@ai-ecoverse/slicc-agent 3.44.0 → 3.45.1

package/README.md

@@ -85,7 +85,7 @@ At boot, the worker sets `/.slicc`, where the session database lives in OPFS, to
 ### The worker seven starts
 
 `@ai-ecoverse/slicc-agent/agent-worker` is a complete agent worker. It waits for the page kernel's port, then:
-- attaches to the kernel and routes its cross-origin `fetch` through the kernel's transport when that transport isn't bound by CORS (slicc-node, slicc-swift or slicc-extension);
+- attaches to the kernel and routes its cross-origin `fetch` through the kernel's transport when that transport isn't bound by CORS (slicc-node, slicc-swift or slicc-extension), and every `<port>.kernel.localhost` request to the kernel's loopback (`loopbackFetch`);
 - opens the encrypted credential store, the AWS Bedrock provider and the session in OPFS SQLite;
 - installs durable's coding tools and SLICC's system prompt, and serves the agent.
 
@@ -308,6 +308,8 @@ A codemode script waits up to 10 s for servers still connecting. For the model,
 
 **Network.** Requests go through the worker's transport fetch, as Bedrock's do. On the page's own fetch, a server must send CORS headers allowing `Authorization`, `Content-Type`, `Mcp-Session-Id`, `Mcp-Protocol-Version` and `Last-Event-ID`, and exposing `Mcp-Session-Id`. A server that doesn't gets a lick saying to run slicc-node, slicc-swift or the extension. Stop or a steer that aborts the turn cancels a running call (`notifications/cancelled`). Lists and reads are retried once after 408, 429 or 5xx, and tool calls never are. An interrupted call isn't rerun after a worker restart. Server log messages go to `~/.pi/agent/mcp.log`, which rolls over to `mcp.log.1` at 5 MB.
 
+**Kernel servers.** A server a kernel program serves with `ctx.net.listen` on the kernel's loopback works as `"url": "http://<port>.kernel.localhost/mcp"`, as for [mcpcat](https://github.com/ai-ecoverse/mcpcat)'s `mcpcat serve --proxy <name> --http <port>`, which bridges a stdio server to HTTP. The worker's fetch hands every `<port>.kernel.localhost` request to the kernel client's `loopbackFetch` on that port, whatever the transport, so it needs no CORS headers, no service worker and no open `/os/` tab, SSE streams have no idle limit, and the request carries no `Origin`. The URL's own port is ignored, as slicc-bios ignores it. The route shares the browser guard's rule (`ownKernelServer`): any other `*.kernel.localhost` name, the CDP facade's `9222.kernel.localhost` included, fails before anything is sent, so no URL in a config can drive SLICC's own pages. `test/integration/mcp-loopback.test.mjs` runs a JS kernel program as the server and calls its tool on the page and relay routes, with a JSON-RPC answer streamed as SSE, and checks that an entry on 9222 is refused.
+
 **Limiting a server** until approvals (PR 25): `"enabled": false`; `"exposure": "hidden"` with a `toolExposure` allow list; `toolExposure` deny patterns; role and `--tools` lists for scoops; and tokens or scopes that allow only what the server should do.
 
 ### Memory
@@ -546,10 +548,11 @@ The agent never holds a secret's value. Values live in the vault (`vault.sliccy.
 - **`slicc-secrets`**, a built-in extension modelled on [pi-fnox](https://github.com/Bucurenciu-Cristian/pi-fnox) (MIT, © 2026 Kicky), with its hooks mapped to pi-durable: `secret list --json` in the home env at start and whenever `version` changes (pi-fnox's `fnox export`; nothing goes into the worker's environment); an `afterTool` hook scrubbing every result's text, diagnostics and string `details` (pi-fnox's `tool_result`); a `secrets` system section with the names, placeholders, where each works and how to use them (`before_agent_start`); and `/secrets`, answered locally as a `slicc.secrets` entry (`/fnox-list`; reloading is automatic). When at least one secret is `shell = true`, every conversation command runs as `fnox exec --shell-grants -- <argv>` (pi-fnox's `spawnHook`). slicc-agent doesn't depend on `@kickythrust/pi-fnox`. Every conversation keeps the extension: new ones are pinned at creation, and conversations stored with an extension list that lacks it get it back at start.
 - **Where text is scrubbed before anything keeps or cuts it:** command output, per stream, before the bash tool's tail window, the spill file and the live slot; `read`'s bytes (images aren't, and files over 8 MiB stream in 1 MiB chunks); MCP results before their middle cut and progress text; codemode output before its cut; user and remote sends after skill expansion; every lick (sprinkle sends and scoop results included) before triage and the outbox; and memory writes, before the pattern redaction. Remote-control summaries are built from stored entries only.
 - **The hold.** A vault that doesn't answer within 2 s reads as `waiting`. Nothing unscrubbed is appended: tool results, sends and licks wait in memory, model requests wait before they start, and command output held past 32 MiB kills the command with "output held: waiting for the vault". The state is the transcript's `vault` field (`{ port, needed, version, locked, held }`), and remote `watch` streams get a `notice` "waiting for the vault" and one when it answers again.
+- **In spectrum.** The agent port's `hold()` is `{ reason: 'locked', held }` while the vault needs a passkey, `{ reason: 'waiting', held }` while scrubbing is needed and the port isn't `ready`, and `null` otherwise, with a `hold` event on each change (and `null` when it clears); spectrum (≥ 1.62.0) shows it above the composer, and older spectrum ignores it. While a hold is up, the worker's active cone is busy (`working` when it isn't running), so the composer steers and queues; a send made during the hold waits in the tab, shown in that cone's queue, and goes to the worker once the hold clears; removing it before then means it's never sent. `/secrets` entries (`slicc.secrets`) show as a "Secrets listed" notice.
 
 ## The kernel
 
-`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.47.1 <2`, the first kernel with users and the H1 wasm commands; until 3.31.0 the floor was 1.26.3): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.47.1), and the unit and integration tests run on it with the H1 wasm commands as devDependencies. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`), with the wasm commands certified for it (`NEWEST_CERTIFIED_WASM`). Today the floor is 1.47.1 and the newest certified kernel 1.64.2; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
+`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.47.1 <2`, the first kernel with users and the H1 wasm commands; until 3.31.0 the floor was 1.26.3): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.47.1), and the unit and integration tests run on it with the H1 wasm commands as devDependencies. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`), with the wasm commands certified for it (`NEWEST_CERTIFIED_WASM`). Today the floor is 1.47.1 and the newest certified kernel 1.65.2; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
 
 ## Patched dependencies
 

package/dist/browser/guard.js

@@ -4,11 +4,11 @@ import {
   ToolTask,
   wrapTool
 } from "@earendil-works/pi-durable";
+import { FACADE_PORT, kernelHost, ownKernelServer } from "../kernel/loopback.js";
 import { PROTECTED_RULES, protectedMatcher } from "./origins.js";
 import { words } from "./shell.js";
 const BROWSER_GUARD = "slicc-browser-guard";
 const REFUSAL = "SLICC's own pages can't be opened or driven from the browser tools.";
-const FACADE_PORT = 9222;
 const BROWSER = /* @__PURE__ */ new Set(["playwright-cli", "curlwright"]);
 const WEB = /* @__PURE__ */ new Set(["http:", "https:", "ws:", "wss:"]);
 const INNER = new Set(PROTECTED_RULES.innerSchemes.map((scheme) => `${scheme}:`));
@@ -16,8 +16,6 @@ const SCHEMED = /^[a-z][a-z0-9+.-]*:/i;
 const EMBEDDED = /[a-z][a-z0-9+.-]*:\/\/[^\s'"`<>(){}\\]+/gi;
 const RELATIVE = /(?<![:\w/])\/\/[^\s'"`<>(){}\\/]+/g;
 const PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;
-const KERNEL = "kernel.localhost";
-const OWN_KERNEL = /^([1-9][0-9]{0,4})\.kernel\.localhost$/;
 function parse(url) {
   try {
     return new URL(url);
@@ -25,17 +23,13 @@ function parse(url) {
     return void 0;
   }
 }
-function ownKernelServer(host) {
-  const port = OWN_KERNEL.exec(host)?.[1];
-  return port !== void 0 && Number(port) <= 65535 && Number(port) !== FACADE_PORT;
-}
 function foreignKernel(url) {
   let parsed = parse(url);
   for (let depth = 0; parsed && INNER.has(parsed.protocol) && depth < 8; depth++)
     parsed = parse(parsed.href.slice(parsed.protocol.length));
   if (!parsed || !WEB.has(parsed.protocol)) return false;
   const host = parsed.hostname.replace(/\.+$/, "");
-  return (host === KERNEL || host.endsWith(`.${KERNEL}`)) && !ownKernelServer(host);
+  return kernelHost(host) && !ownKernelServer(host);
 }
 function forbidden(url, matcher) {
   return matcher.url(url) || foreignKernel(url);

package/dist/browser/guard.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/browser/guard.ts"],
-  "sourcesContent": ["import {\n  defineExtension,\n  type Extension,\n  hook,\n  type ToolRegistration,\n  ToolTask,\n  wrapTool,\n} from '@earendil-works/pi-durable';\nimport { PROTECTED_RULES, type ProtectedMatcher, protectedMatcher } from './origins.ts';\nimport { words } from './shell.ts';\n\nexport const BROWSER_GUARD = 'slicc-browser-guard';\nexport const REFUSAL = \"SLICC's own pages can't be opened or driven from the browser tools.\";\nexport const FACADE_PORT = 9222;\n\nconst BROWSER = new Set(['playwright-cli', 'curlwright']);\nconst WEB = new Set(['http:', 'https:', 'ws:', 'wss:']);\nconst INNER = new Set(PROTECTED_RULES.innerSchemes.map((scheme) => `${scheme}:`));\nconst SCHEMED = /^[a-z][a-z0-9+.-]*:/i;\nconst EMBEDDED = /[a-z][a-z0-9+.-]*:\\/\\/[^\\s'\"`<>(){}\\\\]+/gi;\nconst RELATIVE = /(?<![:\\w/])\\/\\/[^\\s'\"`<>(){}\\\\/]+/g;\nconst PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;\nconst KERNEL = 'kernel.localhost';\nconst OWN_KERNEL = /^([1-9][0-9]{0,4})\\.kernel\\.localhost$/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function ownKernelServer(host: string): boolean {\n  const port = OWN_KERNEL.exec(host)?.[1];\n  return port !== undefined && Number(port) <= 65535 && Number(port) !== FACADE_PORT;\n}\n\nexport function foreignKernel(url: string): boolean {\n  let parsed = parse(url);\n  for (let depth = 0; parsed && INNER.has(parsed.protocol) && depth < 8; depth++)\n    parsed = parse(parsed.href.slice(parsed.protocol.length));\n  if (!parsed || !WEB.has(parsed.protocol)) return false;\n  const host = parsed.hostname.replace(/\\.+$/, '');\n  return (host === KERNEL || host.endsWith(`.${KERNEL}`)) && !ownKernelServer(host);\n}\n\nexport function forbidden(url: string, matcher: ProtectedMatcher): boolean {\n  return matcher.url(url) || foreignKernel(url);\n}\n\nexport function candidates(raw: string): string[] {\n  const word = raw.replace(/[\\t\\n\\r]/g, '').replace(/^[\\0- ]+|[\\0- ]+$/g, '');\n  const value = word.replace(PREFIX, '');\n  const found = [\n    word,\n    value,\n    ...(value.match(EMBEDDED) ?? []),\n    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`),\n  ];\n  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value))\n    found.push(`https://${value}`);\n  if (value.startsWith('//')) found.push(`https:${value}`);\n  return found.filter((each) => SCHEMED.test(each));\n}\n\nfunction browserCommand(word: string): boolean {\n  return BROWSER.has(word.slice(word.lastIndexOf('/') + 1));\n}\n\nexport function refused(command: string, matcher: ProtectedMatcher): boolean {\n  const all = words(command);\n  if (!all.some(browserCommand)) return false;\n  return all.some((word) => candidates(word).some((url) => forbidden(url, matcher)));\n}\n\nfunction commandOf(args: unknown): string {\n  const command = (args as { command?: unknown } | undefined)?.command;\n  return typeof command === 'string' ? command : '';\n}\n\nexport function browserGuard(\n  origins: readonly string[],\n  tools: readonly ToolRegistration[]\n): Extension {\n  const bash = tools.find((tool) => tool.name === 'bash') as ToolRegistration;\n  const matcher = protectedMatcher(origins);\n  return defineExtension({\n    name: BROWSER_GUARD,\n    hooks: [\n      hook(ToolTask, {\n        beforeTool: (call) =>\n          call.name === bash.name && refused(commandOf(call.arguments), matcher)\n            ? { block: REFUSAL }\n            : undefined,\n      }),\n    ],\n    wraps: [\n      wrapTool(bash, (inner) => ({\n        ...inner,\n        execute(args, api, context) {\n          if (!refused(commandOf(args), matcher)) return inner.execute(args, api, context);\n          return Promise.resolve({ content: [{ type: 'text', text: REFUSAL }], isError: true });\n        },\n      })),\n    ],\n  });\n}\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAwC,wBAAwB;AACzE,SAAS,aAAa;AAEf,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAChB,MAAM,cAAc;AAE3B,MAAM,UAAU,oBAAI,IAAI,CAAC,kBAAkB,YAAY,CAAC;AACxD,MAAM,MAAM,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,MAAM,CAAC;AACtD,MAAM,QAAQ,IAAI,IAAI,gBAAgB,aAAa,IAAI,CAAC,WAAW,GAAG,MAAM,GAAG,CAAC;AAChF,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,aAAa;AAEnB,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,MAAuB;AACrD,QAAM,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC;AACtC,SAAO,SAAS,UAAa,OAAO,IAAI,KAAK,SAAS,OAAO,IAAI,MAAM;AACzE;AAEO,SAAS,cAAc,KAAsB;AAClD,MAAI,SAAS,MAAM,GAAG;AACtB,WAAS,QAAQ,GAAG,UAAU,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACrE,aAAS,MAAM,OAAO,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;AAC1D,MAAI,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAG,QAAO;AACjD,QAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAC/C,UAAQ,SAAS,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,MAAM,CAAC,gBAAgB,IAAI;AAClF;AAEO,SAAS,UAAU,KAAa,SAAoC;AACzE,SAAO,QAAQ,IAAI,GAAG,KAAK,cAAc,GAAG;AAC9C;AAEO,SAAS,WAAW,KAAuB;AAChD,QAAM,OAAO,IAAI,QAAQ,aAAa,EAAE,EAAE,QAAQ,sBAAsB,EAAE;AAC1E,QAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE;AACrC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,GAAI,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,IAC9B,IAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,QAAQ,EAAE;AAAA,EACxE;AACA,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,2BAA2B,KAAK,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,EAAE;AAC/B,MAAI,MAAM,WAAW,IAAI,EAAG,OAAM,KAAK,SAAS,KAAK,EAAE;AACvD,SAAO,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClD;AAEA,SAAS,eAAe,MAAuB;AAC7C,SAAO,QAAQ,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAC1D;AAEO,SAAS,QAAQ,SAAiB,SAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO;AACzB,MAAI,CAAC,IAAI,KAAK,cAAc,EAAG,QAAO;AACtC,SAAO,IAAI,KAAK,CAAC,SAAS,WAAW,IAAI,EAAE,KAAK,CAAC,QAAQ,UAAU,KAAK,OAAO,CAAC,CAAC;AACnF;AAEA,SAAS,UAAU,MAAuB;AACxC,QAAM,UAAW,MAA4C;AAC7D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEO,SAAS,aACd,SACA,OACW;AACX,QAAM,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM;AACtD,QAAM,UAAU,iBAAiB,OAAO;AACxC,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,OAAO;AAAA,MACL,KAAK,UAAU;AAAA,QACb,YAAY,CAAC,SACX,KAAK,SAAS,KAAK,QAAQ,QAAQ,UAAU,KAAK,SAAS,GAAG,OAAO,IACjE,EAAE,OAAO,QAAQ,IACjB;AAAA,MACR,CAAC;AAAA,IACH;AAAA,IACA,OAAO;AAAA,MACL,SAAS,MAAM,CAAC,WAAW;AAAA,QACzB,GAAG;AAAA,QACH,QAAQ,MAAM,KAAK,SAAS;AAC1B,cAAI,CAAC,QAAQ,UAAU,IAAI,GAAG,OAAO,EAAG,QAAO,MAAM,QAAQ,MAAM,KAAK,OAAO;AAC/E,iBAAO,QAAQ,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC,GAAG,SAAS,KAAK,CAAC;AAAA,QACtF;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import {\n  defineExtension,\n  type Extension,\n  hook,\n  type ToolRegistration,\n  ToolTask,\n  wrapTool,\n} from '@earendil-works/pi-durable';\nimport { FACADE_PORT, kernelHost, ownKernelServer } from '../kernel/loopback.ts';\nimport { PROTECTED_RULES, type ProtectedMatcher, protectedMatcher } from './origins.ts';\nimport { words } from './shell.ts';\n\nexport const BROWSER_GUARD = 'slicc-browser-guard';\nexport const REFUSAL = \"SLICC's own pages can't be opened or driven from the browser tools.\";\nexport { FACADE_PORT, ownKernelServer };\n\nconst BROWSER = new Set(['playwright-cli', 'curlwright']);\nconst WEB = new Set(['http:', 'https:', 'ws:', 'wss:']);\nconst INNER = new Set(PROTECTED_RULES.innerSchemes.map((scheme) => `${scheme}:`));\nconst SCHEMED = /^[a-z][a-z0-9+.-]*:/i;\nconst EMBEDDED = /[a-z][a-z0-9+.-]*:\\/\\/[^\\s'\"`<>(){}\\\\]+/gi;\nconst RELATIVE = /(?<![:\\w/])\\/\\/[^\\s'\"`<>(){}\\\\/]+/g;\nconst PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function foreignKernel(url: string): boolean {\n  let parsed = parse(url);\n  for (let depth = 0; parsed && INNER.has(parsed.protocol) && depth < 8; depth++)\n    parsed = parse(parsed.href.slice(parsed.protocol.length));\n  if (!parsed || !WEB.has(parsed.protocol)) return false;\n  const host = parsed.hostname.replace(/\\.+$/, '');\n  return kernelHost(host) && !ownKernelServer(host);\n}\n\nexport function forbidden(url: string, matcher: ProtectedMatcher): boolean {\n  return matcher.url(url) || foreignKernel(url);\n}\n\nexport function candidates(raw: string): string[] {\n  const word = raw.replace(/[\\t\\n\\r]/g, '').replace(/^[\\0- ]+|[\\0- ]+$/g, '');\n  const value = word.replace(PREFIX, '');\n  const found = [\n    word,\n    value,\n    ...(value.match(EMBEDDED) ?? []),\n    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`),\n  ];\n  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value))\n    found.push(`https://${value}`);\n  if (value.startsWith('//')) found.push(`https:${value}`);\n  return found.filter((each) => SCHEMED.test(each));\n}\n\nfunction browserCommand(word: string): boolean {\n  return BROWSER.has(word.slice(word.lastIndexOf('/') + 1));\n}\n\nexport function refused(command: string, matcher: ProtectedMatcher): boolean {\n  const all = words(command);\n  if (!all.some(browserCommand)) return false;\n  return all.some((word) => candidates(word).some((url) => forbidden(url, matcher)));\n}\n\nfunction commandOf(args: unknown): string {\n  const command = (args as { command?: unknown } | undefined)?.command;\n  return typeof command === 'string' ? command : '';\n}\n\nexport function browserGuard(\n  origins: readonly string[],\n  tools: readonly ToolRegistration[]\n): Extension {\n  const bash = tools.find((tool) => tool.name === 'bash') as ToolRegistration;\n  const matcher = protectedMatcher(origins);\n  return defineExtension({\n    name: BROWSER_GUARD,\n    hooks: [\n      hook(ToolTask, {\n        beforeTool: (call) =>\n          call.name === bash.name && refused(commandOf(call.arguments), matcher)\n            ? { block: REFUSAL }\n            : undefined,\n      }),\n    ],\n    wraps: [\n      wrapTool(bash, (inner) => ({\n        ...inner,\n        execute(args, api, context) {\n          if (!refused(commandOf(args), matcher)) return inner.execute(args, api, context);\n          return Promise.resolve({ content: [{ type: 'text', text: REFUSAL }], isError: true });\n        },\n      })),\n    ],\n  });\n}\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,YAAY,uBAAuB;AACzD,SAAS,iBAAwC,wBAAwB;AACzE,SAAS,aAAa;AAEf,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAGvB,MAAM,UAAU,oBAAI,IAAI,CAAC,kBAAkB,YAAY,CAAC;AACxD,MAAM,MAAM,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,MAAM,CAAC;AACtD,MAAM,QAAQ,IAAI,IAAI,gBAAgB,aAAa,IAAI,CAAC,WAAW,GAAG,MAAM,GAAG,CAAC;AAChF,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,WAAW;AACjB,MAAM,SAAS;AAEf,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,cAAc,KAAsB;AAClD,MAAI,SAAS,MAAM,GAAG;AACtB,WAAS,QAAQ,GAAG,UAAU,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACrE,aAAS,MAAM,OAAO,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;AAC1D,MAAI,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAG,QAAO;AACjD,QAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAC/C,SAAO,WAAW,IAAI,KAAK,CAAC,gBAAgB,IAAI;AAClD;AAEO,SAAS,UAAU,KAAa,SAAoC;AACzE,SAAO,QAAQ,IAAI,GAAG,KAAK,cAAc,GAAG;AAC9C;AAEO,SAAS,WAAW,KAAuB;AAChD,QAAM,OAAO,IAAI,QAAQ,aAAa,EAAE,EAAE,QAAQ,sBAAsB,EAAE;AAC1E,QAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE;AACrC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,GAAI,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,IAC9B,IAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,QAAQ,EAAE;AAAA,EACxE;AACA,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,2BAA2B,KAAK,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,EAAE;AAC/B,MAAI,MAAM,WAAW,IAAI,EAAG,OAAM,KAAK,SAAS,KAAK,EAAE;AACvD,SAAO,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClD;AAEA,SAAS,eAAe,MAAuB;AAC7C,SAAO,QAAQ,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAC1D;AAEO,SAAS,QAAQ,SAAiB,SAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO;AACzB,MAAI,CAAC,IAAI,KAAK,cAAc,EAAG,QAAO;AACtC,SAAO,IAAI,KAAK,CAAC,SAAS,WAAW,IAAI,EAAE,KAAK,CAAC,QAAQ,UAAU,KAAK,OAAO,CAAC,CAAC;AACnF;AAEA,SAAS,UAAU,MAAuB;AACxC,QAAM,UAAW,MAA4C;AAC7D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEO,SAAS,aACd,SACA,OACW;AACX,QAAM,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM;AACtD,QAAM,UAAU,iBAAiB,OAAO;AACxC,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,OAAO;AAAA,MACL,KAAK,UAAU;AAAA,QACb,YAAY,CAAC,SACX,KAAK,SAAS,KAAK,QAAQ,QAAQ,UAAU,KAAK,SAAS,GAAG,OAAO,IACjE,EAAE,OAAO,QAAQ,IACjB;AAAA,MACR,CAAC;AAAA,IACH;AAAA,IACA,OAAO;AAAA,MACL,SAAS,MAAM,CAAC,WAAW;AAAA,QACzB,GAAG;AAAA,QACH,QAAQ,MAAM,KAAK,SAAS;AAC1B,cAAI,CAAC,QAAQ,UAAU,IAAI,GAAG,OAAO,EAAG,QAAO,MAAM,QAAQ,MAAM,KAAK,OAAO;AAC/E,iBAAO,QAAQ,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC,GAAG,SAAS,KAAK,CAAC;AAAA,QACtF;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/index.js

@@ -22,7 +22,9 @@ import { PortListener } from "./listener.js";
 import {
   runAgentWorker
 } from "./main.js";
-import { transportFetch } from "./net.js";
+import {
+  transportFetch
+} from "./net.js";
 import {
   AGENT_LOCK,
   startAgent

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeClassifiers,\n  adobeConfig,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport { CREDENTIALS_DATABASE, EncryptedCredentialStore } from './credentials.ts';\nexport { type AgentHost, type ConnectOptions, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport {\n  adminOver,\n  type KernelAdmin,\n  type KernelUser,\n  type KernelUsers,\n  serveAdmin,\n  type UserClient,\n  type UserClients,\n  type UserConnect,\n  type UserSpec,\n  userClients,\n} from './kernel/users.ts';\nexport { PortListener } from './listener.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport { type Transport, type TransportResponse, transportFetch } from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type KernelSource,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { applyPatches, patchServerAccept } from './patches.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AgentPages,\n  createPages,\n  type PageBatch,\n  type PageCaller,\n  type PageRequest,\n  type PageResult,\n  type Pages,\n  type PagesOpened,\n  type PageTab,\n} from './remote/pages.ts';\nexport {\n  type AccountState,\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentSessions,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { PortChannel, type PortEndpoint, withUnrefTimers } from './wire.ts';\nexport {\n  type KernelPorts,\n  kernelPort,\n  kernelPorts,\n  serveConnections,\n  type WorkerScope,\n} from './worker.ts';\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAwC,YAAY,iBAAiB;AACrE,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,gCAAgC;AAC/D,SAA8C,iBAAiB;AAQ/D,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EAIA;AAAA,EAKA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EAIE;AAAA,OACK;AACP,SAAiD,sBAAsB;AACvE;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AACP,SAAS,cAAc,yBAAyB;AAChD,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,OAQK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,aAAgC,uBAAuB;AAChE;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;",
+  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeClassifiers,\n  adobeConfig,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport { CREDENTIALS_DATABASE, EncryptedCredentialStore } from './credentials.ts';\nexport { type AgentHost, type ConnectOptions, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport {\n  adminOver,\n  type KernelAdmin,\n  type KernelUser,\n  type KernelUsers,\n  serveAdmin,\n  type UserClient,\n  type UserClients,\n  type UserConnect,\n  type UserSpec,\n  userClients,\n} from './kernel/users.ts';\nexport { PortListener } from './listener.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport {\n  type Loopback,\n  type Transport,\n  type TransportResponse,\n  transportFetch,\n} from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type KernelSource,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { applyPatches, patchServerAccept } from './patches.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AgentPages,\n  createPages,\n  type PageBatch,\n  type PageCaller,\n  type PageRequest,\n  type PageResult,\n  type Pages,\n  type PagesOpened,\n  type PageTab,\n} from './remote/pages.ts';\nexport {\n  type AccountState,\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentSessions,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { PortChannel, type PortEndpoint, withUnrefTimers } from './wire.ts';\nexport {\n  type KernelPorts,\n  kernelPort,\n  kernelPorts,\n  serveConnections,\n  type WorkerScope,\n} from './worker.ts';\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAwC,YAAY,iBAAiB;AACrE,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,gCAAgC;AAC/D,SAA8C,iBAAiB;AAQ/D,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EAIA;AAAA,EAKA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AACP,SAAS,cAAc,yBAAyB;AAChD,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,OAQK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,aAAgC,uBAAuB;AAChE;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;",
   "names": []
 }

package/dist/kernel/loopback.js

@@ -0,0 +1,17 @@
+const FACADE_PORT = 9222;
+const KERNEL = "kernel.localhost";
+const OWN_KERNEL = /^([1-9][0-9]{0,4})\.kernel\.localhost$/;
+function ownKernelServer(host) {
+  const port = OWN_KERNEL.exec(host)?.[1];
+  return port !== void 0 && Number(port) <= 65535 && Number(port) !== FACADE_PORT;
+}
+function kernelHost(host) {
+  return host === KERNEL || host.endsWith(`.${KERNEL}`);
+}
+export {
+  FACADE_PORT,
+  KERNEL,
+  kernelHost,
+  ownKernelServer
+};
+//# sourceMappingURL=loopback.js.map

package/dist/kernel/loopback.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/kernel/loopback.ts"],
+  "sourcesContent": ["export const FACADE_PORT = 9222;\nexport const KERNEL = 'kernel.localhost';\nconst OWN_KERNEL = /^([1-9][0-9]{0,4})\\.kernel\\.localhost$/;\n\nexport function ownKernelServer(host: string): boolean {\n  const port = OWN_KERNEL.exec(host)?.[1];\n  return port !== undefined && Number(port) <= 65535 && Number(port) !== FACADE_PORT;\n}\n\nexport function kernelHost(host: string): boolean {\n  return host === KERNEL || host.endsWith(`.${KERNEL}`);\n}\n"],
+  "mappings": "AAAO,MAAM,cAAc;AACpB,MAAM,SAAS;AACtB,MAAM,aAAa;AAEZ,SAAS,gBAAgB,MAAuB;AACrD,QAAM,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC;AACtC,SAAO,SAAS,UAAa,OAAO,IAAI,KAAK,SAAS,OAAO,IAAI,MAAM;AACzE;AAEO,SAAS,WAAW,MAAuB;AAChD,SAAO,SAAS,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE;AACtD;",
+  "names": []
+}

package/dist/main.js

@@ -100,13 +100,18 @@ async function secretsFor(home, vault) {
   await names.refresh(BACKGROUND_CONTEXT);
   return names;
 }
+function routeFetch(scope, client) {
+  const native = scope.fetch.bind(scope);
+  const loopback = client.loopbackFetch?.bind(client);
+  scope.fetch = transportFetch(client.transport, scope.location.origin, native, loopback);
+  return native;
+}
 async function start(scope, ports, options, vault) {
   const { client, users } = await attached(ports, options);
   const home = new SliccKernelEnv(client, { cwd: HOME });
   await privateStore(home);
   const names = await secretsFor(home, vault);
-  const native = scope.fetch.bind(scope);
-  scope.fetch = transportFetch(client.transport, scope.location.origin, native);
+  const native = routeFetch(scope, client);
   const facts = {
     version: await agentVersion((url) => native(url)),
     commands: await commandsOnPath(client),

