@ai-ecoverse/slicc-agent 5.1.0 → 5.3.0

package/dist/guests/serve.js

@@ -0,0 +1,72 @@
+import { replicatedState } from "@earendil-works/chord";
+import { PortLink } from "../wire.js";
+import { guestView } from "./view.js";
+function proposalsOf(items, seat) {
+  return (items ?? []).filter((item) => item.kind === "guest-message" && item.seat === seat).map((item) => ({
+    id: item.id,
+    text: item.detail.text ?? "",
+    state: item.state,
+    reason: item.reason ?? null,
+    createdAt: item.createdAt,
+    decidedAt: item.decidedAt ?? null
+  }));
+}
+function guestOpener(guests, agents, views, context, approvals) {
+  return (principal) => {
+    const record = guests.current(principal);
+    if (!record) return void 0;
+    const pick = (all) => all?.[record.agentId];
+    let shown = pick(views.value);
+    const transcript = replicatedState(guestView(shown, record.id));
+    const off = views.subscribe((all) => {
+      if (pick(all) === shown) return;
+      shown = pick(all);
+      transcript.replace(context, guestView(shown, record.id));
+    });
+    const seat = replicatedState({
+      id: record.id,
+      label: record.label,
+      agentId: record.agentId,
+      name: agents.state().cones[record.agentId]?.name ?? record.agentId,
+      expiresAt: record.expiresAt,
+      gates: { ...record.gates }
+    });
+    let listed = JSON.stringify(proposalsOf(approvals?.value, record.id));
+    const proposals = replicatedState(JSON.parse(listed));
+    const offProposals = approvals?.subscribe((items) => {
+      const next = JSON.stringify(proposalsOf(items, record.id));
+      if (next === listed) return;
+      listed = next;
+      proposals.replace(context, JSON.parse(next));
+    });
+    return {
+      value: {
+        transcript,
+        seat,
+        proposals,
+        propose: (request, using) => guests.propose(principal, request, using)
+      },
+      dispose() {
+        off();
+        offProposals?.();
+      }
+    };
+  };
+}
+function admitGuest(guests, endpoint, asked, serverId, link, host) {
+  const port = new PortLink(endpoint);
+  const guest = guests.admit(String(asked.id), String(asked.label));
+  if (!guest) {
+    port.close("this guest seat is not valid");
+    return;
+  }
+  void port.ended.then(guests.joined(guest.id));
+  port.greet(serverId);
+  host.accept(port, { principal: { seat: "guest", link, guest } });
+}
+export {
+  admitGuest,
+  guestOpener,
+  proposalsOf
+};
+//# sourceMappingURL=serve.js.map

package/dist/guests/serve.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/guests/serve.ts"],
+  "sourcesContent": ["import type { Context, Host, ReplicatedState } from '@earendil-works/chord';\nimport { replicatedState } from '@earendil-works/chord';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { Agents } from '../agents.ts';\nimport type { Approval } from '../approvals/index.ts';\nimport type { AgentGuest, GuestProposal, GuestShown } from '../services.ts';\nimport type { AgentPrincipal, GuestPrincipal } from '../serving.ts';\nimport { type PortEndpoint, PortLink } from '../wire.ts';\nimport type { Guests } from './index.ts';\nimport { guestView } from './view.ts';\n\nexport function proposalsOf(items: readonly Approval[] | undefined, seat: string): GuestProposal[] {\n  return (items ?? [])\n    .filter((item) => item.kind === 'guest-message' && item.seat === seat)\n    .map((item) => ({\n      id: item.id,\n      text: (item.detail as { text?: string }).text ?? '',\n      state: item.state,\n      reason: item.reason ?? null,\n      createdAt: item.createdAt,\n      decidedAt: item.decidedAt ?? null,\n    }));\n}\n\nexport function guestOpener(\n  guests: Guests,\n  agents: Pick<Agents, 'state'>,\n  views: ReplicatedState<Record<string, ConversationView>>,\n  context: Context,\n  approvals?: ReplicatedState<Approval[]>\n) {\n  return (principal: GuestPrincipal): { value: AgentGuest; dispose(): void } | undefined => {\n    const record = guests.current(principal);\n    if (!record) return undefined;\n    const pick = (all: Record<string, ConversationView> | undefined) => all?.