code (\\d+)/.exec(message);\n    if (bash && exit) return { output, exit_code: Number(exit[1]) };\n    throw new Error(message);\n  }\n}\n\nfunction valueText(value: unknown): string {\n  return typeof value === 'string' ? value : (JSON.stringify(value) ?? String(value));\n}\n\nexport function formatOutput(output: readonly CodemodeOutputItem[]): CodemodeOutputItem[] {\n  const total = output.filter((item) => item.type === 'text' && !item.console).length;\n  const items: CodemodeOutputItem[] = [];\n  const lines: string[] = [];\n  let index = 0;\n  for (const item of output) {\n    if (item.type === 'image') items.push(item);\n    else if (item.console) lines.push(item.text);\n    else {\n      index++;\n      items.push({\n        type: 'text',\n        text: total > 1 ? `==> text ${index}/${total} <==\\n${item.text}` : item.text,\n      });\n    }\n  }\n  if (lines.length)\n    items.push({ type: 'text', text: `<console_output>\\n${lines.join('\\n')}\\n</console_output>` });\n  return items;\n}\n\nexport function joinText(items: readonly CodemodeOutputItem[]): CodemodeOutputItem[] {\n  const joined: CodemodeOutputItem[] = [];\n  for (const item of items) {\n    const last = joined.at(-1);\n    if (item.type === 'text' && last?.type === 'text') {\n      const separator = last.text === '' || last.text.endsWith('\\n') ? '' : '\\n';\n      joined[joined.length - 1] = { type: 'text', text: `${last.text}${separator}${item.text}` };\n    } else joined.push(item);\n  }\n  return joined;\n}\n\nexport function formatError(error: CodemodeError, calls: CodemodeResult['calls']): string {\n  const heads: Record<string, string> = {\n    timeout: `Script timed out: ${error.message}`,\n    aborted: `Script aborted: ${error.message}`,\n    sandbox: `Script sandbox failed: ${error.message}`,\n  };\n  const head =\n    error.kind === 'script'\n      ? (error.stack ?? `${error.name ?? 'Error'}: ${error.message}`)\n      : heads[error.kind];\n  const summary = calls.length\n    ? `Tool calls made before the failure (they are not undone): ${calls.map((call) => `${call.name} (${call.status})`).join(', ')}`\n    : 'No tool calls were made.';\n  return `${head}\\n\\n${summary}`;\n}\n\nexport function truncate(\n  items: readonly CodemodeOutputItem[],\n  maxTokens: number\n): { items: CodemodeOutputItem[]; full: string | null } {\n  const text = items\n    .filter((item) => item.type === 'text')\n    .map((item) => item.text)\n    .join('\\n');\n  const limit = maxTokens * CHARS_PER_TOKEN;\n  if (text.length <= limit) return { items: [...items], full: null };\n  const half = Math.floor(limit / 2);\n  const kept = `${text.slice(0, half)}\\n\\n[\u2026 ${text.length - 2 * half} characters omitted \u2026]\\n\\n${text.slice(-half)}`;\n  return {\n    items: [{ type: 'text', text: kept }, ...items.filter((item) => item.type === 'image')],\n    full: text,\n  };\n}\n\nasync function spill(api: ToolExecutionApi, text: string, context: Context): Promise<string> {\n  const path = `/tmp/slicc-codemode-${api.callId.replace(/[^\\w-]/g, '_')}.txt`;\n  const written = await api.env?.writeFile(path, text, context);\n  return written?.ok ? path : '';\n}\n\nasync function saveStore(\n  api: ToolExecutionApi,\n  result: CodemodeResult,\n  context: Context\n): Promise<void> {\n  if (!result.ok) return;\n  const { set, delete: removed } = result.storeWrites;\n  if (!Object.keys(set).length && !removed.length) return;\n  await api.commit(async (tx) => {\n    const doc = await tx.doc(CodemodeDoc, api.conversationId);\n    for (const key of removed) delete doc.store[key];\n    Object.assign(doc.store, set);\n  }, context);\n}\n\nexport function codemodeTool(options: CodemodeOptions): ToolRegistration {\n  return defineTool({\n    name: CODEMODE,\n    description: codemodeDescription(options.declared, options.extra !== undefined),\n    parameters: Type.Object({ code: Type.String({ description: 'Raw JavaScript source.' }) }),\n    replay: 'unsafe',\n    async execute({ code }, api, context) {\n      const started = performance.now();\n      const parsed = parseCodemodeSource(code);\n      const agent = await api.agent(context);\n      const callable = agent.tools.filter((tool) => tool.name !== CODEMODE);\n      let count = 0;\n      const tools: CodemodeTool[] = callable.map((tool) => ({\n        ...scriptTool(tool),\n        execute: (args, { signal }) =>\n          callNested(tool, args, api, withAbortSignal(signal, context), `${api.callId}:${++count}`),\n      }));\n      const extra = options.extra\n        ? await options.extra(api, agent, context)\n        : { tools: [], globals: [] };\n      const replaced = new Set(extra.tools.map((tool) => tool.name));\n      const scripted = [...tools.filter((tool) => !replaced.has(tool.name)), ...extra.tools];\n      const saved = await api.snapshot(CodemodeDoc, api.conversationId, context);\n      const sandbox = options.sandbox({\n        tools: scripted,\n        ...