@ai-ecoverse/slicc-agent 3.52.0 → 4.0.0

package/README.md

@@ -112,7 +112,7 @@ With users, each cone and each scoop is a kernel user, and works as that user:
 
 `@ai-ecoverse/slicc-agent/agent-worker` is a complete agent worker. It waits for the page kernel's port, then:
 - attaches to the kernel and routes every cross-origin `fetch` through the kernel's transport, whose router picks a linked `slicc` exit, the extension or the page's own fetch, and every `<port>.kernel.localhost` request to the kernel's loopback (`loopbackFetch`). Same-origin and credentialed (`credentials: 'include'`) requests, and all of them when the kernel has no transport (`traits.unavailable`), use the worker's own fetch, since only it carries the browser's cookies. The system prompt names the route from the traits at attach: `traits.exit` (`{ kind: 'local' | 'remote' | 'tailnet', caps }`, from slicc-bios while it has a default exit) says a linked slicc exit, one on another device or the tailnet's exit node, and any other kind a linked exit, and without it `crossOrigin: 'cors'` says the page's own fetch;
-- opens the encrypted credential store, the AWS Bedrock provider and the session in OPFS SQLite;
+- opens the vault-backed credentials (see Credentials), the AWS Bedrock provider and the session in OPFS SQLite;
 - installs durable's coding tools and SLICC's system prompt, and serves the agent.
 
 The system prompt has a `system` section generated at startup from the running worker (`sliccPrompt(facts)`, `systemSection`). It covers:
@@ -131,17 +131,17 @@ const owner = await startAgent({
 });
 ```
 
-`runAgentWorker(self, options)` is the same with its parts replaceable (model, providers, kernel attach, credentials, storage).
+`runAgentWorker(self, options)` is the same with its parts replaceable (model, providers, kernel attach, the account store, storage).
 
-**Providers.** The first provider is AWS Bedrock with a Bedrock API key as the bearer token; the default model is `us.anthropic.claude-sonnet-5-5`. Requests go to `us-west-2` unless the stored credential names another region (`AWS_REGION`, set by `connect`'s `region`). The default applies when the credential is read, so keys stored earlier get it too. The settings UI has no region field yet. Bedrock sends no CORS headers, so it needs a CORS-free transport, and its account says so (`needs: 'cors-free-transport'`).
+**Providers.** The first provider is AWS Bedrock with a Bedrock API key as the bearer token; the default model is `us.anthropic.claude-sonnet-5-5`. Requests go to `us-west-2` unless the account's `region` field names another one (`AWS_REGION`). The account publishes that field as `fields: [{ name: 'region', label: 'Region' }]`, and `connect` takes it. Bedrock sends no CORS headers, so it needs a CORS-free transport, and its account says so (`needs: 'cors-free-transport'`).
 
-**Adobe.** `adobeProvider()` reaches Adobe's LLM proxy (`ADOBE_PROXY`) with the user's IMS token as a bearer. Its models come from the proxy's `/v1/config` once a token is stored: Anthropic-style models go through pi-ai's `anthropic-messages` API at the proxy root, `api: 'openai'` models through `openai-completions` under `/v1`, and hidden ones are skipped. Every request to the proxy (turns on either API, Clef, `/v1/config` and `/v1/usage`) carries an `X-Session-Id` that is fixed for the worker and an `X-Slicc-Version` (slicc-agent's version, `adobeProvider({ session, version })`); the proxy refuses turns without them. They're added where the request is built, over the caller's and the model's headers, because pi-ai 1.0.4 keeps a provider's `headers` but never sends them. The account is a sign-in (`auth: 'oauth'`): `AgentSettings.signIn('adobe')` returns the IMS `clientId`, `scopes` and `imsEnvironment` from `/v1/config`, fetched in the worker through the transport. The page runs the IMS popup and passes the token to `connect`, so `createAgentModel(connection, { login })` takes a `login(providerId, signIn, { signal })` that returns a token. While it runs, the account shows as `signing-in` (spectrum ≥ 1.34.0), and `SettingsPort.cancel(id)` aborts the signal; a cancelled sign-in never connects, even if the login resolves late. The adapter calls `login` before anything else in the click's task, so the page can open its popup while it still has the user's gesture, and `signIn()` then fetches the IMS options lazily. The weekly budget from `/v1/usage` is in the settings state as `budget` (refreshed on connect and every five minutes), and the `tray` adapter shows it in spectrum's TrayStatus. Until the proxy allows `*.sliccy.ai` (vibemigration#228), Adobe needs a CORS-free transport like Bedrock. An expired session's error card (a 401, or a refusal whose type or message says the token is invalid or expired) offers **Log in**; any other refusal, such as a 403 `missing_required_header`, shows the proxy's message, with the HTTP status and error type below it (`403 missing_required_header`) and **Retry**.
+**Adobe.** `adobeProvider()` reaches Adobe's LLM proxy (`ADOBE_PROXY`) with the user's IMS token as a bearer. Its models come from the proxy's `/v1/config` once a token is stored: Anthropic-style models go through pi-ai's `anthropic-messages` API at the proxy root, `api: 'openai'` models through `openai-completions` under `/v1`, and hidden ones are skipped. Every request to the proxy (turns on either API, Clef, `/v1/config` and `/v1/usage`) carries an `X-Session-Id` that is fixed for the worker and an `X-Slicc-Version` (slicc-agent's version, `adobeProvider({ session, version })`); the proxy refuses turns without them. They're added where the request is built, over the caller's and the model's headers, because pi-ai 1.0.4 keeps a provider's `headers` but never sends them. The account is a sign-in (`auth: 'oauth'`): `AgentSettings.signIn('adobe')` returns the IMS `clientId`, `scopes` and `imsEnvironment` from `/v1/config`, fetched in the worker through the transport. The page runs the IMS popup and seals the token in the vault itself (bios: `seal { kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }`), so `createAgentModel(connection, { login })` takes a `login(providerId, signIn, { signal })` that resolves `{ sealed: true }`; the adapter then calls `connect('adobe')` with no secret. A `login` that still returns a token is refused with "Adobe sign-in needs seven's vault: update seven", and the token never reaches the worker. IMS gives no refresh token, so an expired record shows the account as `expired`, and Sign in (or Reconnect) runs `login` again. While it runs, the account shows as `signing-in` (spectrum ≥ 1.34.0), and `SettingsPort.cancel(id)` aborts the signal; a cancelled sign-in never connects, even if the login resolves late. The adapter calls `login` before anything else in the click's task, so the page can open its popup while it still has the user's gesture, and `signIn()` then fetches the IMS options lazily. The weekly budget from `/v1/usage` is in the settings state as `budget` (refreshed on connect and every five minutes), and the `tray` adapter shows it in spectrum's TrayStatus. Until the proxy allows `*.sliccy.ai` (vibemigration#228), Adobe needs a CORS-free transport like Bedrock. An expired session's error card (a 401, or a refusal whose type or message says the token is invalid or expired) offers **Log in**; any other refusal, such as a 403 `missing_required_header`, shows the proxy's message, with the HTTP status and error type below it (`403 missing_required_header`) and **Retry**.
 
 **Classifiers.** The Adobe provider also registers Cloudflare's Clef classifiers as `adobe/clef` and `adobe/clef-flash` (`adobeClassifiers()`): `type: 'classifier'` models on pi-ai's `cloudflare-workers-ai-system-one` API with `baseUrl: <proxy>/v1/ai`, so `models.classify(model, { state, questions })` posts `{ model: '@cf/cloudflare/clef', input }` to the proxy's `/v1/ai/run` with the IMS token as the bearer. The provider maps its short ids to the Workers AI names, and pi parses the answers and prices the usage ($0.24 per million input tokens for Clef, $0.09 for Clef Flash, nothing for output), which counts against the same weekly budget. They are classifiers only: `models.getModels()`, the settings `models` and the picker list chat models, and `models.getAvailableOfType('classifier', 'adobe')` returns them only while an Adobe token is stored.
 
-**Model credentials.** They live in the IndexedDB database `slicc-agent-credentials`, sealed with AES-GCM under a non-extractable key that never leaves WebCrypto. They never enter the session database or the transcript, and followers never see them.
+**Model credentials.** They live in the vault, never in the worker (see Credentials).
 
-**Settings.** The `slicc.agent.settings` service shows the models and accounts and takes `connect(providerId, apiKey)` and `disconnect(providerId)`.
+**Settings.** The `slicc.agent.settings` service shows the models and accounts and takes `connect(providerId, secret, fields)` and `disconnect(providerId)`. An account's `id` is its lookup key: the pi-ai provider id for model accounts (the vault record's `provider`), and `mcp:<server>` for MCP servers (the record's `server` is the `mcp.json` key); `provider` is only the display name. Accounts whose key the agent reads from the vault carry `store: 'vault'`: spectrum (SPEC-S4) `put`s the key into the vault itself, then calls `connect(id)` with no secret, and the agent rereads `records()`. `fields` holds an account's non-secret settings (`Account.fields`, unknown names ignored), kept in `/.slicc/accounts.json`. `disconnect` clears them; removing the key is spectrum's `vault.remove(name, kind)`, since the agent port can't remove records. `connect` with a secret is refused for every model account ("API keys are kept in seven's vault: update seven"); the only secret it still takes is an MCP sign-in's callback answer.
 
 ### In slicc-spectrum
 
@@ -158,7 +158,7 @@ app.model = { ...createKernelModel({ kernel, root }), ...createAgentModel(agent,
 
 The adapter keeps the replicated transcript and maps it on every update. User, assistant and compaction entries become messages; tool results fill in the tool calls they answer; the generation in flight shows as a streaming message; retries and running compactions show as system messages. A failed generation ends in an error card whose action fits the error: credential errors (an invalid or missing key, 401/403, not authorized) open settings, a model the account can't use offers the model picker, and anything else offers Retry. A content-filter stop is different: every later request resends the content that tripped the filter, so Retry, and any new message, would be stopped again. Content-filter stops are Bedrock's `content_filtered` and `guardrail_intervened`, Anthropic's `sensitive` and refusals, and OpenAI's `content_filter`. Their card leads with "The model's content filter stopped this reply." and offers **Drop the last turn** (spectrum ≥ 1.12.0). `AgentControl.rewind(messageId)` finds the user turn before that message and forks the cone's conversation at the entry before it (`Conversation.fork`, so `pi.agent` comes back as it was there). It points the cone at the fork and returns the turn's prompt, which spectrum puts back into the composer. Forking the very first turn creates a fresh conversation with the same model and thinking level. The filtered branch stays in storage, off the active path. The fork starts with a `slicc.rewound` entry that shows as a "Rewound 1 turn" notice, and clicking the card of an earlier filtered turn rewinds that turn.