[record.agentId];\n    let shown = pick(views.value);\n    const transcript = replicatedState<ConversationView>(guestView(shown, record.id));\n    const off = views.subscribe((all) => {\n      if (pick(all) === shown) return;\n      shown = pick(all);\n      transcript.replace(context, guestView(shown, record.id));\n    });\n    const seat = replicatedState<GuestShown>({\n      id: record.id,\n      label: record.label,\n      agentId: record.agentId,\n      name: agents.state().cones[record.agentId]?.name ?? record.agentId,\n      expiresAt: record.expiresAt,\n      gates: { ...record.gates },\n    });\n    let listed = JSON.stringify(proposalsOf(approvals?.value, record.id));\n    const proposals = replicatedState<GuestProposal[]>(JSON.parse(listed) as GuestProposal[]);\n    const offProposals = approvals?.subscribe((items) => {\n      const next = JSON.stringify(proposalsOf(items, record.id));\n      if (next === listed) return;\n      listed = next;\n      proposals.replace(context, JSON.parse(next) as GuestProposal[]);\n    });\n    return {\n      value: {\n        transcript,\n        seat,\n        proposals,\n        propose: (request, using) => guests.propose(principal, request, using),\n      },\n      dispose() {\n        off();\n        offProposals?.();\n      },\n    };\n  };\n}\n\nexport function admitGuest(\n  guests: Guests,\n  endpoint: PortEndpoint,\n  asked: { id: string; label: string },\n  serverId: string,\n  link: number,\n  host: Pick<Host, 'accept'>\n): void {\n  const port = new PortLink(endpoint);\n  const guest = guests.admit(String(asked.id), String(asked.label));\n  if (!guest) {\n    port.close('this guest seat is not valid');\n    return;\n  }\n  void port.ended.then(guests.joined(guest.id));\n  port.greet(serverId);\n  host.accept(port, { principal: { seat: 'guest', link, guest } satisfies AgentPrincipal });\n}\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAMhC,SAA4B,gBAAgB;AAE5C,SAAS,iBAAiB;AAEnB,SAAS,YAAY,OAAwC,MAA+B;AACjG,UAAQ,SAAS,CAAC,GACf,OAAO,CAAC,SAAS,KAAK,SAAS,mBAAmB,KAAK,SAAS,IAAI,EACpE,IAAI,CAAC,UAAU;AAAA,IACd,IAAI,KAAK;AAAA,IACT,MAAO,KAAK,OAA6B,QAAQ;AAAA,IACjD,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK,UAAU;AAAA,IACvB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK,aAAa;AAAA,EAC/B,EAAE;AACN;AAEO,SAAS,YACd,QACA,QACA,OACA,SACA,WACA;AACA,SAAO,CAAC,cAAkF;AACxF,UAAM,SAAS,OAAO,QAAQ,SAAS;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,CAAC,QAAsD,MAAM,OAAO,OAAO;AACxF,QAAI,QAAQ,KAAK,MAAM,KAAK;AAC5B,UAAM,aAAa,gBAAkC,UAAU,OAAO,OAAO,EAAE,CAAC;AAChF,UAAM,MAAM,MAAM,UAAU,CAAC,QAAQ;AACnC,UAAI,KAAK,GAAG,MAAM,MAAO;AACzB,cAAQ,KAAK,GAAG;AAChB,iBAAW,QAAQ,SAAS,UAAU,OAAO,OAAO,EAAE,CAAC;AAAA,IACzD,CAAC;AACD,UAAM,OAAO,gBAA4B;AAAA,MACvC,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO,MAAM,EAAE,MAAM,OAAO,OAAO,GAAG,QAAQ,OAAO;AAAA,MAC3D,WAAW,OAAO;AAAA,MAClB,OAAO,EAAE,GAAG,OAAO,MAAM;AAAA,IAC3B,CAAC;AACD,QAAI,SAAS,KAAK,UAAU,YAAY,WAAW,OAAO,OAAO,EAAE,CAAC;AACpE,UAAM,YAAY,gBAAiC,KAAK,MAAM,MAAM,CAAoB;AACxF,UAAM,eAAe,WAAW,UAAU,CAAC,UAAU;AACnD,YAAM,OAAO,KAAK,UAAU,YAAY,OAAO,OAAO,EAAE,CAAC;AACzD,UAAI,SAAS,OAAQ;AACrB,eAAS;AACT,gBAAU,QAAQ,SAAS,KAAK,MAAM,IAAI,CAAoB;AAAA,IAChE,CAAC;AACD,WAAO;AAAA,MACL,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,CAAC,SAAS,UAAU,OAAO,QAAQ,WAAW,SAAS,KAAK;AAAA,MACvE;AAAA,MACA,UAAU;AACR,YAAI;AACJ,uBAAe;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,WACd,QACA,UACA,OACA,UACA,MACA,MACM;AACN,QAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,QAAM,QAAQ,OAAO,MAAM,OAAO,MAAM,EAAE,GAAG,OAAO,MAAM,KAAK,CAAC;AAChE,MAAI,CAAC,OAAO;AACV,SAAK,MAAM,8BAA8B;AACzC;AAAA,EACF;AACA,OAAK,KAAK,MAAM,KAAK,OAAO,OAAO,MAAM,EAAE,CAAC;AAC5C,OAAK,MAAM,QAAQ;AACnB,OAAK,OAAO,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,MAAM,MAAM,EAA2B,CAAC;AAC1F;",
+  "names": []
+}

package/dist/guests/view.js

@@ -0,0 +1,40 @@
+import { GUEST_INPUT_KIND } from "./attribution.js";
+const SHOWN = /* @__PURE__ */ new Set([
+  "pi.user",
+  "pi.assistant",
+  "pi.tool-result",
+  "pi.compaction",
+  "slicc.rewound",
+  "slicc.from",
+  GUEST_INPUT_KIND
+]);
+const EMPTY_VIEW = {
+  conversation: {},
+  entries: [],
+  docs: {}
+};
+const own = (seat) => (item) => item.entry?.kind === GUEST_INPUT_KIND && item.entry.data?.seat === seat;
+function guestView(view, seat) {
+  if (!view) return EMPTY_VIEW;
+  const docs = {};
+  const live = view.docs["pi.live"];
+  if (live) docs["pi.live"] = live;
+  const agent = view.docs["pi.agent"];
+  if (agent)
+    docs["pi.agent"] = {