(extra.globals.length ? { globals: extra.globals } : {}),\n        timeoutMs: parsed.options.timeoutMs ?? Number.POSITIVE_INFINITY,\n        memoryLimitBytes: MEMORY_LIMIT_BYTES,\n      });\n      let result: CodemodeResult;\n      try {\n        result = await sandbox.execute(parsed.code, {\n          signal: context.abortSignal as AbortSignal,\n          store: { ...saved?.store },\n        });\n      } finally {\n        await sandbox.close();\n      }\n      await saveStore(api, result, context);\n      const output = [...result.output];\n      if (result.ok && result.value !== undefined)\n        output.push({ type: 'text', text: valueText(result.value) });\n      const items = formatOutput(output);\n      if (!result.ok)\n        items.push({\n          type: 'text',\n          text: `Script error:\\n${formatError(result.error, result.calls)}`,\n        });\n      const cut = truncate(\n        joinText(items),\n        parsed.options.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS\n      );\n      const path = cut.full === null ? '' : await spill(api, cut.full, context);\n      const note = path ? [{ type: 'text' as const, text: `Full output: ${path}` }] : [];\n      const seconds = ((performance.now() - started) / 1000).toFixed(1);\n      const header = `${result.ok ? 'Script completed' : 'Script failed'}\\nWall time ${seconds} seconds\\nOutput:\\n`;\n      return {\n        content: [{ type: 'text', text: header }, ...joinText([...cut.items, ...note])],\n        ...(result.ok ? {} : { isError: true }),\n      };\n    },\n  }) as ToolRegistration;\n}\n\nexport function codemodeExtension(tools: readonly ToolRegistration[]): Extension {\n  return defineExtension({ name: 'slicc-codemode', tools });\n}\n\nexport function disabledBySettings(text: string | undefined): boolean {\n  if (!text) return false;\n  try {\n    const settings = JSON.parse(text) as { defaultTools?: unknown };\n    return Array.isArray(settings.defaultTools) && settings.defaultTools.includes(`-${CODEMODE}`);\n  } catch {\n    return false;\n  }\n}\n\nexport type Fetcher = (url: string) => Promise<Response>;\n\nexport function wasmCandidates(from: URL): string[] {\n  const out: string[] = [];\n  let dir = new URL('.', from);\n  for (;;) {\n    out.push(new URL('node_modules/quickjs-wasi/quickjs.wasm', dir).href);\n    if (dir.pathname === '/') return out;\n    dir = new URL('..', dir);\n  }\n}\n\nexport async function locateWasm(\n  fetcher: Fetcher,\n  from: URL\n): Promise<WebAssembly.Module | undefined> {\n  for (const url of wasmCandidates(from)) {\n    const response = await fetcher(url).catch(() => undefined);\n    if (response?.ok) return WebAssembly.compile(await response.arrayBuffer());\n  }\n  return undefined;\n}\n\nexport function sandboxFactory(\n  wasm: () => Promise<WebAssembly.Module | undefined>,\n  workerUrl?: string | URL\n): SandboxFactory {\n  let found: Promise<WebAssembly.Module | undefined> | undefined;\n  return (options) => {\n    found ??= wasm().catch(() => undefined);\n    return new CodemodeSandbox({\n      ...options,\n      ...(workerUrl ? { workerUrl } : {}),\n      wasm: found.then((module) => module ?? loadQuickJSWasm()),\n    });\n  };\n}\n"],
-  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EAKE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEA,MAAM,WAAW;AACjB,MAAM,4BAA4B;AAClC,MAAM,qBAAqB,MAAM,OAAO;AAC/C,MAAM,kBAAkB;AAEjB,MAAM,cAAc,UAAgD;AAAA,EACzE,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,SAAS;AAAA,EACT,MAAM;AAAA,EACN,SAAS,OAAO,EAAE,OAAO,CAAC,EAAE;AAC9B,CAAC;AAuBD,MAAM,QAAQ;AAAA;AAAA;AAId,MAAM,UAAU;AAAA,EACd;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEX,MAAM,YACJ;AAEF,MAAM,cAAkC;AAAA,EACtC,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,GAAG,WAAW,EAAE,MAAM,SAAS,EAAE;AAAA,EACxE,UAAU,CAAC,UAAU,WAAW;AAClC;AAEA,SAAS,WAAW,MAAuD;AACzE,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,SAAS,SAAS,EAAE,cAAc,YAAY,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,SAAS,oBACd,UACA,YAAY,OACJ;AACR,QAAM,QAAQ,SACX,OAAO,CAAC,SAAS,KAAK,SAAS,QAAQ,EACvC,IAAI,CAAC,UAAU,EAAE,GAAG,WAAW,IAAI,GAAG,SAAS,MAAM,OAAU,EAAE;AACpE,QAAM,WAAW,CAAC,OAAO,YAAY,GAAG,OAAO;AAAA,EAAK,SAAS,KAAK,OAAO;AACzE,MAAI,MAAM,OAAQ,UAAS,KAAK;AAAA,EAAkB,mBAAmB,EAAE,MAAM,CAAC,CAAC,EAAE;AACjF,SAAO,SAAS,KAAK,MAAM;AAC7B;AAEA,SAAS,OAAO,SAAyE;AACvF,UAAQ,WAAW,CAAC,GACjB,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,KAAK,IAAI;AACd;AAEA,eAAsB,WACpB,MACA,MACA,KACA,SACA,IACkB;AAClB,QAAM,WAAW,KAAK,mBAAmB,KAAK,iBAAiB,IAAI,IAAI;AACvE,QAAM,QAAQ,sBAAsB,MAAM;AAAA,IACxC,MAAM;AAAA,IACN;AAAA,IACA,MAAM,KAAK;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,SAAS;AACb,QAAM,SAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,QAAQ,CAAC,UAAU;AACjB,gBAAU,OAAO,UAAU,WAAW,QAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,IACtF;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,YAAY;AAAA,EACvB;AACA,QAAM,OAAO,KAAK,SAAS;AAC3B,MAAI;AACF,UAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO;AACxD,UAAM,OAAO,