 
-Each cone's active conversation is in the session document `slicc.agents` (the root until the first rewind). The host's transcript follows it across forks. Rewinding is refused while the cone itself is running or has queued input, because a fork starts with an empty inbox, but never because its scoops are busy (see Cones and scoops). A background compaction still running on the old branch finishes there. A fork also starts with fresh `pi.usage`. Credential and model errors lead with a plain sentence ("Bedrock rejected the API key.", "This model isn't available with the current account.") and keep the provider's raw error as `detail`, which spectrum (≥ 1.11.0) shows underneath. `busy()` and `queue()` read durable's live and inbox documents. Steering is the default (#4): a send or a steer goes out with `whenBusy: 'steer'`, so while a run is going it joins after the current tool round, and a `queue` send is a follow-up. User messages carry `delivered` from the host's deliveries; entries the host didn't record (from before a reload) count as steered when they follow a tool result. Cones and scoops are below; the freezer and questions come later. Licks show as spectrum's lick cards (below). slicc-spectrum is an optional peer dependency (≥ 1.39.0, whose Freezer shows every conversation with its kind and Open, Thaw and Remove; 1.40.0 also shows each cone's `title`, the Freezer row's title, so same-named cones are told apart), used for types only, so package managers don't install it next to the agent.
+Each cone's active conversation is in the session document `slicc.agents` (the root until the first rewind). The host's transcript follows it across forks. Rewinding is refused while the cone itself is running or has queued input, because a fork starts with an empty inbox, but never because its scoops are busy (see Cones and scoops). A background compaction still running on the old branch finishes there. A fork also starts with fresh `pi.usage`. Credential and model errors lead with a plain sentence ("Bedrock rejected the API key.", "This model isn't available with the current account.") and keep the provider's raw error as `detail`, which spectrum (≥ 1.11.0) shows underneath. `busy()` and `queue()` read durable's live and inbox documents. Steering is the default (#4): a send or a steer goes out with `whenBusy: 'steer'`, so while a run is going it joins after the current tool round, and a `queue` send is a follow-up. User messages carry `delivered` from the host's deliveries; entries the host didn't record (from before a reload) count as steered when they follow a tool result. Cones and scoops are below; the freezer and questions come later. Licks show as spectrum's lick cards (below). slicc-spectrum is an optional peer dependency (≥ 1.59.0, the lowest whose monitor, tray and panel types match the agent's; `npm run typecheck` fails on anything older), used for types only, so package managers don't install it next to the agent.
 
 Each agent in `list()` has a real `contextFill` and `unread`:
 - **`contextFill`** is the context the agent uses, as a share of its model's `contextWindow` from the settings' model list. The tokens are those of the newest assistant's usage after the active head, counted the way pi-ai's `calculateContextTokens` does (`totalTokens`, or input, output and both cache counts). Aborted and failed turns don't count. After a compaction, the kept turns' usage no longer counts. Until the next turn reports its usage, the fill is estimated the way pi does it, at four characters a token, over the summary and the kept entries (without the system prompt and tools). An unknown model also reads 0. The Monitor's "Fullest context" and its context alerts use the same functions (`src/context.ts`).
@@ -341,7 +341,7 @@ MCP servers reachable over Streamable HTTP become native agent tools. The client
 
 **Per agent.** Today every cone reads the one file in `/home` and gets every enabled server. A scoop doesn't read a file of its own: it inherits its cone's servers, and a role's `tools:` or `agent --tools` list narrows them. A list with no `mcp__` entry gets no MCP servers. A list with `mcp__docs__search` or `mcp__docs__*` keeps only those, and `codemode` is added so codemode tools stay reachable. The resource tools must be listed by name, and they reach only the servers the list names. A nested scoop without a list inherits its calling scoop's list. A `beforeTool` hook blocks the model's calls outside the list, and codemode scripts only get the tools on it. When kernel users give each cone its own home, each cone reads `~/.pi/agent/mcp.json` in that home, and scoops keep inheriting from their cone.
 
-**Secrets.** `${NAME}` placeholders are filled from the agent's encrypted credential store, under `mcp:<server>|<hash of the URL>`, when the worker connects. A server whose secret is missing comes up as needing one, with a lick. Pointing a server at another URL leaves it without its secret. Header values never reach SQLite, the transcript, licks or `~/.pi/agent/mcp.log`, and stored secrets are scrubbed from error texts and server log lines. **OAuth.** A server without an `Authorization` header that answers 401 needs a sign-in, as in pi. Its row in Settings › MCP servers offers Connect, which opens a pop-up on the authorization server, found through the server's protected-resource metadata (RFC 9728) or `oauth.authServerMetadataUrl`. SLICC registers itself dynamically as a public client named `SLICC` (`oauth.clientName` changes it), or uses `oauth.clientId`, with PKCE S256 and the redirect URI `https://<origin>/oauth/mcp-callback`. slicc-bios serves that path from `dist/oauth/mcp-callback.html` in this package. The callback page hands the code back over the `slicc-mcp-oauth` BroadcastChannel and clears it from its address. The worker exchanges the code, checking `state` and `iss`, and keeps the tokens with the client and discovery state in the encrypted store under the server's name and URL. Tokens are refreshed when the server answers 401. When the refresh fails, the row asks for a sign-in again. Disconnect deletes the whole grant. `oauth.scope` sets the scopes, else the server's advertised ones are used. `clientSecret`, `callbackPort`, `callbackUrl` and `clientRegistration` are refused, because SLICC signs in as a public client through its own page.
+**Secrets.** `${NAME}` placeholders resolve to the vault's placeholders for that server (`records()`: an `mcp` record with `server` equal to the `mcp.json` key and that name, else the server's only record when the headers use one name, else an unbound record of that name, which covers mcpcat's `${MCP_<NAME>_TOKEN}` bridge tokens). The headers go out holding placeholders, and the vault fills them in its `mcp` op, only for that server's registered URL. A server whose record is missing comes up as needing one, with a lick, and reconnects when the record appears. The worker never holds a value; server log lines are scrubbed through the vault before they reach `~/.pi/agent/mcp.log`. **OAuth.** A server without an `Authorization` header that answers 401 needs a sign-in, as in pi. Its row in Settings › MCP servers offers Connect, which opens a pop-up on the authorization server, found through the server's protected-resource metadata (RFC 9728) or `oauth.authServerMetadataUrl`. SLICC registers itself dynamically as a public client named `SLICC` (`oauth.clientName` changes it), or uses `oauth.clientId`, with PKCE S256 and the redirect URI `https://<origin>/oauth/mcp-callback`. slicc-bios serves that path from `dist/oauth/mcp-callback.html` in this package. The callback page hands the code back over the `slicc-mcp-oauth` BroadcastChannel and clears it from its address. Before the pop-up opens, the worker registers the server's `tokenUrl` (the discovered `token_endpoint`, else `<authServer>/token`) with the vault. It exchanges the code, checking `state` and `iss`, as a prepared `mcp` request to that `tokenUrl`, and hands the token response straight to the vault's `grant`; the raw response is dropped, and pi-mcp keeps only the reply, which holds placeholders, with the client and discovery state in `/.slicc/accounts.json` under the server's name and URL. When the server answers 401, the worker asks the vault to `refresh` once and sends again; pi-mcp's own refresh is off, because the refresh token is a placeholder. When that fails, the row shows the sign-in as expired. Disconnect deletes the local state; spectrum removes the vault records. Without a vault, the exchange is refused ("MCP sign-in needs seven's vault: update seven") before any token is issued. `oauth.scope` sets the scopes, else the server's advertised ones are used. `clientSecret`, `callbackPort`, `callbackUrl` and `clientRegistration` are refused, because SLICC signs in as a public client through its own page.
 
 **Settings › MCP servers** lists each server whose headers use a placeholder, under its own heading below Accounts, with the URL host. Connect takes the token, which fills every placeholder of a server that uses one name; a server whose headers use several different names can't be filled from Settings yet. The server then reconnects. A server that answers 401 shows as **Rejected**, with Reconnect, and Disconnect deletes the token. Tool cards and remote summaries label MCP calls `server · tool`, unless the name is ambiguous (a server name that starts or ends with `_`, or a name with more than two `__` separators); then they show the raw name.
 
@@ -514,7 +514,7 @@ The process table is the worker's root client's `ps()`. Each process is named af
 - `paused`.
 
 **What the feed never holds:** environment variables, tool arguments, task inputs and credentials.
-- **Command lines** lose the `export …;` prefix the kernel environment adds to agent commands, are joined, scrubbed of the MCP servers' stored secrets, run through the memory redaction (which also catches `NAME=value` for secret-like names, and `--token x`), and cut to 160 characters. Error texts get the same treatment.
+- **Command lines** lose the `export …;` prefix the kernel environment adds to agent commands, are joined, run through the memory redaction (which also catches `NAME=value` for secret-like names, and `--token x`), and cut to 160 characters. Error texts get the same treatment.
 - **View-only connections** get their own state from the worker, in which each command is only its program name, so the arguments never cross the link.
 - **Users mode:** the human's panel is root's, so it sees every process. A cone's bound client would see only its own, by the kernel's hidepid.
 
@@ -588,7 +588,7 @@ It prints the tab's stdout and stderr on their own streams and exits with its co
 
 **The bridge** is the `slicc.agent.pages` service, a sibling of `slicc.agent.remote` with the same long-poll stream: `open(tab)`, `report(stream, tab)`, `next(stream, waitMs)`, `answer(stream, id, result)` and `close(stream)`. A tab reports `{ tab, kinds: ['panel'], cone, visible, focused, lastActive }`. Each request goes to exactly one tab and is never retried elsewhere: the `--tab` tab, the `SLICC_TAB` tab if it's open, otherwise the tab on the caller's cone that is visible and focused, then visible, then the latest active. A tab is dropped when it closes its stream, when its attachment goes, or after 30 s without a poll, and each attachment reaches only its own streams.