package/dist/main.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/main.ts"],
-  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, type AgentOptions, openAgent } from './agent.ts';\nimport { browserGuard } from './browser/guard.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { EncryptedCredentialStore } from './credentials.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { settingsText, titler } from './freezer/title.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { adminOver, type UserClient, type UserClients, userClients } from './kernel/users.ts';\nimport { setupLicks } from './licks/index.ts';\nimport { lickTriage } from './licks/triage.ts';\nimport { setupMcp } from './mcp/index.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { type Transport, transportFetch } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { createPages } from './remote/pages.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport { repin, secretsExtension, shellGrants } from './secrets/extension.ts';\nimport { secretNames } from './secrets/names.ts';\nimport { scrubWith } from './secrets/scrub.ts';\nimport { listenVault, Vault } from './secrets/vault.ts';\nimport {\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { type KernelPorts, kernelPorts, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  credentials?: () => Promise<CredentialStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n  users?: boolean;\n  mcpRedirect?: string;\n}\n\nexport function usersOf(\n  admin: MessagePort | undefined,\n  wanted: boolean | undefined,\n  attach: KernelAttach\n): UserClients | undefined {\n  if (!admin) return undefined;\n  if (wanted === false) {\n    admin.close();\n    return undefined;\n  }\n  return userClients(adminOver(admin), attach as (port: MessagePort) => Promise<UserClient>);\n}\n\nexport const STORE_DIR = '/.slicc';\n\nasync function attached(ports: Promise<KernelPorts>, options: AgentWorkerOptions) {\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const { kernel, admin } = await ports;\n  const client = await attach(kernel);\n  return { client, users: usersOf(admin, options.users, attach) };\n}\n\nfunction privateStore(env: SliccKernelEnv): Promise<unknown> {\n  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, undefined, BACKGROUND_CONTEXT);\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra']\n) {\n  const settings = await client.fs\n    .readFile(`${HOME}/.pi/agent/settings.json`)\n    .catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nexport const MCP_CALLBACK = '/oauth/mcp-callback';\n\nasync function openRepinned(\n  options: AgentWorkerOptions,\n  base: Omit<AgentOptions, 'storage' | 'beforeResume'>\n): Promise<Agent> {\n  const storage = await (options.storage ?? (() => openOpfsSqliteStorage()))();\n  return openAgent({\n    ...base,\n    storage,\n    beforeResume: (harness, using) => repin(harness, storage, using),\n  });\n}\n\nasync function secretsFor(home: SliccKernelEnv, vault: Vault) {\n  scrubWith(vault);\n  const names = secretNames(home, vault);\n  await names.refresh(BACKGROUND_CONTEXT);\n  return names;\n}\n\nasync function start(\n  scope: AgentWorkerScope,\n  ports: Promise<KernelPorts>,\n  options: AgentWorkerOptions,\n  vault: Vault\n): Promise<AgentHost> {\n  const { client, users } = await attached(ports, options);\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  await privateStore(home);\n  const names = await secretsFor(home, vault);\n  const native = scope.fetch.bind(scope);\n  scope.fetch = transportFetch(client.transport, scope.location.origin, native);\n  const facts = {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n  const credentials = await (options.credentials ?? (() => EncryptedCredentialStore.open()))();\n  const providers = options.providers ?? sliccProviders();\n  const models = createSliccModels(credentials, providers);\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(sliccPrompt(facts));\n  registry.install(\n    imageReads(\n      (CodingTools.tools as readonly ToolRegistration[]).find(\n        (tool) => tool.name === 'read'\n      ) as ToolRegistration\n    )\n  );\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  registry.install(browserGuard([scope.location.origin], coding));\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry);\n  licks.licks.triage(lickTriage(models));\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  registry.install(secretsExtension({ names, vault }));\n  const activity = createActivity();\n  const groups = processGroups(client);\n  const model = options.model ?? DEFAULT_MODEL;\n  let opened: Agent | undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    identify: identity(() => opened?.agents, model),\n    scrub: vault,\n    spawn: shellGrants(names),\n  });\n  const agent = await openRepinned(options, { models, model, registry, env: environment });\n  opened = agent;\n  const sources = licks.attach(agent, { env: home, home: HOME, activity });\n  await sources.start(BACKGROUND_CONTEXT);\n  await sources.boot(\n    { version: facts.version, boot: await kernelBoot(client) },\n    BACKGROUND_CONTEXT\n  );\n  const skillsRuntime = await skills.attach(\n    { env: home, home: HOME, assets: options.assets ?? packageAssets(), reloadMs: RELOAD_MS },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      home: HOME,\n      credentials,\n      licks: licks.licks,\n      fetch: scope.fetch,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: client.transport.traits?.crossOrigin === 'cors',\n      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href,\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n    },\n    BACKGROUND_CONTEXT\n  );\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      home: HOME,\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titler(models, settingsText(home, HOME)),\n  });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await createAgentSettings(models, credentials, providers, { mcp: mcpRuntime });\n  const pages = createPages({ claim: sprinkles.claim });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      home: HOME,\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsCommand({ agents: agent.agents, settings, catalog: models }),\n      panel: pages.command,\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  const changes = attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS });\n  return hostAgent(agent, {\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes,\n    pages,\n    mcp: mcpRuntime,\n    ...(users ? { users } : {}),\n    secrets: { vault: vault.state, list: () => names.state.value, close: names.close },\n    monitor: {\n      kernel: client,\n      groups,\n      ...(users ? { users: () => users.users.list() } : {}),\n      secrets: () => mcpRuntime.secrets(),\n    },\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const vault = new Vault();\n  listenVault(scope, vault);\n  const host = start(scope, kernelPorts(scope), options, vault);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAwC,iBAAiB;AACzD,SAAS,oBAAoB;AAC7B,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,cAAc,cAAc;AACrC,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAE/B,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,WAA8C,mBAAmB;AAC1E,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AACzB,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAyB,sBAAsB;AAC/C,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E,SAAS,OAAO,kBAAkB,mBAAmB;AACrD,SAAS,mBAAmB;AAC5B,SAAS,iBAAiB;AAC1B,SAAS,aAAa,aAAa;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,aAAa,wBAA0C;AAuB3E,SAAS,QACd,OACA,QACA,QACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY,UAAU,KAAK,GAAG,MAAoD;AAC3F;AAEO,MAAM,YAAY;AAEzB,eAAe,SAAS,OAA6B,SAA6B;AAChF,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM;AAChC,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,SAAO,EAAE,QAAQ,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAAE;AAChE;AAEA,SAAS,aAAa,KAAuC;AAC3D,SAAO,IAAI,KAAK,YAAY,SAAS,iBAAiB,SAAS,IAAI,QAAW,kBAAkB;AAClG;AAEA,eAAe,cACb,QACA,SACA,QACA,OACA;AACA,QAAM,WAAW,MAAM,OAAO,GAC3B,SAAS,GAAG,IAAI,0BAA0B,EAC1C,MAAM,MAAM,MAAS;AACxB,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEO,MAAM,eAAe;AAE5B,eAAe,aACb,SACA,MACgB;AAChB,QAAM,UAAU,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAC3E,SAAO,UAAU;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,cAAc,CAAC,SAAS,UAAU,MAAM,SAAS,SAAS,KAAK;AAAA,EACjE,CAAC;AACH;AAEA,eAAe,WAAW,MAAsB,OAAc;AAC5D,YAAU,KAAK;AACf,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,MAAM,QAAQ,kBAAkB;AACtC,SAAO;AACT;AAEA,eAAe,MACb,OACA,OACA,SACA,OACoB;AACpB,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,SAAS,OAAO,OAAO;AACvD,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,aAAa,IAAI;AACvB,QAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAC1C,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,QAAQ,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,MAAM;AAC5E,QAAM,QAAQ;AAAA,IACZ,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACA,QAAM,cAAc,OAAO,QAAQ,gBAAgB,MAAM,yBAAyB,KAAK,IAAI;AAC3F,QAAM,YAAY,QAAQ,aAAa,eAAe;AACtD,QAAM,SAAS,kBAAkB,aAAa,SAAS;AACvD,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,WAAS;AAAA,IACP;AAAA,MACG,YAAY,MAAsC;AAAA,QACjD,CAAC,SAAS,KAAK,SAAS;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,WAAS,QAAQ,aAAa,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,CAAC;AAC9D,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,QAAQ;AAC1E,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,QAAQ;AACjC,QAAM,MAAM,OAAO,WAAW,MAAM,CAAC;AACrC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,WAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,CAAC,CAAC;AACnD,QAAM,WAAW,eAAe;AAChC,QAAM,SAAS,cAAc,MAAM;AACnC,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,IAC9C,OAAO;AAAA,IACP,OAAO,YAAY,KAAK;AAAA,EAC1B,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,EAAE,QAAQ,OAAO,UAAU,KAAK,YAAY,CAAC;AACvF,WAAS;AACT,QAAM,UAAU,MAAM,OAAO,OAAO,EAAE,KAAK,MAAM,MAAM,MAAM,SAAS,CAAC;AACvE,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,QAAQ;AAAA,IACZ,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AAAA,IACzD;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC,EAAE,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,UAAU,cAAc,GAAG,UAAU,UAAU;AAAA,IACxF;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,OAAO,UAAU,QAAQ,gBAAgB;AAAA,MAC/C,UAAU,QAAQ,eAAe,IAAI,IAAI,cAAc,MAAM,SAAS,MAAM,EAAE;AAAA,IAChF;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACA,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,CAAC;AAAA,EAChD,CAAC;AACD,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,oBAAoB,QAAQ,aAAa,WAAW,EAAE,KAAK,WAAW,CAAC;AAC9F,QAAM,QAAQ,YAAY,EAAE,OAAO,UAAU,MAAM,CAAC;AACpD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,MAAM;AAAA,MACN,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAAA,MACzE,OAAO,MAAM;AAAA,MACb,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,QAAM,UAAU,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AACvF,SAAO,UAAU,OAAO;AAAA,IACtB;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,SAAS,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM;AAAA,IACjF,SAAS;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,MACA,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACnD,SAAS,MAAM,WAAW,QAAQ;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,QAAQ,IAAI,MAAM;AACxB,cAAY,OAAO,KAAK;AACxB,QAAM,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,KAAK;AAC5D,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
+  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, type AgentOptions, openAgent } from './agent.ts';\nimport { browserGuard } from './browser/guard.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { EncryptedCredentialStore } from './credentials.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { settingsText, titler } from './freezer/title.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { adminOver, type UserClient, type UserClients, userClients } from './kernel/users.ts';\nimport { setupLicks } from './licks/index.ts';\nimport { lickTriage } from './licks/triage.ts';\nimport { setupMcp } from './mcp/index.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { type Transport, transportFetch } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { createPages } from './remote/pages.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport { repin, secretsExtension, shellGrants } from './secrets/extension.ts';\nimport { secretNames } from './secrets/names.ts';\nimport { scrubWith } from './secrets/scrub.ts';\nimport { listenVault, Vault } from './secrets/vault.ts';\nimport {\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { type KernelPorts, kernelPorts, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  credentials?: () => Promise<CredentialStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n  users?: boolean;\n  mcpRedirect?: string;\n}\n\nexport function usersOf(\n  admin: MessagePort | undefined,\n  wanted: boolean | undefined,\n  attach: KernelAttach\n): UserClients | undefined {\n  if (!admin) return undefined;\n  if (wanted === false) {\n    admin.close();\n    return undefined;\n  }\n  return userClients(adminOver(admin), attach as (port: MessagePort) => Promise<UserClient>);\n}\n\nexport const STORE_DIR = '/.slicc';\n\nasync function attached(ports: Promise<KernelPorts>, options: AgentWorkerOptions) {\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const { kernel, admin } = await ports;\n  const client = await attach(kernel);\n  return { client, users: usersOf(admin, options.users, attach) };\n}\n\nfunction privateStore(env: SliccKernelEnv): Promise<unknown> {\n  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, undefined, BACKGROUND_CONTEXT);\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra']\n) {\n  const settings = await client.fs\n    .readFile(`${HOME}/.pi/agent/settings.json`)\n    .catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nexport const MCP_CALLBACK = '/oauth/mcp-callback';\n\nasync function openRepinned(\n  options: AgentWorkerOptions,\n  base: Omit<AgentOptions, 'storage' | 'beforeResume'>\n): Promise<Agent> {\n  const storage = await (options.storage ?? (() => openOpfsSqliteStorage()))();\n  return openAgent({\n    ...base,\n    storage,\n    beforeResume: (harness, using) => repin(harness, storage, using),\n  });\n}\n\nasync function secretsFor(home: SliccKernelEnv, vault: Vault) {\n  scrubWith(vault);\n  const names = secretNames(home, vault);\n  await names.refresh(BACKGROUND_CONTEXT);\n  return names;\n}\n\nfunction routeFetch(scope: AgentWorkerScope, client: KernelClient & { transport: Transport }) {\n  const native = scope.fetch.bind(scope);\n  const loopback = client.loopbackFetch?.bind(client);\n  scope.fetch = transportFetch(client.transport, scope.location.origin, native, loopback);\n  return native;\n}\n\nasync function start(\n  scope: AgentWorkerScope,\n  ports: Promise<KernelPorts>,\n  options: AgentWorkerOptions,\n  vault: Vault\n): Promise<AgentHost> {\n  const { client, users } = await attached(ports, options);\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  await privateStore(home);\n  const names = await secretsFor(home, vault);\n  const native = routeFetch(scope, client);\n  const facts = {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n  const credentials = await (options.credentials ?? (() => EncryptedCredentialStore.open()))();\n  const providers = options.providers ?? sliccProviders();\n  const models = createSliccModels(credentials, providers);\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(sliccPrompt(facts));\n  registry.install(\n    imageReads(\n      (CodingTools.tools as readonly ToolRegistration[]).find(\n        (tool) => tool.name === 'read'\n      ) as ToolRegistration\n    )\n  );\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  registry.install(browserGuard([scope.location.origin], coding));\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry);\n  licks.licks.triage(lickTriage(models));\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  registry.install(secretsExtension({ names, vault }));\n  const activity = createActivity();\n  const groups = processGroups(client);\n  const model = options.model ?? DEFAULT_MODEL;\n  let opened: Agent | undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    identify: identity(() => opened?.agents, model),\n    scrub: vault,\n    spawn: shellGrants(names),\n  });\n  const agent = await openRepinned(options, { models, model, registry, env: environment });\n  opened = agent;\n  const sources = licks.attach(agent, { env: home, home: HOME, activity });\n  await sources.start(BACKGROUND_CONTEXT);\n  await sources.boot(\n    { version: facts.version, boot: await kernelBoot(client) },\n    BACKGROUND_CONTEXT\n  );\n  const skillsRuntime = await skills.attach(\n    { env: home, home: HOME, assets: options.assets ?? packageAssets(), reloadMs: RELOAD_MS },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      home: HOME,\n      credentials,\n      licks: licks.licks,\n      fetch: scope.fetch,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: client.transport.traits?.crossOrigin === 'cors',\n      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href,\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n    },\n    BACKGROUND_CONTEXT\n  );\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      home: HOME,\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titler(models, settingsText(home, HOME)),\n  });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await createAgentSettings(models, credentials, providers, { mcp: mcpRuntime });\n  const pages = createPages({ claim: sprinkles.claim });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      home: HOME,\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsCommand({ agents: agent.agents, settings, catalog: models }),\n      panel: pages.command,\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  const changes = attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS });\n  return hostAgent(agent, {\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes,\n    pages,\n    mcp: mcpRuntime,\n    ...(users ? { users } : {}),\n    secrets: { vault: vault.state, list: () => names.state.value, close: names.close },\n    monitor: {\n      kernel: client,\n      groups,\n      ...(users ? { users: () => users.users.list() } : {}),\n      secrets: () => mcpRuntime.secrets(),\n    },\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const vault = new Vault();\n  listenVault(scope, vault);\n  const host = start(scope, kernelPorts(scope), options, vault);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAwC,iBAAiB;AACzD,SAAS,oBAAoB;AAC7B,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,cAAc,cAAc;AACrC,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAE/B,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,WAA8C,mBAAmB;AAC1E,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AACzB,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAyB,sBAAsB;AAC/C,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E,SAAS,OAAO,kBAAkB,mBAAmB;AACrD,SAAS,mBAAmB;AAC5B,SAAS,iBAAiB;AAC1B,SAAS,aAAa,aAAa;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,aAAa,wBAA0C;AAuB3E,SAAS,QACd,OACA,QACA,QACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY,UAAU,KAAK,GAAG,MAAoD;AAC3F;AAEO,MAAM,YAAY;AAEzB,eAAe,SAAS,OAA6B,SAA6B;AAChF,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM;AAChC,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,SAAO,EAAE,QAAQ,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAAE;AAChE;AAEA,SAAS,aAAa,KAAuC;AAC3D,SAAO,IAAI,KAAK,YAAY,SAAS,iBAAiB,SAAS,IAAI,QAAW,kBAAkB;AAClG;AAEA,eAAe,cACb,QACA,SACA,QACA,OACA;AACA,QAAM,WAAW,MAAM,OAAO,GAC3B,SAAS,GAAG,IAAI,0BAA0B,EAC1C,MAAM,MAAM,MAAS;AACxB,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEO,MAAM,eAAe;AAE5B,eAAe,aACb,SACA,MACgB;AAChB,QAAM,UAAU,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAC3E,SAAO,UAAU;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,cAAc,CAAC,SAAS,UAAU,MAAM,SAAS,SAAS,KAAK;AAAA,EACjE,CAAC;AACH;AAEA,eAAe,WAAW,MAAsB,OAAc;AAC5D,YAAU,KAAK;AACf,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,MAAM,QAAQ,kBAAkB;AACtC,SAAO;AACT;AAEA,SAAS,WAAW,OAAyB,QAAiD;AAC5F,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,WAAW,OAAO,eAAe,KAAK,MAAM;AAClD,QAAM,QAAQ,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,QAAQ,QAAQ;AACtF,SAAO;AACT;AAEA,eAAe,MACb,OACA,OACA,SACA,OACoB;AACpB,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,SAAS,OAAO,OAAO;AACvD,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,aAAa,IAAI;AACvB,QAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAC1C,QAAM,SAAS,WAAW,OAAO,MAAM;AACvC,QAAM,QAAQ;AAAA,IACZ,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACA,QAAM,cAAc,OAAO,QAAQ,gBAAgB,MAAM,yBAAyB,KAAK,IAAI;AAC3F,QAAM,YAAY,QAAQ,aAAa,eAAe;AACtD,QAAM,SAAS,kBAAkB,aAAa,SAAS;AACvD,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,WAAS;AAAA,IACP;AAAA,MACG,YAAY,MAAsC;AAAA,QACjD,CAAC,SAAS,KAAK,SAAS;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,WAAS,QAAQ,aAAa,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,CAAC;AAC9D,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,QAAQ;AAC1E,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,QAAQ;AACjC,QAAM,MAAM,OAAO,WAAW,MAAM,CAAC;AACrC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,WAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,CAAC,CAAC;AACnD,QAAM,WAAW,eAAe;AAChC,QAAM,SAAS,cAAc,MAAM;AACnC,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,IAC9C,OAAO;AAAA,IACP,OAAO,YAAY,KAAK;AAAA,EAC1B,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,EAAE,QAAQ,OAAO,UAAU,KAAK,YAAY,CAAC;AACvF,WAAS;AACT,QAAM,UAAU,MAAM,OAAO,OAAO,EAAE,KAAK,MAAM,MAAM,MAAM,SAAS,CAAC;AACvE,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,QAAQ;AAAA,IACZ,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AAAA,IACzD;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC,EAAE,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,UAAU,cAAc,GAAG,UAAU,UAAU;AAAA,IACxF;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,OAAO,UAAU,QAAQ,gBAAgB;AAAA,MAC/C,UAAU,QAAQ,eAAe,IAAI,IAAI,cAAc,MAAM,SAAS,MAAM,EAAE;AAAA,IAChF;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACA,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,CAAC;AAAA,EAChD,CAAC;AACD,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,oBAAoB,QAAQ,aAAa,WAAW,EAAE,KAAK,WAAW,CAAC;AAC9F,QAAM,QAAQ,YAAY,EAAE,OAAO,UAAU,MAAM,CAAC;AACpD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,MAAM;AAAA,MACN,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAAA,MACzE,OAAO,MAAM;AAAA,MACb,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,QAAM,UAAU,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AACvF,SAAO,UAAU,OAAO;AAAA,IACtB;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,SAAS,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM;AAAA,IACjF,SAAS;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,MACA,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACnD,SAAS,MAAM,WAAW,QAAQ;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,QAAQ,IAAI,MAAM;AACxB,cAAY,OAAO,KAAK;AACxB,QAAM,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,KAAK;AAC5D,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
   "names": []
 }

package/dist/net.js

@@ -1,4 +1,14 @@
+import { FACADE_PORT, kernelHost, ownKernelServer } from "./kernel/loopback.js";
 const empty = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function kernelPort(url) {
+  const host = new URL(url).hostname.replace(/\.+$/, "");
+  if (!kernelHost(host)) return void 0;
+  if (!ownKernelServer(host))
+    throw new TypeError(
+      `${host} isn't a kernel server SLICC may reach: use <port>.kernel.localhost with a port from 1 to 65535 other than ${FACADE_PORT}, the CDP facade`
+    );
+  return Number(host.split(".")[0]);
+}
 function stream(body) {
   const iterator = body[Symbol.asyncIterator]();
   return new ReadableStream({
@@ -12,9 +22,11 @@ function stream(body) {
     }
   });
 }
-function transportFetch(transport, origin, native = globalThis.fetch.bind(globalThis)) {
+function transportFetch(transport, origin, native = globalThis.fetch.bind(globalThis), loopback) {
   return async (input, init) => {
     const request = new Request(input, init);
+    const port = kernelPort(request.url);
+    if (loopback && port) return loopback(request, { port, signal: request.signal });
     if (new URL(request.url).origin === origin || transport.traits?.crossOrigin === "cors") {
       return native(request);
     }
@@ -34,6 +46,7 @@ function transportFetch(transport, origin, native = globalThis.fetch.bind(global
   };
 }
 export {
+  kernelPort,
   transportFetch
 };
 //# sourceMappingURL=net.js.map

package/dist/net.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/net.ts"],
-  "sourcesContent": ["export interface TransportResponse {\n  status: number;\n  statusText?: string;\n  headers: HeadersInit;\n  body: AsyncIterable<Uint8Array>;\n}\n\nexport interface Transport {\n  traits?: { crossOrigin?: 'cors' | 'any'; manualRedirects?: boolean };\n  fetch(request: {\n    url: string;\n    method: string;\n    headers: [string, string][];\n    body?: Uint8Array;\n    signal?: AbortSignal;\n  }): Promise<TransportResponse>;\n}\n\nconst empty = new Set([101, 103, 204, 205, 304]);\n\nfunction stream(body: AsyncIterable<Uint8Array>): ReadableStream<Uint8Array> {\n  const iterator = body[Symbol.asyncIterator]();\n  return new ReadableStream({\n    async pull(controller) {\n      const next = await iterator.next();\n      if (next.done) controller.close();\n      else controller.enqueue(next.value);\n    },\n    async cancel() {\n      await iterator.return?.();\n    },\n  });\n}\n\nexport function transportFetch(\n  transport: Transport,\n  origin: string,\n  native: typeof fetch = globalThis.fetch.bind(globalThis)\n): typeof fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    if (new URL(request.url).origin === origin || transport.traits?.crossOrigin === 'cors') {\n      return native(request);\n    }\n    const body = ['GET', 'HEAD'].includes(request.method)\n      ? undefined\n      : new Uint8Array(await request.arrayBuffer());\n    const response = await transport.fetch({\n      url: request.url,\n      method: request.method,\n      headers: [...request.headers],\n      ...(body ? { body } : {}),\n      signal: request.signal,\n    });\n    return new Response(empty.has(response.status) ? null : stream(response.body), {\n      status: response.status,\n      statusText: response.statusText ?? '',\n      headers: response.headers,\n    });\n  };\n}\n"],
-  "mappings": "AAkBA,MAAM,QAAQ,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAE/C,SAAS,OAAO,MAA6D;AAC3E,QAAM,WAAW,KAAK,OAAO,aAAa,EAAE;AAC5C,SAAO,IAAI,eAAe;AAAA,IACxB,MAAM,KAAK,YAAY;AACrB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,KAAK,KAAM,YAAW,MAAM;AAAA,UAC3B,YAAW,QAAQ,KAAK,KAAK;AAAA,IACpC;AAAA,IACA,MAAM,SAAS;AACb,YAAM,SAAS,SAAS;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eACd,WACA,QACA,SAAuB,WAAW,MAAM,KAAK,UAAU,GACzC;AACd,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,QAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,WAAW,UAAU,UAAU,QAAQ,gBAAgB,QAAQ;AACtF,aAAO,OAAO,OAAO;AAAA,IACvB;AACA,UAAM,OAAO,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM,IAChD,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,UAAM,WAAW,MAAM,UAAU,MAAM;AAAA,MACrC,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,MAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AACD,WAAO,IAAI,SAAS,MAAM,IAAI,SAAS,MAAM,IAAI,OAAO,OAAO,SAAS,IAAI,GAAG;AAAA,MAC7E,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS,cAAc;AAAA,MACnC,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import { FACADE_PORT, kernelHost, ownKernelServer } from './kernel/loopback.ts';\n\nexport interface TransportResponse {\n  status: number;\n  statusText?: string;\n  headers: HeadersInit;\n  body: AsyncIterable<Uint8Array>;\n}\n\nexport interface Transport {\n  traits?: { crossOrigin?: 'cors' | 'any'; manualRedirects?: boolean };\n  fetch(request: {\n    url: string;\n    method: string;\n    headers: [string, string][];\n    body?: Uint8Array;\n    signal?: AbortSignal;\n  }): Promise<TransportResponse>;\n}\n\nexport type Loopback = (\n  request: Request,\n  options: { port: number; signal?: AbortSignal }\n) => Promise<Response>;\n\nconst empty = new Set([101, 103, 204, 205, 304]);\n\nexport function kernelPort(url: string): number | undefined {\n  const host = new URL(url).hostname.replace(/\\.+$/, '');\n  if (!kernelHost(host)) return undefined;\n  if (!ownKernelServer(host))\n    throw new TypeError(\n      `${host} isn't a kernel server SLICC may reach: use <port>.kernel.localhost with a port from 1 to 65535 other than ${FACADE_PORT}, the CDP facade`\n    );\n  return Number(host.split('.')[0]);\n}\n\nfunction stream(body: AsyncIterable<Uint8Array>): ReadableStream<Uint8Array> {\n  const iterator = body[Symbol.asyncIterator]();\n  return new ReadableStream({\n    async pull(controller) {\n      const next = await iterator.next();\n      if (next.done) controller.close();\n      else controller.enqueue(next.value);\n    },\n    async cancel() {\n      await iterator.return?.();\n    },\n  });\n}\n\nexport function transportFetch(\n  transport: Transport,\n  origin: string,\n  native: typeof fetch = globalThis.fetch.bind(globalThis),\n  loopback?: Loopback\n): typeof fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const port = kernelPort(request.url);\n    if (loopback && port) return loopback(request, { port, signal: request.signal });\n    if (new URL(request.url).origin === origin || transport.traits?.crossOrigin === 'cors') {\n      return native(request);\n    }\n    const body = ['GET', 'HEAD'].includes(request.method)\n      ? undefined\n      : new Uint8Array(await request.arrayBuffer());\n    const response = await transport.fetch({\n      url: request.url,\n      method: request.method,\n      headers: [...request.headers],\n      ...(body ? { body } : {}),\n      signal: request.signal,\n    });\n    return new Response(empty.has(response.status) ? null : stream(response.body), {\n      status: response.status,\n      statusText: response.statusText ?? '',\n      headers: response.headers,\n    });\n  };\n}\n"],
+  "mappings": "AAAA,SAAS,aAAa,YAAY,uBAAuB;AAyBzD,MAAM,QAAQ,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAExC,SAAS,WAAW,KAAiC;AAC1D,QAAM,OAAO,IAAI,IAAI,GAAG,EAAE,SAAS,QAAQ,QAAQ,EAAE;AACrD,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI,CAAC,gBAAgB,IAAI;AACvB,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,8GAA8G,WAAW;AAAA,IAClI;AACF,SAAO,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AAClC;AAEA,SAAS,OAAO,MAA6D;AAC3E,QAAM,WAAW,KAAK,OAAO,aAAa,EAAE;AAC5C,SAAO,IAAI,eAAe;AAAA,IACxB,MAAM,KAAK,YAAY;AACrB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,KAAK,KAAM,YAAW,MAAM;AAAA,UAC3B,YAAW,QAAQ,KAAK,KAAK;AAAA,IACpC;AAAA,IACA,MAAM,SAAS;AACb,YAAM,SAAS,SAAS;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eACd,WACA,QACA,SAAuB,WAAW,MAAM,KAAK,UAAU,GACvD,UACc;AACd,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,OAAO,WAAW,QAAQ,GAAG;AACnC,QAAI,YAAY,KAAM,QAAO,SAAS,SAAS,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAC/E,QAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,WAAW,UAAU,UAAU,QAAQ,gBAAgB,QAAQ;AACtF,aAAO,OAAO,OAAO;AAAA,IACvB;AACA,UAAM,OAAO,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM,IAChD,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,UAAM,WAAW,MAAM,UAAU,MAAM;AAAA,MACrC,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,MAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AACD,WAAO,IAAI,SAAS,MAAM,IAAI,SAAS,MAAM,IAAI,OAAO,OAAO,SAAS,IAAI,GAAG;AAAA,MAC7E,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS,cAAc;AAAA,MACnC,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/secrets/extension.js

@@ -5,8 +5,8 @@ import {
   section,
   ToolTask
 } from "@earendil-works/pi-durable";
+import { listedLine, SECRETS_KIND } from "./view.js";
 const SECRETS = "slicc-secrets";
-const SECRETS_KIND = "slicc.secrets";
 const SECRETS_COMMAND = "/secrets";
 const SHELL_GRANTS = ["fnox", "exec", "--shell-grants", "--"];
 const MODEL_LINE = "Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.";
@@ -82,9 +82,6 @@ function renderSecrets(names) {
   const lines = names.map((name) => `- ${name.name} = ${name.placeholder}${where(name)}`);
   return [MODEL_LINE, "", ...lines].join("\n");
 }
-function listedLine(names) {
-  return `The user listed secrets: ${names.length ? names.map((name) => name.name).join(", ") : "none"}.`;
-}
 function secretsEntry(names) {
   return {
     kind: SECRETS_KIND,