+      ...agent.model ? { model: agent.model } : {},
+      ...agent.thinkingLevel ? { thinkingLevel: agent.thinkingLevel } : {}
+    };
+  const inbox = view.docs["pi.inbox"];
+  if (inbox) docs["pi.inbox"] = { items: (inbox.items ?? []).filter(own(seat)) };
+  return {
+    conversation: view.conversation,
+    entries: view.entries.filter((entry) => SHOWN.has(entry.kind)),
+    docs
+  };
+}
+export {
+  EMPTY_VIEW,
+  guestView
+};
+//# sourceMappingURL=view.js.map

package/dist/guests/view.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/guests/view.ts"],
+  "sourcesContent": ["import type { ConversationView, EntryRecord, JsonObject } from '@earendil-works/pi-durable';\nimport { GUEST_INPUT_KIND } from './attribution.ts';\n\nconst SHOWN = new Set([\n  'pi.user',\n  'pi.assistant',\n  'pi.tool-result',\n  'pi.compaction',\n  'slicc.rewound',\n  'slicc.from',\n  GUEST_INPUT_KIND,\n]);\n\nexport const EMPTY_VIEW = {\n  conversation: {},\n  entries: [],\n  docs: {},\n} as unknown as ConversationView;\n\ntype InboxItem = { mode?: string; entry?: { kind?: string; data?: { seat?: unknown } } };\n\nconst own = (seat: string) => (item: InboxItem) =>\n  item.entry?.kind === GUEST_INPUT_KIND && item.entry.data?.seat === seat;\n\nexport function guestView(view: ConversationView | undefined, seat: string): ConversationView {\n  if (!view) return EMPTY_VIEW;\n  const docs: Record<string, JsonObject> = {};\n  const live = view.docs['pi.live'];\n  if (live) docs['pi.live'] = live;\n  const agent = view.docs['pi.agent'] as { model?: JsonObject; thinkingLevel?: string } | undefined;\n  if (agent)\n    docs['pi.agent'] = {\n      ...(agent.model ? { model: agent.model } : {}),\n      ...(agent.thinkingLevel ? { thinkingLevel: agent.thinkingLevel } : {}),\n    };\n  const inbox = view.docs['pi.inbox'] as { items?: InboxItem[] } | undefined;\n  if (inbox) docs['pi.inbox'] = { items: (inbox.items ?? []).filter(own(seat)) } as JsonObject;\n  return {\n    conversation: view.conversation,\n    entries: view.entries.filter((entry: EntryRecord) => SHOWN.has(entry.kind)),\n    docs,\n  };\n}\n"],
+  "mappings": "AACA,SAAS,wBAAwB;AAEjC,MAAM,QAAQ,oBAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,MAAM,aAAa;AAAA,EACxB,cAAc,CAAC;AAAA,EACf,SAAS,CAAC;AAAA,EACV,MAAM,CAAC;AACT;AAIA,MAAM,MAAM,CAAC,SAAiB,CAAC,SAC7B,KAAK,OAAO,SAAS,oBAAoB,KAAK,MAAM,MAAM,SAAS;AAE9D,SAAS,UAAU,MAAoC,MAAgC;AAC5F,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAmC,CAAC;AAC1C,QAAM,OAAO,KAAK,KAAK,SAAS;AAChC,MAAI,KAAM,MAAK,SAAS,IAAI;AAC5B,QAAM,QAAQ,KAAK,KAAK,UAAU;AAClC,MAAI;AACF,SAAK,UAAU,IAAI;AAAA,MACjB,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC5C,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACtE;AACF,QAAM,QAAQ,KAAK,KAAK,UAAU;AAClC,MAAI,MAAO,MAAK,UAAU,IAAI,EAAE,QAAQ,MAAM,SAAS,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,EAAE;AAC7E,SAAO;AAAA,IACL,cAAc,KAAK;AAAA,IACnB,SAAS,KAAK,QAAQ,OAAO,CAAC,UAAuB,MAAM,IAAI,MAAM,IAAI,CAAC;AAAA,IAC1E;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/host.js

@@ -1,24 +1,31 @@
 import {
   createHost,
+  forbidden,
   replicatedState,
   resource
 } from "@earendil-works/chord";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
-import { attachApprovals } from "./approvals/index.js";
+import {
+  attachApprovals
+} from "./approvals/index.js";
 import { createAgentControl } from "./control.js";
 import { trackDeliveries } from "./deliveries.js";
+import { createGuests } from "./guests/index.js";
+import { admitGuest, guestOpener } from "./guests/serve.js";
 import { createMonitor } from "./monitor/index.js";
 import { viewRemote } from "./readonly.js";
 import { createRemote } from "./remote/host.js";
 import { createPages, ownedPages } from "./remote/pages.js";
 import {
   AgentControl,
+  AgentGuestService,
   AgentPagesService,
   AgentRemoteService,
   AgentSettings,
   AgentTranscript,
   CONTROL_METHODS,
   CONTROL_READS,
+  GUEST_METHODS,
   PAGE_METHODS,
   REMOTE_METHODS,
   REMOTE_READS,
@@ -26,6 +33,7 @@ import {
 } from "./services.js";
 import {
   AGENT_HOST,
+  guestOf,
   principalKey,
   readable,
   readablesOf,
@@ -102,7 +110,10 @@ async function hostAgent(agent, options = {}) {
   const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];
   const pages = options.pages ?? createPages();