OAAO,UAAU,OAAO,OAAO,OAAO,IAAI;AACvD,QAAI,OAAO,QAAS,OAAM,IAAI,MAAM,QAAQ,SAAS,KAAK,IAAI,UAAU;AACxE,WAAO,OAAO,EAAE,QAAQ,MAAM,WAAW,EAAE,IAAI;AAAA,EACjD,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,OAAO,yBAAyB,KAAK,OAAO;AAClD,QAAI,QAAQ,KAAM,QAAO,EAAE,QAAQ,WAAW,OAAO,KAAK,CAAC,CAAC,EAAE;AAC9D,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AACF;AAEA,SAAS,UAAU,OAAwB;AACzC,SAAO,OAAO,UAAU,WAAW,QAAS,KAAK,UAAU,KAAK,KAAK,OAAO,KAAK;AACnF;AAEO,SAAS,aAAa,QAA6D;AACxF,QAAM,QAAQ,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,UAAU,CAAC,KAAK,OAAO,EAAE;AAC7E,QAAM,QAA8B,CAAC;AACrC,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAQ;AACZ,aAAW,QAAQ,QAAQ;AACzB,QAAI,KAAK,SAAS,QAAS,OAAM,KAAK,IAAI;AAAA,aACjC,KAAK,QAAS,OAAM,KAAK,KAAK,IAAI;AAAA,SACtC;AACH;AACA,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,QAAQ,IAAI,YAAY,KAAK,IAAI,KAAK;AAAA,EAAS,KAAK,IAAI,KAAK,KAAK;AAAA,MAC1E,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,MAAM;AACR,UAAM,KAAK,EAAE,MAAM,QAAQ,MAAM;AAAA,EAAqB,MAAM,KAAK,IAAI,CAAC;AAAA,mBAAsB,CAAC;AAC/F,SAAO;AACT;AAEO,SAAS,SAAS,OAA4D;AACnF,QAAM,SAA+B,CAAC;AACtC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,OAAO,GAAG,EAAE;AACzB,QAAI,KAAK,SAAS,UAAU,MAAM,SAAS,QAAQ;AACjD,YAAM,YAAY,KAAK,SAAS,MAAM,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK;AACtE,aAAO,OAAO,SAAS,CAAC,IAAI,EAAE,MAAM,QAAQ,MAAM,GAAG,KAAK,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,GAAG;AAAA,IAC3F,MAAO,QAAO,KAAK,IAAI;AAAA,EACzB;AACA,SAAO;AACT;AAEO,SAAS,YAAY,OAAsB,OAAwC;AACxF,QAAM,QAAgC;AAAA,IACpC,SAAS,qBAAqB,MAAM,OAAO;AAAA,IAC3C,SAAS,mBAAmB,MAAM,OAAO;AAAA,IACzC,SAAS,0BAA0B,MAAM,OAAO;AAAA,EAClD;AACA,QAAM,OACJ,MAAM,SAAS,WACV,MAAM,SAAS,GAAG,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO,KAC1D,MAAM,MAAM,IAAI;AACtB,QAAM,UAAU,MAAM,SAClB,6DAA6D,MAAM,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC,KAC5H;AACJ,SAAO,GAAG,IAAI;AAAA;AAAA,EAAO,OAAO;AAC9B;AAEO,SAAS,SACd,OACA,WACsD;AACtD,QAAM,OAAO,MACV,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,KAAK,IAAI;AACZ,QAAM,QAAQ,YAAY;AAC1B,MAAI,KAAK,UAAU,MAAO,QAAO,EAAE,OAAO,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK;AACjE,QAAM,OAAO,KAAK,MAAM,QAAQ,CAAC;AACjC,QAAM,OAAO,GAAG,KAAK,MAAM,GAAG,IAAI,CAAC;AAAA;AAAA,UAAU,KAAK,SAAS,IAAI,IAAI;AAAA;AAAA,EAA6B,KAAK,MAAM,CAAC,IAAI,CAAC;AACjH,SAAO;AAAA,IACL,OAAO,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,OAAO,CAAC;AAAA,IACtF,MAAM;AAAA,EACR;AACF;AAEA,eAAe,MAAM,KAAuB,MAAc,SAAmC;AAC3F,QAAM,OAAO,uBAAuB,IAAI,OAAO,QAAQ,WAAW,GAAG,CAAC;AACtE,QAAM,UAAU,MAAM,IAAI,KAAK,UAAU,MAAM,MAAM,OAAO;AAC5D,SAAO,SAAS,KAAK,OAAO;AAC9B;AAEA,eAAe,UACb,KACA,QACA,SACe;AACf,MAAI,CAAC,OAAO,GAAI;AAChB,QAAM,EAAE,KAAK,QAAQ,QAAQ,IAAI,OAAO;AACxC,MAAI,CAAC,OAAO,KAAK,GAAG,EAAE,UAAU,CAAC,QAAQ,OAAQ;AACjD,QAAM,IAAI,OAAO,OAAO,OAAO;AAC7B,UAAM,MAAM,MAAM,GAAG,IAAI,aAAa,IAAI,cAAc;AACxD,eAAW,OAAO,QAAS,QAAO,IAAI,MAAM,GAAG;AAC/C,WAAO,OAAO,IAAI,OAAO,GAAG;AAAA,EAC9B,GAAG,OAAO;AACZ;AAEO,SAAS,aAAa,SAA4C;AACvE,SAAO,WAAW;AAAA,IAChB,MAAM;AAAA,IACN,aAAa,oBAAoB,QAAQ,UAAU,QAAQ,UAAU,MAAS;AAAA,IAC9E,YAAY,KAAK,OAAO,EAAE,MAAM,KAAK,OAAO,EAAE,aAAa,yBAAyB,CAAC,EAAE,CAAC;AAAA,IACxF,QAAQ;AAAA,IACR,MAAM,QAAQ,EAAE,KAAK,GAAG,KAAK,SAAS;AACpC,YAAM,UAAU,YAAY,IAAI;AAChC,YAAM,SAAS,oBAAoB,IAAI;AACvC,YAAM,QAAQ,MAAM,IAAI,MAAM,OAAO;AACrC,YAAM,WAAW,MAAM,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,QAAQ;AACpE,UAAI,QAAQ;AACZ,YAAM,QAAwB,SAAS,IAAI,CAAC,UAAU;AAAA,QACpD,GAAG,WAAW,IAAI;AAAA,QAClB,SAAS,CAAC,MAAM,EAAE,OAAO,MACvB,WAAW,MAAM,MAAM,KAAK,gBAAgB,QAAQ,OAAO,GAAG,GAAG,IAAI,MAAM,IAAI,EAAE,KAAK,EAAE;AAAA,MAC5F,EAAE;AACF,YAAM,QAAQ,QAAQ,QAClB,MAAM,QAAQ,MAAM,KAAK,OAAO,OAAO,IACvC,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAC7B,YAAM,WAAW,IAAI,IAAI,MAAM,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAC7D,YAAM,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,IAAI,CAAC,GAAG,GAAG,MAAM,KAAK;AACrF,YAAM,QAAQ,MAAM,IAAI,SAAS,aAAa,IAAI,gBAAgB,OAAO;AACzE,YAAM,UAAU,QAAQ,QAAQ;AAAA,QAC9B,OAAO;AAAA,QACP,GAAI,MAAM,QAAQ,SAAS,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,QACzD,WAAW,OAAO,QAAQ,aAAa,OAAO;AAAA,QAC9C,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,QAAQ,QAAQ,OAAO,MAAM;AAAA,UAC1C,QAAQ,QAAQ;AAAA,UAChB,OAAO,EAAE,GAAG,OAAO,MAAM;AAAA,QAC3B,CAAC;AAAA,MACH,UAAE;AACA,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,YAAM,UAAU,KAAK,QAAQ,OAAO;AACpC,YAAM,SAAS,CAAC,GAAG,OAAO,MAAM;AAChC,UAAI,OAAO,MAAM,OAAO,UAAU;AAChC,eAAO,KAAK,EAAE,MAAM,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AAC7D,YAAM,QAAQ,aAAa,MAAM;AACjC,UAAI,CAAC,OAAO;AACV,cAAM,KAAK;AAAA,UACT,MAAM;AAAA,UACN,MAAM;AAAA,EAAkB,YAAY,OAAO,OAAO,OAAO,KAAK,CAAC;AAAA,QACjE,CAAC;AACH,YAAM,MAAM;AAAA,QACV,SAAS,KAAK;AAAA,QACd,OAAO,QAAQ,mBAAmB;AAAA,MACpC;AACA,YAAM,OAAO,IAAI,SAAS,OAAO,KAAK,MAAM,MAAM,KAAK,IAAI,MAAM,OAAO;AACxE,YAAM,OAAO,OAAO,CAAC,EAAE,MAAM,QAAiB,MAAM,gBAAgB,IAAI,GAAG,CAAC,IAAI,CAAC;AACjF,YAAM,YAAY,YAAY,IAAI,IAAI,WAAW,KAAM,QAAQ,CAAC;AAChE,YAAM,SAAS,GAAG,OAAO,KAAK,qBAAqB,eAAe;AAAA,YAAe,OAAO;AAAA;AAAA;AACxF,aAAO;AAAA,QACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,OAAO,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,CAAC;AAAA,QAC9E,GAAI,OAAO,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kBAAkB,OAA+C;AAC/E,SAAO,gBAAgB,EAAE,MAAM,kBAAkB,MAAM,CAAC;AAC1D;AAEO,SAAS,mBAAmB,MAAmC;AACpE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,IAAI;AAChC,WAAO,MAAM,QAAQ,SAAS,YAAY,KAAK,SAAS,aAAa,SAAS,IAAI,QAAQ,EAAE;AAAA,EAC9F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIO,SAAS,eAAe,MAAqB;AAClD,QAAM,MAAgB,CAAC;AACvB,MAAI,MAAM,IAAI,IAAI,KAAK,IAAI;AAC3B,aAAS;AACP,QAAI,KAAK,IAAI,IAAI,0CAA0C,GAAG,EAAE,IAAI;AACpE,QAAI,IAAI,aAAa,IAAK,QAAO;AACjC,UAAM,IAAI,IAAI,MAAM,GAAG;AAAA,EACzB;AACF;AAEA,eAAsB,WACpB,SACA,MACyC;AACzC,aAAW,OAAO,eAAe,IAAI,GAAG;AACtC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,MAAM,MAAM,MAAS;AACzD,QAAI,UAAU,GAAI,QAAO,YAAY,QAAQ,MAAM,SAAS,YAAY,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAEO,SAAS,eACd,MACA,WACgB;AAChB,MAAI;AACJ,SAAO,CAAC,YAAY;AAClB,cAAU,KAAK,EAAE,MAAM,MAAM,MAAS;AACtC,WAAO,IAAI,gBAAgB;AAAA,MACzB,GAAG;AAAA,MACH,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,MAAM,MAAM,KAAK,CAAC,WAAW,UAAU,gBAAgB,CAAC;AAAA,IAC1D,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import type { Context, JsonValue } from '@earendil-works/chord';\nimport { withAbortSignal } from '@earendil-works/chord/context';\nimport { Type } from '@earendil-works/pi-ai';\nimport { validateToolArguments } from '@earendil-works/pi-ai/utils/validation';\nimport {\n  type CodemodeError,\n  type CodemodeJsonSchema,\n  type CodemodeOutputItem,\n  type CodemodeResult,\n  CodemodeSandbox,\n  type CodemodeSandboxOptions,\n  type CodemodeTool,\n  loadQuickJSWasm,\n  parseCodemodeSource,\n  renderDeclarations,\n} from '@earendil-works/pi-codemode';\nimport {\n  type Agent,\n  defineDoc,\n  defineExtension,\n  defineTool,\n  type Extension,\n  type ToolExecutionApi,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { scrubItems } from '../secrets/scrub.ts';\n\nexport const CODEMODE = 'codemode';\nexport const DEFAULT_MAX_OUTPUT_TOKENS = 10_000;\nexport const MEMORY_LIMIT_BYTES = 256 * 1024 * 1024;\nconst CHARS_PER_TOKEN = 4;\n\nexport const CodemodeDoc = defineDoc<{ store: Record<string, JsonValue> }>({\n  kind: 'slicc.codemode',\n  version: 1,\n  scope: 'conversation',\n  history: 'rewindable',\n  fork: 'asOf',\n  initial: () => ({ store: {} }),\n});\n\nexport interface Sandbox {\n  execute(\n    code: string,\n    options: { signal?: AbortSignal; store?: Record<string, unknown> }\n  ): Promise<CodemodeResult>;\n  close(): Promise<void>;\n}\n\nexport type SandboxFactory = (options: CodemodeSandboxOptions) => Sandbox;\n\nexport interface CodemodeExtra {\n  tools: CodemodeTool[];\n  globals: CodemodeTool[];\n}\n\nexport interface CodemodeOptions {\n  sandbox: SandboxFactory;\n  declared: readonly ToolRegistration[];\n  extra?: (api: ToolExecutionApi, agent: Agent, context: Context) => Promise<CodemodeExtra>;\n}\n\nconst INTRO = `Run JavaScript that calls other tools. The input is raw JavaScript (not JSON, no code fence), run as an async function body in a QuickJS sandbox: top-level \\`await\\` and \\`return\\` work. No Node, file system, network, or timers.\n- \\`await tools.<name>({ ...args })\\` resolves to a string, or an object if the tool's declaration says so, and rejects with an Error on failure. Calls still running when the script ends are cancelled.\n- Optional first line: \\`// @options: {\"max_output_tokens\": 10000, \"timeout_ms\": 60000}\\``;\n\nconst GLOBALS = [\n  'Globals:',\n  '- `text(value)`, `image(dataUrlOrImageBlock)`, `console.log(...)`, and top-level `return` add output; `exit()` ends the script. With several text items, each starts with a `==> text N/M <==` line, and `console` lines follow the other output in one `<console_output>` block.',\n  '- `store(key, value)` and `load(key)` keep JSON values across codemode calls in this conversation.',\n  '- `ALL_TOOLS` lists every tool scripts can call.',\n].join('\\n');\n\nconst DISCOVERY =\n  '- `await searchTools(query, { limit?, namespace? })`, `await describeTool(name)`, `await describeNamespace(name)`: find unlisted tools, such as MCP tools.';\n\nconst BASH_OUTPUT: CodemodeJsonSchema = {\n  type: 'object',\n  properties: { output: { type: 'string' }, exit_code: { type: 'number' } },\n  required: ['output', 'exit_code'],\n};\n\nfunction scriptTool(tool: ToolRegistration): Omit<CodemodeTool, 'execute'> {\n  return {\n    name: tool.name,\n    description: tool.description,\n    inputSchema: tool.parameters as CodemodeJsonSchema,\n    ...(tool.name === 'bash' ? { outputSchema: BASH_OUTPUT } : {}),\n  };\n}\n\nexport function codemodeDescription(\n  declared: readonly ToolRegistration[],\n  discovery = false\n): string {\n  const tools = declared\n    .filter((tool) => tool.name !