package/dist/secrets/extension.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/secrets/extension.ts"],
-  "sourcesContent": ["import type { Context, JsonValue } from '@earendil-works/chord';\nimport {\n  type AgentChange,\n  type Cursor,\n  defineExtension,\n  type Extension,\n  GenerationTask,\n  type Harness,\n  hook,\n  type Storage,\n  section,\n  type ToolExecutionResult,\n  ToolTask,\n} from '@earendil-works/pi-durable';\nimport type { Names, SecretName } from './names.ts';\nimport type { Scrub } from './scrub.ts';\nimport type { Vault } from './vault.ts';\n\nexport const SECRETS = 'slicc-secrets';\nexport const SECRETS_KIND = 'slicc.secrets';\nexport const SECRETS_COMMAND = '/secrets';\nexport const SHELL_GRANTS = ['fnox', 'exec', '--shell-grants', '--'] as const;\n\nexport const MODEL_LINE =\n  \"Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.\";\n\ntype Leaf = { get(): string; set(text: string): void };\n\nfunction leaves(value: JsonValue, out: Leaf[], set: (next: JsonValue) => void): void {\n  if (typeof value === 'string') {\n    out.push({ get: () => value, set });\n    return;\n  }\n  if (Array.isArray(value)) {\n    value.forEach((item, at) => {\n      leaves(item, out, (next) => {\n        value[at] = next;\n      });\n    });\n    return;\n  }\n  if (value && typeof value === 'object')\n    for (const [key, item] of Object.entries(value))\n      leaves(item as JsonValue, out, (next) => {\n        (value as Record<string, JsonValue>)[key] = next;\n      });\n}\n\nexport async function scrubResult(\n  result: ToolExecutionResult,\n  scrub: Pick<Scrub, 'texts'>\n): Promise<ToolExecutionResult | undefined> {\n  const content = [...(result.content ?? [])];\n  const diagnostics = [...(result.diagnostics ?? [])];\n  const details =\n    result.details === undefined ? undefined : (structuredClone(result.details) as JsonValue);\n  const found: Leaf[] = [];\n  content.forEach((item, at) => {\n    if (item.type === 'text')\n      found.push({ get: () => item.text, set: (text) => void (content[at] = { ...item, text }) });\n  });\n  diagnostics.forEach((item, at) => {\n    found.push({\n      get: () => item.message,\n      set: (message) => void (diagnostics[at] = { ...item, message }),\n    });\n  });\n  let replaced = details;\n  if (details !== undefined)\n    leaves(details, found, (next) => {\n      replaced = next;\n    });\n  const before = found.map((leaf) => leaf.get());\n  const after = await scrub.texts(before);\n  if (after.every((text, at) => text === before[at])) return undefined;\n  found.forEach((leaf, at) => {\n    leaf.set(after[at] as string);\n  });\n  const kept = result.content as ToolExecutionResult['content'] & unknown[];\n  if (kept) kept.splice(0, kept.length, ...content);\n  return {\n    ...result,\n    ...(kept ? { content: kept } : {}),\n    ...(result.diagnostics ? { diagnostics } : {}),\n    ...(replaced === undefined ? {} : { details: replaced }),\n  };\n}\n\nfunction where(name: SecretName): string {\n  const rules = name.rules.map((rule) =>\n    [\n      rule.domain,\n      rule.header ? `header ${rule.header}` : '',\n      rule.methods?.length ? rule.methods.join(' ') : '',\n      rule.paths?.length ? rule.paths.join(' ') : '',\n    ]\n      .filter(Boolean)\n      .join(', ')\n  );\n  const shell = name.exec === 'shell' ? ['in every bash'] : [];\n  const parts = [...rules, ...shell];\n  return parts.length ? `: ${parts.join('; ')}` : '';\n}\n\nexport function renderSecrets(names: readonly SecretName[]): string | undefined {\n  if (!names.length) return undefined;\n  const lines = names.map((name) => `- ${name.name} = ${name.placeholder}${where(name)}`);\n  return [MODEL_LINE, '', ...lines].join('\\n');\n}\n\nexport function listedLine(names: readonly SecretName[]): string {\n  return `The user listed secrets: ${names.length ? names.map((name) => name.name).join(', ') : 'none'}.`;\n}\n\nexport function secretsEntry(names: readonly SecretName[]) {\n  return {\n    kind: SECRETS_KIND,\n    data: { names: structuredClone(names) as unknown as JsonValue },\n    model: [{ role: 'user' as const, content: listedLine(names), timestamp: Date.now() }],\n  };\n}\n\nexport function shellGrants(names: Pick<Names, 'state'>) {\n  return (argv: readonly string[]): readonly string[] =>\n    names.state.value.some((name) => name.exec === 'shell') ? [...SHELL_GRANTS, ...argv] : argv;\n}\n\nexport function pinned<T extends AgentChange>(change: T): T {\n  const list = change.extensions;\n  if (!Array.isArray(list) || list.some((extension) => extension.name === SECRETS)) return change;\n  return { ...change, extensions: [...list, { name: SECRETS }] };\n}\n\nexport async function repin(\n  harness: Pick<Harness, 'conversation'>,\n  storage: Pick<Storage, 'scanConversations'>,\n  context: Context\n): Promise<number> {\n  let fixed = 0;\n  let cursor: Cursor | undefined;\n  do {\n    const page = await storage.scanConversations({}, 100, cursor, context);\n    for (const record of page.items) {\n      const conversation = await harness.conversation(record.id, context);\n      if (!conversation) continue;\n      const agent = await conversation.agent(context);\n      if (agent.extensions.some((extension) => extension.name === SECRETS)) continue;\n      await conversation.configure(pinned({ extensions: agent.extensions }), context);\n      fixed++;\n    }\n    cursor = page.next;\n  } while (cursor);\n  return fixed;\n}\n\nexport function secretsExtension(deps: {\n  names: Pick<Names, 'state'>;\n  vault: Pick<Vault, 'ready' | 'texts'>;\n}): Extension {\n  return defineExtension({\n    name: SECRETS,\n    sections: [section('secrets', () => renderSecrets(deps.names.state.value))],\n    hooks: [\n      hook(ToolTask, { afterTool: (_call, result) => scrubResult(result, deps.vault) }),\n      hook(GenerationTask, {\n        beforeRequest: async () => {\n          await deps.vault.ready();\n          return undefined;\n        },\n      }),\n    ],\n  });\n}\n"],
-  "mappings": "AACA;AAAA,EAGE;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,OACK;AAKA,MAAM,UAAU;AAChB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,eAAe,CAAC,QAAQ,QAAQ,kBAAkB,IAAI;AAE5D,MAAM,aACX;AAIF,SAAS,OAAO,OAAkB,KAAa,KAAsC;AACnF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,KAAK,EAAE,KAAK,MAAM,OAAO,IAAI,CAAC;AAClC;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,aAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,cAAM,EAAE,IAAI;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD;AAAA,EACF;AACA,MAAI,SAAS,OAAO,UAAU;AAC5B,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK;AAC5C,aAAO,MAAmB,KAAK,CAAC,SAAS;AACvC,QAAC,MAAoC,GAAG,IAAI;AAAA,MAC9C,CAAC;AACP;AAEA,eAAsB,YACpB,QACA,OAC0C;AAC1C,QAAM,UAAU,CAAC,GAAI,OAAO,WAAW,CAAC,CAAE;AAC1C,QAAM,cAAc,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAClD,QAAM,UACJ,OAAO,YAAY,SAAY,SAAa,gBAAgB,OAAO,OAAO;AAC5E,QAAM,QAAgB,CAAC;AACvB,UAAQ,QAAQ,CAAC,MAAM,OAAO;AAC5B,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,MAAM,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,GAAG,CAAC;AAAA,EAC9F,CAAC;AACD,cAAY,QAAQ,CAAC,MAAM,OAAO;AAChC,UAAM,KAAK;AAAA,MACT,KAAK,MAAM,KAAK;AAAA,MAChB,KAAK,CAAC,YAAY,MAAM,YAAY,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACD,MAAI,WAAW;AACf,MAAI,YAAY;AACd,WAAO,SAAS,OAAO,CAAC,SAAS;AAC/B,iBAAW;AAAA,IACb,CAAC;AACH,QAAM,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAC7C,QAAM,QAAQ,MAAM,MAAM,MAAM,MAAM;AACtC,MAAI,MAAM,MAAM,CAAC,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC,EAAG,QAAO;AAC3D,QAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,SAAK,IAAI,MAAM,EAAE,CAAW;AAAA,EAC9B,CAAC;AACD,QAAM,OAAO,OAAO;AACpB,MAAI,KAAM,MAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,OAAO;AAChD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,IAChC,GAAI,OAAO,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,IAC5C,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS;AAAA,EACxD;AACF;AAEA,SAAS,MAAM,MAA0B;AACvC,QAAM,QAAQ,KAAK,MAAM;AAAA,IAAI,CAAC,SAC5B;AAAA,MACE,KAAK;AAAA,MACL,KAAK,SAAS,UAAU,KAAK,MAAM,KAAK;AAAA,MACxC,KAAK,SAAS,SAAS,KAAK,QAAQ,KAAK,GAAG,IAAI;AAAA,MAChD,KAAK,OAAO,SAAS,KAAK,MAAM,KAAK,GAAG,IAAI;AAAA,IAC9C,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,EACd;AACA,QAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,eAAe,IAAI,CAAC;AAC3D,QAAM,QAAQ,CAAC,GAAG,OAAO,GAAG,KAAK;AACjC,SAAO,MAAM,SAAS,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK;AAClD;AAEO,SAAS,cAAc,OAAkD;AAC9E,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,QAAM,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE;AACtF,SAAO,CAAC,YAAY,IAAI,GAAG,KAAK,EAAE,KAAK,IAAI;AAC7C;AAEO,SAAS,WAAW,OAAsC;AAC/D,SAAO,4BAA4B,MAAM,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM;AACtG;AAEO,SAAS,aAAa,OAA8B;AACzD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,EAAE,OAAO,gBAAgB,KAAK,EAA0B;AAAA,IAC9D,OAAO,CAAC,EAAE,MAAM,QAAiB,SAAS,WAAW,KAAK,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EACtF;AACF;AAEO,SAAS,YAAY,OAA6B;AACvD,SAAO,CAAC,SACN,MAAM,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,OAAO,IAAI,CAAC,GAAG,cAAc,GAAG,IAAI,IAAI;AAC3F;AAEO,SAAS,OAA8B,QAAc;AAC1D,QAAM,OAAO,OAAO;AACpB,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC,cAAc,UAAU,SAAS,OAAO,EAAG,QAAO;AACzF,SAAO,EAAE,GAAG,QAAQ,YAAY,CAAC,GAAG,MAAM,EAAE,MAAM,QAAQ,CAAC,EAAE;AAC/D;AAEA,eAAsB,MACpB,SACA,SACA,SACiB;AACjB,MAAI,QAAQ;AACZ,MAAI;AACJ,KAAG;AACD,UAAM,OAAO,MAAM,QAAQ,kBAAkB,CAAC,GAAG,KAAK,QAAQ,OAAO;AACrE,eAAW,UAAU,KAAK,OAAO;AAC/B,YAAM,eAAe,MAAM,QAAQ,aAAa,OAAO,IAAI,OAAO;AAClE,UAAI,CAAC,aAAc;AACnB,YAAM,QAAQ,MAAM,aAAa,MAAM,OAAO;AAC9C,UAAI,MAAM,WAAW,KAAK,CAAC,cAAc,UAAU,SAAS,OAAO,EAAG;AACtE,YAAM,aAAa,UAAU,OAAO,EAAE,YAAY,MAAM,WAAW,CAAC,GAAG,OAAO;AAC9E;AAAA,IACF;AACA,aAAS,KAAK;AAAA,EAChB,SAAS;AACT,SAAO;AACT;AAEO,SAAS,iBAAiB,MAGnB;AACZ,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,UAAU,CAAC,QAAQ,WAAW,MAAM,cAAc,KAAK,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,IAC1E,OAAO;AAAA,MACL,KAAK,UAAU,EAAE,WAAW,CAAC,OAAO,WAAW,YAAY,QAAQ,KAAK,KAAK,EAAE,CAAC;AAAA,MAChF,KAAK,gBAAgB;AAAA,QACnB,eAAe,YAAY;AACzB,gBAAM,KAAK,MAAM,MAAM;AACvB,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import type { Context, JsonValue } from '@earendil-works/chord';\nimport {\n  type AgentChange,\n  type Cursor,\n  defineExtension,\n  type Extension,\n  GenerationTask,\n  type Harness,\n  hook,\n  type Storage,\n  section,\n  type ToolExecutionResult,\n  ToolTask,\n} from '@earendil-works/pi-durable';\nimport type { Names, SecretName } from './names.ts';\nimport type { Scrub } from './scrub.ts';\nimport type { Vault } from './vault.ts';\nimport { listedLine, SECRETS_KIND } from './view.ts';\n\nexport { listedLine, SECRETS_KIND };\n\nexport const SECRETS = 'slicc-secrets';\nexport const SECRETS_COMMAND = '/secrets';\nexport const SHELL_GRANTS = ['fnox', 'exec', '--shell-grants', '--'] as const;\n\nexport const MODEL_LINE =\n  \"Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.\";\n\ntype Leaf = { get(): string; set(text: string): void };\n\nfunction leaves(value: JsonValue, out: Leaf[], set: (next: JsonValue) => void): void {\n  if (typeof value === 'string') {\n    out.push({ get: () => value, set });\n    return;\n  }\n  if (Array.isArray(value)) {\n    value.forEach((item, at) => {\n      leaves(item, out, (next) => {\n        value[at] = next;\n      });\n    });\n    return;\n  }\n  if (value && typeof value === 'object')\n    for (const [key, item] of Object.entries(value))\n      leaves(item as JsonValue, out, (next) => {\n        (value as Record<string, JsonValue>)[key] = next;\n      });\n}\n\nexport async function scrubResult(\n  result: ToolExecutionResult,\n  scrub: Pick<Scrub, 'texts'>\n): Promise<ToolExecutionResult | undefined> {\n  const content = [...(result.content ?? [])];\n  const diagnostics = [...(result.diagnostics ?? [])];\n  const details =\n    result.details === undefined ? undefined : (structuredClone(result.details) as JsonValue);\n  const found: Leaf[] = [];\n  content.forEach((item, at) => {\n    if (item.type === 'text')\n      found.push({ get: () => item.text, set: (text) => void (content[at] = { ...item, text }) });\n  });\n  diagnostics.forEach((item, at) => {\n    found.push({\n      get: () => item.message,\n      set: (message) => void (diagnostics[at] = { ...item, message }),\n    });\n  });\n  let replaced = details;\n  if (details !== undefined)\n    leaves(details, found, (next) => {\n      replaced = next;\n    });\n  const before = found.map((leaf) => leaf.get());\n  const after = await scrub.texts(before);\n  if (after.every((text, at) => text === before[at])) return undefined;\n  found.forEach((leaf, at) => {\n    leaf.set(after[at] as string);\n  });\n  const kept = result.content as ToolExecutionResult['content'] & unknown[];\n  if (kept) kept.splice(0, kept.length, ...content);\n  return {\n    ...result,\n    ...(kept ? { content: kept } : {}),\n    ...(result.diagnostics ? { diagnostics } : {}),\n    ...(replaced === undefined ? {} : { details: replaced }),\n  };\n}\n\nfunction where(name: SecretName): string {\n  const rules = name.rules.map((rule) =>\n    [\n      rule.domain,\n      rule.header ? `header ${rule.header}` : '',\n      rule.methods?.length ? rule.methods.join(' ') : '',\n      rule.paths?.length ? rule.paths.join(' ') : '',\n    ]\n      .filter(Boolean)\n      .join(', ')\n  );\n  const shell = name.exec === 'shell' ? ['in every bash'] : [];\n  const parts = [...rules, ...shell];\n  return parts.length ? `: ${parts.join('; ')}` : '';\n}\n\nexport function renderSecrets(names: readonly SecretName[]): string | undefined {\n  if (!names.length) return undefined;\n  const lines = names.map((name) => `- ${name.name} = ${name.placeholder}${where(name)}`);\n  return [MODEL_LINE, '', ...lines].join('\\n');\n}\n\nexport function secretsEntry(names: readonly SecretName[]) {\n  return {\n    kind: SECRETS_KIND,\n    data: { names: structuredClone(names) as unknown as JsonValue },\n    model: [{ role: 'user' as const, content: listedLine(names), timestamp: Date.now() }],\n  };\n}\n\nexport function shellGrants(names: Pick<Names, 'state'>) {\n  return (argv: readonly string[]): readonly string[] =>\n    names.state.value.some((name) => name.exec === 'shell') ? [...SHELL_GRANTS, ...argv] : argv;\n}\n\nexport function pinned<T extends AgentChange>(change: T): T {\n  const list = change.extensions;\n  if (!Array.isArray(list) || list.some((extension) => extension.name === SECRETS)) return change;\n  return { ...change, extensions: [...list, { name: SECRETS }] };\n}\n\nexport async function repin(\n  harness: Pick<Harness, 'conversation'>,\n  storage: Pick<Storage, 'scanConversations'>,\n  context: Context\n): Promise<number> {\n  let fixed = 0;\n  let cursor: Cursor | undefined;\n  do {\n    const page = await storage.scanConversations({}, 100, cursor, context);\n    for (const record of page.items) {\n      const conversation = await harness.conversation(record.id, context);\n      if (!conversation) continue;\n      const agent = await conversation.agent(context);\n      if (agent.extensions.some((extension) => extension.name === SECRETS)) continue;\n      await conversation.configure(pinned({ extensions: agent.extensions }), context);\n      fixed++;\n    }\n    cursor = page.next;\n  } while (cursor);\n  return fixed;\n}\n\nexport function secretsExtension(deps: {\n  names: Pick<Names, 'state'>;\n  vault: Pick<Vault, 'ready' | 'texts'>;\n}): Extension {\n  return defineExtension({\n    name: SECRETS,\n    sections: [section('secrets', () => renderSecrets(deps.names.state.value))],\n    hooks: [\n      hook(ToolTask, { afterTool: (_call, result) => scrubResult(result, deps.vault) }),\n      hook(GenerationTask, {\n        beforeRequest: async () => {\n          await deps.vault.ready();\n          return undefined;\n        },\n      }),\n    ],\n  });\n}\n"],
+  "mappings": "AACA;AAAA,EAGE;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,OACK;AAIP,SAAS,YAAY,oBAAoB;AAIlC,MAAM,UAAU;AAChB,MAAM,kBAAkB;AACxB,MAAM,eAAe,CAAC,QAAQ,QAAQ,kBAAkB,IAAI;AAE5D,MAAM,aACX;AAIF,SAAS,OAAO,OAAkB,KAAa,KAAsC;AACnF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,KAAK,EAAE,KAAK,MAAM,OAAO,IAAI,CAAC;AAClC;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,aAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,cAAM,EAAE,IAAI;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD;AAAA,EACF;AACA,MAAI,SAAS,OAAO,UAAU;AAC5B,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK;AAC5C,aAAO,MAAmB,KAAK,CAAC,SAAS;AACvC,QAAC,MAAoC,GAAG,IAAI;AAAA,MAC9C,CAAC;AACP;AAEA,eAAsB,YACpB,QACA,OAC0C;AAC1C,QAAM,UAAU,CAAC,GAAI,OAAO,WAAW,CAAC,CAAE;AAC1C,QAAM,cAAc,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAClD,QAAM,UACJ,OAAO,YAAY,SAAY,SAAa,gBAAgB,OAAO,OAAO;AAC5E,QAAM,QAAgB,CAAC;AACvB,UAAQ,QAAQ,CAAC,MAAM,OAAO;AAC5B,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,MAAM,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,GAAG,CAAC;AAAA,EAC9F,CAAC;AACD,cAAY,QAAQ,CAAC,MAAM,OAAO;AAChC,UAAM,KAAK;AAAA,MACT,KAAK,MAAM,KAAK;AAAA,MAChB,KAAK,CAAC,YAAY,MAAM,YAAY,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACD,MAAI,WAAW;AACf,MAAI,YAAY;AACd,WAAO,SAAS,OAAO,CAAC,SAAS;AAC/B,iBAAW;AAAA,IACb,CAAC;AACH,QAAM,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAC7C,QAAM,QAAQ,MAAM,MAAM,MAAM,MAAM;AACtC,MAAI,MAAM,MAAM,CAAC,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC,EAAG,QAAO;AAC3D,QAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,SAAK,IAAI,MAAM,EAAE,CAAW;AAAA,EAC9B,CAAC;AACD,QAAM,OAAO,OAAO;AACpB,MAAI,KAAM,MAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,OAAO;AAChD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,IAChC,GAAI,OAAO,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,IAC5C,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS;AAAA,EACxD;AACF;AAEA,SAAS,MAAM,MAA0B;AACvC,QAAM,QAAQ,KAAK,MAAM;AAAA,IAAI,CAAC,SAC5B;AAAA,MACE,KAAK;AAAA,MACL,KAAK,SAAS,UAAU,KAAK,MAAM,KAAK;AAAA,MACxC,KAAK,SAAS,SAAS,KAAK,QAAQ,KAAK,GAAG,IAAI;AAAA,MAChD,KAAK,OAAO,SAAS,KAAK,MAAM,KAAK,GAAG,IAAI;AAAA,IAC9C,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,EACd;AACA,QAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,eAAe,IAAI,CAAC;AAC3D,QAAM,QAAQ,CAAC,GAAG,OAAO,GAAG,KAAK;AACjC,SAAO,MAAM,SAAS,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK;AAClD;AAEO,SAAS,cAAc,OAAkD;AAC9E,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,QAAM,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE;AACtF,SAAO,CAAC,YAAY,IAAI,GAAG,KAAK,EAAE,KAAK,IAAI;AAC7C;AAEO,SAAS,aAAa,OAA8B;AACzD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,EAAE,OAAO,gBAAgB,KAAK,EAA0B;AAAA,IAC9D,OAAO,CAAC,EAAE,MAAM,QAAiB,SAAS,WAAW,KAAK,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EACtF;AACF;AAEO,SAAS,YAAY,OAA6B;AACvD,SAAO,CAAC,SACN,MAAM,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,OAAO,IAAI,CAAC,GAAG,cAAc,GAAG,IAAI,IAAI;AAC3F;AAEO,SAAS,OAA8B,QAAc;AAC1D,QAAM,OAAO,OAAO;AACpB,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC,cAAc,UAAU,SAAS,OAAO,EAAG,QAAO;AACzF,SAAO,EAAE,GAAG,QAAQ,YAAY,CAAC,GAAG,MAAM,EAAE,MAAM,QAAQ,CAAC,EAAE;AAC/D;AAEA,eAAsB,MACpB,SACA,SACA,SACiB;AACjB,MAAI,QAAQ;AACZ,MAAI;AACJ,KAAG;AACD,UAAM,OAAO,MAAM,QAAQ,kBAAkB,CAAC,GAAG,KAAK,QAAQ,OAAO;AACrE,eAAW,UAAU,KAAK,OAAO;AAC/B,YAAM,eAAe,MAAM,QAAQ,aAAa,OAAO,IAAI,OAAO;AAClE,UAAI,CAAC,aAAc;AACnB,YAAM,QAAQ,MAAM,aAAa,MAAM,OAAO;AAC9C,UAAI,MAAM,WAAW,KAAK,CAAC,cAAc,UAAU,SAAS,OAAO,EAAG;AACtE,YAAM,aAAa,UAAU,OAAO,EAAE,YAAY,MAAM,WAAW,CAAC,GAAG,OAAO;AAC9E;AAAA,IACF;AACA,aAAS,KAAK;AAAA,EAChB,SAAS;AACT,SAAO;AACT;AAEO,SAAS,iBAAiB,MAGnB;AACZ,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,UAAU,CAAC,QAAQ,WAAW,MAAM,cAAc,KAAK,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,IAC1E,OAAO;AAAA,MACL,KAAK,UAAU,EAAE,WAAW,CAAC,OAAO,WAAW,YAAY,QAAQ,KAAK,KAAK,EAAE,CAAC;AAAA,MAChF,KAAK,gBAAgB;AAAA,QACnB,eAAe,YAAY;AACzB,gBAAM,KAAK,MAAM,MAAM;AACvB,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/secrets/vault.js

@@ -1,5 +1,6 @@
 import { replicatedState } from "@earendil-works/chord";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { vaultHold } from "./view.js";
 const WAITING_MS = 2e3;
 const WAITING = "waiting for the vault";
 const LOCKS = ["no", "scrubbing", "passkey"];
@@ -139,9 +140,9 @@ class Vault {
   }
 }
 function holdText(state) {
-  if (!state.needed) return void 0;
-  if (state.locked === "passkey") return "unlock the vault to continue";
-  return state.port === "ready" ? void 0 : WAITING;
+  const hold = vaultHold(state);
+  if (!hold) return void 0;
+  return hold.reason === "locked" ? "unlock the vault to continue" : WAITING;
 }
 function listenVault(scope, vault) {
   scope.addEventListener("message", ({ data }) => {