 
-**The page side.** `createAgentModel(connection, { page: { tab, run } })` starts a `PageAdapter`. It reports the tab's selected cone (`AgentAdapter.active()`, or a scoop's cone), `document.visibilityState`, `document.hasFocus()` and the time of the last pointer or key event, debounced by 250 ms. It answers each request with `run(argv, caller)`, which bios points at spectrum's `panelCommand` (≥ 1.59.0). `PageRun` uses the agent's own types, so the peer range stays `^1.39.0`, and `test/integration/panel-run.ts` type-checks `(argv, caller) => panelCommand(app, argv, caller)` against it. The integration test runs the real `panelCommand` on a `<slicc-app>` with the dummy model under the agent's ports. Without `run` the tab never registers, so the bridge works with older spectrums too.
+**The page side.** `createAgentModel(connection, { page: { tab, run } })` starts a `PageAdapter`. It reports the tab's selected cone (`AgentAdapter.active()`, or a scoop's cone), `document.visibilityState`, `document.hasFocus()` and the time of the last pointer or key event, debounced by 250 ms. It answers each request with `run(argv, caller)`, which bios points at spectrum's `panelCommand` (≥ 1.59.0). `PageRun` uses the agent's own types, and `test/integration/panel-run.ts` type-checks `(argv, caller) => panelCommand(app, argv, caller)` against it. The integration test runs the real `panelCommand` on a `<slicc-app>` with the dummy model under the agent's ports. Without `run` the tab never registers, so the bridge works with older spectrums too.
 
 **Followers never execute.** Read-only attachments (`owner.port({ readOnly: true })`) and attachments made with `owner.port({ pages: false })`, which bios uses for link followers, get a `slicc.agent.pages` whose `open` answers `{ error }`, so they are never chosen.
 
@@ -606,14 +606,18 @@ It prints the tab's stdout and stderr on their own streams and exits with its co
 
 ### Credentials
 
-The agent never holds a secret's value. Values live in the vault (`vault.sliccy.ai`); the agent sees names and placeholders (`fnox_proxy_…`), and every text that could reach the model is scrubbed through the vault first. The design is secrets rev 4 (§3.15–§3.18), and this part is AGENT-S1.
+The agent never holds a secret's value. Values live in the vault (`vault.sliccy.ai`); the agent sees names and placeholders (`fnox_proxy_…`), and every text that could reach the model is scrubbed through the vault first. The design is secrets rev 4 (§3.12, §3.15–§3.18); scrubbing is AGENT-S1 and the model and MCP transport VAULT-2 (slicc-agent 4.0.0). Without a vault port there are no model credentials.
 
-- **The port.** bios posts `{ kernel, admin, vault, scrub }` to the worker, where `vault` is a `MessagePort` to the vault frame (role `agent`) and `scrub` the last-known `{ needed, version }`, or `null` when no vault ever connected. On a vault reload it posts `{ vault, scrub }` again, and the worker resends its unanswered ops. Without a port, or with `needed: false`, nothing is sent and every scrub is the identity. A `version` newer than the last pair read counts as `needed` until the new pair arrives.
-- **The wire.** Requests are `{ id, op, ... }` and answers `{ id, ok }` or `{ id, error }`, in request order: `redact { texts }` (strings and `Uint8Array`s, answered in the same order and types, with `version`), and the stream ops `redactStream`, `push { chunk }`, `end` and `drop`, each with the worker's `stream` id. The vault may push `{ scrub }` and `{ locked }` at any time.
+- **The port.** bios posts `{ kernel, admin, vault, scrub }` to the worker, where `vault` is a `MessagePort` to the vault frame (role `agent`) and `scrub` the last-known `{ needed, version }`, or `null` when no vault ever connected. On a vault reload it posts `{ vault, scrub }` again, and the worker resends its unanswered ops. The agent port gets no events, so bios also posts `{ locked }` (a boolean, from the page port's `status`) whenever the lock changes; the worker reads the initial state from the vault's `welcome`. Without a port, or with `needed: false`, nothing is sent and every scrub is the identity. A `version` newer than the last pair read counts as `needed` until the new pair arrives.
+- **The wire** is slicc-vault's `AgentOp`/`AgentReply` (`@ai-ecoverse/slicc-vault`, types only). Requests are `{ v: 1, id, op, ... }` and answers `{ v: 1, id, op, ... }` or `{ v: 1, id, error: { code, message } }`, in request order: `redact { texts }` (strings and `Uint8Array`s, answered in the same order and types, with `version`), the stream ops `redactStream`, `push { chunk }`, `end` and `drop` with the worker's string `stream` id, and `model`, `mcp`, `records`, `grant`, `refresh` and `endpoints`. The vault's first message, `welcome`, carries `status.scrub` and `status.locked`; version bumps come only from bios's `{ scrub }` posts and the `version` in answers.
+- **Credentials by placeholder.** `records()` lists the `model` and `mcp` records (names, placeholders, states, never values). It is read at start, whenever `version` changes, and after `connect` and `disconnect`. The read-only `CredentialStore` behind pi-ai returns a model record's placeholder as the API key (found by `kind: 'model'` and `provider`), with the account's non-secret fields as its env (Bedrock's `region` as `AWS_REGION`); writing to it throws.
+- **The transport.** The worker's `fetch` is `vaultFetch`: a request to a configured provider's base URL (Bedrock's standard `bedrock-runtime.*.amazonaws.com` and `-fips` endpoints included, so the AWS SDK's bearer requests are covered), or one carrying a model placeholder in its URL or headers, goes out as `model { provider?, request }`; MCP requests go out as `mcp { server, request }`, discovery and client registration included. The vault returns the request scrubbed over every value and with the credential filled in its headers or URL, and the existing transport sends it (`loopbackFetch` for a server on `http://<port>.kernel.localhost`); the response comes back directly. `EAGAIN` prepares the request once more; a refusal becomes a response (403 for `EACCES`, with the vault's sentence); a 401 calls `refresh { provider | server }` once and sends again. Anything else passes through, and without a vault every request does. Transport errors name only the method and origin, never a prepared URL or header.
+- **Endpoints.** `endpoints { model: [{ provider, url }], mcp: [{ server, url, names?, tokenUrl? }] }` is sent when the port opens and whenever the providers, the accounts or `mcp.json` change: every https base URL of every provider, and every server URL with the `${NAME}`s its headers use. Registrations only add.
 - **`slicc-secrets`**, a built-in extension modelled on [pi-fnox](https://github.com/Bucurenciu-Cristian/pi-fnox) (MIT, © 2026 Kicky), with its hooks mapped to pi-durable: `secret list --json` in the home env at start and whenever `version` changes (pi-fnox's `fnox export`; nothing goes into the worker's environment); an `afterTool` hook scrubbing every result's text, diagnostics and string `details` (pi-fnox's `tool_result`); a `secrets` system section with the names, placeholders, where each works and how to use them (`before_agent_start`); and `/secrets`, answered locally as a `slicc.secrets` entry (`/fnox-list`; reloading is automatic). When at least one secret is `shell = true`, every conversation command runs as `fnox exec --shell-grants -- <argv>` (pi-fnox's `spawnHook`). slicc-agent doesn't depend on `@kickythrust/pi-fnox`. Every conversation keeps the extension: new ones are pinned at creation, and conversations stored with an extension list that lacks it get it back at start.
 - **Where text is scrubbed before anything keeps or cuts it:** command output, per stream, before the bash tool's tail window, the spill file and the live slot; `read`'s bytes (images aren't, and files over 8 MiB stream in 1 MiB chunks); MCP results before their middle cut and progress text; codemode output before its cut; user and remote sends after skill expansion; every lick (sprinkle sends and scoop results included) before triage and the outbox; and memory writes, before the pattern redaction. Remote-control summaries are built from stored entries only.
 - **The hold.** A vault that doesn't answer within 2 s reads as `waiting`. Nothing unscrubbed is appended: tool results, sends and licks wait in memory, model requests wait before they start, and command output held past 32 MiB kills the command with "output held: waiting for the vault". The state is the transcript's `vault` field (`{ port, needed, version, locked, held }`), and remote `watch` streams get a `notice` "waiting for the vault" and one when it answers again.
 - **In spectrum.** The agent port's `hold()` is `{ reason: 'locked', held }` while the vault needs a passkey, `{ reason: 'waiting', held }` while scrubbing is needed and the port isn't `ready`, and `null` otherwise, with a `hold` event on each change (and `null` when it clears); spectrum (≥ 1.62.0) shows it above the composer, and older spectrum ignores it. While a hold is up, the worker's active cone is busy (`working` when it isn't running), so the composer steers and queues; a send made during the hold waits in the tab, shown in that cone's queue, and goes to the worker once the hold clears; removing it before then means it's never sent. `/secrets` entries (`slicc.secrets`) show as a "Secrets listed" notice.
+- **Tests.** The worker never compiles values: `src/` takes only `import type { Hit }` from [`@ai-ecoverse/slicc-scrub`](https://www.npmjs.com/package/@ai-ecoverse/slicc-scrub), the vault's scrubber, and the package is a devDependency. The fake vault the tests use scrubs with that package, and its `vectors.json` (every form, line-wrapped base64 and hex included) runs through each scrub point and each cut. A suite-wide check asserts that no captured model request, entry, slot or memory file holds any form of a seeded value.