== CODEMODE)\n    .map((tool) => ({ ...scriptTool(tool), execute: () => undefined }));\n  const sections = [INTRO, discovery ? `${GLOBALS}\\n${DISCOVERY}` : GLOBALS];\n  if (tools.length) sections.push(`Nested tools:\\n${renderDeclarations({ tools })}`);\n  return sections.join('\\n\\n');\n}\n\nfunction textOf(content: readonly { type: string; text?: string }[] | undefined): string {\n  return (content ?? [])\n    .filter((part) => part.type === 'text')\n    .map((part) => part.text)\n    .join('\\n');\n}\n\nexport async function callNested(\n  tool: ToolRegistration,\n  args: unknown,\n  api: ToolExecutionApi,\n  context: Context,\n  id: string\n): Promise<unknown> {\n  const prepared = tool.prepareArguments ? tool.prepareArguments(args) : args;\n  const valid = validateToolArguments(tool, {\n    type: 'toolCall',\n    id,\n    name: tool.name,\n    arguments: prepared as never,\n  });\n  const decoder = new TextDecoder();\n  let output = '';\n  const nested: ToolExecutionApi = {\n    ...api,\n    callId: id,\n    outputWindow: undefined,\n    output: (chunk) => {\n      output += typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });\n    },\n    diagnostic: () => undefined,\n    details: async () => undefined,\n  };\n  const bash = tool.name === 'bash';\n  try {\n    const result = await tool.execute(valid, nested, context);\n    const text = result.content ? textOf(result.content) : output;\n    if (result.isError) throw new Error(text || `Tool \"${tool.name}\" failed`);\n    return bash ? { output: text, exit_code: 0 } : text;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    const exit = /exited with code (\\d+)/.exec(message);\n    if (bash && exit) return { output, exit_code: Number(exit[1]) };\n    throw new Error(message);\n  }\n}\n\nfunction valueText(value: unknown): string {\n  return typeof value === 'string' ? value : (JSON.stringify(value) ?? String(value));\n}\n\nexport function formatOutput(output: readonly CodemodeOutputItem[]): CodemodeOutputItem[] {\n  const total = output.filter((item) => item.type === 'text' && !item.console).length;\n  const items: CodemodeOutputItem[] = [];\n  const lines: string[] = [];\n  let index = 0;\n  for (const item of output) {\n    if (item.type === 'image') items.push(item);\n    else if (item.console) lines.push(item.text);\n    else {\n      index++;\n      items.push({\n        type: 'text',\n        text: total > 1 ? `==> text ${index}/${total} <==\\n${item.text}` : item.text,\n      });\n    }\n  }\n  if (lines.length)\n    items.push({ type: 'text', text: `<console_output>\\n${lines.join('\\n')}\\n</console_output>` });\n  return items;\n}\n\nexport function joinText(items: readonly CodemodeOutputItem[]): CodemodeOutputItem[] {\n  const joined: CodemodeOutputItem[] = [];\n  for (const item of items) {\n    const last = joined.at(-1);\n    if (item.type === 'text' && last?.type === 'text') {\n      const separator = last.text === '' || last.text.endsWith('\\n') ? '' : '\\n';\n      joined[joined.length - 1] = { type: 'text', text: `${last.text}${separator}${item.text}` };\n    } else joined.push(item);\n  }\n  return joined;\n}\n\nexport function formatError(error: CodemodeError, calls: CodemodeResult['calls']): string {\n  const heads: Record<string, string> = {\n    timeout: `Script timed out: ${error.message}`,\n    aborted: `Script aborted: ${error.message}`,\n    sandbox: `Script sandbox failed: ${error.message}`,\n  };\n  const head =\n    error.kind === 'script'\n      ? (error.stack ?? `${error.name ?? 'Error'}: ${error.message}`)\n      : heads[error.kind];\n  const summary = calls.length\n    ? `Tool calls made before the failure (they are not undone): ${calls.map((call) => `${call.name} (${call.status})`).join(', ')}`\n    : 'No tool calls were made.';\n  return `${head}\\n\\n${summary}`;\n}\n\nexport function truncate(\n  items: readonly CodemodeOutputItem[],\n  maxTokens: number\n): { items: CodemodeOutputItem[]; full: string | null } {\n  const text = items\n    .filter((item) => item.type === 'text')\n    .map((item) => item.text)\n    .join('\\n');\n  const limit = maxTokens * CHARS_PER_TOKEN;\n  if (text.length <= limit) return { items: [...items], full: null };\n  const half = Math.floor(limit / 2);\n  const kept = `${text.slice(0, half)}\\n\\n[\u2026 ${text.length - 2 * half} characters omitted \u2026]\\n\\n${text.slice(-half)}`;\n  return {\n    items: [{ type: 'text', text: kept }, ...items.filter((item) => item.type === 'image')],\n    full: text,\n  };\n}\n\nasync function spill(api: ToolExecutionApi, text: string, context: Context): Promise<string> {\n  const path = `/tmp/slicc-codemode-${api.callId.replace(/[^\\w-]/g, '_')}.txt`;\n  const written = await api.env?.writeFile(path, text, context);\n  return written?.ok ? path : '';\n}\n\nasync function saveStore(\n  api: ToolExecutionApi,\n  result: CodemodeResult,\n  context: Context\n): Promise<void> {\n  if (!result.ok) return;\n  const { set, delete: removed } = result.storeWrites;\n  if (!Object.keys(set).length && !removed.length) return;\n  await api.commit(async (tx) => {\n    const doc = await tx.doc(CodemodeDoc, api.conversationId);\n    for (const key of removed) delete doc.store[key];\n    Object.assign(doc.store, set);\n  }, context);\n}\n\nexport function codemodeTool(options: CodemodeOptions): ToolRegistration {\n  return defineTool({\n    name: CODEMODE,\n    description: codemodeDescription(options.declared, options.extra !