package/dist/secrets/vault.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/secrets/vault.ts"],
-  "sourcesContent": ["import { type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Scrub, Scrubbable, ScrubStream } from './scrub.ts';\n\nexport type ScrubPair = { needed: boolean; version: number };\nexport type Locked = 'no' | 'scrubbing' | 'passkey';\n\nexport interface VaultState {\n  port: 'none' | 'ready' | 'waiting';\n  needed: boolean;\n  version: number;\n  locked: Locked;\n  held: number;\n}\n\nexport const WAITING_MS = 2000;\nexport const WAITING = 'waiting for the vault';\n\ntype Message = Record<string, unknown> & { id: number; op: string };\n\ninterface Pending {\n  message: Message;\n  at: number;\n  resolve(value: unknown): void;\n  reject(error: Error): void;\n}\n\ntype Answer = {\n  id?: unknown;\n  ok?: unknown;\n  error?: { message?: string };\n  scrub?: unknown;\n  locked?: unknown;\n};\n\nconst LOCKS: readonly unknown[] = ['no', 'scrubbing', 'passkey'];\n\nconst EMPTY = new Uint8Array();\n\nfunction pairOf(value: unknown): ScrubPair | undefined {\n  const pair = value as Partial<ScrubPair> | null;\n  if (pair === null) return { needed: false, version: 0 };\n  if (typeof pair?.needed !== 'boolean' || typeof pair.version !== 'number') return undefined;\n  return { needed: pair.needed, version: pair.version };\n}\n\nexport class Vault implements Scrub {\n  readonly state: MutableReplicatedState<VaultState>;\n  readonly #pending = new Map<number, Pending>();\n  readonly #streams = new Set<number>();\n  readonly #waiters = new Set<() => void>();\n  readonly #now: () => number;\n  #port: MessagePort | undefined;\n  #pair: ScrubPair = { needed: false, version: 0 };\n  #locked: Locked = 'no';\n  #seen = 0;\n  #serial = 0;\n  #streamSerial = 0;\n\n  constructor(now: () => number = Date.now) {\n    this.#now = now;\n    this.state = replicatedState<VaultState>(this.#snapshot());\n  }\n\n  get needed(): boolean {\n    return this.#pair.needed || this.#seen > this.#pair.version;\n  }\n\n  connect(port: MessagePort | undefined, scrub: unknown): void {\n    const pair = scrub === undefined ? undefined : pairOf(scrub);\n    if (pair) this.#pair = pair;\n    if (port && port !== this.#port) {\n      if (this.#port) this.#port.onmessage = null;\n      this.#port = port;\n      port.onmessage = (event) => this.#answer(event.data as Answer);\n      port.start?.();\n      const resend = [...this.#pending.values()];\n      const opening = new Set(\n        resend\n          .filter((item) => item.message.op === 'redactStream')\n          .map((item) => item.message.stream)\n      );\n      for (const stream of this.#streams)\n        if (!opening.has(stream)) void this.#call('redactStream', { stream });\n      for (const item of resend) port.postMessage(item.message);\n    }\n    this.#refresh();\n  }\n\n  ready(): Promise<void> {\n    if (!this.#holding()) return Promise.resolve();\n    return new Promise((resolve) => this.#waiters.add(resolve));\n  }\n\n  async texts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]> {\n    if (!this.needed) return [...texts];\n    const answer = (await this.#call('redact', { texts: [...texts] })) as {\n      texts: T[];\n      version?: number;\n    };\n    return answer.texts;\n  }\n\n  stream(): ScrubStream {\n    let stream: number | undefined;\n    return {\n      push: (chunk) => {\n        if (stream === undefined && !this.needed) return Promise.resolve(chunk);\n        if (stream === undefined) {\n          stream = ++this.#streamSerial;\n          this.#streams.add(stream);\n          void this.#call('redactStream', { stream });\n        }\n        return this.#call('push', { stream, chunk }) as Promise<Uint8Array>;\n      },\n      end: async () => {\n        if (stream === undefined) return EMPTY;\n        const tail = (await this.#call('end', { stream })) as Uint8Array;\n        this.#streams.delete(stream);\n        return tail;\n      },\n      drop: () => {\n        if (stream === undefined) return;\n        const dropped = stream;\n        this.#streams.delete(dropped);\n        for (const [id, item] of this.#pending)\n          if (item.message.stream === dropped && item.message.op !== 'redactStream') {\n            this.#pending.delete(id);\n            item.resolve(EMPTY);\n          }\n        void this.#call('drop', { stream: dropped });\n      },\n    };\n  }\n\n  #call(op: string, fields: Record<string, unknown>): Promise<unknown> {\n    const message: Message = { id: ++this.#serial, op, ...fields };\n    const result = new Promise((resolve, reject) => {\n      this.#pending.set(message.id, { message, at: this.#now(), resolve, reject });\n    });\n    this.#port?.postMessage(message);\n    setTimeout(() => this.#refresh(), WAITING_MS);\n    this.#refresh();\n    return result;\n  }\n\n  #answer(data: Answer): void {\n    if (!data || typeof data !== 'object') return;\n    const pair = 'scrub' in data ? pairOf(data.scrub) : undefined;\n    if (pair) this.#pair = pair;\n    if (LOCKS.includes(data.locked)) this.#locked = data.locked as Locked;\n    const item = typeof data.id === 'number' ? this.#pending.get(data.id) : undefined;\n    if (item) {\n      this.#pending.delete(data.id as number);\n      const version = (data.ok as { version?: unknown } | undefined)?.version;\n      if (typeof version === 'number') this.#seen = Math.max(this.#seen, version);\n      if (data.error) item.reject(new Error(data.error.message ?? 'the vault refused'));\n      else item.resolve(data.ok);\n    }\n    this.#refresh();\n  }\n\n  #waiting(): boolean {\n    const now = this.#now();\n    return [...this.#pending.values()].some((item) => now - item.at >= WAITING_MS);\n  }\n\n  #holding(): boolean {\n    return this.needed && (!this.#port || this.#waiting() || this.#locked === 'passkey');\n  }\n\n  #snapshot(): VaultState {\n    return {\n      port: !this.#port ? 'none' : this.#waiting() ? 'waiting' : 'ready',\n      needed: this.needed,\n      version: this.#pair.version,\n      locked: this.#locked,\n      held: this.#pending.size,\n    };\n  }\n\n  #refresh(): void {\n    const next = this.#snapshot();\n    const before = this.state.value;\n    if (Object.entries(next).some(([key, value]) => before[key as keyof VaultState] !== value))\n      this.state.replace(BACKGROUND_CONTEXT, next);\n    if (this.#holding()) return;\n    for (const resolve of this.#waiters) resolve();\n    this.#waiters.clear();\n  }\n}\n\nexport function holdText(state: VaultState): string | undefined {\n  if (!state.needed) return undefined;\n  if (state.locked === 'passkey') return 'unlock the vault to continue';\n  return state.port === 'ready' ? undefined : WAITING;\n}\n\nexport function listenVault(\n  scope: { addEventListener(type: 'message', listener: (event: MessageEvent) => void): void },\n  vault: Vault\n): void {\n  scope.addEventListener('message', ({ data }) => {\n    const message = data as { vault?: MessagePort; scrub?: unknown } | null;\n    if (!message || typeof message !== 'object' || !('vault' in message || 'scrub' in message))\n      return;\n    vault.connect(message.vault, message.scrub);\n  });\n}\n"],
-  "mappings": "AAAA,SAAsC,uBAAuB;AAC7D,SAAS,0BAA0B;AAc5B,MAAM,aAAa;AACnB,MAAM,UAAU;AAmBvB,MAAM,QAA4B,CAAC,MAAM,aAAa,SAAS;AAE/D,MAAM,QAAQ,IAAI,WAAW;AAE7B,SAAS,OAAO,OAAuC;AACrD,QAAM,OAAO;AACb,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,OAAO,SAAS,EAAE;AACtD,MAAI,OAAO,MAAM,WAAW,aAAa,OAAO,KAAK,YAAY,SAAU,QAAO;AAClF,SAAO,EAAE,QAAQ,KAAK,QAAQ,SAAS,KAAK,QAAQ;AACtD;AAEO,MAAM,MAAuB;AAAA,EACzB;AAAA,EACA,WAAW,oBAAI,IAAqB;AAAA,EACpC,WAAW,oBAAI,IAAY;AAAA,EAC3B,WAAW,oBAAI,IAAgB;AAAA,EAC/B;AAAA,EACT;AAAA,EACA,QAAmB,EAAE,QAAQ,OAAO,SAAS,EAAE;AAAA,EAC/C,UAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,gBAAgB;AAAA,EAEhB,YAAY,MAAoB,KAAK,KAAK;AACxC,SAAK,OAAO;AACZ,SAAK,QAAQ,gBAA4B,KAAK,UAAU,CAAC;AAAA,EAC3D;AAAA,EAEA,IAAI,SAAkB;AACpB,WAAO,KAAK,MAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AAAA,EACtD;AAAA,EAEA,QAAQ,MAA+B,OAAsB;AAC3D,UAAM,OAAO,UAAU,SAAY,SAAY,OAAO,KAAK;AAC3D,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,QAAQ,SAAS,KAAK,OAAO;AAC/B,UAAI,KAAK,MAAO,MAAK,MAAM,YAAY;AACvC,WAAK,QAAQ;AACb,WAAK,YAAY,CAAC,UAAU,KAAK,QAAQ,MAAM,IAAc;AAC7D,WAAK,QAAQ;AACb,YAAM,SAAS,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC;AACzC,YAAM,UAAU,IAAI;AAAA,QAClB,OACG,OAAO,CAAC,SAAS,KAAK,QAAQ,OAAO,cAAc,EACnD,IAAI,CAAC,SAAS,KAAK,QAAQ,MAAM;AAAA,MACtC;AACA,iBAAW,UAAU,KAAK;AACxB,YAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,MAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AACtE,iBAAW,QAAQ,OAAQ,MAAK,YAAY,KAAK,OAAO;AAAA,IAC1D;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,QAAuB;AACrB,QAAI,CAAC,KAAK,SAAS,EAAG,QAAO,QAAQ,QAAQ;AAC7C,WAAO,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,MAA4B,OAAmC;AACnE,QAAI,CAAC,KAAK,OAAQ,QAAO,CAAC,GAAG,KAAK;AAClC,UAAM,SAAU,MAAM,KAAK,MAAM,UAAU,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;AAIhE,WAAO,OAAO;AAAA,EAChB;AAAA,EAEA,SAAsB;AACpB,QAAI;AACJ,WAAO;AAAA,MACL,MAAM,CAAC,UAAU;AACf,YAAI,WAAW,UAAa,CAAC,KAAK,OAAQ,QAAO,QAAQ,QAAQ,KAAK;AACtE,YAAI,WAAW,QAAW;AACxB,mBAAS,EAAE,KAAK;AAChB,eAAK,SAAS,IAAI,MAAM;AACxB,eAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AAAA,QAC5C;AACA,eAAO,KAAK,MAAM,QAAQ,EAAE,QAAQ,MAAM,CAAC;AAAA,MAC7C;AAAA,MACA,KAAK,YAAY;AACf,YAAI,WAAW,OAAW,QAAO;AACjC,cAAM,OAAQ,MAAM,KAAK,MAAM,OAAO,EAAE,OAAO,CAAC;AAChD,aAAK,SAAS,OAAO,MAAM;AAC3B,eAAO;AAAA,MACT;AAAA,MACA,MAAM,MAAM;AACV,YAAI,WAAW,OAAW;AAC1B,cAAM,UAAU;AAChB,aAAK,SAAS,OAAO,OAAO;AAC5B,mBAAW,CAAC,IAAI,IAAI,KAAK,KAAK;AAC5B,cAAI,KAAK,QAAQ,WAAW,WAAW,KAAK,QAAQ,OAAO,gBAAgB;AACzE,iBAAK,SAAS,OAAO,EAAE;AACvB,iBAAK,QAAQ,KAAK;AAAA,UACpB;AACF,aAAK,KAAK,MAAM,QAAQ,EAAE,QAAQ,QAAQ,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,IAAY,QAAmD;AACnE,UAAM,UAAmB,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,OAAO;AAC7D,UAAM,SAAS,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9C,WAAK,SAAS,IAAI,QAAQ,IAAI,EAAE,SAAS,IAAI,KAAK,KAAK,GAAG,SAAS,OAAO,CAAC;AAAA,IAC7E,CAAC;AACD,SAAK,OAAO,YAAY,OAAO;AAC/B,eAAW,MAAM,KAAK,SAAS,GAAG,UAAU;AAC5C,SAAK,SAAS;AACd,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,MAAoB;AAC1B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,OAAO,WAAW,OAAO,OAAO,KAAK,KAAK,IAAI;AACpD,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,MAAM,SAAS,KAAK,MAAM,EAAG,MAAK,UAAU,KAAK;AACrD,UAAM,OAAO,OAAO,KAAK,OAAO,WAAW,KAAK,SAAS,IAAI,KAAK,EAAE,IAAI;AACxE,QAAI,MAAM;AACR,WAAK,SAAS,OAAO,KAAK,EAAY;AACtC,YAAM,UAAW,KAAK,IAA0C;AAChE,UAAI,OAAO,YAAY,SAAU,MAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,OAAO;AAC1E,UAAI,KAAK,MAAO,MAAK,OAAO,IAAI,MAAM,KAAK,MAAM,WAAW,mBAAmB,CAAC;AAAA,UAC3E,MAAK,QAAQ,KAAK,EAAE;AAAA,IAC3B;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAClB,UAAM,MAAM,KAAK,KAAK;AACtB,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,EAC/E;AAAA,EAEA,WAAoB;AAClB,WAAO,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,SAAS,KAAK,KAAK,YAAY;AAAA,EAC5E;AAAA,EAEA,YAAwB;AACtB,WAAO;AAAA,MACL,MAAM,CAAC,KAAK,QAAQ,SAAS,KAAK,SAAS,IAAI,YAAY;AAAA,MAC3D,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK,MAAM;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,UAAM,OAAO,KAAK,UAAU;AAC5B,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,OAAO,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,GAAuB,MAAM,KAAK;AACvF,WAAK,MAAM,QAAQ,oBAAoB,IAAI;AAC7C,QAAI,KAAK,SAAS,EAAG;AACrB,eAAW,WAAW,KAAK,SAAU,SAAQ;AAC7C,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAEO,SAAS,SAAS,OAAuC;AAC9D,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,MAAI,MAAM,WAAW,UAAW,QAAO;AACvC,SAAO,MAAM,SAAS,UAAU,SAAY;AAC9C;AAEO,SAAS,YACd,OACA,OACM;AACN,QAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,UAAM,UAAU;AAChB,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,EAAE,WAAW,WAAW,WAAW;AAChF;AACF,UAAM,QAAQ,QAAQ,OAAO,QAAQ,KAAK;AAAA,EAC5C,CAAC;AACH;",
+  "sourcesContent": ["import { type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Scrub, Scrubbable, ScrubStream } from './scrub.ts';\nimport { vaultHold } from './view.ts';\n\nexport type ScrubPair = { needed: boolean; version: number };\nexport type Locked = 'no' | 'scrubbing' | 'passkey';\n\nexport interface VaultState {\n  port: 'none' | 'ready' | 'waiting';\n  needed: boolean;\n  version: number;\n  locked: Locked;\n  held: number;\n}\n\nexport const WAITING_MS = 2000;\nexport const WAITING = 'waiting for the vault';\n\ntype Message = Record<string, unknown> & { id: number; op: string };\n\ninterface Pending {\n  message: Message;\n  at: number;\n  resolve(value: unknown): void;\n  reject(error: Error): void;\n}\n\ntype Answer = {\n  id?: unknown;\n  ok?: unknown;\n  error?: { message?: string };\n  scrub?: unknown;\n  locked?: unknown;\n};\n\nconst LOCKS: readonly unknown[] = ['no', 'scrubbing', 'passkey'];\n\nconst EMPTY = new Uint8Array();\n\nfunction pairOf(value: unknown): ScrubPair | undefined {\n  const pair = value as Partial<ScrubPair> | null;\n  if (pair === null) return { needed: false, version: 0 };\n  if (typeof pair?.needed !== 'boolean' || typeof pair.version !== 'number') return undefined;\n  return { needed: pair.needed, version: pair.version };\n}\n\nexport class Vault implements Scrub {\n  readonly state: MutableReplicatedState<VaultState>;\n  readonly #pending = new Map<number, Pending>();\n  readonly #streams = new Set<number>();\n  readonly #waiters = new Set<() => void>();\n  readonly #now: () => number;\n  #port: MessagePort | undefined;\n  #pair: ScrubPair = { needed: false, version: 0 };\n  #locked: Locked = 'no';\n  #seen = 0;\n  #serial = 0;\n  #streamSerial = 0;\n\n  constructor(now: () => number = Date.now) {\n    this.#now = now;\n    this.state = replicatedState<VaultState>(this.#snapshot());\n  }\n\n  get needed(): boolean {\n    return this.#pair.needed || this.#seen > this.#pair.version;\n  }\n\n  connect(port: MessagePort | undefined, scrub: unknown): void {\n    const pair = scrub === undefined ? undefined : pairOf(scrub);\n    if (pair) this.#pair = pair;\n    if (port && port !== this.#port) {\n      if (this.#port) this.#port.onmessage = null;\n      this.#port = port;\n      port.onmessage = (event) => this.#answer(event.data as Answer);\n      port.start?.();\n      const resend = [...this.#pending.values()];\n      const opening = new Set(\n        resend\n          .filter((item) => item.message.op === 'redactStream')\n          .map((item) => item.message.stream)\n      );\n      for (const stream of this.#streams)\n        if (!opening.has(stream)) void this.#call('redactStream', { stream });\n      for (const item of resend) port.postMessage(item.message);\n    }\n    this.#refresh();\n  }\n\n  ready(): Promise<void> {\n    if (!this.#holding()) return Promise.resolve();\n    return new Promise((resolve) => this.#waiters.add(resolve));\n  }\n\n  async texts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]> {\n    if (!this.needed) return [...texts];\n    const answer = (await this.#call('redact', { texts: [...texts] })) as {\n      texts: T[];\n      version?: number;\n    };\n    return answer.texts;\n  }\n\n  stream(): ScrubStream {\n    let stream: number | undefined;\n    return {\n      push: (chunk) => {\n        if (stream === undefined && !this.needed) return Promise.resolve(chunk);\n        if (stream === undefined) {\n          stream = ++this.#streamSerial;\n          this.#streams.add(stream);\n          void this.#call('redactStream', { stream });\n        }\n        return this.#call('push', { stream, chunk }) as Promise<Uint8Array>;\n      },\n      end: async () => {\n        if (stream === undefined) return EMPTY;\n        const tail = (await this.#call('end', { stream })) as Uint8Array;\n        this.#streams.delete(stream);\n        return tail;\n      },\n      drop: () => {\n        if (stream === undefined) return;\n        const dropped = stream;\n        this.#streams.delete(dropped);\n        for (const [id, item] of this.#pending)\n          if (item.message.stream === dropped && item.message.op !== 'redactStream') {\n            this.#pending.delete(id);\n            item.resolve(EMPTY);\n          }\n        void this.#call('drop', { stream: dropped });\n      },\n    };\n  }\n\n  #call(op: string, fields: Record<string, unknown>): Promise<unknown> {\n    const message: Message = { id: ++this.#serial, op, ...fields };\n    const result = new Promise((resolve, reject) => {\n      this.#pending.set(message.id, { message, at: this.#now(), resolve, reject });\n    });\n    this.#port?.postMessage(message);\n    setTimeout(() => this.#refresh(), WAITING_MS);\n    this.#refresh();\n    return result;\n  }\n\n  #answer(data: Answer): void {\n    if (!data || typeof data !== 'object') return;\n    const pair = 'scrub' in data ? pairOf(data.scrub) : undefined;\n    if (pair) this.#pair = pair;\n    if (LOCKS.includes(data.locked)) this.#locked = data.locked as Locked;\n    const item = typeof data.id === 'number' ? this.#pending.get(data.id) : undefined;\n    if (item) {\n      this.#pending.delete(data.id as number);\n      const version = (data.ok as { version?: unknown } | undefined)?.version;\n      if (typeof version === 'number') this.#seen = Math.max(this.#seen, version);\n      if (data.error) item.reject(new Error(data.error.message ?? 'the vault refused'));\n      else item.resolve(data.ok);\n    }\n    this.#refresh();\n  }\n\n  #waiting(): boolean {\n    const now = this.#now();\n    return [...this.#pending.values()].some((item) => now - item.at >= WAITING_MS);\n  }\n\n  #holding(): boolean {\n    return this.needed && (!this.#port || this.#waiting() || this.#locked === 'passkey');\n  }\n\n  #snapshot(): VaultState {\n    return {\n      port: !this.#port ? 'none' : this.#waiting() ? 'waiting' : 'ready',\n      needed: this.needed,\n      version: this.#pair.version,\n      locked: this.#locked,\n      held: this.#pending.size,\n    };\n  }\n\n  #refresh(): void {\n    const next = this.#snapshot();\n    const before = this.state.value;\n    if (Object.entries(next).some(([key, value]) => before[key as keyof VaultState] !== value))\n      this.state.replace(BACKGROUND_CONTEXT, next);\n    if (this.#holding()) return;\n    for (const resolve of this.#waiters) resolve();\n    this.#waiters.clear();\n  }\n}\n\nexport function holdText(state: VaultState): string | undefined {\n  const hold = vaultHold(state);\n  if (!hold) return undefined;\n  return hold.reason === 'locked' ? 'unlock the vault to continue' : WAITING;\n}\n\nexport function listenVault(\n  scope: { addEventListener(type: 'message', listener: (event: MessageEvent) => void): void },\n  vault: Vault\n): void {\n  scope.addEventListener('message', ({ data }) => {\n    const message = data as { vault?: MessagePort; scrub?: unknown } | null;\n    if (!message || typeof message !== 'object' || !('vault' in message || 'scrub' in message))\n      return;\n    vault.connect(message.vault, message.scrub);\n  });\n}\n"],
+  "mappings": "AAAA,SAAsC,uBAAuB;AAC7D,SAAS,0BAA0B;AAEnC,SAAS,iBAAiB;AAanB,MAAM,aAAa;AACnB,MAAM,UAAU;AAmBvB,MAAM,QAA4B,CAAC,MAAM,aAAa,SAAS;AAE/D,MAAM,QAAQ,IAAI,WAAW;AAE7B,SAAS,OAAO,OAAuC;AACrD,QAAM,OAAO;AACb,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,OAAO,SAAS,EAAE;AACtD,MAAI,OAAO,MAAM,WAAW,aAAa,OAAO,KAAK,YAAY,SAAU,QAAO;AAClF,SAAO,EAAE,QAAQ,KAAK,QAAQ,SAAS,KAAK,QAAQ;AACtD;AAEO,MAAM,MAAuB;AAAA,EACzB;AAAA,EACA,WAAW,oBAAI,IAAqB;AAAA,EACpC,WAAW,oBAAI,IAAY;AAAA,EAC3B,WAAW,oBAAI,IAAgB;AAAA,EAC/B;AAAA,EACT;AAAA,EACA,QAAmB,EAAE,QAAQ,OAAO,SAAS,EAAE;AAAA,EAC/C,UAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,gBAAgB;AAAA,EAEhB,YAAY,MAAoB,KAAK,KAAK;AACxC,SAAK,OAAO;AACZ,SAAK,QAAQ,gBAA4B,KAAK,UAAU,CAAC;AAAA,EAC3D;AAAA,EAEA,IAAI,SAAkB;AACpB,WAAO,KAAK,MAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AAAA,EACtD;AAAA,EAEA,QAAQ,MAA+B,OAAsB;AAC3D,UAAM,OAAO,UAAU,SAAY,SAAY,OAAO,KAAK;AAC3D,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,QAAQ,SAAS,KAAK,OAAO;AAC/B,UAAI,KAAK,MAAO,MAAK,MAAM,YAAY;AACvC,WAAK,QAAQ;AACb,WAAK,YAAY,CAAC,UAAU,KAAK,QAAQ,MAAM,IAAc;AAC7D,WAAK,QAAQ;AACb,YAAM,SAAS,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC;AACzC,YAAM,UAAU,IAAI;AAAA,QAClB,OACG,OAAO,CAAC,SAAS,KAAK,QAAQ,OAAO,cAAc,EACnD,IAAI,CAAC,SAAS,KAAK,QAAQ,MAAM;AAAA,MACtC;AACA,iBAAW,UAAU,KAAK;AACxB,YAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,MAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AACtE,iBAAW,QAAQ,OAAQ,MAAK,YAAY,KAAK,OAAO;AAAA,IAC1D;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,QAAuB;AACrB,QAAI,CAAC,KAAK,SAAS,EAAG,QAAO,QAAQ,QAAQ;AAC7C,WAAO,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,MAA4B,OAAmC;AACnE,QAAI,CAAC,KAAK,OAAQ,QAAO,CAAC,GAAG,KAAK;AAClC,UAAM,SAAU,MAAM,KAAK,MAAM,UAAU,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;AAIhE,WAAO,OAAO;AAAA,EAChB;AAAA,EAEA,SAAsB;AACpB,QAAI;AACJ,WAAO;AAAA,MACL,MAAM,CAAC,UAAU;AACf,YAAI,WAAW,UAAa,CAAC,KAAK,OAAQ,QAAO,QAAQ,QAAQ,KAAK;AACtE,YAAI,WAAW,QAAW;AACxB,mBAAS,EAAE,KAAK;AAChB,eAAK,SAAS,IAAI,MAAM;AACxB,eAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AAAA,QAC5C;AACA,eAAO,KAAK,MAAM,QAAQ,EAAE,QAAQ,MAAM,CAAC;AAAA,MAC7C;AAAA,MACA,KAAK,YAAY;AACf,YAAI,WAAW,OAAW,QAAO;AACjC,cAAM,OAAQ,MAAM,KAAK,MAAM,OAAO,EAAE,OAAO,CAAC;AAChD,aAAK,SAAS,OAAO,MAAM;AAC3B,eAAO;AAAA,MACT;AAAA,MACA,MAAM,MAAM;AACV,YAAI,WAAW,OAAW;AAC1B,cAAM,UAAU;AAChB,aAAK,SAAS,OAAO,OAAO;AAC5B,mBAAW,CAAC,IAAI,IAAI,KAAK,KAAK;AAC5B,cAAI,KAAK,QAAQ,WAAW,WAAW,KAAK,QAAQ,OAAO,gBAAgB;AACzE,iBAAK,SAAS,OAAO,EAAE;AACvB,iBAAK,QAAQ,KAAK;AAAA,UACpB;AACF,aAAK,KAAK,MAAM,QAAQ,EAAE,QAAQ,QAAQ,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,IAAY,QAAmD;AACnE,UAAM,UAAmB,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,OAAO;AAC7D,UAAM,SAAS,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9C,WAAK,SAAS,IAAI,QAAQ,IAAI,EAAE,SAAS,IAAI,KAAK,KAAK,GAAG,SAAS,OAAO,CAAC;AAAA,IAC7E,CAAC;AACD,SAAK,OAAO,YAAY,OAAO;AAC/B,eAAW,MAAM,KAAK,SAAS,GAAG,UAAU;AAC5C,SAAK,SAAS;AACd,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,MAAoB;AAC1B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,OAAO,WAAW,OAAO,OAAO,KAAK,KAAK,IAAI;AACpD,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,MAAM,SAAS,KAAK,MAAM,EAAG,MAAK,UAAU,KAAK;AACrD,UAAM,OAAO,OAAO,KAAK,OAAO,WAAW,KAAK,SAAS,IAAI,KAAK,EAAE,IAAI;AACxE,QAAI,MAAM;AACR,WAAK,SAAS,OAAO,KAAK,EAAY;AACtC,YAAM,UAAW,KAAK,IAA0C;AAChE,UAAI,OAAO,YAAY,SAAU,MAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,OAAO;AAC1E,UAAI,KAAK,MAAO,MAAK,OAAO,IAAI,MAAM,KAAK,MAAM,WAAW,mBAAmB,CAAC;AAAA,UAC3E,MAAK,QAAQ,KAAK,EAAE;AAAA,IAC3B;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAClB,UAAM,MAAM,KAAK,KAAK;AACtB,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,EAC/E;AAAA,EAEA,WAAoB;AAClB,WAAO,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,SAAS,KAAK,KAAK,YAAY;AAAA,EAC5E;AAAA,EAEA,YAAwB;AACtB,WAAO;AAAA,MACL,MAAM,CAAC,KAAK,QAAQ,SAAS,KAAK,SAAS,IAAI,YAAY;AAAA,MAC3D,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK,MAAM;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,UAAM,OAAO,KAAK,UAAU;AAC5B,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,OAAO,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,GAAuB,MAAM,KAAK;AACvF,WAAK,MAAM,QAAQ,oBAAoB,IAAI;AAC7C,QAAI,KAAK,SAAS,EAAG;AACrB,eAAW,WAAW,KAAK,SAAU,SAAQ;AAC7C,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAEO,SAAS,SAAS,OAAuC;AAC9D,QAAM,OAAO,UAAU,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,WAAW,WAAW,iCAAiC;AACrE;AAEO,SAAS,YACd,OACA,OACM;AACN,QAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,UAAM,UAAU;AAChB,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,EAAE,WAAW,WAAW,WAAW;AAChF;AACF,UAAM,QAAQ,QAAQ,OAAO,QAAQ,KAAK;AAAA,EAC5C,CAAC;AACH;",
   "names": []
 }

package/dist/secrets/view.js

@@ -0,0 +1,15 @@
+const SECRETS_KIND = "slicc.secrets";
+function vaultHold(state) {
+  if (!state?.needed) return null;
+  if (state.locked === "passkey") return { reason: "locked", held: state.held };
+  return state.port === "ready" ? null : { reason: "waiting", held: state.held };
+}
+function listedLine(names) {
+  return `The user listed secrets: ${names.length ? names.map((name) => name.name).join(", ") : "none"}.`;
+}
+export {
+  SECRETS_KIND,
+  listedLine,
+  vaultHold
+};
+//# sourceMappingURL=view.js.map

package/dist/secrets/view.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/view.ts"],
+  "sourcesContent": ["import type { SecretName } from './names.ts';\nimport type { VaultState } from './vault.ts';\n\nexport const SECRETS_KIND = 'slicc.secrets';\n\nexport interface VaultHold {\n  reason: 'waiting' | 'locked';\n  held: number;\n}\n\nexport function vaultHold(state: VaultState | undefined): VaultHold | null {\n  if (!state?.needed) return null;\n  if (state.locked === 'passkey') return { reason: 'locked', held: state.held };\n  return state.port === 'ready' ? null : { reason: 'waiting', held: state.held };\n}\n\nexport function listedLine(names: readonly SecretName[]): string {\n  return `The user listed secrets: ${names.length ? names.map((name) => name.name).join(', ') : 'none'}.`;\n}\n"],
+  "mappings": "AAGO,MAAM,eAAe;AAOrB,SAAS,UAAU,OAAiD;AACzE,MAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,MAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU,MAAM,MAAM,KAAK;AAC5E,SAAO,MAAM,SAAS,UAAU,OAAO,EAAE,QAAQ,WAAW,MAAM,MAAM,KAAK;AAC/E;AAEO,SAAS,WAAW,OAAsC;AAC/D,SAAO,4BAA4B,MAAM,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM;AACtG;",
+  "names": []
+}

package/dist/spectrum/agent-port.js

@@ -1,5 +1,6 @@
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { entryLick } from "../licks/state.js";
+import { vaultHold } from "../secrets/view.js";
 import { Emitter } from "./emitter.js";
 import { isBusy, queued, toMessages } from "./messages.js";
 const CONE = "cone";
@@ -23,15 +24,29 @@ function status(view, messages) {
 function slashCommand({ kind, ...command }) {
   return kind === "action" ? command : { ...command, kind };
 }
+function sameHold(a, b) {
+  return a === b || a !== null && b !== null && a.reason === b.reason && a.held === b.held;
+}
 class AgentAdapter extends Emitter {
   #connection;
   #ready;
   #messages = /* @__PURE__ */ new Map();
   #active = null;
   #creating = /* @__PURE__ */ new Map();
+  #hold = null;
+  #outbox = /* @__PURE__ */ new Map();
   constructor(connection) {
     super();
     this.#connection = connection;
+    this.#hold = this.hold();
+    connection.vault?.subscribe(() => {
+      const next = this.hold();
+      if (sameHold(next, this.#hold)) return;
+      this.#hold = next;
+      if (!next) for (const pending of this.#outbox.values()) pending.release();
+      this.emit("hold", next);
+      this.emit("agents", this.list());
+    });
     connection.frozen?.subscribe(() => {
       this.emit("frozen", this.frozen());
       this.emit("agents", this.list());
@@ -83,6 +98,9 @@ class AgentAdapter extends Emitter {
   ready() {
     return this.#ready;
   }
+  hold() {
+    return vaultHold(this.#connection.vault?.value);
+  }
   list() {
     const rows = this.#connection.frozen?.value ?? [];
     return this.#summary().map((summary) => {
@@ -94,7 +112,7 @@ class AgentAdapter extends Emitter {
         name: summary.role ? `${summary.name} \xB7 ${summary.role}` : summary.name,
         kind: summary.kind,
         parentId: summary.parentId,
-        status: status(view, this.#messages.get(summary.id) ?? []),
+        status: this.#status(summary.id, status(view, this.#messages.get(summary.id) ?? [])),
         model: doc?.model ? `${doc.model.provider}/${doc.model.modelId}` : "",
         contextFill: 0,
         unread: 0,
@@ -129,6 +147,9 @@ class AgentAdapter extends Emitter {
     const outgoing = typeof input === "string" ? { text: input } : input;
     const target = this.#creating.has(agentId) ? await this.#creating.get(agentId) : agentId;
     if (target === null) throw new Error("The scoop could not be created.");
+    const pending = target && this.#held(target) ? this.#pending(target, outgoing) : void 0;
+    if (pending) await pending.released;
+    if (pending?.dropped) return this.#settle(pending);
     const sent = await this.#connection.control.send(
       {
         text: outgoing.text,
@@ -137,8 +158,30 @@ class AgentAdapter extends Emitter {
         agentId: target || null
       },
       BACKGROUND_CONTEXT
-    );
+    ).finally(() => pending && this.#settle(pending));
     if (!sent.accepted) throw new Error(sent.error.message);
+    if (pending?.dropped)
+      void this.#connection.control.unqueue(pending.agentId, sent.submissionId, BACKGROUND_CONTEXT);
+  }
+  #pending(agentId, outgoing) {
+    const id = `p${crypto.randomUUID()}`;
+    const message = {
+      id,
+      role: "user",
+      text: outgoing.text,
+      createdAt: Date.now(),
+      queued: true,
+      mode: outgoing.mode === "queue" ? "queue" : "steer"
+    };
+    const { promise: released, resolve: release } = Promise.withResolvers();
+    const pending = { agentId, message, dropped: false, release, released };
+    this.#outbox.set(id, pending);
+    this.emit("messages", agentId);
+    return pending;
+  }
+  #settle(pending) {
+    this.#outbox.delete(pending.message.id);
+    this.emit("messages", pending.agentId);
   }
   async rewind(agentId, messageId) {
     const rewound = await this.#connection.control.rewindAgent(
@@ -152,12 +195,26 @@ class AgentAdapter extends Emitter {
     void this.#connection.control.stopAgent(agentId, BACKGROUND_CONTEXT);
   }
   busy(agentId = this.active()) {
-    return isBusy(this.#view(agentId));
+    return isBusy(this.#view(agentId)) || this.#held(agentId);
+  }
+  #status(agentId, shown) {
+    return shown === "idle" && this.#held(agentId) ? "working" : shown;
+  }
+  #held(agentId) {
+    return this.#hold !== null && agentId === (this.#connection.agents?.value?.active ?? CONE);
   }
   queue(agentId = this.active()) {
-    return queued(this.#view(agentId));
+    const pending = [...this.#outbox.values()].filter((item) => item.agentId === agentId && !item.dropped).map((item) => item.message);
+    return [...queued(this.#view(agentId)), ...pending];
   }
   unqueue(agentId, messageId) {
+    const pending = this.#outbox.get(messageId);
+    if (pending) {
+      pending.dropped = true;
+      pending.release();
+      this.emit("messages", pending.agentId);
+      return;
+    }
     void this.#connection.control.unqueue(agentId, messageId.replace(/^q/, ""), BACKGROUND_CONTEXT);
   }
   suggestion() {