   const deliveries = trackDeliveries(agent.harness, state, context);
-  const approvals = options.approvals ?? await attachApprovals({ harness: agent.harness }, context);
+  const approvals = options.approvals ?? await attachApprovals(
+    { harness: agent.harness, ...options.judge ? { judge: options.judge } : {} },
+    context
+  );
   const monitor = createMonitor({
     ...options.monitor,
     harness: agent.harness,
@@ -110,6 +121,12 @@ async function hostAgent(agent, options = {}) {
     views: mounted.views,
     context
   });
+  const guests = await createGuests({
+    harness: agent.harness,
+    agents: agent.agents,
+    approvals,
+    context
+  });
   const control = createAgentControl(
     agent.harness,
     agent,
@@ -124,7 +141,8 @@ async function hostAgent(agent, options = {}) {
     monitor,
     options.secrets?.list,
     options.uploads,
-    options.labels
+    options.labels,
+    guests
   );
   const remote = createRemote({
     harness: agent.harness,
@@ -155,6 +173,7 @@ async function hostAgent(agent, options = {}) {
     monitor: monitor.state,
     vault: options.secrets?.vault ?? idleVault,
     labels: labels.state,
+    guests: guests.seats,
     approvals: approvals.state
   };
   const settings = options.settings ?? noSettings;
@@ -168,16 +187,26 @@ async function hostAgent(agent, options = {}) {
     settings,
     remote,
     pages,
+    guest: guestOpener(guests, agent.agents, mounted.views, context, approvals.state),
     decide: (by) => (id, decision, reason, using) => approvals.decide(id, decision, reason, by, using)
   });
+  const offGuests = guests.onEnd((id) => {
+    void host.invalidatePrincipal((principal) => guestOf(principal)?.id === id);
+  });
   let links = 0;
   return {
     serverId,
     agent,
     pages,
+    guests,
     approvals,
     ...options.users ? { users: options.users } : {},
     connect(endpoint, connectOptions) {
+      if (connectOptions?.guest) {
+        links += 1;
+        admitGuest(guests, endpoint, connectOptions.guest, serverId, links, host);
+        return;
+      }
       const seat = connectOptions?.readOnly ? "view" : connectOptions?.pages === false ? "control" : "owner";
       links += 1;
       const link = new PortLink(endpoint);
@@ -185,7 +214,9 @@ async function hostAgent(agent, options = {}) {
       host.accept(link, { principal: { seat, link: links } });
     },
     async close() {
+      offGuests();
       await host.close();
+      guests.dispose();
       await pages.dispose();
       await monitor.dispose();
       await remote.dispose();
@@ -210,12 +241,48 @@ async function hostAgent(agent, options = {}) {
     }
   };
 }
+const CLOSED_TO_GUESTS = "a guest seat has only its transcript and propose";
+const opened = /* @__PURE__ */ new WeakSet();
+const openToGuests = (factory) => {
+  opened.add(factory);
+  return factory;
+};
+function closedToGuests(host) {
+  const serve = ((type, factory, options) => host.serve(
+    type,
+    opened.has(factory) ? factory : (input, principal, self) => {
+      if (seatOf(principal) === "guest") throw forbidden(CLOSED_TO_GUESTS);
+      return factory(input, principal, self);
+    },
+    options
+  ));
+  return new Proxy(host, {
+    get(target, key) {
+      if (key === "serve") return serve;
+      const value = Reflect.get(target, key, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+function lazily(state) {
+  return {
+    get value() {
+      return readable(state()).value;
+    },
+    subscribe: (listener) => readable(state()).subscribe(listener),
+    events: (listener) => readable(state()).events(listener)
+  };
+}
+const GUEST_MANAGERS = /* @__PURE__ */ new Set(["owner"]);
+const OWNER_GUESTS = "only the owner can invite or revoke guests";
+const notOwner = () => Promise.reject(forbidden(OWNER_GUESTS));
 const seated = (serving, seat) => ({
   ...serving.trusted,
-  decide: serving.decide(seat === "owner" ? "owner" : "follower")
+  decide: serving.decide(seat === "owner" ? "owner" : "follower"),
+  ...GUEST_MANAGERS.has(seat) ? {} : { guestOpen: notOwner, guestRevoke: notOwner }
 });
 function serveAgent(serving) {
-  const host = createHost({ name: AGENT_HOST, principalKey });
+  const host = closedToGuests(createHost({ name: AGENT_HOST, principalKey }));