== undefined),\n    parameters: Type.Object({ code: Type.String({ description: 'Raw JavaScript source.' }) }),\n    replay: 'unsafe',\n    async execute({ code }, api, context) {\n      const started = performance.now();\n      const parsed = parseCodemodeSource(code);\n      const agent = await api.agent(context);\n      const callable = agent.tools.filter((tool) => tool.name !== CODEMODE);\n      let count = 0;\n      const tools: CodemodeTool[] = callable.map((tool) => ({\n        ...scriptTool(tool),\n        execute: (args, { signal }) =>\n          callNested(tool, args, api, withAbortSignal(signal, context), `${api.callId}:${++count}`),\n      }));\n      const extra = options.extra\n        ? await options.extra(api, agent, context)\n        : { tools: [], globals: [] };\n      const replaced = new Set(extra.tools.map((tool) => tool.name));\n      const scripted = [...tools.filter((tool) => !replaced.has(tool.name)), ...extra.tools];\n      const saved = await api.snapshot(CodemodeDoc, api.conversationId, context);\n      const sandbox = options.sandbox({\n        tools: scripted,\n        ...(extra.globals.length ? { globals: extra.globals } : {}),\n        timeoutMs: parsed.options.timeoutMs ?? Number.POSITIVE_INFINITY,\n        memoryLimitBytes: MEMORY_LIMIT_BYTES,\n      });\n      let result: CodemodeResult;\n      try {\n        result = await sandbox.execute(parsed.code, {\n          signal: context.abortSignal as AbortSignal,\n          store: { ...saved?.store },\n        });\n      } finally {\n        await sandbox.close();\n      }\n      await saveStore(api, result, context);\n      const output = [...result.output];\n      if (result.ok && result.value !== undefined)\n        output.push({ type: 'text', text: valueText(result.value) });\n      const items = formatOutput(output);\n      if (!result.ok)\n        items.push({\n          type: 'text',\n          text: `Script error:\\n${formatError(result.error, result.calls)}`,\n        });\n      const cut = truncate(\n        await scrubItems(joinText(items)),\n        parsed.options.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS\n      );\n      const path = cut.full === null ? '' : await spill(api, cut.full, context);\n      const note = path ? [{ type: 'text' as const, text: `Full output: ${path}` }] : [];\n      const seconds = ((performance.now() - started) / 1000).toFixed(1);\n      const header = `${result.ok ? 'Script completed' : 'Script failed'}\\nWall time ${seconds} seconds\\nOutput:\\n`;\n      return {\n        content: [{ type: 'text', text: header }, ...joinText([...cut.items, ...note])],\n        ...(result.ok ? {} : { isError: true }),\n      };\n    },\n  }) as ToolRegistration;\n}\n\nexport function codemodeExtension(tools: readonly ToolRegistration[]): Extension {\n  return defineExtension({ name: 'slicc-codemode', tools });\n}\n\nexport function disabledBySettings(text: string | undefined): boolean {\n  if (!text) return false;\n  try {\n    const settings = JSON.parse(text) as { defaultTools?: unknown };\n    return Array.isArray(settings.defaultTools) && settings.defaultTools.includes(`-${CODEMODE}`);\n  } catch {\n    return false;\n  }\n}\n\nexport type Fetcher = (url: string) => Promise<Response>;\n\nexport function wasmCandidates(from: URL): string[] {\n  const out: string[] = [];\n  let dir = new URL('.', from);\n  for (;;) {\n    out.push(new URL('node_modules/quickjs-wasi/quickjs.wasm', dir).href);\n    if (dir.pathname === '/') return out;\n    dir = new URL('..', dir);\n  }\n}\n\nexport async function locateWasm(\n  fetcher: Fetcher,\n  from: URL\n): Promise<WebAssembly.Module | undefined> {\n  for (const url of wasmCandidates(from)) {\n    const response = await fetcher(url).catch(() => undefined);\n    if (response?.ok) return WebAssembly.compile(await response.arrayBuffer());\n  }\n  return undefined;\n}\n\nexport function sandboxFactory(\n  wasm: () => Promise<WebAssembly.Module | undefined>,\n  workerUrl?: string | URL\n): SandboxFactory {\n  let found: Promise<WebAssembly.Module | undefined> | undefined;\n  return (options) => {\n    found ??= wasm().catch(() => undefined);\n    return new CodemodeSandbox({\n      ...options,\n      ...