 
 ## The kernel
 

package/dist/client.js

@@ -40,7 +40,7 @@ function lasting(state) {
 function lastingSettings(settings, hold) {
   return {
     state: hold(settings.state),
-    connect: (providerId, secret, region, context) => settings.connect(providerId, secret, region, context),
+    connect: (providerId, secret, fields, context) => settings.connect(providerId, secret, fields, context),
     disconnect: (providerId, context) => settings.disconnect(providerId, context),
     signIn: (providerId, context) => settings.signIn(providerId, context)
   };

package/dist/client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/client.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceBinding,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport { Client, createClientServiceTransport } from '@earendil-works/pi-client';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  type Command,\n  type Delivered,\n  type MonitorFeed,\n  type SendMode,\n} from './services.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { PortChannel, type PortEndpoint } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly vault?: ReplicatedState<VaultState>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly pages?: AgentPages;\n  readonly closed: Promise<Error | undefined>;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, region, context) =>\n      settings.connect(providerId, secret, region, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n  };\n}\n\nfunction attached(client: Client): Promise<void> {\n  return new Promise((resolve) => {\n    const stop = client.onAttachmentChange(() => {\n      stop();\n      resolve();\n    });\n  });\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const channel = new PortChannel(endpoint);\n  const serverId = await channel.hello;\n  const client = await Client.connect({ serverId, transportFactory: channel.transport });\n  const server = createRemoteServiceBinding({\n    services: [AgentSessions],\n    transport: createClientServiceTransport(client, () => ({ serverId })),\n    bound: true,\n  });\n  const ready = attached(client);\n  await server.use(AgentSessions).attach(AGENT_SESSION, context);\n  await ready;\n  const session = createRemoteServiceBinding({\n    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService, AgentPagesService],\n    transport: createClientServiceTransport(client, () => client.attachment),\n    bound: true,\n  });\n  const control = session.use(AgentControl);\n  const {\n    state: transcript,\n    deliveries,\n    agents,\n    views,\n    commands,\n    sprinkles,\n    memories,\n    memoryScopes,\n    frozen,\n    changes,\n    monitor,\n    vault,\n  } = session.use(AgentTranscript);\n  const settings = session.use(AgentSettings);\n  const remote = session.use(AgentRemoteService);\n  const pages = session.use(AgentPagesService);\n  await session.ready(context);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  const freeze = () => {\n    for (const kept of held) kept.freeze();\n  };\n  const closed = channel.ended.then((reason) => {\n    freeze();\n    return reason;\n  });\n  return {\n    serverId,\n    control,\n    transcript: hold(transcript),\n    deliveries: hold(deliveries),\n    agents: hold(agents),\n    views: hold(views),\n    commands: hold(commands),\n    sprinkles: hold(sprinkles),\n    memories: hold(memories),\n    memoryScopes: hold(memoryScopes),\n    frozen: hold(frozen),\n    changes: hold(changes),\n    monitor: hold(monitor),\n    vault: hold(vault),\n    settings: lastingSettings(settings, hold),\n    remote,\n    pages,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      freeze();\n      await server.use(AgentSessions).detach(context);\n      await session.dispose(context);\n      await server.dispose(context);\n      await client.dispose();\n    },\n  };\n}\n"],
+  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceBinding,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport { Client, createClientServiceTransport } from '@earendil-works/pi-client';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  type Command,\n  type Delivered,\n  type MonitorFeed,\n  type SendMode,\n} from './services.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { PortChannel, type PortEndpoint } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly vault?: ReplicatedState<VaultState>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly pages?: AgentPages;\n  readonly closed: Promise<Error | undefined>;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, fields, context) =>\n      settings.connect(providerId, secret, fields, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n  };\n}\n\nfunction attached(client: Client): Promise<void> {\n  return new Promise((resolve) => {\n    const stop = client.onAttachmentChange(() => {\n      stop();\n      resolve();\n    });\n  });\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const channel = new PortChannel(endpoint);\n  const serverId = await channel.hello;\n  const client = await Client.connect({ serverId, transportFactory: channel.transport });\n  const server = createRemoteServiceBinding({\n    services: [AgentSessions],\n    transport: createClientServiceTransport(client, () => ({ serverId })),\n    bound: true,\n  });\n  const ready = attached(client);\n  await server.use(AgentSessions).attach(AGENT_SESSION, context);\n  await ready;\n  const session = createRemoteServiceBinding({\n    services: [AgentControl, AgentTranscript, AgentSettings, AgentRemoteService, AgentPagesService],\n    transport: createClientServiceTransport(client, () => client.attachment),\n    bound: true,\n  });\n  const control = session.use(AgentControl);\n  const {\n    state: transcript,\n    deliveries,\n    agents,\n    views,\n    commands,\n    sprinkles,\n    memories,\n    memoryScopes,\n    frozen,\n    changes,\n    monitor,\n    vault,\n  } = session.use(AgentTranscript);\n  const settings = session.use(AgentSettings);\n  const remote = session.use(AgentRemoteService);\n  const pages = session.use(AgentPagesService);\n  await session.ready(context);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  const freeze = () => {\n    for (const kept of held) kept.freeze();\n  };\n  const closed = channel.ended.then((reason) => {\n    freeze();\n    return reason;\n  });\n  return {\n    serverId,\n    control,\n    transcript: hold(transcript),\n    deliveries: hold(deliveries),\n    agents: hold(agents),\n    views: hold(views),\n    commands: hold(commands),\n    sprinkles: hold(sprinkles),\n    memories: hold(memories),\n    memoryScopes: hold(memoryScopes),\n    frozen: hold(frozen),\n    changes: hold(changes),\n    monitor: hold(monitor),\n    vault: hold(vault),\n    settings: lastingSettings(settings, hold),\n    remote,\n    pages,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      freeze();\n      await server.use(AgentSessions).detach(context);\n      await session.dispose(context);\n      await server.dispose(context);\n      await client.dispose();\n    },\n  };\n}\n"],
   "mappings": "AAAA;AAAA,EAEE;AAAA,OAEK;AACP,SAAS,0BAA0B;AACnC,SAAS,QAAQ,oCAAoC;AAQrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAKK;AAEP,SAAS,mBAAsC;AAkCxC,SAAS,QAAW,OAAuC;AAChE,MAAI;AACJ,MAAI,SAAS;AACb,QAAM,OAAO,MAAM;AACjB,QAAI,OAAQ,QAAO;AACnB,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,IAAI,QAAQ;AACV,eAAO,KAAK;AAAA,MACd;AAAA,MACA,WAAW,CAAC,aAAc,SAAS,MAAM,SAAY,MAAM,UAAU,QAAQ;AAAA,IAC/E;AAAA,IACA,SAAS;AACP,WAAK;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,SAAS,gBACP,UACA,MACe;AACf,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,KAAK;AAAA,IAC1B,SAAS,CAAC,YAAY,QAAQ,QAAQ,YACpC,SAAS,QAAQ,YAAY,QAAQ,QAAQ,OAAO;AAAA,IACtD,YAAY,CAAC,YAAY,YAAY,SAAS,WAAW,YAAY,OAAO;AAAA,IAC5E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,EACtE;AACF;AAEA,SAAS,SAAS,QAA+B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,OAAO,OAAO,mBAAmB,MAAM;AAC3C,WAAK;AACL,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,aACpB,UACA,UAAiC,CAAC,GACR;AAC1B,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,IAAI,YAAY,QAAQ;AACxC,QAAM,WAAW,MAAM,QAAQ;AAC/B,QAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,UAAU,kBAAkB,QAAQ,UAAU,CAAC;AACrF,QAAM,SAAS,2BAA2B;AAAA,IACxC,UAAU,CAAC,aAAa;AAAA,IACxB,WAAW,6BAA6B,QAAQ,OAAO,EAAE,SAAS,EAAE;AAAA,IACpE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,QAAQ,SAAS,MAAM;AAC7B,QAAM,OAAO,IAAI,aAAa,EAAE,OAAO,eAAe,OAAO;AAC7D,QAAM;AACN,QAAM,UAAU,2BAA2B;AAAA,IACzC,UAAU,CAAC,cAAc,iBAAiB,eAAe,oBAAoB,iBAAiB;AAAA,IAC9F,WAAW,6BAA6B,QAAQ,MAAM,OAAO,UAAU;AAAA,IACvE,OAAO;AAAA,EACT,CAAC;AACD,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,QAAM;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,QAAQ,IAAI,eAAe;AAC/B,QAAM,WAAW,QAAQ,IAAI,aAAa;AAC1C,QAAM,SAAS,QAAQ,IAAI,kBAAkB;AAC7C,QAAM,QAAQ,QAAQ,IAAI,iBAAiB;AAC3C,QAAM,QAAQ,MAAM,OAAO;AAC3B,QAAM,OAA2B,CAAC;AAClC,QAAM,OAAO,CAAI,UAAkD;AACjE,UAAM,OAAO,QAAQ,KAAK;AAC1B,SAAK,KAAK,IAAwB;AAClC,WAAO,KAAK;AAAA,EACd;AACA,QAAM,SAAS,MAAM;AACnB,eAAW,QAAQ,KAAM,MAAK,OAAO;AAAA,EACvC;AACA,QAAM,SAAS,QAAQ,MAAM,KAAK,CAAC,WAAW;AAC5C,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,KAAK,UAAU;AAAA,IAC3B,YAAY,KAAK,UAAU;AAAA,IAC3B,QAAQ,KAAK,MAAM;AAAA,IACnB,OAAO,KAAK,KAAK;AAAA,IACjB,UAAU,KAAK,QAAQ;AAAA,IACvB,WAAW,KAAK,SAAS;AAAA,IACzB,UAAU,KAAK,QAAQ;AAAA,IACvB,cAAc,KAAK,YAAY;AAAA,IAC/B,QAAQ,KAAK,MAAM;AAAA,IACnB,SAAS,KAAK,OAAO;AAAA,IACrB,SAAS,KAAK,OAAO;AAAA,IACrB,OAAO,KAAK,KAAK;AAAA,IACjB,UAAU,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,UAAU;AACtB,aAAO,QAAQ;AAAA,QACb;AAAA,QACA,EAAE,IAAI,SAAS,MAAM,MAAM,SAAS,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,WAAW,YAAY;AACxC,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,UAAU,WAAW,KAAK,GAAG,OAAO;AAC5E,UAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,OAAO,EAAE;AAC/E,YAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO;AAC7D,UAAI,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,eAAe,QAAQ,MAAM,EAAE;AAC9E,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ;AACZ,aAAO;AACP,YAAM,OAAO,IAAI,aAAa,EAAE,OAAO,OAAO;AAC9C,YAAM,QAAQ,QAAQ,OAAO;AAC7B,YAAM,OAAO,QAAQ,OAAO;AAC5B,YAAM,OAAO,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/host.