   const viewing = { ...serving.transcript, monitor: serving.viewMonitor };
   host.serve(AgentControl, ((_input, principal) => {
     const seat = seatOf(principal);
@@ -249,10 +316,36 @@ function serveAgent(serving) {
     });
     return { kind: "pages", ...served(() => held.mine.value, PAGE_METHODS) };
   }));
+  host.serve(
+    AgentGuestService,
+    openToGuests((_input, principal, self) => {
+      const guest = guestOf(principal);
+      if (!guest) return { kind: "none" };
+      const opening = serving.guest?.(guest);
+      if (!opening) throw forbidden(CLOSED_TO_GUESTS);
+      const held = self.resources({
+        seat: resource({ rev: 1, open: () => opening, close: (made) => made.dispose() })
+      });
+      const later = (name) => lazily(() => held.seat.value.value[name]);
+      return {
+        kind: "guest",
+        transcript: later("transcript"),
+        seat: later("seat"),
+        proposals: later("proposals"),
+        ...served(() => held.seat.value.value, GUEST_METHODS)
+      };
+    })
+  );
   return host;
 }
 export {
+  CLOSED_TO_GUESTS,
+  GUEST_MANAGERS,
+  OWNER_GUESTS,
+  closedToGuests,
   hostAgent,
+  lazily,
+  openToGuests,
   serveAgent
 };
 //# sourceMappingURL=host.js.map

package/dist/host.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/host.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createHost,\n  type Host,\n  type ReplicatedState,\n  replicatedState,\n  resource,\n  type Self,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { Agent } from './agent.ts';\nimport { type Approvals, attachApprovals, type DecidedBy } from './approvals/index.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport type { UserClients } from './kernel/users.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { createMonitor, type MonitorOptions } from './monitor/index.ts';\nimport { viewRemote } from './readonly.ts';\nimport { type AgentRemote, createRemote } from './remote/host.ts';\nimport { createPages, ownedPages, type Pages } from './remote/pages.ts';\nimport type { SecretName } from './secrets/names.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSettings,\n  AgentTranscript,\n  CONTROL_METHODS,\n  CONTROL_READS,\n  type Command,\n  PAGE_METHODS,\n  type PrivateRevision,\n  REMOTE_METHODS,\n  REMOTE_READS,\n  SETTINGS_METHODS,\n} from './services.ts';\nimport {\n  AGENT_HOST,\n  type AgentPrincipal,\n  principalKey,\n  readable,\n  readablesOf,\n  type Seat,\n  seatOf,\n  served,\n} from './serving.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { slimmer, type Thumbnail, thumbnail } from './thumbs.ts';\nimport { type LabelsRuntime, visibleLabels, watchLabel } from './titles/labels.ts';\nimport type { Uploads } from './uploads.ts';\nimport { agentViews } from './views.ts';\nimport { type PortEndpoint, PortLink } from './wire.ts';\n\nexport interface ConnectOptions {\n  readOnly?: boolean;\n  pages?: boolean;\n}\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  readonly users?: UserClients;\n  readonly pages: Pages;\n  readonly approvals: Approvals;\n  connect(endpoint: PortEndpoint, options?: ConnectOptions): void;\n  close(): Promise<void>;\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  signIn: async () => null,\n  dismissMoved: async () => {},\n};\n\nasync function follow(\n  agent: Agent,\n  context: Context,\n  slim: (view: ConversationView) => ConversationView\n) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(slim(attached.value));\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, slim(value));\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, slim(next.value));\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    refresh: () => state.replace(context, slim(attached.value)),\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport interface HostSecrets {\n  vault: ReplicatedState<VaultState>;\n  list(): readonly SecretName[];\n  close?