package/dist/spectrum/agent-port.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/spectrum/agent-port.ts"],
-  "sourcesContent": ["import type {\n  Agent,\n  AgentEvents,\n  AgentPort,\n  AgentStatus,\n  FrozenCone,\n  Message,\n  Outgoing,\n  SlashCommand,\n  Thinking,\n  UserMessage,\n} from '@ai-ecoverse/slicc-spectrum/ui';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { AgentConnection } from '../client.ts';\nimport { entryLick } from '../licks/state.ts';\nimport type { AgentSettingsChange, AgentSummary, Command } from '../services.ts';\nimport { Emitter } from './emitter.ts';\nimport { isBusy, queued, toMessages } from './messages.ts';\n\nexport const CONE = 'cone';\n\nconst thinking: Record<string, Thinking> = {\n  off: 'off',\n  minimal: 'low',\n  low: 'low',\n  medium: 'medium',\n  high: 'high',\n  xhigh: 'high',\n  max: 'high',\n};\n\ninterface AgentDoc {\n  model?: { provider: string; modelId: string };\n  thinkingLevel?: string;\n}\n\nfunction status(view: ConversationView | undefined, messages: readonly Message[]): AgentStatus {\n  if (isBusy(view)) {\n    const live = view?.docs['pi.live'] as { tools?: { status: string }[] } | undefined;\n    return live?.tools?.some((slot) => slot.status === 'running') ? 'working' : 'thinking';\n  }\n  const last = messages.at(-1);\n  return last?.role === 'assistant' && last.status === 'error' ? 'error' : 'idle';\n}\n\nexport function slashCommand({ kind, ...command }: Command): SlashCommand {\n  return kind === 'action' ? command : { ...command, kind };\n}\n\nexport class AgentAdapter extends Emitter<AgentEvents> implements AgentPort {\n  readonly #connection: AgentConnection;\n  readonly #ready: Promise<void>;\n  readonly #messages = new Map<string, Message[]>();\n  #active: string | null = null;\n  #creating = new Map<string, Promise<string | null>>();\n\n  constructor(connection: AgentConnection) {\n    super();\n    this.#connection = connection;\n    connection.frozen?.subscribe(() => {\n      this.emit('frozen', this.frozen());\n      this.emit('agents', this.list());\n    });\n    this.#ready = new Promise((resolve) => {\n      connection.transcript.subscribe(() => {\n        this.#refresh();\n        resolve();\n      });\n      connection.deliveries.subscribe(() => this.#refresh());\n      connection.views?.subscribe(() => this.#refresh());\n      connection.agents?.subscribe(() => this.#refresh());\n    });\n  }\n\n  #summary(): readonly AgentSummary[] {\n    const agents = this.#connection.agents?.value?.agents;\n    return agents?.length\n      ? agents\n      : [{ id: CONE, name: 'sliccy', kind: 'cone', parentId: null, role: null }];\n  }\n\n  #view(agentId: string = this.active()): ConversationView | undefined {\n    const views = this.#connection.views?.value;\n    const view = views?.[agentId];\n    if (view) return view;\n    const cone = this.#connection.agents?.value?.active ?? CONE;\n    return agentId === cone ? this.#connection.transcript.value : undefined;\n  }\n\n  #refresh(): void {\n    this.#active ??= this.#connection.agents?.value?.active ?? null;\n    this.emit('agents', this.list());\n    for (const summary of this.#summary()) this.#update(summary.id);\n    for (const id of [...this.#messages.keys()])\n      if (!this.#summary().some((summary) => summary.id === id)) this.#messages.delete(id);\n  }\n\n  #update(agentId: string): void {\n    const view = this.#view(agentId);\n    if (!view) return;\n    const before = this.#messages.get(agentId) ?? [];\n    const after = toMessages(view, this.#connection.deliveries.value);\n    this.#messages.set(agentId, after);\n    if (before.length !== after.length) {\n      this.emit('messages', agentId);\n      return;\n    }\n    const changed = after.filter(\n      (message, index) => JSON.stringify(message) !== JSON.stringify(before[index])\n    );\n    if (changed.length === 1) this.emit('message', { agentId, message: changed[0] as Message });\n    else if (changed.length > 1) this.emit('messages', agentId);\n  }\n\n  ready(): Promise<void> {\n    return this.#ready;\n  }\n\n  list(): readonly Agent[] {\n    const rows = this.#connection.frozen?.value ?? [];\n    return this.#summary().map((summary) => {\n      const view = this.#view(summary.id);\n      const doc = view?.docs['pi.agent'] as AgentDoc | undefined;\n      const title =\n        summary.kind === 'cone' ? rows.find((row) => row.id === summary.id)?.title : undefined;\n      return {\n        id: summary.id,\n        name: summary.role ? `${summary.name} \u00B7 ${summary.role}` : summary.name,\n        kind: summary.kind,\n        parentId: summary.parentId,\n        status: status(view, this.#messages.get(summary.id) ?? []),\n        model: doc?.model ? `${doc.model.provider}/${doc.model.modelId}` : '',\n        contextFill: 0,\n        unread: 0,\n        thinking: thinking[doc?.thinkingLevel ?? 'off'] ?? 'off',\n        ...(title ? { title } : {}),\n      };\n    });\n  }\n\n  active(): string {\n    const known = this.#summary();\n    if (this.#active && this.#creating.has(this.#active)) return this.#active;\n    if (this.#active && known.some((summary) => summary.id === this.#active)) return this.#active;\n    return this.#connection.agents?.value?.active ?? CONE;\n  }\n\n  select(id: string): void {\n    if (this.#creating.has(id)) {\n      this.#active = id;\n      this.emit('active', id);\n      return;\n    }\n    const found = this.#summary().find((summary) => summary.id === id);\n    if (!found) return;\n    this.#active = id;\n    if (found.kind === 'cone') void this.#connection.control.selectCone(id, BACKGROUND_CONTEXT);\n    this.emit('active', id);\n    this.emit('messages', id);\n  }\n\n  messages(agentId: string = this.active()): readonly Message[] {\n    return this.#messages.get(agentId) ?? [];\n  }\n\n  async send(agentId: string, input: string | Outgoing): Promise<void> {\n    const outgoing = typeof input === 'string' ? { text: input } : input;\n    const target = this.#creating.has(agentId) ? await this.#creating.get(agentId) : agentId;\n    if (target === null) throw new Error('The scoop could not be created.');\n    const sent = await this.#connection.control.send(\n      {\n        text: outgoing.text,\n        whenBusy: outgoing.mode === 'queue' ? 'followUp' : 'steer',\n        requestId: crypto.randomUUID(),\n        agentId: target || null,\n      },\n      BACKGROUND_CONTEXT\n    );\n    if (!sent.accepted) throw new Error(sent.error.message);\n  }\n\n  async rewind(agentId: string, messageId: string): Promise<Outgoing | null> {\n    const rewound = await this.#connection.control.rewindAgent(\n      agentId,\n      messageId,\n      BACKGROUND_CONTEXT\n    );\n    return rewound.done ? { text: rewound.text } : null;\n  }\n\n  stop(agentId: string = this.active()): void {\n    void this.#connection.control.stopAgent(agentId, BACKGROUND_CONTEXT);\n  }\n\n  busy(agentId: string = this.active()): boolean {\n    return isBusy(this.#view(agentId));\n  }\n\n  queue(agentId: string = this.active()): readonly UserMessage[] {\n    return queued(this.#view(agentId));\n  }\n\n  unqueue(agentId: string, messageId: string): void {\n    void this.#connection.control.unqueue(agentId, messageId.replace(/^q/, ''), BACKGROUND_CONTEXT);\n  }\n\n  suggestion(): string | null {\n    return null;\n  }\n\n  answer(): void {}\n\n  resolveLick(agentId: string, messageId: string, state: 'confirmed' | 'dismissed'): void {\n    const message = this.messages(agentId).find((candidate) => candidate.id === messageId);\n    const entry = this.#view(agentId)?.entries.find(\n      (candidate) => `e${candidate.id}` === messageId\n    );\n    const lick = message?.role === 'lick' && entry ? entryLick(entry) : undefined;\n    if (lick)\n      void this.#connection.control.resolveAgentLick(agentId, lick.id, state, BACKGROUND_CONTEXT);\n  }\n\n  compact(agentId: string = this.active()): void {\n    void this.#connection.control.compactAgent(agentId, null, BACKGROUND_CONTEXT);\n  }\n\n  clear(agentId: string = this.active()): void {\n    void this.#connection.control.newChat(agentId, BACKGROUND_CONTEXT);\n  }\n\n  freeze(agentId: string = this.active()): void {\n    void this.#connection.control.freeze(agentId, BACKGROUND_CONTEXT);\n  }\n\n  #configure(agentId: string, change: Partial<AgentSettingsChange>): void {\n    void this.#connection.control.configure(\n      {\n        model: change.model ?? null,\n        thinkingLevel: change.thinkingLevel ?? null,\n        agentId,\n      },\n      BACKGROUND_CONTEXT\n    );\n  }\n\n  setModel(agentId: string, model: string): void {\n    const at = model.indexOf('/');\n    if (at <= 0) return;\n    this.#configure(agentId, {\n      model: { provider: model.slice(0, at), modelId: model.slice(at + 1) },\n    });\n  }\n\n  setThinking(agentId: string, level: Thinking): void {\n    this.#configure(agentId, { thinkingLevel: level });\n  }\n\n  async older(): Promise<readonly Message[]> {\n    return [];\n  }\n\n  commands(): readonly SlashCommand[] {\n    return (this.#connection.commands?.value ?? []).map(slashCommand);\n  }\n\n  createScoop(parentId: string, name: string): Agent {\n    const provisional = `scoop:creating-${crypto.randomUUID()}`;\n    const created = this.#connection.control.createScoop(parentId, name, BACKGROUND_CONTEXT).then(\n      (result) => result.id,\n      () => null\n    );\n    this.#creating.set(provisional, created);\n    void created.then((id) => {\n      if (this.#active !== provisional) return;\n      this.#active = id ?? parentId;\n      this.emit('active', this.#active);\n      this.emit('messages', this.#active);\n    });\n    return {\n      id: provisional,\n      name,\n      kind: 'scoop',\n      parentId,\n      status: 'idle',\n      model: '',\n      contextFill: 0,\n      unread: 0,\n    };\n  }\n\n  async drop(agentId: string): Promise<void> {\n    const parent = this.#summary().find((summary) => summary.id === agentId)?.parentId ?? CONE;\n    const dropped = await this.#connection.control.drop(agentId, BACKGROUND_CONTEXT);\n    if (dropped.error !== null) throw new Error(dropped.error);\n    if (this.#active === agentId) this.select(parent);\n  }\n\n  async createCone(name: string): Promise<Agent> {\n    const created = await this.#connection.control.createCone(name, BACKGROUND_CONTEXT);\n    if (created.error !== null) throw new Error(created.error);\n    return {\n      id: created.id,\n      name: name.trim(),\n      kind: 'cone',\n      parentId: null,\n      status: 'idle',\n      model: '',\n      contextFill: 0,\n      unread: 0,\n    };\n  }\n\n  frozen(): readonly FrozenCone[] {\n    return (this.#connection.frozen?.value ?? []).map(\n      ({ id, name, title, model, messages, frozenAt, kind, live, thawedAs }) => ({\n        id,\n        name,\n        title,\n        model,\n        messages,\n        frozenAt,\n        kind,\n        live,\n        ...(thawedAs ? { thawedAs } : {}),\n      })\n    );\n  }\n\n  thaw(id: string): Agent | null {\n    const record = this.frozen().find((item) => item.id === id);\n    if (!record) return null;\n    if (record.live) {\n      const running = this.list().find((agent) => agent.id === id) ?? null;\n      if (running) this.select(id);\n      return running;\n    }\n    const provisional = `thawing-${crypto.randomUUID()}`;\n    const thawed = this.#connection.control.thaw(id, BACKGROUND_CONTEXT).then(\n      (result) => result.id,\n      () => null\n    );\n    this.#creating.set(provisional, thawed);\n    void thawed.then((cone) => {\n      if (this.#active !== provisional) return;\n      this.#active = cone ?? CONE;\n      this.emit('active', this.#active);\n      this.emit('messages', this.#active);\n    });\n    return {\n      id: provisional,\n      name: record.name,\n      kind: 'cone',\n      parentId: null,\n      status: 'idle',\n      model: record.model,\n      contextFill: 0,\n      unread: 0,\n    };\n  }\n\n  discard(id: string): void {\n    void this.#connection.control.discard(id, BACKGROUND_CONTEXT);\n  }\n}\n"],
-  "mappings": "AAYA,SAAS,0BAA0B;AAGnC,SAAS,iBAAiB;AAE1B,SAAS,eAAe;AACxB,SAAS,QAAQ,QAAQ,kBAAkB;AAEpC,MAAM,OAAO;AAEpB,MAAM,WAAqC;AAAA,EACzC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,KAAK;AACP;AAOA,SAAS,OAAO,MAAoC,UAA2C;AAC7F,MAAI,OAAO,IAAI,GAAG;AAChB,UAAM,OAAO,MAAM,KAAK,SAAS;AACjC,WAAO,MAAM,OAAO,KAAK,CAAC,SAAS,KAAK,WAAW,SAAS,IAAI,YAAY;AAAA,EAC9E;AACA,QAAM,OAAO,SAAS,GAAG,EAAE;AAC3B,SAAO,MAAM,SAAS,eAAe,KAAK,WAAW,UAAU,UAAU;AAC3E;AAEO,SAAS,aAAa,EAAE,MAAM,GAAG,QAAQ,GAA0B;AACxE,SAAO,SAAS,WAAW,UAAU,EAAE,GAAG,SAAS,KAAK;AAC1D;AAEO,MAAM,qBAAqB,QAA0C;AAAA,EACjE;AAAA,EACA;AAAA,EACA,YAAY,oBAAI,IAAuB;AAAA,EAChD,UAAyB;AAAA,EACzB,YAAY,oBAAI,IAAoC;AAAA,EAEpD,YAAY,YAA6B;AACvC,UAAM;AACN,SAAK,cAAc;AACnB,eAAW,QAAQ,UAAU,MAAM;AACjC,WAAK,KAAK,UAAU,KAAK,OAAO,CAAC;AACjC,WAAK,KAAK,UAAU,KAAK,KAAK,CAAC;AAAA,IACjC,CAAC;AACD,SAAK,SAAS,IAAI,QAAQ,CAAC,YAAY;AACrC,iBAAW,WAAW,UAAU,MAAM;AACpC,aAAK,SAAS;AACd,gBAAQ;AAAA,MACV,CAAC;AACD,iBAAW,WAAW,UAAU,MAAM,KAAK,SAAS,CAAC;AACrD,iBAAW,OAAO,UAAU,MAAM,KAAK,SAAS,CAAC;AACjD,iBAAW,QAAQ,UAAU,MAAM,KAAK,SAAS,CAAC;AAAA,IACpD,CAAC;AAAA,EACH;AAAA,EAEA,WAAoC;AAClC,UAAM,SAAS,KAAK,YAAY,QAAQ,OAAO;AAC/C,WAAO,QAAQ,SACX,SACA,CAAC,EAAE,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,UAAkB,KAAK,OAAO,GAAiC;AACnE,UAAM,QAAQ,KAAK,YAAY,OAAO;AACtC,UAAM,OAAO,QAAQ,OAAO;AAC5B,QAAI,KAAM,QAAO;AACjB,UAAM,OAAO,KAAK,YAAY,QAAQ,OAAO,UAAU;AACvD,WAAO,YAAY,OAAO,KAAK,YAAY,WAAW,QAAQ;AAAA,EAChE;AAAA,EAEA,WAAiB;AACf,SAAK,YAAY,KAAK,YAAY,QAAQ,OAAO,UAAU;AAC3D,SAAK,KAAK,UAAU,KAAK,KAAK,CAAC;AAC/B,eAAW,WAAW,KAAK,SAAS,EAAG,MAAK,QAAQ,QAAQ,EAAE;AAC9D,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,KAAK,CAAC;AACxC,UAAI,CAAC,KAAK,SAAS,EAAE,KAAK,CAAC,YAAY,QAAQ,OAAO,EAAE,EAAG,MAAK,UAAU,OAAO,EAAE;AAAA,EACvF;AAAA,EAEA,QAAQ,SAAuB;AAC7B,UAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAI,CAAC,KAAM;AACX,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC;AAC/C,UAAM,QAAQ,WAAW,MAAM,KAAK,YAAY,WAAW,KAAK;AAChE,SAAK,UAAU,IAAI,SAAS,KAAK;AACjC,QAAI,OAAO,WAAW,MAAM,QAAQ;AAClC,WAAK,KAAK,YAAY,OAAO;AAC7B;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,CAAC,SAAS,UAAU,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,OAAO,KAAK,CAAC;AAAA,IAC9E;AACA,QAAI,QAAQ,WAAW,EAAG,MAAK,KAAK,WAAW,EAAE,SAAS,SAAS,QAAQ,CAAC,EAAa,CAAC;AAAA,aACjF,QAAQ,SAAS,EAAG,MAAK,KAAK,YAAY,OAAO;AAAA,EAC5D;AAAA,EAEA,QAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,OAAyB;AACvB,UAAM,OAAO,KAAK,YAAY,QAAQ,SAAS,CAAC;AAChD,WAAO,KAAK,SAAS,EAAE,IAAI,CAAC,YAAY;AACtC,YAAM,OAAO,KAAK,MAAM,QAAQ,EAAE;AAClC,YAAM,MAAM,MAAM,KAAK,UAAU;AACjC,YAAM,QACJ,QAAQ,SAAS,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ,EAAE,GAAG,QAAQ;AAC/E,aAAO;AAAA,QACL,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ,OAAO,GAAG,QAAQ,IAAI,SAAM,QAAQ,IAAI,KAAK,QAAQ;AAAA,QACnE,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,QAAQ,OAAO,MAAM,KAAK,UAAU,IAAI,QAAQ,EAAE,KAAK,CAAC,CAAC;AAAA,QACzD,OAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,QAAQ,IAAI,IAAI,MAAM,OAAO,KAAK;AAAA,QACnE,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,UAAU,SAAS,KAAK,iBAAiB,KAAK,KAAK;AAAA,QACnD,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,SAAiB;AACf,UAAM,QAAQ,KAAK,SAAS;AAC5B,QAAI,KAAK,WAAW,KAAK,UAAU,IAAI,KAAK,OAAO,EAAG,QAAO,KAAK;AAClE,QAAI,KAAK,WAAW,MAAM,KAAK,CAAC,YAAY,QAAQ,OAAO,KAAK,OAAO,EAAG,QAAO,KAAK;AACtF,WAAO,KAAK,YAAY,QAAQ,OAAO,UAAU;AAAA,EACnD;AAAA,EAEA,OAAO,IAAkB;AACvB,QAAI,KAAK,UAAU,IAAI,EAAE,GAAG;AAC1B,WAAK,UAAU;AACf,WAAK,KAAK,UAAU,EAAE;AACtB;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,SAAS,EAAE,KAAK,CAAC,YAAY,QAAQ,OAAO,EAAE;AACjE,QAAI,CAAC,MAAO;AACZ,SAAK,UAAU;AACf,QAAI,MAAM,SAAS,OAAQ,MAAK,KAAK,YAAY,QAAQ,WAAW,IAAI,kBAAkB;AAC1F,SAAK,KAAK,UAAU,EAAE;AACtB,SAAK,KAAK,YAAY,EAAE;AAAA,EAC1B;AAAA,EAEA,SAAS,UAAkB,KAAK,OAAO,GAAuB;AAC5D,WAAO,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC;AAAA,EACzC;AAAA,EAEA,MAAM,KAAK,SAAiB,OAAyC;AACnE,UAAM,WAAW,OAAO,UAAU,WAAW,EAAE,MAAM,MAAM,IAAI;AAC/D,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO,IAAI,MAAM,KAAK,UAAU,IAAI,OAAO,IAAI;AACjF,QAAI,WAAW,KAAM,OAAM,IAAI,MAAM,iCAAiC;AACtE,UAAM,OAAO,MAAM,KAAK,YAAY,QAAQ;AAAA,MAC1C;AAAA,QACE,MAAM,SAAS;AAAA,QACf,UAAU,SAAS,SAAS,UAAU,aAAa;AAAA,QACnD,WAAW,OAAO,WAAW;AAAA,QAC7B,SAAS,UAAU;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,KAAK,MAAM,OAAO;AAAA,EACxD;AAAA,EAEA,MAAM,OAAO,SAAiB,WAA6C;AACzE,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI;AAAA,EACjD;AAAA,EAEA,KAAK,UAAkB,KAAK,OAAO,GAAS;AAC1C,SAAK,KAAK,YAAY,QAAQ,UAAU,SAAS,kBAAkB;AAAA,EACrE;AAAA,EAEA,KAAK,UAAkB,KAAK,OAAO,GAAY;AAC7C,WAAO,OAAO,KAAK,MAAM,OAAO,CAAC;AAAA,EACnC;AAAA,EAEA,MAAM,UAAkB,KAAK,OAAO,GAA2B;AAC7D,WAAO,OAAO,KAAK,MAAM,OAAO,CAAC;AAAA,EACnC;AAAA,EAEA,QAAQ,SAAiB,WAAyB;AAChD,SAAK,KAAK,YAAY,QAAQ,QAAQ,SAAS,UAAU,QAAQ,MAAM,EAAE,GAAG,kBAAkB;AAAA,EAChG;AAAA,EAEA,aAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,SAAe;AAAA,EAAC;AAAA,EAEhB,YAAY,SAAiB,WAAmB,OAAwC;AACtF,UAAM,UAAU,KAAK,SAAS,OAAO,EAAE,KAAK,CAAC,cAAc,UAAU,OAAO,SAAS;AACrF,UAAM,QAAQ,KAAK,MAAM,OAAO,GAAG,QAAQ;AAAA,MACzC,CAAC,cAAc,IAAI,UAAU,EAAE,OAAO;AAAA,IACxC;AACA,UAAM,OAAO,SAAS,SAAS,UAAU,QAAQ,UAAU,KAAK,IAAI;AACpE,QAAI;AACF,WAAK,KAAK,YAAY,QAAQ,iBAAiB,SAAS,KAAK,IAAI,OAAO,kBAAkB;AAAA,EAC9F;AAAA,EAEA,QAAQ,UAAkB,KAAK,OAAO,GAAS;AAC7C,SAAK,KAAK,YAAY,QAAQ,aAAa,SAAS,MAAM,kBAAkB;AAAA,EAC9E;AAAA,EAEA,MAAM,UAAkB,KAAK,OAAO,GAAS;AAC3C,SAAK,KAAK,YAAY,QAAQ,QAAQ,SAAS,kBAAkB;AAAA,EACnE;AAAA,EAEA,OAAO,UAAkB,KAAK,OAAO,GAAS;AAC5C,SAAK,KAAK,YAAY,QAAQ,OAAO,SAAS,kBAAkB;AAAA,EAClE;AAAA,EAEA,WAAW,SAAiB,QAA4C;AACtE,SAAK,KAAK,YAAY,QAAQ;AAAA,MAC5B;AAAA,QACE,OAAO,OAAO,SAAS;AAAA,QACvB,eAAe,OAAO,iBAAiB;AAAA,QACvC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,SAAS,SAAiB,OAAqB;AAC7C,UAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,QAAI,MAAM,EAAG;AACb,SAAK,WAAW,SAAS;AAAA,MACvB,OAAO,EAAE,UAAU,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,MAAM,MAAM,KAAK,CAAC,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,YAAY,SAAiB,OAAuB;AAClD,SAAK,WAAW,SAAS,EAAE,eAAe,MAAM,CAAC;AAAA,EACnD;AAAA,EAEA,MAAM,QAAqC;AACzC,WAAO,CAAC;AAAA,EACV;AAAA,EAEA,WAAoC;AAClC,YAAQ,KAAK,YAAY,UAAU,SAAS,CAAC,GAAG,IAAI,YAAY;AAAA,EAClE;AAAA,EAEA,YAAY,UAAkB,MAAqB;AACjD,UAAM,cAAc,kBAAkB,OAAO,WAAW,CAAC;AACzD,UAAM,UAAU,KAAK,YAAY,QAAQ,YAAY,UAAU,MAAM,kBAAkB,EAAE;AAAA,MACvF,CAAC,WAAW,OAAO;AAAA,MACnB,MAAM;AAAA,IACR;AACA,SAAK,UAAU,IAAI,aAAa,OAAO;AACvC,SAAK,QAAQ,KAAK,CAAC,OAAO;AACxB,UAAI,KAAK,YAAY,YAAa;AAClC,WAAK,UAAU,MAAM;AACrB,WAAK,KAAK,UAAU,KAAK,OAAO;AAChC,WAAK,KAAK,YAAY,KAAK,OAAO;AAAA,IACpC,CAAC;AACD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,SAAgC;AACzC,UAAM,SAAS,KAAK,SAAS,EAAE,KAAK,CAAC,YAAY,QAAQ,OAAO,OAAO,GAAG,YAAY;AACtF,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,KAAK,SAAS,kBAAkB;AAC/E,QAAI,QAAQ,UAAU,KAAM,OAAM,IAAI,MAAM,QAAQ,KAAK;AACzD,QAAI,KAAK,YAAY,QAAS,MAAK,OAAO,MAAM;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,MAA8B;AAC7C,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,WAAW,MAAM,kBAAkB;AAClF,QAAI,QAAQ,UAAU,KAAM,OAAM,IAAI,MAAM,QAAQ,KAAK;AACzD,WAAO;AAAA,MACL,IAAI,QAAQ;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EAEA,SAAgC;AAC9B,YAAQ,KAAK,YAAY,QAAQ,SAAS,CAAC,GAAG;AAAA,MAC5C,CAAC,EAAE,IAAI,MAAM,OAAO,OAAO,UAAU,UAAU,MAAM,MAAM,SAAS,OAAO;AAAA,QACzE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,KAAK,IAA0B;AAC7B,UAAM,SAAS,KAAK,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE;AAC1D,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,MAAM;AACf,YAAM,UAAU,KAAK,KAAK,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,EAAE,KAAK;AAChE,UAAI,QAAS,MAAK,OAAO,EAAE;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,cAAc,WAAW,OAAO,WAAW,CAAC;AAClD,UAAM,SAAS,KAAK,YAAY,QAAQ,KAAK,IAAI,kBAAkB,EAAE;AAAA,MACnE,CAAC,WAAW,OAAO;AAAA,MACnB,MAAM;AAAA,IACR;AACA,SAAK,UAAU,IAAI,aAAa,MAAM;AACtC,SAAK,OAAO,KAAK,CAAC,SAAS;AACzB,UAAI,KAAK,YAAY,YAAa;AAClC,WAAK,UAAU,QAAQ;AACvB,WAAK,KAAK,UAAU,KAAK,OAAO;AAChC,WAAK,KAAK,YAAY,KAAK,OAAO;AAAA,IACpC,CAAC;AACD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM,OAAO;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,OAAO,OAAO;AAAA,MACd,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EAEA,QAAQ,IAAkB;AACxB,SAAK,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB;AAAA,EAC9D;AACF;",
+  "sourcesContent": ["import type {\n  Agent,\n  AgentEvents,\n  AgentPort,\n  AgentStatus,\n  FrozenCone,\n  Message,\n  Outgoing,\n  SlashCommand,\n  Thinking,\n  UserMessage,\n} from '@ai-ecoverse/slicc-spectrum/ui';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { AgentConnection } from '../client.ts';\nimport { entryLick } from '../licks/state.ts';\nimport { type VaultHold, vaultHold } from '../secrets/view.ts';\nimport type { AgentSettingsChange, AgentSummary, Command } from '../services.ts';\nimport { Emitter } from './emitter.ts';\nimport { isBusy, queued, toMessages } from './messages.ts';\n\nexport const CONE = 'cone';\n\nconst thinking: Record<string, Thinking> = {\n  off: 'off',\n  minimal: 'low',\n  low: 'low',\n  medium: 'medium',\n  high: 'high',\n  xhigh: 'high',\n  max: 'high',\n};\n\ninterface AgentDoc {\n  model?: { provider: string; modelId: string };\n  thinkingLevel?: string;\n}\n\nfunction status(view: ConversationView | undefined, messages: readonly Message[]): AgentStatus {\n  if (isBusy(view)) {\n    const live = view?.docs['pi.live'] as { tools?: { status: string }[] } | undefined;\n    return live?.tools?.some((slot) => slot.status === 'running') ? 'working' : 'thinking';\n  }\n  const last = messages.at(-1);\n  return last?.role === 'assistant' && last.status === 'error' ? 'error' : 'idle';\n}\n\nexport function slashCommand({ kind, ...command }: Command): SlashCommand {\n  return kind === 'action' ? command : { ...command, kind };\n}\n\nexport type AgentHold = VaultHold;\n\nexport type AgentAdapterEvents = AgentEvents & { hold: AgentHold | null };\n\nfunction sameHold(a: AgentHold | null, b: AgentHold | null): boolean {\n  return a === b || (a !== null && b !== null && a.reason === b.reason && a.held === b.held);\n}\n\ninterface Pending {\n  agentId: string;\n  message: UserMessage;\n  dropped: boolean;\n  release(): void;\n  released: Promise<void>;\n}\n\nexport class AgentAdapter extends Emitter<AgentAdapterEvents> implements AgentPort {\n  readonly #connection: AgentConnection;\n  readonly #ready: Promise<void>;\n  readonly #messages = new Map<string, Message[]>();\n  #active: string | null = null;\n  #creating = new Map<string, Promise<string | null>>();\n  #hold: AgentHold | null = null;\n  readonly #outbox = new Map<string, Pending>();\n\n  constructor(connection: AgentConnection) {\n    super();\n    this.#connection = connection;\n    this.#hold = this.hold();\n    connection.vault?.subscribe(() => {\n      const next = this.hold();\n      if (sameHold(next, this.#hold)) return;\n      this.#hold = next;\n      if (!next) for (const pending of this.#outbox.values()) pending.release();\n      this.emit('hold', next);\n      this.emit('agents', this.list());\n    });\n    connection.frozen?.subscribe(() => {\n      this.emit('frozen', this.frozen());\n      this.emit('agents', this.list());\n    });\n    this.#ready = new Promise((resolve) => {\n      connection.transcript.subscribe(() => {\n        this.#refresh();\n        resolve();\n      });\n      connection.deliveries.subscribe(() => this.#refresh());\n      connection.views?.subscribe(() => this.#refresh());\n      connection.agents?.subscribe(() => this.#refresh());\n    });\n  }\n\n  #summary(): readonly AgentSummary[] {\n    const agents = this.#connection.agents?.value?.agents;\n    return agents?.length\n      ? agents\n      : [{ id: CONE, name: 'sliccy', kind: 'cone', parentId: null, role: null }];\n  }\n\n  #view(agentId: string = this.active()): ConversationView | undefined {\n    const views = this.#connection.views?.value;\n    const view = views?.[agentId];\n    if (view) return view;\n    const cone = this.#connection.agents?.value?.active ?? CONE;\n    return agentId === cone ? this.#connection.transcript.value : undefined;\n  }\n\n  #refresh(): void {\n    this.#active ??= this.#connection.agents?.value?.active ?? null;\n    this.emit('agents', this.list());\n    for (const summary of this.#summary()) this.#update(summary.id);\n    for (const id of [...this.#messages.keys()])\n      if (!this.#summary().some((summary) => summary.id === id)) this.#messages.delete(id);\n  }\n\n  #update(agentId: string): void {\n    const view = this.#view(agentId);\n    if (!view) return;\n    const before = this.#messages.get(agentId) ?? [];\n    const after = toMessages(view, this.#connection.deliveries.value);\n    this.#messages.set(agentId, after);\n    if (before.length !== after.length) {\n      this.emit('messages', agentId);\n      return;\n    }\n    const changed = after.filter(\n      (message, index) => JSON.stringify(message) !== JSON.stringify(before[index])\n    );\n    if (changed.length === 1) this.emit('message', { agentId, message: changed[0] as Message });\n    else if (changed.length > 1) this.emit('messages', agentId);\n  }\n\n  ready(): Promise<void> {\n    return this.#ready;\n  }\n\n  hold(): AgentHold | null {\n    return vaultHold(this.#connection.vault?.value);\n  }\n\n  list(): readonly Agent[] {\n    const rows = this.#connection.frozen?.value ?? [];\n    return this.#summary().map((summary) => {\n      const view = this.#view(summary.id);\n      const doc = view?.docs['pi.agent'] as AgentDoc | undefined;\n      const title =\n        summary.kind === 'cone' ? rows.find((row) => row.id === summary.id)?.title : undefined;\n      return {\n        id: summary.id,\n        name: summary.role ? `${summary.name} \u00B7 ${summary.role}` : summary.name,\n        kind: summary.kind,\n        parentId: summary.parentId,\n        status: this.#status(summary.id, status(view, this.#messages.get(summary.id) ?? [])),\n        model: doc?.model ? `${doc.model.provider}/${doc.model.modelId}` : '',\n        contextFill: 0,\n        unread: 0,\n        thinking: thinking[doc?.thinkingLevel ?? 'off'] ?? 'off',\n        ...(title ? { title } : {}),\n      };\n    });\n  }\n\n  active(): string {\n    const known = this.#summary();\n    if (this.#active && this.#creating.has(this.#active)) return this.#active;\n    if (this.#active && known.some((summary) => summary.id === this.#active)) return this.#active;\n    return this.#connection.agents?.value?.active ?? CONE;\n  }\n\n  select(id: string): void {\n    if (this.#creating.has(id)) {\n      this.#active = id;\n      this.emit('active', id);\n      return;\n    }\n    const found = this.#summary().find((summary) => summary.id === id);\n    if (!found) return;\n    this.#active = id;\n    if (found.kind === 'cone') void this.#connection.control.selectCone(id, BACKGROUND_CONTEXT);\n    this.emit('active', id);\n    this.emit('messages', id);\n  }\n\n  messages(agentId: string = this.active()): readonly Message[] {\n    return this.#messages.get(agentId) ?? [];\n  }\n\n  async send(agentId: string, input: string | Outgoing): Promise<void> {\n    const outgoing = typeof input === 'string' ? { text: input } : input;\n    const target = this.#creating.has(agentId) ? await this.#creating.get(agentId) : agentId;\n    if (target === null) throw new Error('The scoop could not be created.');\n    const pending = target && this.#held(target) ? this.#pending(target, outgoing) : undefined;\n    if (pending) await pending.released;\n    if (pending?.dropped) return this.#settle(pending);\n    const sent = await this.#connection.control\n      .send(\n        {\n          text: outgoing.text,\n          whenBusy: outgoing.mode === 'queue' ? 'followUp' : 'steer',\n          requestId: crypto.randomUUID(),\n          agentId: target || null,\n        },\n        BACKGROUND_CONTEXT\n      )\n      .finally(() => pending && this.#settle(pending));\n    if (!sent.accepted) throw new Error(sent.error.message);\n    if (pending?.dropped)\n      void this.#connection.control.unqueue(pending.agentId, sent.submissionId, BACKGROUND_CONTEXT);\n  }\n\n  #pending(agentId: string, outgoing: Outgoing): Pending {\n    const id = `p${crypto.randomUUID()}`;\n    const message: UserMessage = {\n      id,\n      role: 'user',\n      text: outgoing.text,\n      createdAt: Date.now(),\n      queued: true,\n      mode: outgoing.mode === 'queue' ? 'queue' : 'steer',\n    };\n    const { promise: released, resolve: release } = Promise.withResolvers<void>();\n    const pending = { agentId, message, dropped: false, release, released };\n    this.#outbox.set(id, pending);\n    this.emit('messages', agentId);\n    return pending;\n  }\n\n  #settle(pending: Pending): void {\n    this.#outbox.delete(pending.message.id);\n    this.emit('messages', pending.agentId);\n  }\n\n  async rewind(agentId: string, messageId: string): Promise<Outgoing | null> {\n    const rewound = await this.#connection.control.rewindAgent(\n      agentId,\n      messageId,\n      BACKGROUND_CONTEXT\n    );\n    return rewound.done ? { text: rewound.text } : null;\n  }\n\n  stop(agentId: string = this.active()): void {\n    void this.#connection.control.stopAgent(agentId, BACKGROUND_CONTEXT);\n  }\n\n  busy(agentId: string = this.active()): boolean {\n    return isBusy(this.#view(agentId)) || this.#held(agentId);\n  }\n\n  #status(agentId: string, shown: AgentStatus): AgentStatus {\n    return shown === 'idle' && this.#held(agentId) ? 'working' : shown;\n  }\n\n  #held(agentId: string): boolean {\n    return this.#hold !== null && agentId === (this.#connection.agents?.value?.active ?? CONE);\n  }\n\n  queue(agentId: string = this.active()): readonly UserMessage[] {\n    const pending = [...this.#outbox.values()]\n      .filter((item) => item.agentId === agentId && !item.dropped)\n      .map((item) => item.message);\n    return [...queued(this.#view(agentId)), ...pending];\n  }\n\n  unqueue(agentId: string, messageId: string): void {\n    const pending = this.#outbox.get(messageId);\n    if (pending) {\n      pending.dropped = true;\n      pending.release();\n      this.emit('messages', pending.agentId);\n      return;\n    }\n    void this.#connection.control.unqueue(agentId, messageId.replace(/^q/, ''), BACKGROUND_CONTEXT);\n  }\n\n  suggestion(): string | null {\n    return null;\n  }\n\n  answer(): void {}\n\n  resolveLick(agentId: string, messageId: string, state: 'confirmed' | 'dismissed'): void {\n    const message = this.messages(agentId).find((candidate) => candidate.id === messageId);\n    const entry = this.#view(agentId)?.entries.find(\n      (candidate) => `e${candidate.id}` === messageId\n    );\n    const lick = message?.role === 'lick' && entry ? entryLick(entry) : undefined;\n    if (lick)\n      void this.#connection.control.resolveAgentLick(agentId, lick.id, state, BACKGROUND_CONTEXT);\n  }\n\n  compact(agentId: string = this.active()): void {\n    void this.#connection.control.compactAgent(agentId, null, BACKGROUND_CONTEXT);\n  }\n\n  clear(agentId: string = this.active()): void {\n    void this.#connection.control.newChat(agentId, BACKGROUND_CONTEXT);\n  }\n\n  freeze(agentId: string = this.active()): void {\n    void this.#connection.control.freeze(agentId, BACKGROUND_CONTEXT);\n  }\n\n  #configure(agentId: string, change: Partial<AgentSettingsChange>): void {\n    void this.#connection.control.configure(\n      {\n        model: change.model ?? null,\n        thinkingLevel: change.thinkingLevel ?? null,\n        agentId,\n      },\n      BACKGROUND_CONTEXT\n    );\n  }\n\n  setModel(agentId: string, model: string): void {\n    const at = model.indexOf('/');\n    if (at <= 0) return;\n    this.#configure(agentId, {\n      model: { provider: model.slice(0, at), modelId: model.slice(at + 1) },\n    });\n  }\n\n  setThinking(agentId: string, level: Thinking): void {\n    this.#configure(agentId, { thinkingLevel: level });\n  }\n\n  async older(): Promise<readonly Message[]> {\n    return [];\n  }\n\n  commands(): readonly SlashCommand[] {\n    return (this.#connection.commands?.value ?? []).map(slashCommand);\n  }\n\n  createScoop(parentId: string, name: string): Agent {\n    const provisional = `scoop:creating-${crypto.randomUUID()}`;\n    const created = this.#connection.control.createScoop(parentId, name, BACKGROUND_CONTEXT).then(\n      (result) => result.id,\n      () => null\n    );\n    this.#creating.set(provisional, created);\n    void created.then((id) => {\n      if (this.#active !== provisional) return;\n      this.#active = id ?? parentId;\n      this.emit('active', this.#active);\n      this.emit('messages', this.#active);\n    });\n    return {\n      id: provisional,\n      name,\n      kind: 'scoop',\n      parentId,\n      status: 'idle',\n      model: '',\n      contextFill: 0,\n      unread: 0,\n    };\n  }\n\n  async drop(agentId: string): Promise<void> {\n    const parent = this.#summary().find((summary) => summary.id === agentId)?.parentId ?? CONE;\n    const dropped = await this.#connection.control.drop(agentId, BACKGROUND_CONTEXT);\n    if (dropped.error !== null) throw new Error(dropped.error);\n    if (this.#active === agentId) this.select(parent);\n  }\n\n  async createCone(name: string): Promise<Agent> {\n    const created = await this.#connection.control.createCone(name, BACKGROUND_CONTEXT);\n    if (created.error !== null) throw new Error(created.error);\n    return {\n      id: created.id,\n      name: name.trim(),\n      kind: 'cone',\n      parentId: null,\n      status: 'idle',\n      model: '',\n      contextFill: 0,\n      unread: 0,\n    };\n  }\n\n  frozen(): readonly FrozenCone[] {\n    return (this.#connection.frozen?.value ?? []).map(\n      ({ id, name, title, model, messages, frozenAt, kind, live, thawedAs }) => ({\n        id,\n        name,\n        title,\n        model,\n        messages,\n        frozenAt,\n        kind,\n        live,\n        ...(thawedAs ? { thawedAs } : {}),\n      })\n    );\n  }\n\n  thaw(id: string): Agent | null {\n    const record = this.frozen().find((item) => item.id === id);\n    if (!record) return null;\n    if (record.live) {\n      const running = this.list().find((agent) => agent.id === id) ?? null;\n      if (running) this.select(id);\n      return running;\n    }\n    const provisional = `thawing-${crypto.randomUUID()}`;\n    const thawed = this.#connection.control.thaw(id, BACKGROUND_CONTEXT).then(\n      (result) => result.id,\n      () => null\n    );\n    this.#creating.set(provisional, thawed);\n    void thawed.then((cone) => {\n      if (this.#active !== provisional) return;\n      this.#active = cone ?? CONE;\n      this.emit('active', this.#active);\n      this.emit('messages', this.#active);\n    });\n    return {\n      id: provisional,\n      name: record.name,\n      kind: 'cone',\n      parentId: null,\n      status: 'idle',\n      model: record.model,\n      contextFill: 0,\n      unread: 0,\n    };\n  }\n\n  discard(id: string): void {\n    void this.#connection.control.discard(id, BACKGROUND_CONTEXT);\n  }\n}\n"],
+  "mappings": "AAYA,SAAS,0BAA0B;AAGnC,SAAS,iBAAiB;AAC1B,SAAyB,iBAAiB;AAE1C,SAAS,eAAe;AACxB,SAAS,QAAQ,QAAQ,kBAAkB;AAEpC,MAAM,OAAO;AAEpB,MAAM,WAAqC;AAAA,EACzC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,KAAK;AACP;AAOA,SAAS,OAAO,MAAoC,UAA2C;AAC7F,MAAI,OAAO,IAAI,GAAG;AAChB,UAAM,OAAO,MAAM,KAAK,SAAS;AACjC,WAAO,MAAM,OAAO,KAAK,CAAC,SAAS,KAAK,WAAW,SAAS,IAAI,YAAY;AAAA,EAC9E;AACA,QAAM,OAAO,SAAS,GAAG,EAAE;AAC3B,SAAO,MAAM,SAAS,eAAe,KAAK,WAAW,UAAU,UAAU;AAC3E;AAEO,SAAS,aAAa,EAAE,MAAM,GAAG,QAAQ,GAA0B;AACxE,SAAO,SAAS,WAAW,UAAU,EAAE,GAAG,SAAS,KAAK;AAC1D;AAMA,SAAS,SAAS,GAAqB,GAA8B;AACnE,SAAO,MAAM,KAAM,MAAM,QAAQ,MAAM,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE;AACvF;AAUO,MAAM,qBAAqB,QAAiD;AAAA,EACxE;AAAA,EACA;AAAA,EACA,YAAY,oBAAI,IAAuB;AAAA,EAChD,UAAyB;AAAA,EACzB,YAAY,oBAAI,IAAoC;AAAA,EACpD,QAA0B;AAAA,EACjB,UAAU,oBAAI,IAAqB;AAAA,EAE5C,YAAY,YAA6B;AACvC,UAAM;AACN,SAAK,cAAc;AACnB,SAAK,QAAQ,KAAK,KAAK;AACvB,eAAW,OAAO,UAAU,MAAM;AAChC,YAAM,OAAO,KAAK,KAAK;AACvB,UAAI,SAAS,MAAM,KAAK,KAAK,EAAG;AAChC,WAAK,QAAQ;AACb,UAAI,CAAC,KAAM,YAAW,WAAW,KAAK,QAAQ,OAAO,EAAG,SAAQ,QAAQ;AACxE,WAAK,KAAK,QAAQ,IAAI;AACtB,WAAK,KAAK,UAAU,KAAK,KAAK,CAAC;AAAA,IACjC,CAAC;AACD,eAAW,QAAQ,UAAU,MAAM;AACjC,WAAK,KAAK,UAAU,KAAK,OAAO,CAAC;AACjC,WAAK,KAAK,UAAU,KAAK,KAAK,CAAC;AAAA,IACjC,CAAC;AACD,SAAK,SAAS,IAAI,QAAQ,CAAC,YAAY;AACrC,iBAAW,WAAW,UAAU,MAAM;AACpC,aAAK,SAAS;AACd,gBAAQ;AAAA,MACV,CAAC;AACD,iBAAW,WAAW,UAAU,MAAM,KAAK,SAAS,CAAC;AACrD,iBAAW,OAAO,UAAU,MAAM,KAAK,SAAS,CAAC;AACjD,iBAAW,QAAQ,UAAU,MAAM,KAAK,SAAS,CAAC;AAAA,IACpD,CAAC;AAAA,EACH;AAAA,EAEA,WAAoC;AAClC,UAAM,SAAS,KAAK,YAAY,QAAQ,OAAO;AAC/C,WAAO,QAAQ,SACX,SACA,CAAC,EAAE,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,UAAkB,KAAK,OAAO,GAAiC;AACnE,UAAM,QAAQ,KAAK,YAAY,OAAO;AACtC,UAAM,OAAO,QAAQ,OAAO;AAC5B,QAAI,KAAM,QAAO;AACjB,UAAM,OAAO,KAAK,YAAY,QAAQ,OAAO,UAAU;AACvD,WAAO,YAAY,OAAO,KAAK,YAAY,WAAW,QAAQ;AAAA,EAChE;AAAA,EAEA,WAAiB;AACf,SAAK,YAAY,KAAK,YAAY,QAAQ,OAAO,UAAU;AAC3D,SAAK,KAAK,UAAU,KAAK,KAAK,CAAC;AAC/B,eAAW,WAAW,KAAK,SAAS,EAAG,MAAK,QAAQ,QAAQ,EAAE;AAC9D,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,KAAK,CAAC;AACxC,UAAI,CAAC,KAAK,SAAS,EAAE,KAAK,CAAC,YAAY,QAAQ,OAAO,EAAE,EAAG,MAAK,UAAU,OAAO,EAAE;AAAA,EACvF;AAAA,EAEA,QAAQ,SAAuB;AAC7B,UAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAI,CAAC,KAAM;AACX,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC;AAC/C,UAAM,QAAQ,WAAW,MAAM,KAAK,YAAY,WAAW,KAAK;AAChE,SAAK,UAAU,IAAI,SAAS,KAAK;AACjC,QAAI,OAAO,WAAW,MAAM,QAAQ;AAClC,WAAK,KAAK,YAAY,OAAO;AAC7B;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,CAAC,SAAS,UAAU,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,OAAO,KAAK,CAAC;AAAA,IAC9E;AACA,QAAI,QAAQ,WAAW,EAAG,MAAK,KAAK,WAAW,EAAE,SAAS,SAAS,QAAQ,CAAC,EAAa,CAAC;AAAA,aACjF,QAAQ,SAAS,EAAG,MAAK,KAAK,YAAY,OAAO;AAAA,EAC5D;AAAA,EAEA,QAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,OAAyB;AACvB,WAAO,UAAU,KAAK,YAAY,OAAO,KAAK;AAAA,EAChD;AAAA,EAEA,OAAyB;AACvB,UAAM,OAAO,KAAK,YAAY,QAAQ,SAAS,CAAC;AAChD,WAAO,KAAK,SAAS,EAAE,IAAI,CAAC,YAAY;AACtC,YAAM,OAAO,KAAK,MAAM,QAAQ,EAAE;AAClC,YAAM,MAAM,MAAM,KAAK,UAAU;AACjC,YAAM,QACJ,QAAQ,SAAS,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ,EAAE,GAAG,QAAQ;AAC/E,aAAO;AAAA,QACL,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ,OAAO,GAAG,QAAQ,IAAI,SAAM,QAAQ,IAAI,KAAK,QAAQ;AAAA,QACnE,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,QAAQ,KAAK,QAAQ,QAAQ,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAAA,QACnF,OAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,QAAQ,IAAI,IAAI,MAAM,OAAO,KAAK;AAAA,QACnE,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,UAAU,SAAS,KAAK,iBAAiB,KAAK,KAAK;AAAA,QACnD,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,SAAiB;AACf,UAAM,QAAQ,KAAK,SAAS;AAC5B,QAAI,KAAK,WAAW,KAAK,UAAU,IAAI,KAAK,OAAO,EAAG,QAAO,KAAK;AAClE,QAAI,KAAK,WAAW,MAAM,KAAK,CAAC,YAAY,QAAQ,OAAO,KAAK,OAAO,EAAG,QAAO,KAAK;AACtF,WAAO,KAAK,YAAY,QAAQ,OAAO,UAAU;AAAA,EACnD;AAAA,EAEA,OAAO,IAAkB;AACvB,QAAI,KAAK,UAAU,IAAI,EAAE,GAAG;AAC1B,WAAK,UAAU;AACf,WAAK,KAAK,UAAU,EAAE;AACtB;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,SAAS,EAAE,KAAK,CAAC,YAAY,QAAQ,OAAO,EAAE;AACjE,QAAI,CAAC,MAAO;AACZ,SAAK,UAAU;AACf,QAAI,MAAM,SAAS,OAAQ,MAAK,KAAK,YAAY,QAAQ,WAAW,IAAI,kBAAkB;AAC1F,SAAK,KAAK,UAAU,EAAE;AACtB,SAAK,KAAK,YAAY,EAAE;AAAA,EAC1B;AAAA,EAEA,SAAS,UAAkB,KAAK,OAAO,GAAuB;AAC5D,WAAO,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC;AAAA,EACzC;AAAA,EAEA,MAAM,KAAK,SAAiB,OAAyC;AACnE,UAAM,WAAW,OAAO,UAAU,WAAW,EAAE,MAAM,MAAM,IAAI;AAC/D,UAAM,SAAS,KAAK,UAAU,IAAI,OAAO,IAAI,MAAM,KAAK,UAAU,IAAI,OAAO,IAAI;AACjF,QAAI,WAAW,KAAM,OAAM,IAAI,MAAM,iCAAiC;AACtE,UAAM,UAAU,UAAU,KAAK,MAAM,MAAM,IAAI,KAAK,SAAS,QAAQ,QAAQ,IAAI;AACjF,QAAI,QAAS,OAAM,QAAQ;AAC3B,QAAI,SAAS,QAAS,QAAO,KAAK,QAAQ,OAAO;AACjD,UAAM,OAAO,MAAM,KAAK,YAAY,QACjC;AAAA,MACC;AAAA,QACE,MAAM,SAAS;AAAA,QACf,UAAU,SAAS,SAAS,UAAU,aAAa;AAAA,QACnD,WAAW,OAAO,WAAW;AAAA,QAC7B,SAAS,UAAU;AAAA,MACrB;AAAA,MACA;AAAA,IACF,EACC,QAAQ,MAAM,WAAW,KAAK,QAAQ,OAAO,CAAC;AACjD,QAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,KAAK,MAAM,OAAO;AACtD,QAAI,SAAS;AACX,WAAK,KAAK,YAAY,QAAQ,QAAQ,QAAQ,SAAS,KAAK,cAAc,kBAAkB;AAAA,EAChG;AAAA,EAEA,SAAS,SAAiB,UAA6B;AACrD,UAAM,KAAK,IAAI,OAAO,WAAW,CAAC;AAClC,UAAM,UAAuB;AAAA,MAC3B;AAAA,MACA,MAAM;AAAA,MACN,MAAM,SAAS;AAAA,MACf,WAAW,KAAK,IAAI;AAAA,MACpB,QAAQ;AAAA,MACR,MAAM,SAAS,SAAS,UAAU,UAAU;AAAA,IAC9C;AACA,UAAM,EAAE,SAAS,UAAU,SAAS,QAAQ,IAAI,QAAQ,cAAoB;AAC5E,UAAM,UAAU,EAAE,SAAS,SAAS,SAAS,OAAO,SAAS,SAAS;AACtE,SAAK,QAAQ,IAAI,IAAI,OAAO;AAC5B,SAAK,KAAK,YAAY,OAAO;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,SAAwB;AAC9B,SAAK,QAAQ,OAAO,QAAQ,QAAQ,EAAE;AACtC,SAAK,KAAK,YAAY,QAAQ,OAAO;AAAA,EACvC;AAAA,EAEA,MAAM,OAAO,SAAiB,WAA6C;AACzE,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI;AAAA,EACjD;AAAA,EAEA,KAAK,UAAkB,KAAK,OAAO,GAAS;AAC1C,SAAK,KAAK,YAAY,QAAQ,UAAU,SAAS,kBAAkB;AAAA,EACrE;AAAA,EAEA,KAAK,UAAkB,KAAK,OAAO,GAAY;AAC7C,WAAO,OAAO,KAAK,MAAM,OAAO,CAAC,KAAK,KAAK,MAAM,OAAO;AAAA,EAC1D;AAAA,EAEA,QAAQ,SAAiB,OAAiC;AACxD,WAAO,UAAU,UAAU,KAAK,MAAM,OAAO,IAAI,YAAY;AAAA,EAC/D;AAAA,EAEA,MAAM,SAA0B;AAC9B,WAAO,KAAK,UAAU,QAAQ,aAAa,KAAK,YAAY,QAAQ,OAAO,UAAU;AAAA,EACvF;AAAA,EAEA,MAAM,UAAkB,KAAK,OAAO,GAA2B;AAC7D,UAAM,UAAU,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EACtC,OAAO,CAAC,SAAS,KAAK,YAAY,WAAW,CAAC,KAAK,OAAO,EAC1D,IAAI,CAAC,SAAS,KAAK,OAAO;AAC7B,WAAO,CAAC,GAAG,OAAO,KAAK,MAAM,OAAO,CAAC,GAAG,GAAG,OAAO;AAAA,EACpD;AAAA,EAEA,QAAQ,SAAiB,WAAyB;AAChD,UAAM,UAAU,KAAK,QAAQ,IAAI,SAAS;AAC1C,QAAI,SAAS;AACX,cAAQ,UAAU;AAClB,cAAQ,QAAQ;AAChB,WAAK,KAAK,YAAY,QAAQ,OAAO;AACrC;AAAA,IACF;AACA,SAAK,KAAK,YAAY,QAAQ,QAAQ,SAAS,UAAU,QAAQ,MAAM,EAAE,GAAG,kBAAkB;AAAA,EAChG;AAAA,EAEA,aAA4B;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,SAAe;AAAA,EAAC;AAAA,EAEhB,YAAY,SAAiB,WAAmB,OAAwC;AACtF,UAAM,UAAU,KAAK,SAAS,OAAO,EAAE,KAAK,CAAC,cAAc,UAAU,OAAO,SAAS;AACrF,UAAM,QAAQ,KAAK,MAAM,OAAO,GAAG,QAAQ;AAAA,MACzC,CAAC,cAAc,IAAI,UAAU,EAAE,OAAO;AAAA,IACxC;AACA,UAAM,OAAO,SAAS,SAAS,UAAU,QAAQ,UAAU,KAAK,IAAI;AACpE,QAAI;AACF,WAAK,KAAK,YAAY,QAAQ,iBAAiB,SAAS,KAAK,IAAI,OAAO,kBAAkB;AAAA,EAC9F;AAAA,EAEA,QAAQ,UAAkB,KAAK,OAAO,GAAS;AAC7C,SAAK,KAAK,YAAY,QAAQ,aAAa,SAAS,MAAM,kBAAkB;AAAA,EAC9E;AAAA,EAEA,MAAM,UAAkB,KAAK,OAAO,GAAS;AAC3C,SAAK,KAAK,YAAY,QAAQ,QAAQ,SAAS,kBAAkB;AAAA,EACnE;AAAA,EAEA,OAAO,UAAkB,KAAK,OAAO,GAAS;AAC5C,SAAK,KAAK,YAAY,QAAQ,OAAO,SAAS,kBAAkB;AAAA,EAClE;AAAA,EAEA,WAAW,SAAiB,QAA4C;AACtE,SAAK,KAAK,YAAY,QAAQ;AAAA,MAC5B;AAAA,QACE,OAAO,OAAO,SAAS;AAAA,QACvB,eAAe,OAAO,iBAAiB;AAAA,QACvC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,SAAS,SAAiB,OAAqB;AAC7C,UAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,QAAI,MAAM,EAAG;AACb,SAAK,WAAW,SAAS;AAAA,MACvB,OAAO,EAAE,UAAU,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,MAAM,MAAM,KAAK,CAAC,EAAE;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEA,YAAY,SAAiB,OAAuB;AAClD,SAAK,WAAW,SAAS,EAAE,eAAe,MAAM,CAAC;AAAA,EACnD;AAAA,EAEA,MAAM,QAAqC;AACzC,WAAO,CAAC;AAAA,EACV;AAAA,EAEA,WAAoC;AAClC,YAAQ,KAAK,YAAY,UAAU,SAAS,CAAC,GAAG,IAAI,YAAY;AAAA,EAClE;AAAA,EAEA,YAAY,UAAkB,MAAqB;AACjD,UAAM,cAAc,kBAAkB,OAAO,WAAW,CAAC;AACzD,UAAM,UAAU,KAAK,YAAY,QAAQ,YAAY,UAAU,MAAM,kBAAkB,EAAE;AAAA,MACvF,CAAC,WAAW,OAAO;AAAA,MACnB,MAAM;AAAA,IACR;AACA,SAAK,UAAU,IAAI,aAAa,OAAO;AACvC,SAAK,QAAQ,KAAK,CAAC,OAAO;AACxB,UAAI,KAAK,YAAY,YAAa;AAClC,WAAK,UAAU,MAAM;AACrB,WAAK,KAAK,UAAU,KAAK,OAAO;AAChC,WAAK,KAAK,YAAY,KAAK,OAAO;AAAA,IACpC,CAAC;AACD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,SAAgC;AACzC,UAAM,SAAS,KAAK,SAAS,EAAE,KAAK,CAAC,YAAY,QAAQ,OAAO,OAAO,GAAG,YAAY;AACtF,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,KAAK,SAAS,kBAAkB;AAC/E,QAAI,QAAQ,UAAU,KAAM,OAAM,IAAI,MAAM,QAAQ,KAAK;AACzD,QAAI,KAAK,YAAY,QAAS,MAAK,OAAO,MAAM;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,MAA8B;AAC7C,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,WAAW,MAAM,kBAAkB;AAClF,QAAI,QAAQ,UAAU,KAAM,OAAM,IAAI,MAAM,QAAQ,KAAK;AACzD,WAAO;AAAA,MACL,IAAI,QAAQ;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EAEA,SAAgC;AAC9B,YAAQ,KAAK,YAAY,QAAQ,SAAS,CAAC,GAAG;AAAA,MAC5C,CAAC,EAAE,IAAI,MAAM,OAAO,OAAO,UAAU,UAAU,MAAM,MAAM,SAAS,OAAO;AAAA,QACzE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,KAAK,IAA0B;AAC7B,UAAM,SAAS,KAAK,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE;AAC1D,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,MAAM;AACf,YAAM,UAAU,KAAK,KAAK,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,EAAE,KAAK;AAChE,UAAI,QAAS,MAAK,OAAO,EAAE;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,cAAc,WAAW,OAAO,WAAW,CAAC;AAClD,UAAM,SAAS,KAAK,YAAY,QAAQ,KAAK,IAAI,kBAAkB,EAAE;AAAA,MACnE,CAAC,WAAW,OAAO;AAAA,MACnB,MAAM;AAAA,IACR;AACA,SAAK,UAAU,IAAI,aAAa,MAAM;AACtC,SAAK,OAAO,KAAK,CAAC,SAAS;AACzB,UAAI,KAAK,YAAY,YAAa;AAClC,WAAK,UAAU,QAAQ;AACvB,WAAK,KAAK,UAAU,KAAK,OAAO;AAChC,WAAK,KAAK,YAAY,KAAK,OAAO;AAAA,IACpC,CAAC;AACD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM,OAAO;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,OAAO,OAAO;AAAA,MACd,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EAEA,QAAQ,IAAkB;AACxB,SAAK,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB;AAAA,EAC9D;AACF;",
   "names": []
 }