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/host.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceEndpoint,\n  RemoteServiceProvider,\n  type ReplicatedState,\n  replicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport {\n  type RoutedServerServiceHost,\n  type RoutedSessionAttachment,\n  type RoutedSessionHandle,\n  Server,\n  type ServerHost,\n  SessionNotFoundError,\n} from '@earendil-works/pi-server';\nimport type { Agent } from './agent.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport type { UserClients } from './kernel/users.ts';\nimport { PortListener } from './listener.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { createMonitor, type MonitorOptions } from './monitor/index.ts';\nimport { viewControl, viewPages, viewRemote, viewSettings } from './readonly.ts';\nimport { createRemote } from './remote/host.ts';\nimport { type AgentPages, createPages, ownedPages, type Pages } from './remote/pages.ts';\nimport type { SecretName } from './secrets/names.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  AgentTranscript,\n  type Command,\n} from './services.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { slimmer, type Thumbnail, thumbnail } from './thumbs.ts';\nimport type { Uploads } from './uploads.ts';\nimport { agentViews } from './views.ts';\nimport type { PortEndpoint } from './wire.ts';\n\nexport interface ConnectOptions {\n  readOnly?: boolean;\n  pages?: boolean;\n}\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  readonly users?: UserClients;\n  readonly pages: Pages;\n  connect(endpoint: PortEndpoint, options?: ConnectOptions): void;\n  close(): Promise<void>;\n}\n\nfunction endpointFor(provider: RemoteServiceProvider): RoutedSessionAttachment {\n  const endpoint = createRemoteServiceEndpoint(provider);\n  return {\n    invokeService: (call, publish, context) =>\n      endpoint.invoke(call, (id, update) => publish(id, update, context), context),\n    release: () => endpoint.dispose(),\n  };\n}\n\ntype Attached = { provider: RemoteServiceProvider; release(): void };\n\nfunction sessionServices(attach: () => Attached): RoutedSessionHandle {\n  return {\n    attachClient() {\n      const attached = attach();\n      const endpoint = endpointFor(attached.provider);\n      return {\n        invokeService: endpoint.invokeService,\n        release(context) {\n          endpoint.release(context);\n          attached.release();\n        },\n      };\n    },\n    close: async () => {},\n  };\n}\n\nfunction serverServices(): RoutedServerServiceHost {\n  return {\n    attachClient(presentation) {\n      const provider = new RemoteServiceProvider([{ service: AgentSessions, mode: 'singleton' }]);\n      provider.provide(AgentSessions, {\n        attach: (sessionId, context) => presentation.attachSession(sessionId, context),\n        detach: (context) => presentation.detachSession(context),\n      });\n      const attachment = endpointFor(provider);\n      return {\n        invokeService: attachment.invokeService,\n        release(context) {\n          attachment.release(context);\n          provider.dispose();\n        },\n      };\n    },\n  };\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  signIn: async () => null,\n};\n\nasync function follow(\n  agent: Agent,\n  context: Context,\n  slim: (view: ConversationView) => ConversationView\n) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(slim(attached.value));\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, slim(value));\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, slim(next.value));\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    refresh: () => state.replace(context, slim(attached.value)),\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport interface HostSecrets {\n  vault: ReplicatedState<VaultState>;\n  list(): readonly SecretName[];\n  close?(): void;\n}\n\nconst idleVault = replicatedState<VaultState>({\n  port: 'none',\n  needed: false,\n  version: 0,\n  locked: 'no',\n  held: 0,\n});\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n    users?: UserClients;\n    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users' | 'secrets'>;\n    pages?: Pages;\n    secrets?: HostSecrets;\n    uploads?: Uploads;\n    thumbnail?: Thumbnail;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  let refresh = () => {};\n  const slims = slimmer(options.thumbnail ?? thumbnail, () => refresh());\n  const transcript = await follow(agent, context, slims.slim);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context, slims.slim);\n  refresh = () => {\n    transcript.refresh();\n    mounted.refresh();\n  };\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const catalogue = () =>\n    new RemoteServiceProvider([\n      { service: AgentControl, mode: 'singleton' },\n      { service: AgentTranscript, mode: 'singleton' },\n      { service: AgentSettings, mode: 'singleton' },\n      { service: AgentRemoteService, mode: 'singleton' },\n      { service: AgentPagesService, mode: 'singleton' },\n    ]);\n  const pages = options.pages ?? createPages();\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const monitor = createMonitor({\n    ...options.monitor,\n    harness: agent.harness,\n    agents: agent.agents,\n    views: mounted.views,\n    context,\n  });\n  const control = createAgentControl(\n    agent.harness,\n    agent,\n    deliveries,\n    options.licks,\n    options.scoops,\n    options.skills,\n    options.sprinkles,\n    options.memory,\n    options.freezer,\n    options.changes,\n    monitor,\n    options.secrets?.list,\n    options.uploads\n  );\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    vault: options.secrets?.vault ?? idleVault,\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n    monitor: monitor.state,\n    vault: options.secrets?.vault ?? idleVault,\n  };\n  const settings = options.settings ?? noSettings;\n  const visible = (entry: number) =>\n    [state.value, ...Object.values(mounted.views.value)].some((view) =>\n      view.entries.some((item) => item.id === entry)\n    );\n  const gated =\n    (allowed: (entry: number) => boolean): AgentControl['image'] =>\n    async (ref, using) =>\n      allowed(ref.entry) ? control.image(ref, using) : { data: null, mimeType: null };\n  const trusted: AgentControl = { ...control, image: gated(slims.shown) };\n  const viewed: AgentControl = { ...control, image: gated(visible) };\n  const served = (served: AgentPages) => {\n    const made = catalogue();\n    made.provide(AgentControl, trusted);\n    made.provide(AgentTranscript, transcriptService);\n    made.provide(AgentSettings, settings);\n    made.provide(AgentRemoteService, remote);\n    made.provide(AgentPagesService, served);\n    return made;\n  };\n  const owned = (): Attached => {\n    const mine = ownedPages(pages);\n    const made = served(mine);\n    return {\n      provider: made,\n      release() {\n        made.dispose();\n        mine.release();\n      },\n    };\n  };\n  const follower = served(viewPages());\n  const viewer = catalogue();\n  viewer.provide(AgentControl, viewControl(viewed));\n  viewer.provide(AgentTranscript, { ...transcriptService, monitor: monitor.viewState });\n  viewer.provide(AgentSettings, viewSettings(settings));\n  viewer.provide(AgentRemoteService, viewRemote(remote));\n  viewer.provide(AgentPagesService, viewPages());\n  const shared = (services: RemoteServiceProvider) => () => ({\n    provider: services,\n    release: () => undefined,\n  });\n  const serve = async (id: string, attach: () => Attached) => {\n    const host: ServerHost = {\n      serverServices: serverServices(),\n      async resolveSession(sessionId) {\n        if (sessionId !== AGENT_SESSION)\n          throw new SessionNotFoundError(`unknown session ${sessionId}`);\n        return { id: sessionId };\n      },\n      openSession: async () => sessionServices(attach),\n    };\n    const listener = new PortListener(id);\n    const server = await new Server(host, { serverId: id, listeners: [listener] }).start();\n    return { listener, server };\n  };\n  const full = await serve(serverId, owned);\n  const view = await serve(crypto.randomUUID(), shared(viewer));\n  const linked = await serve(crypto.randomUUID(), shared(follower));\n  return {\n    serverId,\n    agent,\n    pages,\n    ...(options.users ? { users: options.users } : {}),\n    connect(endpoint, connectOptions) {\n      const chosen = connectOptions?.readOnly\n        ? view\n        : connectOptions?.pages === false\n          ? linked\n          : full;\n      chosen.listener.connect(endpoint);\n    },\n    async close() {\n      await full.server.close();\n      await view.server.close();\n      await linked.server.close();\n      viewer.dispose();\n      follower.dispose();\n      await pages.dispose();\n      await monitor.dispose();\n      await remote.dispose();\n      deliveries.dispose();\n      transcript.dispose();\n      mounted.dispose();\n      slims.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      options.secrets?.close?.();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n      await options.users?.close();\n    },\n  };\n}\n"],