(workerUrl ? { workerUrl } : {}),\n      wasm: found.then((module) => module ?? loadQuickJSWasm()),\n    });\n  };\n}\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EAKE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,kBAAkB;AAEpB,MAAM,WAAW;AACjB,MAAM,4BAA4B;AAClC,MAAM,qBAAqB,MAAM,OAAO;AAC/C,MAAM,kBAAkB;AAEjB,MAAM,cAAc,UAAgD;AAAA,EACzE,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,SAAS;AAAA,EACT,MAAM;AAAA,EACN,SAAS,OAAO,EAAE,OAAO,CAAC,EAAE;AAC9B,CAAC;AAuBD,MAAM,QAAQ;AAAA;AAAA;AAId,MAAM,UAAU;AAAA,EACd;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEX,MAAM,YACJ;AAEF,MAAM,cAAkC;AAAA,EACtC,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,GAAG,WAAW,EAAE,MAAM,SAAS,EAAE;AAAA,EACxE,UAAU,CAAC,UAAU,WAAW;AAClC;AAEA,SAAS,WAAW,MAAuD;AACzE,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,SAAS,SAAS,EAAE,cAAc,YAAY,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,SAAS,oBACd,UACA,YAAY,OACJ;AACR,QAAM,QAAQ,SACX,OAAO,CAAC,SAAS,KAAK,SAAS,QAAQ,EACvC,IAAI,CAAC,UAAU,EAAE,GAAG,WAAW,IAAI,GAAG,SAAS,MAAM,OAAU,EAAE;AACpE,QAAM,WAAW,CAAC,OAAO,YAAY,GAAG,OAAO;AAAA,EAAK,SAAS,KAAK,OAAO;AACzE,MAAI,MAAM,OAAQ,UAAS,KAAK;AAAA,EAAkB,mBAAmB,EAAE,MAAM,CAAC,CAAC,EAAE;AACjF,SAAO,SAAS,KAAK,MAAM;AAC7B;AAEA,SAAS,OAAO,SAAyE;AACvF,UAAQ,WAAW,CAAC,GACjB,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,KAAK,IAAI;AACd;AAEA,eAAsB,WACpB,MACA,MACA,KACA,SACA,IACkB;AAClB,QAAM,WAAW,KAAK,mBAAmB,KAAK,iBAAiB,IAAI,IAAI;AACvE,QAAM,QAAQ,sBAAsB,MAAM;AAAA,IACxC,MAAM;AAAA,IACN;AAAA,IACA,MAAM,KAAK;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,SAAS;AACb,QAAM,SAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,QAAQ,CAAC,UAAU;AACjB,gBAAU,OAAO,UAAU,WAAW,QAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,IACtF;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,YAAY;AAAA,EACvB;AACA,QAAM,OAAO,KAAK,SAAS;AAC3B,MAAI;AACF,UAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO;AACxD,UAAM,OAAO,OAAO,UAAU,OAAO,OAAO,OAAO,IAAI;AACvD,QAAI,OAAO,QAAS,OAAM,IAAI,MAAM,QAAQ,SAAS,KAAK,IAAI,UAAU;AACxE,WAAO,OAAO,EAAE,QAAQ,MAAM,WAAW,EAAE,IAAI;AAAA,EACjD,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,OAAO,yBAAyB,KAAK,OAAO;AAClD,QAAI,QAAQ,KAAM,QAAO,EAAE,QAAQ,WAAW,OAAO,KAAK,CAAC,CAAC,EAAE;AAC9D,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AACF;AAEA,SAAS,UAAU,OAAwB;AACzC,SAAO,OAAO,UAAU,WAAW,QAAS,KAAK,UAAU,KAAK,KAAK,OAAO,KAAK;AACnF;AAEO,SAAS,aAAa,QAA6D;AACxF,QAAM,QAAQ,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,UAAU,CAAC,KAAK,OAAO,EAAE;AAC7E,QAAM,QAA8B,CAAC;AACrC,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAQ;AACZ,aAAW,QAAQ,QAAQ;AACzB,QAAI,KAAK,SAAS,QAAS,OAAM,KAAK,IAAI;AAAA,aACjC,KAAK,QAAS,OAAM,KAAK,KAAK,IAAI;AAAA,SACtC;AACH;AACA,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,QAAQ,IAAI,YAAY,KAAK,IAAI,KAAK;AAAA,EAAS,KAAK,IAAI,KAAK,KAAK;AAAA,MAC1E,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,MAAM;AACR,UAAM,KAAK,EAAE,MAAM,QAAQ,MAAM;AAAA,EAAqB,MAAM,KAAK,IAAI,CAAC;AAAA,mBAAsB,CAAC;AAC/F,SAAO;AACT;AAEO,SAAS,SAAS,OAA4D;AACnF,QAAM,SAA+B,CAAC;AACtC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,OAAO,GAAG,EAAE;AACzB,QAAI,KAAK,SAAS,UAAU,MAAM,SAAS,QAAQ;AACjD,YAAM,YAAY,KAAK,SAAS,MAAM,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK;AACtE,aAAO,OAAO,SAAS,CAAC,IAAI,EAAE,MAAM,QAAQ,MAAM,GAAG,KAAK,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,GAAG;AAAA,IAC3F,MAAO,QAAO,KAAK,IAAI;AAAA,EACzB;AACA,SAAO;AACT;AAEO,SAAS,YAAY,OAAsB,OAAwC;AACxF,QAAM,QAAgC;AAAA,IACpC,SAAS,qBAAqB,MAAM,OAAO;AAAA,IAC3C,SAAS,mBAAmB,MAAM,OAAO;AAAA,IACzC,SAAS,0BAA0B,MAAM,OAAO;AAAA,EAClD;AACA,QAAM,OACJ,MAAM,SAAS,WACV,MAAM,SAAS,GAAG,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO,KAC1D,MAAM,MAAM,IAAI;AACtB,QAAM,UAAU,MAAM,SAClB,6DAA6D,MAAM,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC,KAC5H;AACJ,SAAO,GAAG,IAAI;AAAA;AAAA,EAAO,OAAO;AAC9B;AAEO,SAAS,SACd,OACA,WACsD;AACtD,QAAM,OAAO,MACV,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,KAAK,IAAI;AACZ,QAAM,QAAQ,YAAY;AAC1B,MAAI,KAAK,UAAU,MAAO,QAAO,EAAE,OAAO,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK;AACjE,QAAM,OAAO,KAAK,MAAM,QAAQ,CAAC;AACjC,QAAM,OAAO,GAAG,KAAK,MAAM,GAAG,IAAI,CAAC;AAAA;AAAA,UAAU,KAAK,SAAS,IAAI,IAAI;AAAA;AAAA,EAA6B,KAAK,MAAM,CAAC,IAAI,CAAC;AACjH,SAAO;AAAA,IACL,OAAO,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,OAAO,CAAC;AAAA,IACtF,MAAM;AAAA,EACR;AACF;AAEA,eAAe,MAAM,KAAuB,MAAc,SAAmC;AAC3F,QAAM,OAAO,uBAAuB,IAAI,OAAO,QAAQ,WAAW,GAAG,CAAC;AACtE,QAAM,UAAU,MAAM,IAAI,KAAK,UAAU,MAAM,MAAM,OAAO;AAC5D,SAAO,SAAS,KAAK,OAAO;AAC9B;AAEA,eAAe,UACb,KACA,QACA,SACe;AACf,MAAI,CAAC,OAAO,GAAI;AAChB,QAAM,EAAE,KAAK,QAAQ,QAAQ,IAAI,OAAO;AACxC,MAAI,CAAC,OAAO,KAAK,GAAG,EAAE,UAAU,CAAC,QAAQ,OAAQ;AACjD,QAAM,IAAI,OAAO,OAAO,OAAO;AAC7B,UAAM,MAAM,MAAM,GAAG,IAAI,aAAa,IAAI,cAAc;AACxD,eAAW,OAAO,QAAS,QAAO,IAAI,MAAM,GAAG;AAC/C,WAAO,OAAO,IAAI,OAAO,GAAG;AAAA,EAC9B,GAAG,OAAO;AACZ;AAEO,SAAS,aAAa,SAA4C;AACvE,SAAO,WAAW;AAAA,IAChB,MAAM;AAAA,IACN,aAAa,oBAAoB,QAAQ,UAAU,QAAQ,UAAU,MAAS;AAAA,IAC9E,YAAY,KAAK,OAAO,EAAE,MAAM,KAAK,OAAO,EAAE,aAAa,yBAAyB,CAAC,EAAE,CAAC;AAAA,IACxF,QAAQ;AAAA,IACR,MAAM,QAAQ,EAAE,KAAK,GAAG,KAAK,SAAS;AACpC,YAAM,UAAU,YAAY,IAAI;AAChC,YAAM,SAAS,oBAAoB,IAAI;AACvC,YAAM,QAAQ,MAAM,IAAI,MAAM,OAAO;AACrC,YAAM,WAAW,MAAM,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,QAAQ;AACpE,UAAI,QAAQ;AACZ,YAAM,QAAwB,SAAS,IAAI,CAAC,UAAU;AAAA,QACpD,GAAG,WAAW,IAAI;AAAA,QAClB,SAAS,CAAC,MAAM,EAAE,OAAO,MACvB,WAAW,MAAM,MAAM,KAAK,gBAAgB,QAAQ,OAAO,GAAG,GAAG,IAAI,MAAM,IAAI,EAAE,KAAK,EAAE;AAAA,MAC5F,EAAE