(): void;\n}\n\nconst idleVault = replicatedState<VaultState>({\n  port: 'none',\n  needed: false,\n  version: 0,\n  locked: 'no',\n  held: 0,\n});\n\nfunction gatedControls(\n  control: AgentControl,\n  shown: (entry: number) => boolean,\n  views: () => readonly ConversationView[],\n  labels: ReplicatedState<Record<string, string>>\n) {\n  const visible = (entry: number) =>\n    views().some((view) => view.entries.some((item) => item.id === entry));\n  const gated =\n    (allowed: (entry: number) => boolean): AgentControl['image'] =>\n    async (ref, using) =>\n      allowed(ref.entry) ? control.image(ref, using) : { data: null, mimeType: null };\n  const trusted: AgentControl = { ...control, image: gated(shown) };\n  const viewed: AgentControl = { ...control, image: gated(visible), toolLabel: watchLabel(labels) };\n  return { trusted, viewed };\n}\n\nconst noRevision = () => replicatedState<PrivateRevision>({ revision: 0 });\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n    users?: UserClients;\n    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users'>;\n    pages?: Pages;\n    secrets?: HostSecrets;\n    uploads?: Uploads;\n    thumbnail?: Thumbnail;\n    labels?: LabelsRuntime;\n    approvals?: Approvals;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  let refresh = () => {};\n  const slims = slimmer(options.thumbnail ?? thumbnail, () => refresh());\n  const transcript = await follow(agent, context, slims.slim);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context, slims.slim);\n  refresh = () => {\n    transcript.refresh();\n    mounted.refresh();\n  };\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const pages = options.pages ?? createPages();\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const approvals =\n    options.approvals ?? (await attachApprovals({ harness: agent.harness }, context));\n  const monitor = createMonitor({\n    ...options.monitor,\n    harness: agent.harness,\n    agents: agent.agents,\n    views: mounted.views,\n    context,\n  });\n  const control = createAgentControl(\n    agent.harness,\n    agent,\n    deliveries,\n    options.licks,\n    options.scoops,\n    options.skills,\n    options.sprinkles,\n    options.memory,\n    options.freezer,\n    options.changes,\n    monitor,\n    options.secrets?.list,\n    options.uploads,\n    options.labels\n  );\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    vault: options.secrets?.vault ?? idleVault,\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  const shownViews = () => [state.value, ...Object.values(mounted.views.value)];\n  const kept = options.labels?.labels ?? replicatedState<Record<string, string>>({});\n  const labels = visibleLabels(kept, [state, mounted.views], shownViews);\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    privateRevision: options.skills?.privateRevision ?? noRevision(),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n    monitor: monitor.state,\n    vault: options.secrets?.vault ?? idleVault,\n    labels: labels.state,\n    approvals: approvals.state,\n  };\n  const settings = options.settings ?? noSettings;\n  const gates = gatedControls(control, slims.shown, shownViews, transcriptService.labels);\n  const { trusted, viewed } = gates;\n  const host = serveAgent({\n    trusted,\n    viewed,\n    transcript: transcriptService,\n    viewMonitor: monitor.viewState,\n    settings,\n    remote,\n    pages,\n    decide: (by) => (id, decision, reason, using) =>\n      approvals.decide(id, decision, reason, by, using),\n  });\n  let links = 0;\n  return {\n    serverId,\n    agent,\n    pages,\n    approvals,\n    ...(options.users ? { users: options.users } : {}),\n    connect(endpoint, connectOptions) {\n      const seat: Seat = connectOptions?.readOnly\n        ? 'view'\n        : connectOptions?.pages === false\n          ? 'control'\n          : 'owner';\n      links += 1;\n      const link = new PortLink(endpoint);\n      link.greet(serverId);\n      host.accept(link, { principal: { seat, link: links } satisfies AgentPrincipal });\n    },\n    async close() {\n      await host.close();\n      await pages.dispose();\n      await monitor.dispose();\n      await remote.dispose();\n      deliveries.dispose();\n      approvals.close();\n      transcript.dispose();\n      mounted.dispose();\n      labels.dispose();\n      slims.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      options.secrets?.close?.();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n      await options.users?.close();\n    },\n  };\n}\n\ninterface Served {\n  trusted: AgentControl;\n  viewed: AgentControl;\n  transcript: Record<keyof AgentTranscript, ReplicatedState<unknown>>;\n  viewMonitor: ReplicatedState<unknown>;\n  settings: AgentSettings;\n  remote: AgentRemote;\n  pages: Pages;\n  decide: (by: DecidedBy) => AgentControl['decide'];\n}\n\nconst seated = (serving: Served, seat: Seat): AgentControl => ({\n  ...serving.trusted,\n  decide: serving.decide(seat === 'owner' ? 