+  "sourcesContent": ["import {\n  type Context,\n  createRemoteServiceEndpoint,\n  RemoteServiceProvider,\n  type ReplicatedState,\n  replicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport {\n  type RoutedServerServiceHost,\n  type RoutedSessionAttachment,\n  type RoutedSessionHandle,\n  Server,\n  type ServerHost,\n  SessionNotFoundError,\n} from '@earendil-works/pi-server';\nimport type { Agent } from './agent.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport type { UserClients } from './kernel/users.ts';\nimport { PortListener } from './listener.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { createMonitor, type MonitorOptions } from './monitor/index.ts';\nimport { viewControl, viewPages, viewRemote, viewSettings } from './readonly.ts';\nimport { createRemote } from './remote/host.ts';\nimport { type AgentPages, createPages, ownedPages, type Pages } from './remote/pages.ts';\nimport type { SecretName } from './secrets/names.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSessions,\n  AgentSettings,\n  AgentTranscript,\n  type Command,\n} from './services.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { slimmer, type Thumbnail, thumbnail } from './thumbs.ts';\nimport type { Uploads } from './uploads.ts';\nimport { agentViews } from './views.ts';\nimport type { PortEndpoint } from './wire.ts';\n\nexport interface ConnectOptions {\n  readOnly?: boolean;\n  pages?: boolean;\n}\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  readonly users?: UserClients;\n  readonly pages: Pages;\n  connect(endpoint: PortEndpoint, options?: ConnectOptions): void;\n  close(): Promise<void>;\n}\n\nfunction endpointFor(provider: RemoteServiceProvider): RoutedSessionAttachment {\n  const endpoint = createRemoteServiceEndpoint(provider);\n  return {\n    invokeService: (call, publish, context) =>\n      endpoint.invoke(call, (id, update) => publish(id, update, context), context),\n    release: () => endpoint.dispose(),\n  };\n}\n\ntype Attached = { provider: RemoteServiceProvider; release(): void };\n\nfunction sessionServices(attach: () => Attached): RoutedSessionHandle {\n  return {\n    attachClient() {\n      const attached = attach();\n      const endpoint = endpointFor(attached.provider);\n      return {\n        invokeService: endpoint.invokeService,\n        release(context) {\n          endpoint.release(context);\n          attached.release();\n        },\n      };\n    },\n    close: async () => {},\n  };\n}\n\nfunction serverServices(): RoutedServerServiceHost {\n  return {\n    attachClient(presentation) {\n      const provider = new RemoteServiceProvider([{ service: AgentSessions, mode: 'singleton' }]);\n      provider.provide(AgentSessions, {\n        attach: (sessionId, context) => presentation.attachSession(sessionId, context),\n        detach: (context) => presentation.detachSession(context),\n      });\n      const attachment = endpointFor(provider);\n      return {\n        invokeService: attachment.invokeService,\n        release(context) {\n          attachment.release(context);\n          provider.dispose();\n        },\n      };\n    },\n  };\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  signIn: async () => null,\n};\n\nasync function follow(\n  agent: Agent,\n  context: Context,\n  slim: (view: ConversationView) => ConversationView\n) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(slim(attached.value));\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, slim(value));\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, slim(next.value));\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    refresh: () => state.replace(context, slim(attached.value)),\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport interface HostSecrets {\n  vault: ReplicatedState<VaultState>;\n  list(): readonly SecretName[];\n  close?(): void;\n}\n\nconst idleVault = replicatedState<VaultState>({\n  port: 'none',\n  needed: false,\n  version: 0,\n  locked: 'no',\n  held: 0,\n});\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n    users?: UserClients;\n    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users'>;\n    pages?: Pages;\n    secrets?: HostSecrets;\n    uploads?: Uploads;\n    thumbnail?: Thumbnail;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  let refresh = () => {};\n  const slims = slimmer(options.thumbnail ?? thumbnail, () => refresh());\n  const transcript = await follow(agent, context, slims.slim);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context, slims.slim);\n  refresh = () => {\n    transcript.refresh();\n    mounted.refresh();\n  };\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const catalogue = () =>\n    new RemoteServiceProvider([\n      { service: AgentControl, mode: 'singleton' },\n      { service: AgentTranscript, mode: 'singleton' },\n      { service: AgentSettings, mode: 'singleton' },\n      { service: AgentRemoteService, mode: 'singleton' },\n      { service: AgentPagesService, mode: 'singleton' },\n    ]);\n  const pages = options.pages ?? createPages();\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const monitor = createMonitor({\n    ...options.monitor,\n    harness: agent.harness,\n    agents: agent.agents,\n    views: mounted.views,\n    context,\n  });\n  const control = createAgentControl(\n    agent.harness,\n    agent,\n    deliveries,\n    options.licks,\n    options.scoops,\n    options.skills,\n    options.sprinkles,\n    options.memory,\n    options.freezer,\n    options.changes,\n    monitor,\n    options.secrets?.list,\n    options.uploads\n  );\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    vault: options.secrets?.vault ?? idleVault,\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n    monitor: monitor.state,\n    vault: options.secrets?.vault ?? idleVault,\n  };\n  const settings = options.settings ?? noSettings;\n  const visible = (entry: number) =>\n    [state.value, ...Object.values(mounted.views.value)].some((view) =>\n      view.entries.some((item) => item.id === entry)\n    );\n  const gated =\n    (allowed: (entry: number) => boolean): AgentControl['image'] =>\n    async (ref, using) =>\n      allowed(ref.entry) ? control.image(ref, using) : { data: null, mimeType: null };\n  const trusted: AgentControl = { ...control, image: gated(slims.shown) };\n  const viewed: AgentControl = { ...control, image: gated(visible) };\n  const served = (served: AgentPages) => {\n    const made = catalogue();\n    made.provide(AgentControl, trusted);\n    made.provide(AgentTranscript, transcriptService);\n    made.provide(AgentSettings, settings);\n    made.provide(AgentRemoteService, remote);\n    made.provide(AgentPagesService, served);\n    return made;\n  };\n  const owned = (): Attached => {\n    const mine = ownedPages(pages);\n    const made = served(mine);\n    return {\n      provider: made,\n      release() {\n        made.dispose();\n        mine.release();\n      },\n    };\n  };\n  const follower = served(viewPages());\n  const viewer = catalogue();\n  viewer.provide(AgentControl, viewControl(viewed));\n  viewer.provide(AgentTranscript, { ...transcriptService, monitor: monitor.viewState });\n  viewer.provide(AgentSettings, viewSettings(settings));\n  viewer.provide(AgentRemoteService, viewRemote(remote));\n  viewer.provide(AgentPagesService, viewPages());\n  const shared = (services: RemoteServiceProvider) => () => ({\n    provider: services,\n    release: () => undefined,\n  });\n  const serve = async (id: string, attach: () => Attached) => {\n    const host: ServerHost = {\n      serverServices: serverServices(),\n      async resolveSession(sessionId) {\n        if (sessionId !== AGENT_SESSION)\n          throw new SessionNotFoundError(`unknown session ${sessionId}`);\n        return { id: sessionId };\n      },\n      openSession: async () => sessionServices(attach),\n    };\n    const listener = new PortListener(id);\n    const server = await new Server(host, { serverId: id, listeners: [listener] }).start();\n    return { listener, server };\n  };\n  const full = await serve(serverId, owned);\n  const view = await serve(crypto.randomUUID(), shared(viewer));\n  const linked = await serve(crypto.randomUUID(), shared(follower));\n  return {\n    serverId,\n    agent,\n    pages,\n    ...(options.users ? { users: options.users } : {}),\n    connect(endpoint, connectOptions) {\n      const chosen = connectOptions?.readOnly\n        ? view\n        : connectOptions?.pages === false\n          ? linked\n          : full;\n      chosen.listener.connect(endpoint);\n    },\n    async close() {\n      await full.server.close();\n      await view.server.close();\n      await linked.server.close();\n      viewer.dispose();\n      follower.dispose();\n      await pages.dispose();\n      await monitor.dispose();\n      await remote.dispose();\n      deliveries.dispose();\n      transcript.dispose();\n      mounted.dispose();\n      slims.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      options.secrets?.close?.();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n      await options.users?.close();\n    },\n  };\n}\n"],