;AACF,YAAM,QAAQ,QAAQ,QAClB,MAAM,QAAQ,MAAM,KAAK,OAAO,OAAO,IACvC,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAC7B,YAAM,WAAW,IAAI,IAAI,MAAM,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAC7D,YAAM,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,IAAI,CAAC,GAAG,GAAG,MAAM,KAAK;AACrF,YAAM,QAAQ,MAAM,IAAI,SAAS,aAAa,IAAI,gBAAgB,OAAO;AACzE,YAAM,UAAU,QAAQ,QAAQ;AAAA,QAC9B,OAAO;AAAA,QACP,GAAI,MAAM,QAAQ,SAAS,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,QACzD,WAAW,OAAO,QAAQ,aAAa,OAAO;AAAA,QAC9C,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,QAAQ,QAAQ,OAAO,MAAM;AAAA,UAC1C,QAAQ,QAAQ;AAAA,UAChB,OAAO,EAAE,GAAG,OAAO,MAAM;AAAA,QAC3B,CAAC;AAAA,MACH,UAAE;AACA,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,YAAM,UAAU,KAAK,QAAQ,OAAO;AACpC,YAAM,SAAS,CAAC,GAAG,OAAO,MAAM;AAChC,UAAI,OAAO,MAAM,OAAO,UAAU;AAChC,eAAO,KAAK,EAAE,MAAM,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AAC7D,YAAM,QAAQ,aAAa,MAAM;AACjC,UAAI,CAAC,OAAO;AACV,cAAM,KAAK;AAAA,UACT,MAAM;AAAA,UACN,MAAM;AAAA,EAAkB,YAAY,OAAO,OAAO,OAAO,KAAK,CAAC;AAAA,QACjE,CAAC;AACH,YAAM,MAAM;AAAA,QACV,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,QAChC,OAAO,QAAQ,mBAAmB;AAAA,MACpC;AACA,YAAM,OAAO,IAAI,SAAS,OAAO,KAAK,MAAM,MAAM,KAAK,IAAI,MAAM,OAAO;AACxE,YAAM,OAAO,OAAO,CAAC,EAAE,MAAM,QAAiB,MAAM,gBAAgB,IAAI,GAAG,CAAC,IAAI,CAAC;AACjF,YAAM,YAAY,YAAY,IAAI,IAAI,WAAW,KAAM,QAAQ,CAAC;AAChE,YAAM,SAAS,GAAG,OAAO,KAAK,qBAAqB,eAAe;AAAA,YAAe,OAAO;AAAA;AAAA;AACxF,aAAO;AAAA,QACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,OAAO,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,CAAC;AAAA,QAC9E,GAAI,OAAO,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kBAAkB,OAA+C;AAC/E,SAAO,gBAAgB,EAAE,MAAM,kBAAkB,MAAM,CAAC;AAC1D;AAEO,SAAS,mBAAmB,MAAmC;AACpE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,IAAI;AAChC,WAAO,MAAM,QAAQ,SAAS,YAAY,KAAK,SAAS,aAAa,SAAS,IAAI,QAAQ,EAAE;AAAA,EAC9F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIO,SAAS,eAAe,MAAqB;AAClD,QAAM,MAAgB,CAAC;AACvB,MAAI,MAAM,IAAI,IAAI,KAAK,IAAI;AAC3B,aAAS;AACP,QAAI,KAAK,IAAI,IAAI,0CAA0C,GAAG,EAAE,IAAI;AACpE,QAAI,IAAI,aAAa,IAAK,QAAO;AACjC,UAAM,IAAI,IAAI,MAAM,GAAG;AAAA,EACzB;AACF;AAEA,eAAsB,WACpB,SACA,MACyC;AACzC,aAAW,OAAO,eAAe,IAAI,GAAG;AACtC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,MAAM,MAAM,MAAS;AACzD,QAAI,UAAU,GAAI,QAAO,YAAY,QAAQ,MAAM,SAAS,YAAY,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAEO,SAAS,eACd,MACA,WACgB;AAChB,MAAI;AACJ,SAAO,CAAC,YAAY;AAClB,cAAU,KAAK,EAAE,MAAM,MAAM,MAAS;AACtC,WAAO,IAAI,gBAAgB;AAAA,MACzB,GAAG;AAAA,MACH,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,MAAM,MAAM,KAAK,CAAC,WAAW,UAAU,gBAAgB,CAAC;AAAA,IAC1D,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/control.js

@@ -4,6 +4,8 @@ import {
 } from "@earendil-works/pi-durable";
 import { answerText } from "./agent.js";
 import { LICK_STATE_KIND } from "./licks/state.js";
+import { pinned, SECRETS_COMMAND, secretsEntry } from "./secrets/extension.js";
+import { scrubText } from "./secrets/scrub.js";
 function readable(out) {
   const text = out.replace(/^(?:sub)?agent: /, "").trim();
   const sentence = text.charAt(0).toUpperCase() + text.slice(1);
@@ -143,7 +145,7 @@ async function forkAt(harness, conversation, found, context) {
     instructions: agent.instructions ?? null,
     cwd: agent.cwd ?? null
   };
-  return harness.createConversation({ ownership, agent: change }, context);
+  return harness.createConversation({ ownership, agent: pinned(change) }, context);
 }
 async function rewindAgent(deps, agentId, messageId, context) {
   const { harness, agents, cone, scoops } = deps;
@@ -167,7 +169,7 @@ async function rewindAgent(deps, agentId, messageId, context) {
   else await cone.switchCone(fork, context);
   return { done: true, text: found.turn.text, reason: null };
 }
-function createAgentControl(harness, target, deliveries, licks, scoops, skills, sprinkles, memory, freezer, changes, monitor) {
+function createAgentControl(harness, target, deliveries, licks, scoops, skills, sprinkles, memory, freezer, changes, monitor, secrets) {
   const cone = cones(target);
   const current = () => cone.cone();
   const agents = target.agents;
@@ -224,7 +226,15 @@ function createAgentControl(harness, target, deliveries, licks, scoops, skills,
   return {
     send(request, context) {
       return serial(async () => {
-        const text = skills ? await skills.expand(request.text, context) : request.text;
+        if (secrets && request.text.trim() === SECRETS_COMMAND)
+          return accepted(
+            async () => (await conversationFor(request.agentId, context)).submit(
+              { type: "write", entry: secretsEntry(secrets()) },
+              context
+            )
+          );
+        const expanded = skills ? await skills.expand(request.text, context) : request.text;
+        const text = await scrubText(expanded);
         const response = await accepted(
           async () => (await conversationFor(request.agentId, context)).submit(
             {