'owner' : 'follower'),\n});\n\nexport function serveAgent(serving: Served): Host {\n  const host = createHost({ name: AGENT_HOST, principalKey });\n  const viewing = { ...serving.transcript, monitor: serving.viewMonitor };\n  host.serve(AgentControl, ((_input: unknown, principal: unknown) => {\n    const seat = seatOf(principal);\n    if (seat === 'view') return { kind: 'view', ...served(() => serving.viewed, CONTROL_READS) };\n    const control = seated(serving, seat);\n    return { kind: 'control', ...served(() => control, CONTROL_METHODS) };\n  }) as never);\n  host.serve(AgentTranscript, ((_input: unknown, principal: unknown) => ({\n    kind: 'transcript',\n    ...readablesOf(seatOf(principal) === 'view' ? viewing : serving.transcript),\n  })) as never);\n  host.serve(AgentSettings, ((_input: unknown, principal: unknown) => ({\n    kind: seatOf(principal) === 'view' ? 'view' : 'settings',\n    state: readable(serving.settings.state),\n    ...(seatOf(principal) === 'view' ? {} : served(() => serving.settings, SETTINGS_METHODS)),\n  })) as never);\n  host.serve(AgentRemoteService, ((_input: unknown, principal: unknown) => {\n    if (seatOf(principal) !== 'view')\n      return { kind: 'remote', ...served(() => serving.remote, REMOTE_METHODS) };\n    const scoped = viewRemote(serving.remote);\n    return { kind: 'watch', ...served(() => scoped, REMOTE_READS) };\n  }) as never);\n  host.serve(AgentPagesService, ((_input: unknown, principal: unknown, self: Self) => {\n    if (seatOf(principal) !== 'owner') return { kind: 'none' };\n    const held = self.resources({\n      mine: resource({\n        rev: 1,\n        open: () => ownedPages(serving.pages),\n        close: (mine) => mine.release(),\n      }),\n    });\n    return { kind: 'pages', ...served(() => held.mine.value, PAGE_METHODS) };\n  }) as never);\n  return host;\n}\n"],
-  "mappings": "AAAA;AAAA,EAEE;AAAA,EAGA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,0BAA0B;AAGnC,SAAyB,uBAAuC;AAGhE,SAAS,0BAA2D;AACpE,SAAS,uBAAuB;AAMhC,SAAS,qBAA0C;AACnD,SAAS,kBAAkB;AAC3B,SAA2B,oBAAoB;AAC/C,SAAS,aAAa,kBAA8B;AAGpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,SAAyB,iBAAiB;AACnD,SAA6B,eAAe,kBAAkB;AAE9D,SAAS,kBAAkB;AAC3B,SAA4B,gBAAgB;AAiB5C,MAAM,aAA4B;AAAA,EAChC,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnD,SAAS,YAAY;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,YAAY,YAAY;AAAA,EAAC;AAAA,EACzB,QAAQ,YAAY;AAAA,EACpB,cAAc,YAAY;AAAA,EAAC;AAC7B;AAEA,eAAe,OACb,OACA,SACA,MACA;AACA,MAAI,WAAW,MAAM,MAAM,KAAK,EAAE,UAAU,OAAO;AACnD,QAAM,QAAQ,gBAAkC,KAAK,SAAS,KAAK,CAAC;AACpE,QAAM,SAAS,CAAC,OAAyB,SAAkB,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC;AAC1F,MAAI,MAAM,SAAS,UAAU,MAAM;AACnC,QAAM,OAAO,MAAM,OAAO,OAAO,iBAAiB;AAChD,UAAM,OAAO,MAAM,aAAa,UAAU,OAAO;AACjD,QAAI;AACJ,aAAS,QAAQ;AACjB,eAAW;AACX,UAAM,QAAQ,SAAS,KAAK,KAAK,KAAK,CAAC;AACvC,UAAM,KAAK,UAAU,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM,MAAM,QAAQ,SAAS,KAAK,SAAS,KAAK,CAAC;AAAA,IAC1D,UAAU;AACR,WAAK;AACL,UAAI;AACJ,eAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;AAQA,MAAM,YAAY,gBAA4B;AAAA,EAC5C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,MAAM;AACR,CAAC;AAED,SAAS,cACP,SACA,OACA,OACA,QACA;AACA,QAAM,UAAU,CAAC,UACf,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,QAAQ,KAAK,CAAC,SAAS,KAAK,OAAO,KAAK,CAAC;AACvE,QAAM,QACJ,CAAC,YACD,OAAO,KAAK,UACV,QAAQ,IAAI,KAAK,IAAI,QAAQ,MAAM,KAAK,KAAK,IAAI,EAAE,MAAM,MAAM,UAAU,KAAK;AAClF,QAAM,UAAwB,EAAE,GAAG,SAAS,OAAO,MAAM,KAAK,EAAE;AAChE,QAAM,SAAuB,EAAE,GAAG,SAAS,OAAO,MAAM,OAAO,GAAG,WAAW,WAAW,MAAM,EAAE;AAChG,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,MAAM,aAAa,MAAM,gBAAiC,EAAE,UAAU,EAAE,CAAC;AAEzE,eAAsB,UACpB,OACA,UAoBI,CAAC,GACe;AACpB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY,OAAO,WAAW;AACvD,MAAI,UAAU,MAAM;AAAA,EAAC;AACrB,QAAM,QAAQ,QAAQ,QAAQ,aAAa,WAAW,MAAM,QAAQ,CAAC;AACrE,QAAM,aAAa,MAAM,OAAO,OAAO,SAAS,MAAM,IAAI;AAC1D,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,SAAS,MAAM,IAAI;AAC3D,YAAU,MAAM;AACd,eAAW,QAAQ;AACnB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAC3C,QAAM,UAAU,