   "mappings": "AAAA;AAAA,EAEE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP,SAAS,0BAA0B;AAEnC;AAAA,EAIE;AAAA,EAEA;AAAA,OACK;AAIP,SAAS,0BAA2D;AACpE,SAAS,uBAAuB;AAGhC,SAAS,oBAAoB;AAI7B,SAAS,qBAA0C;AACnD,SAAS,aAAa,WAAW,YAAY,oBAAoB;AACjE,SAAS,oBAAoB;AAC7B,SAA0B,aAAa,kBAA8B;AAGrE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAIP,SAAS,SAAyB,iBAAiB;AAEnD,SAAS,kBAAkB;AAiB3B,SAAS,YAAY,UAA0D;AAC7E,QAAM,WAAW,4BAA4B,QAAQ;AACrD,SAAO;AAAA,IACL,eAAe,CAAC,MAAM,SAAS,YAC7B,SAAS,OAAO,MAAM,CAAC,IAAI,WAAW,QAAQ,IAAI,QAAQ,OAAO,GAAG,OAAO;AAAA,IAC7E,SAAS,MAAM,SAAS,QAAQ;AAAA,EAClC;AACF;AAIA,SAAS,gBAAgB,QAA6C;AACpE,SAAO;AAAA,IACL,eAAe;AACb,YAAM,WAAW,OAAO;AACxB,YAAM,WAAW,YAAY,SAAS,QAAQ;AAC9C,aAAO;AAAA,QACL,eAAe,SAAS;AAAA,QACxB,QAAQ,SAAS;AACf,mBAAS,QAAQ,OAAO;AACxB,mBAAS,QAAQ;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO,YAAY;AAAA,IAAC;AAAA,EACtB;AACF;AAEA,SAAS,iBAA0C;AACjD,SAAO;AAAA,IACL,aAAa,cAAc;AACzB,YAAM,WAAW,IAAI,sBAAsB,CAAC,EAAE,SAAS,eAAe,MAAM,YAAY,CAAC,CAAC;AAC1F,eAAS,QAAQ,eAAe;AAAA,QAC9B,QAAQ,CAAC,WAAW,YAAY,aAAa,cAAc,WAAW,OAAO;AAAA,QAC7E,QAAQ,CAAC,YAAY,aAAa,cAAc,OAAO;AAAA,MACzD,CAAC;AACD,YAAM,aAAa,YAAY,QAAQ;AACvC,aAAO;AAAA,QACL,eAAe,WAAW;AAAA,QAC1B,QAAQ,SAAS;AACf,qBAAW,QAAQ,OAAO;AAC1B,mBAAS,QAAQ;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAA4B;AAAA,EAChC,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnD,SAAS,YAAY;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,YAAY,YAAY;AAAA,EAAC;AAAA,EACzB,QAAQ,YAAY;AACtB;AAEA,eAAe,OACb,OACA,SACA,MACA;AACA,MAAI,WAAW,MAAM,MAAM,KAAK,EAAE,UAAU,OAAO;AACnD,QAAM,QAAQ,gBAAkC,KAAK,SAAS,KAAK,CAAC;AACpE,QAAM,SAAS,CAAC,OAAyB,SAAkB,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC;AAC1F,MAAI,MAAM,SAAS,UAAU,MAAM;AACnC,QAAM,OAAO,MAAM,OAAO,OAAO,iBAAiB;AAChD,UAAM,OAAO,MAAM,aAAa,UAAU,OAAO;AACjD,QAAI;AACJ,aAAS,QAAQ;AACjB,eAAW;AACX,UAAM,QAAQ,SAAS,KAAK,KAAK,KAAK,CAAC;AACvC,UAAM,KAAK,UAAU,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM,MAAM,QAAQ,SAAS,KAAK,SAAS,KAAK,CAAC;AAAA,IAC1D,UAAU;AACR,WAAK;AACL,UAAI;AACJ,eAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;AAQA,MAAM,YAAY,gBAA4B;AAAA,EAC5C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,MAAM;AACR,CAAC;AAED,eAAsB,UACpB,OACA,UAkBI,CAAC,GACe;AACpB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY,OAAO,WAAW;AACvD,MAAI,UAAU,MAAM;AAAA,EAAC;AACrB,QAAM,QAAQ,QAAQ,QAAQ,aAAa,WAAW,MAAM,QAAQ,CAAC;AACrE,QAAM,aAAa,MAAM,OAAO,OAAO,SAAS,MAAM,IAAI;AAC1D,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,SAAS,MAAM,IAAI;AAC3D,YAAU,MAAM;AACd,eAAW,QAAQ;AACnB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAC3C,QAAM,UAAU,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,MAAM,UAAU,KAAK,CAAC;AACvE,QAAM,YAAY,MAChB,IAAI,sBAAsB;AAAA,IACxB,EAAE,SAAS,cAAc,MAAM,YAAY;AAAA,IAC3C,EAAE,SAAS,iBAAiB,MAAM,YAAY;AAAA,IAC9C,EAAE,SAAS,eAAe,MAAM,YAAY;AAAA,IAC5C,EAAE,SAAS,oBAAoB,MAAM,YAAY;AAAA,IACjD,EAAE,SAAS,mBAAmB,MAAM,YAAY;AAAA,EAClD,CAAC;AACH,QAAM,QAAQ,QAAQ,SAAS,YAAY;AAC3C,QAAM,aAAa,gBAAgB,MAAM,SAAS,OAAO,OAAO;AAChE,QAAM,UAAU,cAAc;AAAA,IAC5B,GAAG,QAAQ;AAAA,IACX,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,QAAQ;AAAA,IACf;AAAA,EACF,CAAC;AACD,QAAM,UAAU;AAAA,IACd,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,QAAQ;AAAA,EACV;AACA,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,SAAS,UAAU,QAAQ,KAAK,SAAS,KAAK;AAAA,IACrD,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,MAAM,aAAa,SAAS,OAAO;AACjC,UAAI,CAAC,QAAS,QAAO,MAAM,KAAK;AAChC,YAAM,QAAQ,MAAM,MAAM,OAAO,aAAa,SAAS,KAAK;AAC5D,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG;AAC3D,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,UAAU,QAAQ,QAAQ,YAAY,gBAA2B,CAAC,CAAC;AAAA,IACnE,WAAW,QAAQ,WAAW,aAAa,gBAA4B,CAAC,CAAC;AAAA,IACzE,UAAU,QAAQ,QAAQ,YAAY,gBAA+B,CAAC,CAAC;AAAA,IACvE,cAAc,QAAQ,QAAQ,UAAU,gBAA+B,CAAC,CAAC;AAAA,IACzE,QAAQ,QAAQ,SAAS,UAAU,gBAA8B,CAAC,CAAC;AAAA,IACnE,SACE,QAAQ,SAAS,QAAQ,gBAA6B,EAAE,aAAa,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,IAC1F,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ,SAAS,SAAS;AAAA,EACnC;AACA,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,UAAU,CAAC,UACf,CAAC,MAAM,OAAO,GAAG,OAAO,OAAO,QAAQ,MAAM,KAAK,CAAC,EAAE;AAAA,IAAK,CAACA,UACzDA,MAAK,QAAQ,KAAK,CAAC,SAAS,KAAK,OAAO,KAAK;AAAA,EAC/C;AACF,QAAM,QACJ,CAAC,YACD,OAAO,KAAK,UACV,QAAQ,IAAI,KAAK,IAAI,QAAQ,MAAM,KAAK,KAAK,IAAI,EAAE,MAAM,MAAM,UAAU,KAAK;AAClF,QAAM,UAAwB,EAAE,GAAG,SAAS,OAAO,MAAM,MAAM,KAAK,EAAE;AACtE,QAAM,SAAuB,EAAE,GAAG,SAAS,OAAO,MAAM,OAAO,EAAE;AACjE,QAAM,SAAS,CAACC,YAAuB;AACrC,UAAM,OAAO,UAAU;AACvB,SAAK,QAAQ,cAAc,OAAO;AAClC,SAAK,QAAQ,iBAAiB,iBAAiB;AAC/C,SAAK,QAAQ,eAAe,QAAQ;AACpC,SAAK,QAAQ,oBAAoB,MAAM;AACvC,SAAK,QAAQ,mBAAmBA,OAAM;AACtC,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAgB;AAC5B,UAAM,OAAO,WAAW,KAAK;AAC7B,UAAM,OAAO,OAAO,IAAI;AACxB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU;AACR,aAAK,QAAQ;AACb,aAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,OAAO,UAAU,CAAC;AACnC,QAAM,SAAS,UAAU;AACzB,SAAO,QAAQ,cAAc,YAAY,MAAM,CAAC;AAChD,SAAO,QAAQ,iBAAiB,EAAE,GAAG,mBAAmB,SAAS,QAAQ,UAAU,CAAC;AACpF,SAAO,QAAQ,eAAe,aAAa,QAAQ,CAAC;AACpD,SAAO,QAAQ,oBAAoB,WAAW,MAAM,CAAC;AACrD,SAAO,QAAQ,mBAAmB,UAAU,CAAC;AAC7C,QAAM,SAAS,CAAC,aAAoC,OAAO;AAAA,IACzD,UAAU;AAAA,IACV,SAAS,MAAM;AAAA,EACjB;AACA,QAAM,QAAQ,OAAO,IAAY,WAA2B;AAC1D,UAAM,OAAmB;AAAA,MACvB,gBAAgB,eAAe;AAAA,MAC/B,MAAM,eAAe,WAAW;AAC9B,YAAI,cAAc;AAChB,gBAAM,IAAI,qBAAqB,mBAAmB,SAAS,EAAE;AAC/D,eAAO,EAAE,IAAI,UAAU;AAAA,MACzB;AAAA,MACA,aAAa,YAAY,gBAAgB,MAAM;AAAA,IACjD;AACA,UAAM,WAAW,IAAI,aAAa,EAAE;AACpC,UAAM,SAAS,MAAM,IAAI,OAAO,MAAM,EAAE,UAAU,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM;AACrF,WAAO,EAAE,UAAU,OAAO;AAAA,EAC5B;AACA,QAAM,OAAO,MAAM,MAAM,UAAU,KAAK;AACxC,QAAM,OAAO,MAAM,MAAM,OAAO,WAAW,GAAG,OAAO,MAAM,CAAC;AAC5D,QAAM,SAAS,MAAM,MAAM,OAAO,WAAW,GAAG,OAAO,QAAQ,CAAC;AAChE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,QAAQ,UAAU,gBAAgB;AAChC,YAAM,SAAS,gBAAgB,WAC3B,OACA,gBAAgB,UAAU,QACxB,SACA;AACN,aAAO,SAAS,QAAQ,QAAQ;AAAA,IAClC;AAAA,IACA,MAAM,QAAQ;AACZ,YAAM,KAAK,OAAO,MAAM;AACxB,YAAM,KAAK,OAAO,MAAM;AACxB,YAAM,OAAO,OAAO,MAAM;AAC1B,aAAO,QAAQ;AACf,eAAS,QAAQ;AACjB,YAAM,MAAM,QAAQ;AACpB,YAAM,QAAQ,QAAQ;AACtB,YAAM,OAAO,QAAQ;AACrB,iBAAW,QAAQ;AACnB,iBAAW,QAAQ;AACnB,cAAQ,QAAQ;AAChB,YAAM,QAAQ;AACd,iBAAW,OAAO,QAAS,KAAI;AAC/B,cAAQ,SAAS,MAAM;AACvB,cAAQ,SAAS,QAAQ;AACzB,YAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,WAAW,MAAM,OAAO;AACtC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAChC,YAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO;AAC3C,YAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM;AAClB,YAAM,QAAQ,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;",
   "names": ["view", "served"]
 }

package/dist/index.js

@@ -21,7 +21,6 @@ import {
 } from "./attachments.js";
 import { connectAgent } from "./client.js";
 import { createAgentControl } from "./control.js";
-import { CREDENTIALS_DATABASE, EncryptedCredentialStore } from "./credentials.js";
 import { hostAgent } from "./host.js";
 import { HOME, kernelEnvironment, SliccKernelEnv } from "./kernel/env.js";
 import {
@@ -88,10 +87,8 @@ export {
   AgentSettings,
   AgentTranscript,
   BEDROCK,
-  CREDENTIALS_DATABASE,
   DEFAULT_MODEL,
   DEFAULT_REGIONS,
-  EncryptedCredentialStore,
   FILE_LIMIT,
   HOME,
   IMAGE_LIMIT,

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeClassifiers,\n  adobeConfig,\n  adobeIdentity,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n  SESSION_HEADER,\n  VERSION_HEADER,\n  withAdobeIdentity,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport {\n  FILE_LIMIT,\n  IMAGE_LIMIT,\n  type SendAttachment,\n  type ShownAttachment,\n  splitUser,\n  TOTAL_LIMIT,\n  userParts,\n} from './attachments.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport { CREDENTIALS_DATABASE, EncryptedCredentialStore } from './credentials.ts';\nexport { type AgentHost, type ConnectOptions, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport {\n  adminOver,\n  type KernelAdmin,\n  type KernelGroup,\n  type KernelGroups,\n  type KernelUser,\n  type KernelUsers,\n  serveAdmin,\n  type UserClient,\n  type UserClients,\n  type UserConnect,\n  type UserSpec,\n  userClients,\n} from './kernel/users.ts';\nexport { PortListener } from './listener.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport {\n  type Loopback,\n  type Transport,\n  type TransportResponse,\n  transportFetch,\n} from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type KernelSource,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { applyPatches, patchServerAccept } from './patches.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AgentPages,\n  createPages,\n  type PageBatch,\n  type PageCaller,\n  type PageRequest,\n  type PageResult,\n  type Pages,\n  type PagesOpened,\n  type PageTab,\n} from './remote/pages.ts';\nexport {\n  type AccountState,\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentSessions,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { UPLOADS, type Uploads, upload } from './uploads.ts';\nexport { PortChannel, type PortEndpoint, withUnrefTimers } from './wire.ts';\nexport {\n  type KernelPorts,\n  kernelPort,\n  kernelPorts,\n  serveConnections,\n  type WorkerScope,\n} from './worker.ts';\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAwC,YAAY,iBAAiB;AACrE;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,gCAAgC;AAC/D,SAA8C,iBAAiB;AAQ/D,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EAMA;AAAA,EAKA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AACP,SAAS,cAAc,yBAAyB;AAChD,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,OAQK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,SAAuB,cAAc;AAC9C,SAAS,aAAgC,uBAAuB;AAChE;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;",