package/dist/spectrum/messages.js

@@ -2,6 +2,7 @@ import { parseLick } from "../licks/lick.js";
 import { entryLick, LICK_TOOLS, lickDecisions } from "../licks/state.js";
 import { mcpLabel } from "../mcp/label.js";
 import { FROM_KIND } from "../scoops/from.js";
+import { listedLine, SECRETS_KIND } from "../secrets/view.js";
 import { SPRINKLE_KIND } from "../sprinkles/kind.js";
 function textOf(content) {
   if (typeof content === "string") return content;
@@ -264,11 +265,23 @@ function thawed(id, entry) {
     createdAt: entry.model?.[0]?.timestamp ?? 0
   };
 }
+function secrets(id, entry) {
+  const data = entry.data ?? {};
+  return {
+    id,
+    role: "system",
+    kind: "notice",
+    title: "Secrets listed",
+    text: listedLine(data.names ?? []),
+    createdAt: entry.model?.[0]?.timestamp ?? 0
+  };
+}
 function entryMessage(entry, out, calls, delivered, notes) {
   const id = `e${entry.id}`;
   const model = entry.model?.[0];
   if (entry.kind === "slicc.rewound") out.push(rewound(id, entry));
   if (entry.kind === "slicc.thawed") out.push(thawed(id, entry));
+  else if (entry.kind === SECRETS_KIND) out.push(secrets(id, entry));
   else if (entry.kind === SPRINKLE_KIND) out.push(sprinkleMessage(id, entry));
   else if (entry.kind === "pi.user" && model)
     out.push(