+  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeClassifiers,\n  adobeConfig,\n  adobeIdentity,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n  SESSION_HEADER,\n  VERSION_HEADER,\n  withAdobeIdentity,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport {\n  FILE_LIMIT,\n  IMAGE_LIMIT,\n  type SendAttachment,\n  type ShownAttachment,\n  splitUser,\n  TOTAL_LIMIT,\n  userParts,\n} from './attachments.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport { type AgentHost, type ConnectOptions, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport {\n  adminOver,\n  type KernelAdmin,\n  type KernelGroup,\n  type KernelGroups,\n  type KernelUser,\n  type KernelUsers,\n  serveAdmin,\n  type UserClient,\n  type UserClients,\n  type UserConnect,\n  type UserSpec,\n  userClients,\n} from './kernel/users.ts';\nexport { PortListener } from './listener.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport {\n  type Loopback,\n  type Transport,\n  type TransportResponse,\n  transportFetch,\n} from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type KernelSource,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { applyPatches, patchServerAccept } from './patches.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AgentPages,\n  createPages,\n  type PageBatch,\n  type PageCaller,\n  type PageRequest,\n  type PageResult,\n  type Pages,\n  type PagesOpened,\n  type PageTab,\n} from './remote/pages.ts';\nexport {\n  type AccountState,\n  AGENT_SESSION,\n  AgentControl,\n  AgentPagesService,\n  AgentSessions,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { UPLOADS, type Uploads, upload } from './uploads.ts';\nexport { PortChannel, type PortEndpoint, withUnrefTimers } from './wire.ts';\nexport {\n  type KernelPorts,\n  kernelPort,\n  kernelPorts,\n  serveConnections,\n  type WorkerScope,\n} from './worker.ts';\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAwC,YAAY,iBAAiB;AACrE;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC,SAA8C,iBAAiB;AAQ/D,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EAMA;AAAA,EAKA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AACP,SAAS,cAAc,yBAAyB;AAChD,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,OAQK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,SAAuB,cAAc;AAC9C,SAAS,aAAgC,uBAAuB;AAChE;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;",
   "names": []
 }

package/dist/main.js

@@ -14,7 +14,6 @@ import {
   locateWasm,
   sandboxFactory
 } from "./codemode/index.js";
-import { EncryptedCredentialStore } from "./credentials.js";
 import { attachFreezer } from "./freezer/index.js";
 import { settingsText, titler } from "./freezer/title.js";
 import { lateGelatiere } from "./gelatiere/index.js";
@@ -36,14 +35,25 @@ import { sliccPrompt } from "./prompt.js";
 import { createPages } from "./remote/pages.js";
 import { identity } from "./scoops/identity.js";
 import { packageAssets, setupScoops } from "./scoops/index.js";
+import { vaultCredentials } from "./secrets/credentials.js";
+import {
+  BEDROCK_ENDPOINTS,
+  modelRoute,
+  vaultEndpoints
+} from "./secrets/endpoints.js";
 import { repin, secretsExtension, shellGrants } from "./secrets/extension.js";
+import { grantFetch, mcpFetch, vaultFetch } from "./secrets/fetch.js";
 import { secretNames } from "./secrets/names.js";
+import { vaultRecords } from "./secrets/records.js";
 import { scrubWith } from "./secrets/scrub.js";
+import { fileStore } from "./secrets/store.js";
 import { listenVault, Vault } from "./secrets/vault.js";
 import {
+  BEDROCK,
   createAgentSettings,
   createSliccModels,
   DEFAULT_MODEL,
+  providerFields,
   sliccProviders
 } from "./settings.js";
 import { RELOAD_MS, setupSkills } from "./skills/index.js";
@@ -66,6 +76,7 @@ function usersOf(admin, wanted, attach) {
   return userClients(adminOver(admin), attach);
 }
 const STORE_DIR = "/.slicc";
+const ACCOUNTS_FILE = `${STORE_DIR}/accounts.json`;
 async function attached(ports, options) {
   const attach = options.attach ?? attachKernel;
   const { kernel, admin } = await ports;
@@ -110,10 +121,59 @@ async function secretsFor(home, vault) {
   await names.refresh(BACKGROUND_CONTEXT);
   return names;
 }
-async function modelsOf(options, version) {
-  const credentials = await (options.credentials ?? (() => EncryptedCredentialStore.open()))();
+function modelBases(providers, models) {
+  return providers.map((provider) => ({
+    provider: provider.id,
+    urls: [
+      ...new Set(
+        [
+          provider.baseUrl,
+          ...models.getModels(provider.id).map((model) => model.baseUrl),
+          ...provider.id === BEDROCK ? BEDROCK_ENDPOINTS : []
+        ].filter((url) => typeof url === "string" && url !== "")
+      )
+    ]
+  }));
+}
+function mcpVault(vault, made) {
+  const { store, records, endpoints } = made;
+  return {
+    store,
+    vault: {
+      records,
+      fetch: (server, base) => mcpFetch(vault, base, server),
+      grant: (server, base) => grantFetch(vault, server, base),
+      servers: endpoints.servers,
+      token: endpoints.token
+    }
+  };
+}
+function hostSecrets(vault, names, parts) {
+  return {
+    vault: vault.state,
+    list: () => names.state.value,
+    close: () => {
+      for (const part of parts) part.close();
+    }
+  };
+}
+async function modelsOf(scope, options, given) {
+  const { vault, home, transport, version } = given;
+  const store = await (options.store ?? (async () => fileStore(home, ACCOUNTS_FILE)))();
+  const records = vaultRecords(vault);
+  void records.refresh(BACKGROUND_CONTEXT).catch(() => void 0);
   const providers = options.providers ?? sliccProviders(version);
-  return { credentials, providers, models: createSliccModels(credentials, providers) };
+  const fields = await providerFields(store, providers);
+  const models = createSliccModels(vaultCredentials(records, fields.env), providers);
+  const bases = () => modelBases(providers, models);
+  scope.fetch = vaultFetch(
+    vault,
+    transport,
+    modelRoute(bases, () => records.state.value)
+  );
+  const endpoints = vaultEndpoints(vault);
+  void endpoints.models(bases()).catch(() => void 0);
+  return { store, records, providers, fields, models, bases, endpoints };
 }
 function baseRegistry(facts) {
   const registry = createRegistry();
@@ -136,25 +196,37 @@ async function factsOf(client, native) {
 function routeFetch(scope, client) {
   const native = scope.fetch.bind(scope);
   const loopback = client.loopbackFetch?.bind(client);
-  scope.fetch = transportFetch(client.transport, scope.location.origin, native, loopback);
-  return native;
+  const transport = transportFetch(client.transport, scope.location.origin, native, loopback);
+  scope.fetch = transport;
+  return { native, transport };
 }
 async function prepare(scope, kernel, options) {
   const names = await secretsFor(kernel.home, kernel.vault);
-  const native = routeFetch(scope, kernel.client);
+  const { native, transport } = routeFetch(scope, kernel.client);
   const facts = await factsOf(kernel.client, native);
-  return {
-    names,
-    native,
-    facts,
-    ...await modelsOf(options, facts.version),
-    registry: baseRegistry(facts)
-  };
+  const made = await modelsOf(scope, options, {
+    vault: kernel.vault,
+    home: kernel.home,
+    transport,
+    version: facts.version
+  });
+  return { names, native, transport, facts, ...made, registry: baseRegistry(facts) };
+}
+function modelsOfAgent(agent, settings, catalog, vault) {
+  const locked = () => vault.state.value.locked !== "no";
+  return modelsCommand({ agents: agent.agents, settings, catalog, locked });
+}
+async function settingsOf(made, mcp) {
+  const { models, records, fields, providers, bases, endpoints } = made;
+  const settings = await createAgentSettings(models, { records, fields }, providers, { mcp });
+  settings.state.subscribe(() => void endpoints.models(bases()).catch(() => void 0));
+  return settings;
 }
 async function start(scope, ports, options, vault) {
   const { client, users, home, at } = await attached(ports, options);
   const ready = await prepare(scope, { client, home, vault }, options);
-  const { names, native, facts, credentials, providers, models, registry } = ready;
+  const { names, native, transport, facts, models, registry } = ready;
+  const { records, endpoints } = ready;
   const memory = setupMemory(registry);
   const coding = CodingTools.tools;
   registry.install(browserGuard([scope.location.origin], coding));
@@ -207,9 +279,9 @@ async function start(scope, ports, options, vault) {
     {
       env: home,
       ...at,
-      credentials,
+      ...mcpVault(vault, ready),
       licks: licks.licks,
-      fetch: scope.fetch,
+      fetch: transport,
       version: facts.version,
       reloadMs: RELOAD_MS,
       codemode: codemode.length > 0,
@@ -255,7 +327,7 @@ async function start(scope, ports, options, vault) {
     ...people ? { layout: people.layout } : {}
   });
   licks.licks.guard(freezer.frozenTarget);
-  const settings = await createAgentSettings(models, credentials, providers, { mcp: mcpRuntime });
+  const settings = await settingsOf(ready, mcpRuntime);
   const pages = createPages({ claim: sprinkles.claim });
   const runtime = await scoops.attach(
     {
@@ -270,7 +342,7 @@ async function start(scope, ports, options, vault) {
       memory: memoryRuntime.command,
       gelatiere: gelatiere.command,
       freezer: freezer.command,
-      models: modelsCommand({ agents: agent.agents, settings, catalog: models }),
+      models: modelsOfAgent(agent, settings, models, vault),
       panel: pages.command,
       mcp: mcp.direct,
       ...options.assets ? { assets: options.assets } : {}
@@ -305,7 +377,7 @@ async function start(scope, ports, options, vault) {
     pages,
     mcp: mcpRuntime,
     ...users ? { users } : {},
-    secrets: { vault: vault.state, list: () => names.state.value, close: names.close },
+    secrets: hostSecrets(vault, names, [names, records, endpoints]),
     uploads: {
       env: environment,
       sees: (ref) => seesImages(models, ref)
@@ -313,8 +385,7 @@ async function start(scope, ports, options, vault) {
     monitor: {
       kernel: client,
       groups,
-      ...users ? { users: () => users.users.list() } : {},
-      secrets: () => mcpRuntime.secrets()
+      ...users ? { users: () => users.users.list() } : {}
     }
   });
 }
@@ -333,9 +404,11 @@ function runAgentWorker(scope, options = {}) {
   return host;
 }
 export {
+  ACCOUNTS_FILE,
   MCP_CALLBACK,
   STORE_DIR,
   alive,
+  modelBases,
   runAgentWorker,
   seesImages,
   usersOf