package/dist/spectrum/messages.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/spectrum/messages.ts"],
-  "sourcesContent": ["import type {\n  AssistantMessage,\n  AssistantStatus,\n  ErrorAction,\n  LickMessage,\n  Message,\n  MessagePart,\n  SystemMessage,\n  ToolCall,\n  ToolStatus,\n  Usage,\n  UserMessage,\n} from '@ai-ecoverse/slicc-spectrum/ui';\nimport type { ConversationView, EntryRecord } from '@earendil-works/pi-durable';\nimport { parseLick } from '../licks/lick.ts';\nimport { entryLick, LICK_TOOLS, type LickDecision, lickDecisions } from '../licks/state.ts';\nimport { mcpLabel } from '../mcp/label.ts';\nimport { FROM_KIND, type From } from '../scoops/from.ts';\nimport type { Delivered } from '../services.ts';\nimport { SPRINKLE_KIND } from '../sprinkles/kind.ts';\n\ntype Json = Record<string, unknown>;\n\ninterface Block {\n  type: string;\n  text?: string;\n  thinking?: string;\n  id?: string;\n  name?: string;\n  arguments?: Json;\n}\n\ninterface ModelMessage {\n  role: string;\n  content?: string | Block[];\n  timestamp?: number;\n  stopReason?: string;\n  errorMessage?: string;\n  provider?: string;\n  model?: string;\n  usage?: {\n    input?: number;\n    output?: number;\n    cacheRead?: number;\n    cacheWrite?: number;\n    cost?: { total?: number };\n  };\n  toolCallId?: string;\n  isError?: boolean;\n  details?: { patch?: unknown };\n}\n\ninterface Slot {\n  callId: string;\n  status: string;\n  output?: string;\n}\n\ninterface Live {\n  run?: unknown;\n  generation?: { message?: ModelMessage; retry?: { at: number; error: string } };\n  tools?: Slot[];\n  compactions?: { taskId: number; reason: string }[];\n}\n\nexport function textOf(content: ModelMessage['content']): string {\n  if (typeof content === 'string') return content;\n  return (content ?? []).map((block) => (block.type === 'text' ? (block.text ?? '') : '')).join('');\n}\n\nconst paths = (args: Json | undefined): string[] =>\n  typeof args?.path === 'string' ? [args.path] : [];\n\nfunction title(args: Json | undefined): string {\n  const subject = args?.command ?? args?.path;\n  return typeof subject === 'string' ? subject : '';\n}\n\ninterface Replacement {\n  oldText?: string;\n  newText?: string;\n}\n\nconst GAP = '\u2026';\n\nfunction seconds(value: unknown): string | undefined {\n  return typeof value === 'number' ? `timeout ${value}s` : undefined;\n}\n\nfunction lines(args: Json): string | undefined {\n  const { offset, limit } = args as { offset?: number; limit?: number };\n  if (typeof offset === 'number' && typeof limit === 'number')\n    return `lines ${offset}\u2013${offset + limit - 1}`;\n  if (typeof offset === 'number') return `from line ${offset}`;\n  return typeof limit === 'number' ? `first ${limit} lines` : undefined;\n}\n\nfunction edits(args: Json): ToolCall['diff'] {\n  const list = Array.isArray(args.edits) ? (args.edits as Replacement[]) : [];\n  if (list.length === 0) return undefined;\n  return {\n    before: list.map((edit) => edit.oldText ?? '').join(`\\n${GAP}\\n`),\n    after: list.map((edit) => edit.newText ?? '').join(`\\n${GAP}\\n`),\n  };\n}\n\nexport function fromPatch(patch: string): ToolCall['diff'] {\n  const before: string[] = [];\n  const after: string[] = [];\n  let hunks = 0;\n  for (const line of patch.split('\\n')) {\n    if (line.startsWith('@@')) {\n      if (hunks++ > 0) {\n        before.push(GAP);\n        after.push(GAP);\n      }\n      continue;\n    }\n    if (hunks === 0 || line === '' || line.startsWith('\\\\')) continue;\n    const text = line.slice(1);\n    if (line.startsWith('-')) before.push(text);\n    else if (line.startsWith('+')) after.push(text);\n    else {\n      before.push(text);\n      after.push(text);\n    }\n  }\n  return hunks ? { before: before.join('\\n'), after: after.join('\\n') } : undefined;\n}\n\nfunction shape(name: string, args: Json): Pick<ToolCall, 'input' | 'meta' | 'diff'> {\n  const path = typeof args.path === 'string' ? args.path : '';\n  const meta = name === 'bash' ? seconds(args.timeout) : name === 'read' ? lines(args) : undefined;\n  const base = meta ? { meta } : {};\n  if (name === 'bash' && typeof args.command === 'string') return { input: args.command, ...base };\n  if (name === 'read' || name === 'write') return { input: path, ...base };\n  if (name === 'edit') {\n    const diff = edits(args);\n    return { input: path, ...(diff ? { diff } : {}) };\n  }\n  return { input: JSON.stringify(args, null, 2) };\n}\n\nfunction toolCall(block: Block): ToolCall {\n  const args = block.arguments ?? {};\n  return {\n    id: block.id ?? '',\n    name: block.name ?? 'tool',\n    title: mcpLabel(block.name ?? '') ?? title(block.arguments),\n    ...shape(block.name ?? 'tool', args),\n    output: '',\n    status: 'running',\n    paths: paths(block.arguments),\n  };\n}\n\nfunction part(block: Block): MessagePart | undefined {\n  if (block.type === 'text') return { type: 'text', text: block.text ?? '' };\n  if (block.type === 'thinking') return { type: 'thinking', text: block.thinking ?? '' };\n  if (block.type === 'toolCall') return { type: 'tool', tool: toolCall(block) };\n  return undefined;\n}\n\nfunction usage(message: ModelMessage): Usage | undefined {\n  const used = message.usage;\n  if (!used) return undefined;\n  return {\n    input: used.input ?? 0,\n    output: used.output ?? 0,\n    cost: used.cost?.total ?? 0,\n    cacheRead: used.cacheRead ?? 0,\n    cacheWrite: used.cacheWrite ?? 0,\n  };\n}\n\nconst statuses: Record<string, AssistantStatus> = { error: 'error', aborted: 'stopped' };\n\nconst credentials =\n  /security token|unrecognizedclient|not authori[sz]ed|unauthori[sz]ed|forbidden|\\b40[13]\\b|api key|credential|bearer/i;\nconst models = /model/i;\nconst unavailable =\n  /access|invalid|not found|identifier|unsupported|not supported|isn['\u2019]t supported|not available|isn['\u2019]t available/i;\n\nconst providerNames: Record<string, string> = { 'amazon-bedrock': 'Bedrock' };\nconst filtered =\n  /Provider (?:stopped with|finish_reason): (?:content_filter(?:ed)?|guardrail_intervened|sensitive)|content[_ ]filter(?:ed|ing)?\\b|guardrail[_ ]intervened/i;\nconst refused =\n  /refused to complete the request|Provider (?:stopped with|finish_reason): refusal|\\bstop_?reason\\W+refusal\\b/i;\nconst missing = /no api key|missing|not configured|no credentials/i;\n\nexport function errorPart(error: string, provider?: string): MessagePart {\n  const action = errorAction(error);\n  if (action === 'drop-turn') {\n    return {\n      type: 'error',\n      message: filtered.test(error)\n        ? \"The model's content filter stopped this reply.\"\n        : 'The model refused to answer this turn.',\n      detail: error,\n      action,\n    };\n  }\n  if (action === 'settings' && provider === 'adobe') {\n    return {\n      type: 'error',\n      message: 'Your Adobe session has expired.',\n      detail: error,\n      action: 'login',\n    };\n  }\n  const name = providerNames[provider ?? ''] ?? 'The provider';\n  const lead =\n    action === 'settings'\n      ? missing.test(error)\n        ? `${name} needs an API key.`\n        : `${name} rejected the API key.`\n      : action === 'change-model'\n        ? \"This model isn't available with the current account.\"\n        : null;\n  return lead\n    ? { type: 'error', message: lead, detail: error, action }\n    : { type: 'error', message: error, action };\n}\n\nexport function errorAction(message: string): ErrorAction {\n  if (filtered.test(message) || refused.test(message)) return 'drop-turn';\n  if (credentials.test(message)) return 'settings';\n  if (models.test(message) && unavailable.test(message)) return 'change-model';\n  return 'retry';\n}\n\nfunction sprinkleMessage(id: string, entry: EntryRecord): AssistantMessage {\n  const data = (entry.data ?? {}) as { sprinkle?: unknown; at?: unknown };\n  return {\n    id,\n    role: 'assistant',\n    parts: [{ type: 'sprinkle', sprinkle: String(data.sprinkle ?? '') }],\n    status: 'done',\n    createdAt: typeof data.at === 'number' ? data.at : 0,\n  };\n}\n\nexport function assistant(\n  id: string,\n  message: ModelMessage,\n  status?: AssistantStatus\n): AssistantMessage {\n  const blocks = Array.isArray(message.content) ? message.content : [];\n  const parts = blocks.map(part).filter((item): item is MessagePart => item !== undefined);\n  if (message.errorMessage) parts.push(errorPart(message.errorMessage, message.provider));\n  const used = usage(message);\n  return {\n    id,\n    role: 'assistant',\n    parts,\n    status: status ?? statuses[message.stopReason ?? ''] ?? 'done',\n    createdAt: message.timestamp ?? 0,\n    ...(message.provider && message.model ? { model: `${message.provider}/${message.model}` } : {}),\n    ...(used ? { usage: used } : {}),\n  };\n}\n\nfunction user(\n  id: string,\n  message: ModelMessage,\n  delivered: Delivered | undefined,\n  from: From | undefined\n): UserMessage {\n  return {\n    id,\n    role: 'user',\n    text: textOf(message.content),\n    createdAt: message.timestamp ?? 0,\n    ...(delivered ? { delivered } : {}),\n    ...(from ? { from: from.from } : {}),\n    ...(from?.agent ? { origin: 'agent' as const } : {}),\n  };\n}\n\nexport function origins(entries: readonly EntryRecord[]): Map<number, From> {\n  const out = new Map<number, From>();\n  for (const entry of entries)\n    if (entry.kind === FROM_KIND) {\n      const note = entry.data as From;\n      out.set(note.entry, note);\n    }\n  return out;\n}\n\nfunction lickMessage(\n  id: string,\n  entry: EntryRecord,\n  decisions: ReadonlyMap<string, LickDecision>\n): LickMessage | undefined {\n  const lick = entryLick(entry);\n  if (!lick) return undefined;\n  const state = lick.actions?.length ? (decisions.get(lick.id) ?? 'pending') : undefined;\n  return {\n    id,\n    role: 'lick',\n    channel: lick.channel,\n    title: lick.title,\n    text: lick.text,\n    createdAt: lick.at,\n    ...(lick.body ? { body: lick.body } : {}),\n    ...(lick.count > 1 ? { count: lick.count } : {}),\n    ...(state ? { state } : {}),\n    ...(lick.severity ? { severity: lick.severity } : {}),\n  };\n}\n\nfunction withoutLickTools(message: AssistantMessage): AssistantMessage {\n  const parts = message.parts.filter((item) => item.type !== 'tool' || !LICK_TOOLS[item.tool.name]);\n  return parts.length === message.parts.length ? message : { ...message, parts };\n}\n\nfunction system(id: string, entry: EntryRecord, text: string): SystemMessage {\n  const reason = (entry.data as Json | undefined)?.reason as SystemMessage['trigger'] | undefined;\n  return {\n    id,\n    role: 'system',\n    kind: 'compaction',\n    text,\n    createdAt: 0,\n    state: 'summarized',\n    ...(reason ? { trigger: reason } : {}),\n  };\n}\n\nfunction tools(messages: Message[]): Map<string, ToolCall> {\n  const found = new Map<string, ToolCall>();\n  for (const message of messages) {\n    if (message.role !== 'assistant') continue;\n    for (const item of message.parts) if (item.type === 'tool') found.set(item.tool.id, item.tool);\n  }\n  return found;\n}\n\nfunction settle(calls: Map<string, ToolCall>, result: ModelMessage): void {\n  const call = calls.get(result.toolCallId ?? '');\n  if (!call) return;\n  call.output = textOf(result.content);\n  call.status = result.isError ? 'error' : 'done';\n  const image = Array.isArray(result.content)\n    ? (result.content as { type: string; data?: string; mimeType?: string }[]).find(\n        (part) => part.type === 'image' && part.data && part.mimeType\n      )\n    : undefined;\n  if (image) call.image = `data:${image.mimeType};base64,${image.data}`;\n  const patch = result.details?.patch;\n  const diff = typeof patch === 'string' ? fromPatch(patch) : undefined;\n  if (diff) call.diff = diff;\n  else if (result.isError) delete call.diff;\n}\n\nfunction rewound(id: string, entry: EntryRecord): SystemMessage {\n  const data = (entry.data ?? {}) as { stopped?: string[]; restored?: string[]; files?: boolean };\n  const notes = [\n    'Its prompt is back in the composer.',\n    ...(data.stopped?.length\n      ? [`Stopped ${data.stopped.map((name) => `scoop ${name}`).join(', ')}.`]\n      : []),\n    ...(data.restored?.length\n      ? [`Restored ${data.restored.map((name) => `scoop ${name}`).join(', ')}.`]\n      : []),\n    ...(data.files ? ['Changed files stay; use Changes or git to revert them.'] : []),\n  ];\n  return {\n    id,\n    role: 'system',\n    kind: 'notice',\n    title: 'Rewound 1 turn',\n    text: notes.join(' '),\n    createdAt: 0,\n  };\n}\n\nfunction thawed(id: string, entry: EntryRecord): SystemMessage {\n  const data = (entry.data ?? {}) as { name?: string; kind?: string };\n  const what = data.kind === 'agent' ? 'agent run' : 'scoop';\n  return {\n    id,\n    role: 'system',\n    kind: 'notice',\n    title: `Thawed from ${what} ${data.name ?? ''}`.trim(),\n    text: textOf(entry.model?.[0]?.content ?? ''),\n    createdAt: entry.model?.[0]?.timestamp ?? 0,\n  };\n}\n\nfunction entryMessage(\n  entry: EntryRecord,\n  out: Message[],\n  calls: Map<string, ToolCall>,\n  delivered: Delivered | undefined,\n  notes: { decisions: ReadonlyMap<string, LickDecision>; origins: ReadonlyMap<number, From> }\n): void {\n  const id = `e${entry.id}`;\n  const model = entry.model?.[0] as ModelMessage | undefined;\n  if (entry.kind === 'slicc.rewound') out.push(rewound(id, entry));\n  if (entry.kind === 'slicc.thawed') out.push(thawed(id, entry));\n  else if (entry.kind === SPRINKLE_KIND) out.push(sprinkleMessage(id, entry));\n  else if (entry.kind === 'pi.user' && model)\n    out.push(\n      lickMessage(id, entry, notes.decisions) ??\n        user(id, model, delivered, notes.origins.get(entry.id))\n    );\n  else if (entry.kind === 'pi.assistant' && model) {\n    const message = assistant(id, model);\n    out.push(withoutLickTools(message));\n    for (const [key, value] of tools([message])) calls.set(key, value);\n  } else if (entry.kind === 'pi.tool-result' && model) settle(calls, model);\n  else if (entry.kind === 'pi.compaction') out.push(system(id, entry, textOf(model?.content)));\n}\n\nconst slotStatus: Record<string, ToolStatus> = {\n  pending: 'running',\n  running: 'running',\n  done: 'done',\n};\n\nfunction live(view: ConversationView, out: Message[], calls: Map<string, ToolCall>): void {\n  const state = view.docs['pi.live'] as Live | undefined;\n  for (const slot of state?.tools ?? []) {\n    const call = calls.get(slot.callId);\n    if (call && call.status === 'running') {\n      call.status = slotStatus[slot.status] ?? 'running';\n      call.output = slot.output ?? call.output;\n    }\n  }\n  const partial = state?.generation?.message;\n  if (partial) out.push(assistant('live', partial, 'streaming'));\n  for (const compaction of state?.compactions ?? []) {\n    out.push({\n      id: `compaction-${compaction.taskId}`,\n      role: 'system',\n      kind: 'compaction',\n      text: '',\n      createdAt: 0,\n      state: 'summarizing',\n      trigger: compaction.reason as SystemMessage['trigger'],\n    });\n  }\n  const retry = state?.generation?.retry;\n  if (retry)\n    out.push({\n      id: 'retry',\n      role: 'system',\n      kind: 'notice',\n      text: retry.error,\n      createdAt: retry.at,\n    });\n}\n\nexport function toMessages(\n  view: ConversationView | undefined,\n  deliveries: Readonly<Record<string, Delivered>> = {}\n): Message[] {\n  const out: Message[] = [];\n  if (!view) return out;\n  const calls = new Map<string, ToolCall>();\n  const notes = { decisions: lickDecisions(view.entries), origins: origins(view.entries) };\n  let previous: EntryRecord | undefined;\n  for (const entry of view.entries) {\n    const steered = previous?.kind === 'pi.tool-result' ? 'steer' : undefined;\n    entryMessage(entry, out, calls, deliveries[String(entry.id)] ?? steered, notes);\n    previous = entry;\n  }\n  live(view, out, calls);\n  return out;\n}\n\nexport function isBusy(view: ConversationView | undefined): boolean {\n  return Boolean((view?.docs['pi.live'] as Live | undefined)?.run);\n}\n\nexport function queued(view: ConversationView | undefined): UserMessage[] {\n  const items = ((view?.docs['pi.inbox'] as { items?: Json[] } | undefined)?.items ?? []) as {\n    id: number;\n    mode: string;\n    content?: ModelMessage['content'];\n  }[];\n  return items\n    .filter((item) => item.mode !== 'write' && !parseLick(textOf(item.content)))\n    .map((item) => ({\n      id: `q${item.id}`,\n      role: 'user',\n      text: textOf(item.content),\n      createdAt: 0,\n      queued: true,\n      mode: item.mode === 'steer' ? 'steer' : 'queue',\n    }));\n}\n"],
-  "mappings": "AAcA,SAAS,iBAAiB;AAC1B,SAAS,WAAW,YAA+B,qBAAqB;AACxE,SAAS,gBAAgB;AACzB,SAAS,iBAA4B;AAErC,SAAS,qBAAqB;AA8CvB,SAAS,OAAO,SAA0C;AAC/D,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,UAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,UAAW,MAAM,SAAS,SAAU,MAAM,QAAQ,KAAM,EAAG,EAAE,KAAK,EAAE;AAClG;AAEA,MAAM,QAAQ,CAAC,SACb,OAAO,MAAM,SAAS,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;AAElD,SAAS,MAAM,MAAgC;AAC7C,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAOA,MAAM,MAAM;AAEZ,SAAS,QAAQ,OAAoC;AACnD,SAAO,OAAO,UAAU,WAAW,WAAW,KAAK,MAAM;AAC3D;AAEA,SAAS,MAAM,MAAgC;AAC7C,QAAM,EAAE,QAAQ,MAAM,IAAI;AAC1B,MAAI,OAAO,WAAW,YAAY,OAAO,UAAU;AACjD,WAAO,SAAS,MAAM,SAAI,SAAS,QAAQ,CAAC;AAC9C,MAAI,OAAO,WAAW,SAAU,QAAO,aAAa,MAAM;AAC1D,SAAO,OAAO,UAAU,WAAW,SAAS,KAAK,WAAW;AAC9D;AAEA,SAAS,MAAM,MAA8B;AAC3C,QAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAK,KAAK,QAA0B,CAAC;AAC1E,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,SAAO;AAAA,IACL,QAAQ,KAAK,IAAI,CAAC,SAAS,KAAK,WAAW,EAAE,EAAE,KAAK;AAAA,EAAK,GAAG;AAAA,CAAI;AAAA,IAChE,OAAO,KAAK,IAAI,CAAC,SAAS,KAAK,WAAW,EAAE,EAAE,KAAK;AAAA,EAAK,GAAG;AAAA,CAAI;AAAA,EACjE;AACF;AAEO,SAAS,UAAU,OAAiC;AACzD,QAAM,SAAmB,CAAC;AAC1B,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAQ;AACZ,aAAW,QAAQ,MAAM,MAAM,IAAI,GAAG;AACpC,QAAI,KAAK,WAAW,IAAI,GAAG;AACzB,UAAI,UAAU,GAAG;AACf,eAAO,KAAK,GAAG;AACf,cAAM,KAAK,GAAG;AAAA,MAChB;AACA;AAAA,IACF;AACA,QAAI,UAAU,KAAK,SAAS,MAAM,KAAK,WAAW,IAAI,EAAG;AACzD,UAAM,OAAO,KAAK,MAAM,CAAC;AACzB,QAAI,KAAK,WAAW,GAAG,EAAG,QAAO,KAAK,IAAI;AAAA,aACjC,KAAK,WAAW,GAAG,EAAG,OAAM,KAAK,IAAI;AAAA,SACzC;AACH,aAAO,KAAK,IAAI;AAChB,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO,QAAQ,EAAE,QAAQ,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,IAAI,EAAE,IAAI;AAC1E;AAEA,SAAS,MAAM,MAAc,MAAuD;AAClF,QAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACzD,QAAM,OAAO,SAAS,SAAS,QAAQ,KAAK,OAAO,IAAI,SAAS,SAAS,MAAM,IAAI,IAAI;AACvF,QAAM,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAChC,MAAI,SAAS,UAAU,OAAO,KAAK,YAAY,SAAU,QAAO,EAAE,OAAO,KAAK,SAAS,GAAG,KAAK;AAC/F,MAAI,SAAS,UAAU,SAAS,QAAS,QAAO,EAAE,OAAO,MAAM,GAAG,KAAK;AACvE,MAAI,SAAS,QAAQ;AACnB,UAAM,OAAO,MAAM,IAAI;AACvB,WAAO,EAAE,OAAO,MAAM,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAClD;AACA,SAAO,EAAE,OAAO,KAAK,UAAU,MAAM,MAAM,CAAC,EAAE;AAChD;AAEA,SAAS,SAAS,OAAwB;AACxC,QAAM,OAAO,MAAM,aAAa,CAAC;AACjC,SAAO;AAAA,IACL,IAAI,MAAM,MAAM;AAAA,IAChB,MAAM,MAAM,QAAQ;AAAA,IACpB,OAAO,SAAS,MAAM,QAAQ,EAAE,KAAK,MAAM,MAAM,SAAS;AAAA,IAC1D,GAAG,MAAM,MAAM,QAAQ,QAAQ,IAAI;AAAA,IACnC,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,SAAS;AAAA,EAC9B;AACF;AAEA,SAAS,KAAK,OAAuC;AACnD,MAAI,MAAM,SAAS,OAAQ,QAAO,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,GAAG;AACzE,MAAI,MAAM,SAAS,WAAY,QAAO,EAAE,MAAM,YAAY,MAAM,MAAM,YAAY,GAAG;AACrF,MAAI,MAAM,SAAS,WAAY,QAAO,EAAE,MAAM,QAAQ,MAAM,SAAS,KAAK,EAAE;AAC5E,SAAO;AACT;AAEA,SAAS,MAAM,SAA0C;AACvD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO;AAAA,IACL,OAAO,KAAK,SAAS;AAAA,IACrB,QAAQ,KAAK,UAAU;AAAA,IACvB,MAAM,KAAK,MAAM,SAAS;AAAA,IAC1B,WAAW,KAAK,aAAa;AAAA,IAC7B,YAAY,KAAK,cAAc;AAAA,EACjC;AACF;AAEA,MAAM,WAA4C,EAAE,OAAO,SAAS,SAAS,UAAU;AAEvF,MAAM,cACJ;AACF,MAAM,SAAS;AACf,MAAM,cACJ;AAEF,MAAM,gBAAwC,EAAE,kBAAkB,UAAU;AAC5E,MAAM,WACJ;AACF,MAAM,UACJ;AACF,MAAM,UAAU;AAET,SAAS,UAAU,OAAe,UAAgC;AACvE,QAAM,SAAS,YAAY,KAAK;AAChC,MAAI,WAAW,aAAa;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,SAAS,KAAK,KAAK,IACxB,mDACA;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,WAAW,cAAc,aAAa,SAAS;AACjD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,OAAO,cAAc,YAAY,EAAE,KAAK;AAC9C,QAAM,OACJ,WAAW,aACP,QAAQ,KAAK,KAAK,IAChB,GAAG,IAAI,uBACP,GAAG,IAAI,2BACT,WAAW,iBACT,yDACA;AACR,SAAO,OACH,EAAE,MAAM,SAAS,SAAS,MAAM,QAAQ,OAAO,OAAO,IACtD,EAAE,MAAM,SAAS,SAAS,OAAO,OAAO;AAC9C;AAEO,SAAS,YAAY,SAA8B;AACxD,MAAI,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,OAAO,EAAG,QAAO;AAC5D,MAAI,YAAY,KAAK,OAAO,EAAG,QAAO;AACtC,MAAI,OAAO,KAAK,OAAO,KAAK,YAAY,KAAK,OAAO,EAAG,QAAO;AAC9D,SAAO;AACT;AAEA,SAAS,gBAAgB,IAAY,OAAsC;AACzE,QAAM,OAAQ,MAAM,QAAQ,CAAC;AAC7B,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,OAAO,CAAC,EAAE,MAAM,YAAY,UAAU,OAAO,KAAK,YAAY,EAAE,EAAE,CAAC;AAAA,IACnE,QAAQ;AAAA,IACR,WAAW,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AAAA,EACrD;AACF;AAEO,SAAS,UACd,IACA,SACA,QACkB;AAClB,QAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO,IAAI,QAAQ,UAAU,CAAC;AACnE,QAAM,QAAQ,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC,SAA8B,SAAS,MAAS;AACvF,MAAI,QAAQ,aAAc,OAAM,KAAK,UAAU,QAAQ,cAAc,QAAQ,QAAQ,CAAC;AACtF,QAAM,OAAO,MAAM,OAAO;AAC1B,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,QAAQ,UAAU,SAAS,QAAQ,cAAc,EAAE,KAAK;AAAA,IACxD,WAAW,QAAQ,aAAa;AAAA,IAChC,GAAI,QAAQ,YAAY,QAAQ,QAAQ,EAAE,OAAO,GAAG,QAAQ,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,CAAC;AAAA,IAC7F,GAAI,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,EAChC;AACF;AAEA,SAAS,KACP,IACA,SACA,WACA,MACa;AACb,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC5B,WAAW,QAAQ,aAAa;AAAA,IAChC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjC,GAAI,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IAClC,GAAI,MAAM,QAAQ,EAAE,QAAQ,QAAiB,IAAI,CAAC;AAAA,EACpD;AACF;AAEO,SAAS,QAAQ,SAAoD;AAC1E,QAAM,MAAM,oBAAI,IAAkB;AAClC,aAAW,SAAS;AAClB,QAAI,MAAM,SAAS,WAAW;AAC5B,YAAM,OAAO,MAAM;AACnB,UAAI,IAAI,KAAK,OAAO,IAAI;AAAA,IAC1B;AACF,SAAO;AACT;AAEA,SAAS,YACP,IACA,OACA,WACyB;AACzB,QAAM,OAAO,UAAU,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,KAAK,SAAS,SAAU,UAAU,IAAI,KAAK,EAAE,KAAK,YAAa;AAC7E,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,SAAS,KAAK;AAAA,IACd,OAAO,KAAK;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,WAAW,KAAK;AAAA,IAChB,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACvC,GAAI,KAAK,QAAQ,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IAC9C,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,EACrD;AACF;AAEA,SAAS,iBAAiB,SAA6C;AACrE,QAAM,QAAQ,QAAQ,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,UAAU,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC;AAChG,SAAO,MAAM,WAAW,QAAQ,MAAM,SAAS,UAAU,EAAE,GAAG,SAAS,MAAM;AAC/E;AAEA,SAAS,OAAO,IAAY,OAAoB,MAA6B;AAC3E,QAAM,SAAU,MAAM,MAA2B;AACjD,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,IACX,OAAO;AAAA,IACP,GAAI,SAAS,EAAE,SAAS,OAAO,IAAI,CAAC;AAAA,EACtC;AACF;AAEA,SAAS,MAAM,UAA4C;AACzD,QAAM,QAAQ,oBAAI,IAAsB;AACxC,aAAW,WAAW,UAAU;AAC9B,QAAI,QAAQ,SAAS,YAAa;AAClC,eAAW,QAAQ,QAAQ,MAAO,KAAI,KAAK,SAAS,OAAQ,OAAM,IAAI,KAAK,KAAK,IAAI,KAAK,IAAI;AAAA,EAC/F;AACA,SAAO;AACT;AAEA,SAAS,OAAO,OAA8B,QAA4B;AACxE,QAAM,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE;AAC9C,MAAI,CAAC,KAAM;AACX,OAAK,SAAS,OAAO,OAAO,OAAO;AACnC,OAAK,SAAS,OAAO,UAAU,UAAU;AACzC,QAAM,QAAQ,MAAM,QAAQ,OAAO,OAAO,IACrC,OAAO,QAAiE;AAAA,IACvE,CAACA,UAASA,MAAK,SAAS,WAAWA,MAAK,QAAQA,MAAK;AAAA,EACvD,IACA;AACJ,MAAI,MAAO,MAAK,QAAQ,QAAQ,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnE,QAAM,QAAQ,OAAO,SAAS;AAC9B,QAAM,OAAO,OAAO,UAAU,WAAW,UAAU,KAAK,IAAI;AAC5D,MAAI,KAAM,MAAK,OAAO;AAAA,WACb,OAAO,QAAS,QAAO,KAAK;AACvC;AAEA,SAAS,QAAQ,IAAY,OAAmC;AAC9D,QAAM,OAAQ,MAAM,QAAQ,CAAC;AAC7B,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,GAAI,KAAK,SAAS,SACd,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,SAAS,SAAS,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,GAAG,IACrE,CAAC;AAAA,IACL,GAAI,KAAK,UAAU,SACf,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,SAAS,SAAS,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,GAAG,IACvE,CAAC;AAAA,IACL,GAAI,KAAK,QAAQ,CAAC,wDAAwD,IAAI,CAAC;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,MAAM,MAAM,KAAK,GAAG;AAAA,IACpB,WAAW;AAAA,EACb;AACF;AAEA,SAAS,OAAO,IAAY,OAAmC;AAC7D,QAAM,OAAQ,MAAM,QAAQ,CAAC;AAC7B,QAAM,OAAO,KAAK,SAAS,UAAU,cAAc;AACnD,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,eAAe,IAAI,IAAI,KAAK,QAAQ,EAAE,GAAG,KAAK;AAAA,IACrD,MAAM,OAAO,MAAM,QAAQ,CAAC,GAAG,WAAW,EAAE;AAAA,IAC5C,WAAW,MAAM,QAAQ,CAAC,GAAG,aAAa;AAAA,EAC5C;AACF;AAEA,SAAS,aACP,OACA,KACA,OACA,WACA,OACM;AACN,QAAM,KAAK,IAAI,MAAM,EAAE;AACvB,QAAM,QAAQ,MAAM,QAAQ,CAAC;AAC7B,MAAI,MAAM,SAAS,gBAAiB,KAAI,KAAK,QAAQ,IAAI,KAAK,CAAC;AAC/D,MAAI,MAAM,SAAS,eAAgB,KAAI,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,WACpD,MAAM,SAAS,cAAe,KAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC;AAAA,WACjE,MAAM,SAAS,aAAa;AACnC,QAAI;AAAA,MACF,YAAY,IAAI,OAAO,MAAM,SAAS,KACpC,KAAK,IAAI,OAAO,WAAW,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;AAAA,IAC1D;AAAA,WACO,MAAM,SAAS,kBAAkB,OAAO;AAC/C,UAAM,UAAU,UAAU,IAAI,KAAK;AACnC,QAAI,KAAK,iBAAiB,OAAO,CAAC;AAClC,eAAW,CAAC,KAAK,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,EAAG,OAAM,IAAI,KAAK,KAAK;AAAA,EACnE,WAAW,MAAM,SAAS,oBAAoB,MAAO,QAAO,OAAO,KAAK;AAAA,WAC/D,MAAM,SAAS,gBAAiB,KAAI,KAAK,OAAO,IAAI,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC;AAC7F;AAEA,MAAM,aAAyC;AAAA,EAC7C,SAAS;AAAA,EACT,SAAS;AAAA,EACT,MAAM;AACR;AAEA,SAAS,KAAK,MAAwB,KAAgB,OAAoC;AACxF,QAAM,QAAQ,KAAK,KAAK,SAAS;AACjC,aAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,UAAM,OAAO,MAAM,IAAI,KAAK,MAAM;AAClC,QAAI,QAAQ,KAAK,WAAW,WAAW;AACrC,WAAK,SAAS,WAAW,KAAK,MAAM,KAAK;AACzC,WAAK,SAAS,KAAK,UAAU,KAAK;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,OAAO,YAAY;AACnC,MAAI,QAAS,KAAI,KAAK,UAAU,QAAQ,SAAS,WAAW,CAAC;AAC7D,aAAW,cAAc,OAAO,eAAe,CAAC,GAAG;AACjD,QAAI,KAAK;AAAA,MACP,IAAI,cAAc,WAAW,MAAM;AAAA,MACnC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,WAAW;AAAA,MACX,OAAO;AAAA,MACP,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,OAAO,YAAY;AACjC,MAAI;AACF,QAAI,KAAK;AAAA,MACP,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,WAAW,MAAM;AAAA,IACnB,CAAC;AACL;AAEO,SAAS,WACd,MACA,aAAkD,CAAC,GACxC;AACX,QAAM,MAAiB,CAAC;AACxB,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,oBAAI,IAAsB;AACxC,QAAM,QAAQ,EAAE,WAAW,cAAc,KAAK,OAAO,GAAG,SAAS,QAAQ,KAAK,OAAO,EAAE;AACvF,MAAI;AACJ,aAAW,SAAS,KAAK,SAAS;AAChC,UAAM,UAAU,UAAU,SAAS,mBAAmB,UAAU;AAChE,iBAAa,OAAO,KAAK,OAAO,WAAW,OAAO,MAAM,EAAE,CAAC,KAAK,SAAS,KAAK;AAC9E,eAAW;AAAA,EACb;AACA,OAAK,MAAM,KAAK,KAAK;AACrB,SAAO;AACT;AAEO,SAAS,OAAO,MAA6C;AAClE,SAAO,QAAS,MAAM,KAAK,SAAS,GAAwB,GAAG;AACjE;AAEO,SAAS,OAAO,MAAmD;AACxE,QAAM,QAAU,MAAM,KAAK,UAAU,GAAsC,SAAS,CAAC;AAKrF,SAAO,MACJ,OAAO,CAAC,SAAS,KAAK,SAAS,WAAW,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,CAAC,EAC1E,IAAI,CAAC,UAAU;AAAA,IACd,IAAI,IAAI,KAAK,EAAE;AAAA,IACf,MAAM;AAAA,IACN,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,MAAM,KAAK,SAAS,UAAU,UAAU;AAAA,EAC1C,EAAE;AACN;",
+  "sourcesContent": ["import type {\n  AssistantMessage,\n  AssistantStatus,\n  ErrorAction,\n  LickMessage,\n  Message,\n  MessagePart,\n  SystemMessage,\n  ToolCall,\n  ToolStatus,\n  Usage,\n  UserMessage,\n} from '@ai-ecoverse/slicc-spectrum/ui';\nimport type { ConversationView, EntryRecord } from '@earendil-works/pi-durable';\nimport { parseLick } from '../licks/lick.ts';\nimport { entryLick, LICK_TOOLS, type LickDecision, lickDecisions } from '../licks/state.ts';\nimport { mcpLabel } from '../mcp/label.ts';\nimport { FROM_KIND, type From } from '../scoops/from.ts';\nimport type { SecretName } from '../secrets/names.ts';\nimport { listedLine, SECRETS_KIND } from '../secrets/view.ts';\nimport type { Delivered } from '../services.ts';\nimport { SPRINKLE_KIND } from '../sprinkles/kind.ts';\n\ntype Json = Record<string, unknown>;\n\ninterface Block {\n  type: string;\n  text?: string;\n  thinking?: string;\n  id?: string;\n  name?: string;\n  arguments?: Json;\n}\n\ninterface ModelMessage {\n  role: string;\n  content?: string | Block[];\n  timestamp?: number;\n  stopReason?: string;\n  errorMessage?: string;\n  provider?: string;\n  model?: string;\n  usage?: {\n    input?: number;\n    output?: number;\n    cacheRead?: number;\n    cacheWrite?: number;\n    cost?: { total?: number };\n  };\n  toolCallId?: string;\n  isError?: boolean;\n  details?: { patch?: unknown };\n}\n\ninterface Slot {\n  callId: string;\n  status: string;\n  output?: string;\n}\n\ninterface Live {\n  run?: unknown;\n  generation?: { message?: ModelMessage; retry?: { at: number; error: string } };\n  tools?: Slot[];\n  compactions?: { taskId: number; reason: string }[];\n}\n\nexport function textOf(content: ModelMessage['content']): string {\n  if (typeof content === 'string') return content;\n  return (content ?? []).map((block) => (block.type === 'text' ? (block.text ?? '') : '')).join('');\n}\n\nconst paths = (args: Json | undefined): string[] =>\n  typeof args?.path === 'string' ? [args.path] : [];\n\nfunction title(args: Json | undefined): string {\n  const subject = args?.command ?? args?.path;\n  return typeof subject === 'string' ? subject : '';\n}\n\ninterface Replacement {\n  oldText?: string;\n  newText?: string;\n}\n\nconst GAP = '\u2026';\n\nfunction seconds(value: unknown): string | undefined {\n  return typeof value === 'number' ? `timeout ${value}s` : undefined;\n}\n\nfunction lines(args: Json): string | undefined {\n  const { offset, limit } = args as { offset?: number; limit?: number };\n  if (typeof offset === 'number' && typeof limit === 'number')\n    return `lines ${offset}\u2013${offset + limit - 1}`;\n  if (typeof offset === 'number') return `from line ${offset}`;\n  return typeof limit === 'number' ? `first ${limit} lines` : undefined;\n}\n\nfunction edits(args: Json): ToolCall['diff'] {\n  const list = Array.isArray(args.edits) ? (args.edits as Replacement[]) : [];\n  if (list.length === 0) return undefined;\n  return {\n    before: list.map((edit) => edit.oldText ?? '').join(`\\n${GAP}\\n`),\n    after: list.map((edit) => edit.newText ?? '').join(`\\n${GAP}\\n`),\n  };\n}\n\nexport function fromPatch(patch: string): ToolCall['diff'] {\n  const before: string[] = [];\n  const after: string[] = [];\n  let hunks = 0;\n  for (const line of patch.split('\\n')) {\n    if (line.startsWith('@@')) {\n      if (hunks++ > 0) {\n        before.push(GAP);\n        after.push(GAP);\n      }\n      continue;\n    }\n    if (hunks === 0 || line === '' || line.startsWith('\\\\')) continue;\n    const text = line.slice(1);\n    if (line.startsWith('-')) before.push(text);\n    else if (line.startsWith('+')) after.push(text);\n    else {\n      before.push(text);\n      after.push(text);\n    }\n  }\n  return hunks ? { before: before.join('\\n'), after: after.join('\\n') } : undefined;\n}\n\nfunction shape(name: string, args: Json): Pick<ToolCall, 'input' | 'meta' | 'diff'> {\n  const path = typeof args.path === 'string' ? args.path : '';\n  const meta = name === 'bash' ? seconds(args.timeout) : name === 'read' ? lines(args) : undefined;\n  const base = meta ? { meta } : {};\n  if (name === 'bash' && typeof args.command === 'string') return { input: args.command, ...base };\n  if (name === 'read' || name === 'write') return { input: path, ...base };\n  if (name === 'edit') {\n    const diff = edits(args);\n    return { input: path, ...(diff ? { diff } : {}) };\n  }\n  return { input: JSON.stringify(args, null, 2) };\n}\n\nfunction toolCall(block: Block): ToolCall {\n  const args = block.arguments ?? {};\n  return {\n    id: block.id ?? '',\n    name: block.name ?? 'tool',\n    title: mcpLabel(block.name ?? '') ?? title(block.arguments),\n    ...shape(block.name ?? 'tool', args),\n    output: '',\n    status: 'running',\n    paths: paths(block.arguments),\n  };\n}\n\nfunction part(block: Block): MessagePart | undefined {\n  if (block.type === 'text') return { type: 'text', text: block.text ?? '' };\n  if (block.type === 'thinking') return { type: 'thinking', text: block.thinking ?? '' };\n  if (block.type === 'toolCall') return { type: 'tool', tool: toolCall(block) };\n  return undefined;\n}\n\nfunction usage(message: ModelMessage): Usage | undefined {\n  const used = message.usage;\n  if (!used) return undefined;\n  return {\n    input: used.input ?? 0,\n    output: used.output ?? 0,\n    cost: used.cost?.total ?? 0,\n    cacheRead: used.cacheRead ?? 0,\n    cacheWrite: used.cacheWrite ?? 0,\n  };\n}\n\nconst statuses: Record<string, AssistantStatus> = { error: 'error', aborted: 'stopped' };\n\nconst credentials =\n  /security token|unrecognizedclient|not authori[sz]ed|unauthori[sz]ed|forbidden|\\b40[13]\\b|api key|credential|bearer/i;\nconst models = /model/i;\nconst unavailable =\n  /access|invalid|not found|identifier|unsupported|not supported|isn['\u2019]t supported|not available|isn['\u2019]t available/i;\n\nconst providerNames: Record<string, string> = { 'amazon-bedrock': 'Bedrock' };\nconst filtered =\n  /Provider (?:stopped with|finish_reason): (?:content_filter(?:ed)?|guardrail_intervened|sensitive)|content[_ ]filter(?:ed|ing)?\\b|guardrail[_ ]intervened/i;\nconst refused =\n  /refused to complete the request|Provider (?:stopped with|finish_reason): refusal|\\bstop_?reason\\W+refusal\\b/i;\nconst missing = /no api key|missing|not configured|no credentials/i;\n\nexport function errorPart(error: string, provider?: string): MessagePart {\n  const action = errorAction(error);\n  if (action === 'drop-turn') {\n    return {\n      type: 'error',\n      message: filtered.test(error)\n        ? \"The model's content filter stopped this reply.\"\n        : 'The model refused to answer this turn.',\n      detail: error,\n      action,\n    };\n  }\n  if (action === 'settings' && provider === 'adobe') {\n    return {\n      type: 'error',\n      message: 'Your Adobe session has expired.',\n      detail: error,\n      action: 'login',\n    };\n  }\n  const name = providerNames[provider ?? ''] ?? 'The provider';\n  const lead =\n    action === 'settings'\n      ? missing.test(error)\n        ? `${name} needs an API key.`\n        : `${name} rejected the API key.`\n      : action === 'change-model'\n        ? \"This model isn't available with the current account.\"\n        : null;\n  return lead\n    ? { type: 'error', message: lead, detail: error, action }\n    : { type: 'error', message: error, action };\n}\n\nexport function errorAction(message: string): ErrorAction {\n  if (filtered.test(message) || refused.test(message)) return 'drop-turn';\n  if (credentials.test(message)) return 'settings';\n  if (models.test(message) && unavailable.test(message)) return 'change-model';\n  return 'retry';\n}\n\nfunction sprinkleMessage(id: string, entry: EntryRecord): AssistantMessage {\n  const data = (entry.data ?? {}) as { sprinkle?: unknown; at?: unknown };\n  return {\n    id,\n    role: 'assistant',\n    parts: [{ type: 'sprinkle', sprinkle: String(data.sprinkle ?? '') }],\n    status: 'done',\n    createdAt: typeof data.at === 'number' ? data.at : 0,\n  };\n}\n\nexport function assistant(\n  id: string,\n  message: ModelMessage,\n  status?: AssistantStatus\n): AssistantMessage {\n  const blocks = Array.isArray(message.content) ? message.content : [];\n  const parts = blocks.map(part).filter((item): item is MessagePart => item !== undefined);\n  if (message.errorMessage) parts.push(errorPart(message.errorMessage, message.provider));\n  const used = usage(message);\n  return {\n    id,\n    role: 'assistant',\n    parts,\n    status: status ?? statuses[message.stopReason ?? ''] ?? 'done',\n    createdAt: message.timestamp ?? 0,\n    ...(message.provider && message.model ? { model: `${message.provider}/${message.model}` } : {}),\n    ...(used ? { usage: used } : {}),\n  };\n}\n\nfunction user(\n  id: string,\n  message: ModelMessage,\n  delivered: Delivered | undefined,\n  from: From | undefined\n): UserMessage {\n  return {\n    id,\n    role: 'user',\n    text: textOf(message.content),\n    createdAt: message.timestamp ?? 0,\n    ...(delivered ? { delivered } : {}),\n    ...(from ? { from: from.from } : {}),\n    ...(from?.agent ? { origin: 'agent' as const } : {}),\n  };\n}\n\nexport function origins(entries: readonly EntryRecord[]): Map<number, From> {\n  const out = new Map<number, From>();\n  for (const entry of entries)\n    if (entry.kind === FROM_KIND) {\n      const note = entry.data as From;\n      out.set(note.entry, note);\n    }\n  return out;\n}\n\nfunction lickMessage(\n  id: string,\n  entry: EntryRecord,\n  decisions: ReadonlyMap<string, LickDecision>\n): LickMessage | undefined {\n  const lick = entryLick(entry);\n  if (!lick) return undefined;\n  const state = lick.actions?.length ? (decisions.get(lick.id) ?? 'pending') : undefined;\n  return {\n    id,\n    role: 'lick',\n    channel: lick.channel,\n    title: lick.title,\n    text: lick.text,\n    createdAt: lick.at,\n    ...(lick.body ? { body: lick.body } : {}),\n    ...(lick.count > 1 ? { count: lick.count } : {}),\n    ...(state ? { state } : {}),\n    ...(lick.severity ? { severity: lick.severity } : {}),\n  };\n}\n\nfunction withoutLickTools(message: AssistantMessage): AssistantMessage {\n  const parts = message.parts.filter((item) => item.type !== 'tool' || !LICK_TOOLS[item.tool.name]);\n  return parts.length === message.parts.length ? message : { ...message, parts };\n}\n\nfunction system(id: string, entry: EntryRecord, text: string): SystemMessage {\n  const reason = (entry.data as Json | undefined)?.reason as SystemMessage['trigger'] | undefined;\n  return {\n    id,\n    role: 'system',\n    kind: 'compaction',\n    text,\n    createdAt: 0,\n    state: 'summarized',\n    ...(reason ? { trigger: reason } : {}),\n  };\n}\n\nfunction tools(messages: Message[]): Map<string, ToolCall> {\n  const found = new Map<string, ToolCall>();\n  for (const message of messages) {\n    if (message.role !== 'assistant') continue;\n    for (const item of message.parts) if (item.type === 'tool') found.set(item.tool.id, item.tool);\n  }\n  return found;\n}\n\nfunction settle(calls: Map<string, ToolCall>, result: ModelMessage): void {\n  const call = calls.get(result.toolCallId ?? '');\n  if (!call) return;\n  call.output = textOf(result.content);\n  call.status = result.isError ? 'error' : 'done';\n  const image = Array.isArray(result.content)\n    ? (result.content as { type: string; data?: string; mimeType?: string }[]).find(\n        (part) => part.type === 'image' && part.data && part.mimeType\n      )\n    : undefined;\n  if (image) call.image = `data:${image.mimeType};base64,${image.data}`;\n  const patch = result.details?.patch;\n  const diff = typeof patch === 'string' ? fromPatch(patch) : undefined;\n  if (diff) call.diff = diff;\n  else if (result.isError) delete call.diff;\n}\n\nfunction rewound(id: string, entry: EntryRecord): SystemMessage {\n  const data = (entry.data ?? {}) as { stopped?: string[]; restored?: string[]; files?: boolean };\n  const notes = [\n    'Its prompt is back in the composer.',\n    ...(data.stopped?.length\n      ? [`Stopped ${data.stopped.map((name) => `scoop ${name}`).join(', ')}.`]\n      : []),\n    ...(data.restored?.length\n      ? [`Restored ${data.restored.map((name) => `scoop ${name}`).join(', ')}.`]\n      : []),\n    ...(data.files ? ['Changed files stay; use Changes or git to revert them.'] : []),\n  ];\n  return {\n    id,\n    role: 'system',\n    kind: 'notice',\n    title: 'Rewound 1 turn',\n    text: notes.join(' '),\n    createdAt: 0,\n  };\n}\n\nfunction thawed(id: string, entry: EntryRecord): SystemMessage {\n  const data = (entry.data ?? {}) as { name?: string; kind?: string };\n  const what = data.kind === 'agent' ? 'agent run' : 'scoop';\n  return {\n    id,\n    role: 'system',\n    kind: 'notice',\n    title: `Thawed from ${what} ${data.name ?? ''}`.trim(),\n    text: textOf(entry.model?.[0]?.content ?? ''),\n    createdAt: entry.model?.[0]?.timestamp ?? 0,\n  };\n}\n\nfunction secrets(id: string, entry: EntryRecord): SystemMessage {\n  const data = (entry.data ?? {}) as { names?: SecretName[] };\n  return {\n    id,\n    role: 'system',\n    kind: 'notice',\n    title: 'Secrets listed',\n    text: listedLine(data.names ?? []),\n    createdAt: entry.model?.[0]?.timestamp ?? 0,\n  };\n}\n\nfunction entryMessage(\n  entry: EntryRecord,\n  out: Message[],\n  calls: Map<string, ToolCall>,\n  delivered: Delivered | undefined,\n  notes: { decisions: ReadonlyMap<string, LickDecision>; origins: ReadonlyMap<number, From> }\n): void {\n  const id = `e${entry.id}`;\n  const model = entry.model?.[0] as ModelMessage | undefined;\n  if (entry.kind === 'slicc.rewound') out.push(rewound(id, entry));\n  if (entry.kind === 'slicc.thawed') out.push(thawed(id, entry));\n  else if (entry.kind === SECRETS_KIND) out.push(secrets(id, entry));\n  else if (entry.kind === SPRINKLE_KIND) out.push(sprinkleMessage(id, entry));\n  else if (entry.kind === 'pi.user' && model)\n    out.push(\n      lickMessage(id, entry, notes.decisions) ??\n        user(id, model, delivered, notes.origins.get(entry.id))\n    );\n  else if (entry.kind === 'pi.assistant' && model) {\n    const message = assistant(id, model);\n    out.push(withoutLickTools(message));\n    for (const [key, value] of tools([message])) calls.set(key, value);\n  } else if (entry.kind === 'pi.tool-result' && model) settle(calls, model);\n  else if (entry.kind === 'pi.compaction') out.push(system(id, entry, textOf(model?.content)));\n}\n\nconst slotStatus: Record<string, ToolStatus> = {\n  pending: 'running',\n  running: 'running',\n  done: 'done',\n};\n\nfunction live(view: ConversationView, out: Message[], calls: Map<string, ToolCall>): void {\n  const state = view.docs['pi.live'] as Live | undefined;\n  for (const slot of state?.tools ?? []) {\n    const call = calls.get(slot.callId);\n    if (call && call.status === 'running') {\n      call.status = slotStatus[slot.status] ?? 'running';\n      call.output = slot.output ?? call.output;\n    }\n  }\n  const partial = state?.generation?.message;\n  if (partial) out.push(assistant('live', partial, 'streaming'));\n  for (const compaction of state?.compactions ?? []) {\n    out.push({\n      id: `compaction-${compaction.taskId}`,\n      role: 'system',\n      kind: 'compaction',\n      text: '',\n      createdAt: 0,\n      state: 'summarizing',\n      trigger: compaction.reason as SystemMessage['trigger'],\n    });\n  }\n  const retry = state?.generation?.retry;\n  if (retry)\n    out.push({\n      id: 'retry',\n      role: 'system',\n      kind: 'notice',\n      text: retry.error,\n      createdAt: retry.at,\n    });\n}\n\nexport function toMessages(\n  view: ConversationView | undefined,\n  deliveries: Readonly<Record<string, Delivered>> = {}\n): Message[] {\n  const out: Message[] = [];\n  if (!view) return out;\n  const calls = new Map<string, ToolCall>();\n  const notes = { decisions: lickDecisions(view.entries), origins: origins(view.entries) };\n  let previous: EntryRecord | undefined;\n  for (const entry of view.entries) {\n    const steered = previous?.kind === 'pi.tool-result' ? 'steer' : undefined;\n    entryMessage(entry, out, calls, deliveries[String(entry.id)] ?? steered, notes);\n    previous = entry;\n  }\n  live(view, out, calls);\n  return out;\n}\n\nexport function isBusy(view: ConversationView | undefined): boolean {\n  return Boolean((view?.docs['pi.live'] as Live | undefined)?.run);\n}\n\nexport function queued(view: ConversationView | undefined): UserMessage[] {\n  const items = ((view?.docs['pi.inbox'] as { items?: Json[] } | undefined)?.items ?? []) as {\n    id: number;\n    mode: string;\n    content?: ModelMessage['content'];\n  }[];\n  return items\n    .filter((item) => item.mode !== 'write' && !parseLick(textOf(item.content)))\n    .map((item) => ({\n      id: `q${item.id}`,\n      role: 'user',\n      text: textOf(item.content),\n      createdAt: 0,\n      queued: true,\n      mode: item.mode === 'steer' ? 'steer' : 'queue',\n    }));\n}\n"],
+  "mappings": "AAcA,SAAS,iBAAiB;AAC1B,SAAS,WAAW,YAA+B,qBAAqB;AACxE,SAAS,gBAAgB;AACzB,SAAS,iBAA4B;AAErC,SAAS,YAAY,oBAAoB;AAEzC,SAAS,qBAAqB;AA8CvB,SAAS,OAAO,SAA0C;AAC/D,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,UAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,UAAW,MAAM,SAAS,SAAU,MAAM,QAAQ,KAAM,EAAG,EAAE,KAAK,EAAE;AAClG;AAEA,MAAM,QAAQ,CAAC,SACb,OAAO,MAAM,SAAS,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;AAElD,SAAS,MAAM,MAAgC;AAC7C,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAOA,MAAM,MAAM;AAEZ,SAAS,QAAQ,OAAoC;AACnD,SAAO,OAAO,UAAU,WAAW,WAAW,KAAK,MAAM;AAC3D;AAEA,SAAS,MAAM,MAAgC;AAC7C,QAAM,EAAE,QAAQ,MAAM,IAAI;AAC1B,MAAI,OAAO,WAAW,YAAY,OAAO,UAAU;AACjD,WAAO,SAAS,MAAM,SAAI,SAAS,QAAQ,CAAC;AAC9C,MAAI,OAAO,WAAW,SAAU,QAAO,aAAa,MAAM;AAC1D,SAAO,OAAO,UAAU,WAAW,SAAS,KAAK,WAAW;AAC9D;AAEA,SAAS,MAAM,MAA8B;AAC3C,QAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAK,KAAK,QAA0B,CAAC;AAC1E,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,SAAO;AAAA,IACL,QAAQ,KAAK,IAAI,CAAC,SAAS,KAAK,WAAW,EAAE,EAAE,KAAK;AAAA,EAAK,GAAG;AAAA,CAAI;AAAA,IAChE,OAAO,KAAK,IAAI,CAAC,SAAS,KAAK,WAAW,EAAE,EAAE,KAAK;AAAA,EAAK,GAAG;AAAA,CAAI;AAAA,EACjE;AACF;AAEO,SAAS,UAAU,OAAiC;AACzD,QAAM,SAAmB,CAAC;AAC1B,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAQ;AACZ,aAAW,QAAQ,MAAM,MAAM,IAAI,GAAG;AACpC,QAAI,KAAK,WAAW,IAAI,GAAG;AACzB,UAAI,UAAU,GAAG;AACf,eAAO,KAAK,GAAG;AACf,cAAM,KAAK,GAAG;AAAA,MAChB;AACA;AAAA,IACF;AACA,QAAI,UAAU,KAAK,SAAS,MAAM,KAAK,WAAW,IAAI,EAAG;AACzD,UAAM,OAAO,KAAK,MAAM,CAAC;AACzB,QAAI,KAAK,WAAW,GAAG,EAAG,QAAO,KAAK,IAAI;AAAA,aACjC,KAAK,WAAW,GAAG,EAAG,OAAM,KAAK,IAAI;AAAA,SACzC;AACH,aAAO,KAAK,IAAI;AAChB,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO,QAAQ,EAAE,QAAQ,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,IAAI,EAAE,IAAI;AAC1E;AAEA,SAAS,MAAM,MAAc,MAAuD;AAClF,QAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACzD,QAAM,OAAO,SAAS,SAAS,QAAQ,KAAK,OAAO,IAAI,SAAS,SAAS,MAAM,IAAI,IAAI;AACvF,QAAM,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAChC,MAAI,SAAS,UAAU,OAAO,KAAK,YAAY,SAAU,QAAO,EAAE,OAAO,KAAK,SAAS,GAAG,KAAK;AAC/F,MAAI,SAAS,UAAU,SAAS,QAAS,QAAO,EAAE,OAAO,MAAM,GAAG,KAAK;AACvE,MAAI,SAAS,QAAQ;AACnB,UAAM,OAAO,MAAM,IAAI;AACvB,WAAO,EAAE,OAAO,MAAM,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAClD;AACA,SAAO,EAAE,OAAO,KAAK,UAAU,MAAM,MAAM,CAAC,EAAE;AAChD;AAEA,SAAS,SAAS,OAAwB;AACxC,QAAM,OAAO,MAAM,aAAa,CAAC;AACjC,SAAO;AAAA,IACL,IAAI,MAAM,MAAM;AAAA,IAChB,MAAM,MAAM,QAAQ;AAAA,IACpB,OAAO,SAAS,MAAM,QAAQ,EAAE,KAAK,MAAM,MAAM,SAAS;AAAA,IAC1D,GAAG,MAAM,MAAM,QAAQ,QAAQ,IAAI;AAAA,IACnC,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,SAAS;AAAA,EAC9B;AACF;AAEA,SAAS,KAAK,OAAuC;AACnD,MAAI,MAAM,SAAS,OAAQ,QAAO,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,GAAG;AACzE,MAAI,MAAM,SAAS,WAAY,QAAO,EAAE,MAAM,YAAY,MAAM,MAAM,YAAY,GAAG;AACrF,MAAI,MAAM,SAAS,WAAY,QAAO,EAAE,MAAM,QAAQ,MAAM,SAAS,KAAK,EAAE;AAC5E,SAAO;AACT;AAEA,SAAS,MAAM,SAA0C;AACvD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO;AAAA,IACL,OAAO,KAAK,SAAS;AAAA,IACrB,QAAQ,KAAK,UAAU;AAAA,IACvB,MAAM,KAAK,MAAM,SAAS;AAAA,IAC1B,WAAW,KAAK,aAAa;AAAA,IAC7B,YAAY,KAAK,cAAc;AAAA,EACjC;AACF;AAEA,MAAM,WAA4C,EAAE,OAAO,SAAS,SAAS,UAAU;AAEvF,MAAM,cACJ;AACF,MAAM,SAAS;AACf,MAAM,cACJ;AAEF,MAAM,gBAAwC,EAAE,kBAAkB,UAAU;AAC5E,MAAM,WACJ;AACF,MAAM,UACJ;AACF,MAAM,UAAU;AAET,SAAS,UAAU,OAAe,UAAgC;AACvE,QAAM,SAAS,YAAY,KAAK;AAChC,MAAI,WAAW,aAAa;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,SAAS,KAAK,KAAK,IACxB,mDACA;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,WAAW,cAAc,aAAa,SAAS;AACjD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,OAAO,cAAc,YAAY,EAAE,KAAK;AAC9C,QAAM,OACJ,WAAW,aACP,QAAQ,KAAK,KAAK,IAChB,GAAG,IAAI,uBACP,GAAG,IAAI,2BACT,WAAW,iBACT,yDACA;AACR,SAAO,OACH,EAAE,MAAM,SAAS,SAAS,MAAM,QAAQ,OAAO,OAAO,IACtD,EAAE,MAAM,SAAS,SAAS,OAAO,OAAO;AAC9C;AAEO,SAAS,YAAY,SAA8B;AACxD,MAAI,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,OAAO,EAAG,QAAO;AAC5D,MAAI,YAAY,KAAK,OAAO,EAAG,QAAO;AACtC,MAAI,OAAO,KAAK,OAAO,KAAK,YAAY,KAAK,OAAO,EAAG,QAAO;AAC9D,SAAO;AACT;AAEA,SAAS,gBAAgB,IAAY,OAAsC;AACzE,QAAM,OAAQ,MAAM,QAAQ,CAAC;AAC7B,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,OAAO,CAAC,EAAE,MAAM,YAAY,UAAU,OAAO,KAAK,YAAY,EAAE,EAAE,CAAC;AAAA,IACnE,QAAQ;AAAA,IACR,WAAW,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AAAA,EACrD;AACF;AAEO,SAAS,UACd,IACA,SACA,QACkB;AAClB,QAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO,IAAI,QAAQ,UAAU,CAAC;AACnE,QAAM,QAAQ,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC,SAA8B,SAAS,MAAS;AACvF,MAAI,QAAQ,aAAc,OAAM,KAAK,UAAU,QAAQ,cAAc,QAAQ,QAAQ,CAAC;AACtF,QAAM,OAAO,MAAM,OAAO;AAC1B,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,QAAQ,UAAU,SAAS,QAAQ,cAAc,EAAE,KAAK;AAAA,IACxD,WAAW,QAAQ,aAAa;AAAA,IAChC,GAAI,QAAQ,YAAY,QAAQ,QAAQ,EAAE,OAAO,GAAG,QAAQ,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,CAAC;AAAA,IAC7F,GAAI,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,EAChC;AACF;AAEA,SAAS,KACP,IACA,SACA,WACA,MACa;AACb,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC5B,WAAW,QAAQ,aAAa;AAAA,IAChC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjC,GAAI,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IAClC,GAAI,MAAM,QAAQ,EAAE,QAAQ,QAAiB,IAAI,CAAC;AAAA,EACpD;AACF;AAEO,SAAS,QAAQ,SAAoD;AAC1E,QAAM,MAAM,oBAAI,IAAkB;AAClC,aAAW,SAAS;AAClB,QAAI,MAAM,SAAS,WAAW;AAC5B,YAAM,OAAO,MAAM;AACnB,UAAI,IAAI,KAAK,OAAO,IAAI;AAAA,IAC1B;AACF,SAAO;AACT;AAEA,SAAS,YACP,IACA,OACA,WACyB;AACzB,QAAM,OAAO,UAAU,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,KAAK,SAAS,SAAU,UAAU,IAAI,KAAK,EAAE,KAAK,YAAa;AAC7E,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,SAAS,KAAK;AAAA,IACd,OAAO,KAAK;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,WAAW,KAAK;AAAA,IAChB,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACvC,GAAI,KAAK,QAAQ,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IAC9C,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,EACrD;AACF;AAEA,SAAS,iBAAiB,SAA6C;AACrE,QAAM,QAAQ,QAAQ,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,UAAU,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC;AAChG,SAAO,MAAM,WAAW,QAAQ,MAAM,SAAS,UAAU,EAAE,GAAG,SAAS,MAAM;AAC/E;AAEA,SAAS,OAAO,IAAY,OAAoB,MAA6B;AAC3E,QAAM,SAAU,MAAM,MAA2B;AACjD,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,IACX,OAAO;AAAA,IACP,GAAI,SAAS,EAAE,SAAS,OAAO,IAAI,CAAC;AAAA,EACtC;AACF;AAEA,SAAS,MAAM,UAA4C;AACzD,QAAM,QAAQ,oBAAI,IAAsB;AACxC,aAAW,WAAW,UAAU;AAC9B,QAAI,QAAQ,SAAS,YAAa;AAClC,eAAW,QAAQ,QAAQ,MAAO,KAAI,KAAK,SAAS,OAAQ,OAAM,IAAI,KAAK,KAAK,IAAI,KAAK,IAAI;AAAA,EAC/F;AACA,SAAO;AACT;AAEA,SAAS,OAAO,OAA8B,QAA4B;AACxE,QAAM,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE;AAC9C,MAAI,CAAC,KAAM;AACX,OAAK,SAAS,OAAO,OAAO,OAAO;AACnC,OAAK,SAAS,OAAO,UAAU,UAAU;AACzC,QAAM,QAAQ,MAAM,QAAQ,OAAO,OAAO,IACrC,OAAO,QAAiE;AAAA,IACvE,CAACA,UAASA,MAAK,SAAS,WAAWA,MAAK,QAAQA,MAAK;AAAA,EACvD,IACA;AACJ,MAAI,MAAO,MAAK,QAAQ,QAAQ,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnE,QAAM,QAAQ,OAAO,SAAS;AAC9B,QAAM,OAAO,OAAO,UAAU,WAAW,UAAU,KAAK,IAAI;AAC5D,MAAI,KAAM,MAAK,OAAO;AAAA,WACb,OAAO,QAAS,QAAO,KAAK;AACvC;AAEA,SAAS,QAAQ,IAAY,OAAmC;AAC9D,QAAM,OAAQ,MAAM,QAAQ,CAAC;AAC7B,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,GAAI,KAAK,SAAS,SACd,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,SAAS,SAAS,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,GAAG,IACrE,CAAC;AAAA,IACL,GAAI,KAAK,UAAU,SACf,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,SAAS,SAAS,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,GAAG,IACvE,CAAC;AAAA,IACL,GAAI,KAAK,QAAQ,CAAC,wDAAwD,IAAI,CAAC;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,MAAM,MAAM,KAAK,GAAG;AAAA,IACpB,WAAW;AAAA,EACb;AACF;AAEA,SAAS,OAAO,IAAY,OAAmC;AAC7D,QAAM,OAAQ,MAAM,QAAQ,CAAC;AAC7B,QAAM,OAAO,KAAK,SAAS,UAAU,cAAc;AACnD,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,eAAe,IAAI,IAAI,KAAK,QAAQ,EAAE,GAAG,KAAK;AAAA,IACrD,MAAM,OAAO,MAAM,QAAQ,CAAC,GAAG,WAAW,EAAE;AAAA,IAC5C,WAAW,MAAM,QAAQ,CAAC,GAAG,aAAa;AAAA,EAC5C;AACF;AAEA,SAAS,QAAQ,IAAY,OAAmC;AAC9D,QAAM,OAAQ,MAAM,QAAQ,CAAC;AAC7B,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,MAAM,WAAW,KAAK,SAAS,CAAC,CAAC;AAAA,IACjC,WAAW,MAAM,QAAQ,CAAC,GAAG,aAAa;AAAA,EAC5C;AACF;AAEA,SAAS,aACP,OACA,KACA,OACA,WACA,OACM;AACN,QAAM,KAAK,IAAI,MAAM,EAAE;AACvB,QAAM,QAAQ,MAAM,QAAQ,CAAC;AAC7B,MAAI,MAAM,SAAS,gBAAiB,KAAI,KAAK,QAAQ,IAAI,KAAK,CAAC;AAC/D,MAAI,MAAM,SAAS,eAAgB,KAAI,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,WACpD,MAAM,SAAS,aAAc,KAAI,KAAK,QAAQ,IAAI,KAAK,CAAC;AAAA,WACxD,MAAM,SAAS,cAAe,KAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC;AAAA,WACjE,MAAM,SAAS,aAAa;AACnC,QAAI;AAAA,MACF,YAAY,IAAI,OAAO,MAAM,SAAS,KACpC,KAAK,IAAI,OAAO,WAAW,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;AAAA,IAC1D;AAAA,WACO,MAAM,SAAS,kBAAkB,OAAO;AAC/C,UAAM,UAAU,UAAU,IAAI,KAAK;AACnC,QAAI,KAAK,iBAAiB,OAAO,CAAC;AAClC,eAAW,CAAC,KAAK,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,EAAG,OAAM,IAAI,KAAK,KAAK;AAAA,EACnE,WAAW,MAAM,SAAS,oBAAoB,MAAO,QAAO,OAAO,KAAK;AAAA,WAC/D,MAAM,SAAS,gBAAiB,KAAI,KAAK,OAAO,IAAI,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC;AAC7F;AAEA,MAAM,aAAyC;AAAA,EAC7C,SAAS;AAAA,EACT,SAAS;AAAA,EACT,MAAM;AACR;AAEA,SAAS,KAAK,MAAwB,KAAgB,OAAoC;AACxF,QAAM,QAAQ,KAAK,KAAK,SAAS;AACjC,aAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,UAAM,OAAO,MAAM,IAAI,KAAK,MAAM;AAClC,QAAI,QAAQ,KAAK,WAAW,WAAW;AACrC,WAAK,SAAS,WAAW,KAAK,MAAM,KAAK;AACzC,WAAK,SAAS,KAAK,UAAU,KAAK;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,OAAO,YAAY;AACnC,MAAI,QAAS,KAAI,KAAK,UAAU,QAAQ,SAAS,WAAW,CAAC;AAC7D,aAAW,cAAc,OAAO,eAAe,CAAC,GAAG;AACjD,QAAI,KAAK;AAAA,MACP,IAAI,cAAc,WAAW,MAAM;AAAA,MACnC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,WAAW;AAAA,MACX,OAAO;AAAA,MACP,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,OAAO,YAAY;AACjC,MAAI;AACF,QAAI,KAAK;AAAA,MACP,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,WAAW,MAAM;AAAA,IACnB,CAAC;AACL;AAEO,SAAS,WACd,MACA,aAAkD,CAAC,GACxC;AACX,QAAM,MAAiB,CAAC;AACxB,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,oBAAI,IAAsB;AACxC,QAAM,QAAQ,EAAE,WAAW,cAAc,KAAK,OAAO,GAAG,SAAS,QAAQ,KAAK,OAAO,EAAE;AACvF,MAAI;AACJ,aAAW,SAAS,KAAK,SAAS;AAChC,UAAM,UAAU,UAAU,SAAS,mBAAmB,UAAU;AAChE,iBAAa,OAAO,KAAK,OAAO,WAAW,OAAO,MAAM,EAAE,CAAC,KAAK,SAAS,KAAK;AAC9E,eAAW;AAAA,EACb;AACA,OAAK,MAAM,KAAK,KAAK;AACrB,SAAO;AACT;AAEO,SAAS,OAAO,MAA6C;AAClE,SAAO,QAAS,MAAM,KAAK,SAAS,GAAwB,GAAG;AACjE;AAEO,SAAS,OAAO,MAAmD;AACxE,QAAM,QAAU,MAAM,KAAK,UAAU,GAAsC,SAAS,CAAC;AAKrF,SAAO,MACJ,OAAO,CAAC,SAAS,KAAK,SAAS,WAAW,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,CAAC,EAC1E,IAAI,CAAC,UAAU;AAAA,IACd,IAAI,IAAI,KAAK,EAAE;AAAA,IACf,MAAM;AAAA,IACN,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,MAAM,KAAK,SAAS,UAAU,UAAU;AAAA,EAC1C,EAAE;AACN;",
   "names": ["part"]
 }

package/dist/types/browser/guard.d.ts

@@ -1,9 +1,9 @@
 import { type Extension, type ToolRegistration } from '@earendil-works/pi-durable';
+import { FACADE_PORT, ownKernelServer } from '../kernel/loopback.ts';
 import { type ProtectedMatcher } from './origins.ts';
 export declare const BROWSER_GUARD = "slicc-browser-guard";
 export declare const REFUSAL = "SLICC's own pages can't be opened or driven from the browser tools.";
-export declare const FACADE_PORT = 9222;
-export declare function ownKernelServer(host: string): boolean;
+export { FACADE_PORT, ownKernelServer };
 export declare function foreignKernel(url: string): boolean;
 export declare function forbidden(url: string, matcher: ProtectedMatcher): boolean;
 export declare function candidates(raw: string): string[];

package/dist/types/index.d.ts

@@ -9,7 +9,7 @@ export { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from '
 export { adminOver, type KernelAdmin, type KernelUser, type KernelUsers, serveAdmin, type UserClient, type UserClients, type UserConnect, type UserSpec, userClients, } from './kernel/users.ts';
 export { PortListener } from './listener.ts';
 export { type AgentWorkerOptions, type AgentWorkerScope, type KernelAttach, runAgentWorker, } from './main.ts';
-export { type Transport, type TransportResponse, transportFetch } from './net.ts';
+export { type Loopback, type Transport, type TransportResponse, transportFetch, } from './net.ts';
 export { AGENT_LOCK, type AgentOwner, type AgentWorker, type KernelSource, type OwnerOptions, startAgent, } from './owner.ts';
 export { applyPatches, patchServerAccept } from './patches.ts';
 export { SliccPrompt, sliccPrompt } from './prompt.ts';

package/dist/types/kernel/client.d.ts

@@ -51,4 +51,8 @@ export interface KernelClient {
         pid: number;
         ppid?: number;
     }[]>;
+    loopbackFetch?(request: Request, options: {
+        port: number;
+        signal?: AbortSignal;
+    }): Promise<Response>;
 }

package/dist/types/kernel/loopback.d.ts

@@ -0,0 +1,4 @@
+export declare const FACADE_PORT = 9222;
+export declare const KERNEL = "kernel.localhost";
+export declare function ownKernelServer(host: string): boolean;
+export declare function kernelHost(host: string): boolean;

package/dist/types/net.d.ts

@@ -17,4 +17,9 @@ export interface Transport {
         signal?: AbortSignal;
     }): Promise<TransportResponse>;
 }
-export declare function transportFetch(transport: Transport, origin: string, native?: typeof fetch): typeof fetch;
+export type Loopback = (request: Request, options: {
+    port: number;
+    signal?: AbortSignal;
+}) => Promise<Response>;
+export declare function kernelPort(url: string): number | undefined;
+export declare function transportFetch(transport: Transport, origin: string, native?: typeof fetch, loopback?: Loopback): typeof fetch;

package/dist/types/secrets/extension.d.ts

@@ -3,14 +3,14 @@ import { type AgentChange, type Extension, type Harness, type Storage, type Tool
 import type { Names, SecretName } from './names.ts';
 import type { Scrub } from './scrub.ts';
 import type { Vault } from './vault.ts';
+import { listedLine, SECRETS_KIND } from './view.ts';
+export { listedLine, SECRETS_KIND };
 export declare const SECRETS = "slicc-secrets";
-export declare const SECRETS_KIND = "slicc.secrets";
 export declare const SECRETS_COMMAND = "/secrets";
 export declare const SHELL_GRANTS: readonly ['fnox', 'exec', '--shell-grants', '--'];
 export declare const MODEL_LINE = "Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.";
 export declare function scrubResult(result: ToolExecutionResult, scrub: Pick<Scrub, 'texts'>): Promise<ToolExecutionResult | undefined>;
 export declare function renderSecrets(names: readonly SecretName[]): string | undefined;
-export declare function listedLine(names: readonly SecretName[]): string;
 export declare function secretsEntry(names: readonly SecretName[]): {
     kind: string;
     data: {

package/dist/types/secrets/view.d.ts

@@ -0,0 +1,9 @@
+import type { SecretName } from './names.ts';
+import type { VaultState } from './vault.ts';
+export declare const SECRETS_KIND = "slicc.secrets";
+export interface VaultHold {
+    reason: 'waiting' | 'locked';
+    held: number;
+}
+export declare function vaultHold(state: VaultState | undefined): VaultHold | null;
+export declare function listedLine(names: readonly SecretName[]): string;

package/dist/types/spectrum/agent-port.d.ts

@@ -1,13 +1,19 @@
 import type { Agent, AgentEvents, AgentPort, FrozenCone, Message, Outgoing, SlashCommand, Thinking, UserMessage } from '@ai-ecoverse/slicc-spectrum/ui';
 import type { AgentConnection } from '../client.ts';
+import { type VaultHold } from '../secrets/view.ts';
 import type { Command } from '../services.ts';
 import { Emitter } from './emitter.ts';
 export declare const CONE = "cone";
 export declare function slashCommand({ kind, ...command }: Command): SlashCommand;
-export declare class AgentAdapter extends Emitter<AgentEvents> implements AgentPort {
+export type AgentHold = VaultHold;
+export type AgentAdapterEvents = AgentEvents & {
+    hold: AgentHold | null;
+};
+export declare class AgentAdapter extends Emitter<AgentAdapterEvents> implements AgentPort {
     #private;
     constructor(connection: AgentConnection);
     ready(): Promise<void>;
+    hold(): AgentHold | null;
     list(): readonly Agent[];
     active(): string;
     select(id: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "3.44.0",
+  "version": "3.45.1",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",
@@ -63,7 +63,7 @@
   "devDependencies": {
     "@ai-ecoverse/slicc-kernel": "1.47.1",
     "@ai-ecoverse/slicc-shared-web": "1.13.1",
-    "@ai-ecoverse/slicc-spectrum": "1.61.0",
+    "@ai-ecoverse/slicc-spectrum": "1.62.0",
     "@ai-ecoverse/wasm-bash": "5.3.0-17",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-5",
     "@ai-ecoverse/wasm-git": "2.55.0-15",