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,MAAM,UAAU,KAAK,CAAC;AACvE,QAAM,QAAQ,QAAQ,SAAS,YAAY;AAC3C,QAAM,aAAa,gBAAgB,MAAM,SAAS,OAAO,OAAO;AAChE,QAAM,YACJ,QAAQ,aAAc,MAAM,gBAAgB,EAAE,SAAS,MAAM,QAAQ,GAAG,OAAO;AACjF,QAAM,UAAU,cAAc;AAAA,IAC5B,GAAG,QAAQ;AAAA,IACX,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,QAAQ;AAAA,IACf;AAAA,EACF,CAAC;AACD,QAAM,UAAU;AAAA,IACd,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACA,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,SAAS,UAAU,QAAQ,KAAK,SAAS,KAAK;AAAA,IACrD,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,MAAM,aAAa,SAAS,OAAO;AACjC,UAAI,CAAC,QAAS,QAAO,MAAM,KAAK;AAChC,YAAM,QAAQ,MAAM,MAAM,OAAO,aAAa,SAAS,KAAK;AAC5D,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG;AAC3D,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,QAAM,aAAa,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,OAAO,QAAQ,MAAM,KAAK,CAAC;AAC5E,QAAM,OAAO,QAAQ,QAAQ,UAAU,gBAAwC,CAAC,CAAC;AACjF,QAAM,SAAS,cAAc,MAAM,CAAC,OAAO,QAAQ,KAAK,GAAG,UAAU;AACrE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,UAAU,QAAQ,QAAQ,YAAY,gBAA2B,CAAC,CAAC;AAAA,IACnE,iBAAiB,QAAQ,QAAQ,mBAAmB,WAAW;AAAA,IAC/D,WAAW,QAAQ,WAAW,aAAa,gBAA4B,CAAC,CAAC;AAAA,IACzE,UAAU,QAAQ,QAAQ,YAAY,gBAA+B,CAAC,CAAC;AAAA,IACvE,cAAc,QAAQ,QAAQ,UAAU,gBAA+B,CAAC,CAAC;AAAA,IACzE,QAAQ,QAAQ,SAAS,UAAU,gBAA8B,CAAC,CAAC;AAAA,IACnE,SACE,QAAQ,SAAS,QAAQ,gBAA6B,EAAE,aAAa,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,IAC1F,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,QAAQ,OAAO;AAAA,IACf,WAAW,UAAU;AAAA,EACvB;AACA,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,QAAQ,cAAc,SAAS,MAAM,OAAO,YAAY,kBAAkB,MAAM;AACtF,QAAM,EAAE,SAAS,OAAO,IAAI;AAC5B,QAAM,OAAO,WAAW;AAAA,IACtB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,QAAQ,UACrC,UAAU,OAAO,IAAI,UAAU,QAAQ,IAAI,KAAK;AAAA,EACpD,CAAC;AACD,MAAI,QAAQ;AACZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,QAAQ,UAAU,gBAAgB;AAChC,YAAM,OAAa,gBAAgB,WAC/B,SACA,gBAAgB,UAAU,QACxB,YACA;AACN,eAAS;AACT,YAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,WAAK,MAAM,QAAQ;AACnB,WAAK,OAAO,MAAM,EAAE,WAAW,EAAE,MAAM,MAAM,MAAM,EAA2B,CAAC;AAAA,IACjF;AAAA,IACA,MAAM,QAAQ;AACZ,YAAM,KAAK,MAAM;AACjB,YAAM,MAAM,QAAQ;AACpB,YAAM,QAAQ,QAAQ;AACtB,YAAM,OAAO,QAAQ;AACrB,iBAAW,QAAQ;AACnB,gBAAU,MAAM;AAChB,iBAAW,QAAQ;AACnB,cAAQ,QAAQ;AAChB,aAAO,QAAQ;AACf,YAAM,QAAQ;AACd,iBAAW,OAAO,QAAS,KAAI;AAC/B,cAAQ,SAAS,MAAM;AACvB,cAAQ,SAAS,QAAQ;AACzB,YAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,WAAW,MAAM,OAAO;AACtC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAChC,YAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO;AAC3C,YAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM;AAClB,YAAM,QAAQ,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAaA,MAAM,SAAS,CAAC,SAAiB,UAA8B;AAAA,EAC7D,GAAG,QAAQ;AAAA,EACX,QAAQ,QAAQ,OAAO,SAAS,UAAU,UAAU,UAAU;AAChE;AAEO,SAAS,WAAW,SAAuB;AAChD,QAAM,OAAO,WAAW,EAAE,MAAM,YAAY,aAAa,CAAC;AAC1D,QAAM,UAAU,EAAE,GAAG,QAAQ,YAAY,SAAS,QAAQ,YAAY;AACtE,OAAK,MAAM,eAAe,CAAC,QAAiB,cAAuB;AACjE,UAAM,OAAO,OAAO,SAAS;AAC7B,QAAI,SAAS,OAAQ,QAAO,EAAE,MAAM,QAAQ,GAAG,OAAO,MAAM,QAAQ,QAAQ,aAAa,EAAE;AAC3F,UAAM,UAAU,OAAO,SAAS,IAAI;AACpC,WAAO,EAAE,MAAM,WAAW,GAAG,OAAO,MAAM,SAAS,eAAe,EAAE;AAAA,EACtE,EAAW;AACX,OAAK,MAAM,kBAAkB,CAAC,QAAiB,eAAwB;AAAA,IACrE,MAAM;AAAA,IACN,GAAG,YAAY,OAAO,SAAS,MAAM,SAAS,UAAU,QAAQ,UAAU;AAAA,EAC5E,GAAY;AACZ,OAAK,MAAM,gBAAgB,CAAC,QAAiB,eAAwB;AAAA,IACnE,MAAM,OAAO,SAAS,MAAM,SAAS,SAAS;AAAA,IAC9C,OAAO,SAAS,QAAQ,SAAS,KAAK;AAAA,IACtC,GAAI,OAAO,SAAS,MAAM,SAAS,CAAC,IAAI,OAAO,MAAM,QAAQ,UAAU,gBAAgB;AAAA,EACzF,GAAY;AACZ,OAAK,MAAM,qBAAqB,CAAC,QAAiB,cAAuB;AACvE,QAAI,OAAO,SAAS,MAAM;AACxB,aAAO,EAAE,MAAM,UAAU,GAAG,OAAO,MAAM,QAAQ,QAAQ,cAAc,EAAE;AAC3E,UAAM,SAAS,WAAW,QAAQ,MAAM;AACxC,WAAO,EAAE,MAAM,SAAS,GAAG,OAAO,MAAM,QAAQ,YAAY,EAAE;AAAA,EAChE,EAAW;AACX,OAAK,MAAM,oBAAoB,CAAC,QAAiB,WAAoB,SAAe;AAClF,QAAI,OAAO,SAAS,MAAM,QAAS,QAAO,EAAE,MAAM,OAAO;AACzD,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,MAAM,SAAS;AAAA,QACb,KAAK;AAAA,QACL,MAAM,MAAM,WAAW,QAAQ,KAAK;AAAA,QACpC,OAAO,CAAC,SAAS,KAAK,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH,CAAC;AACD,WAAO,EAAE,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,YAAY,EAAE;AAAA,EACzE,EAAW;AACX,SAAO;AACT;",
+  "sourcesContent": ["import {\n  type Context,\n  createHost,\n  forbidden,\n  type Host,\n  type Readable,\n  type ReplicatedState,\n  replicatedState,\n  resource,\n  type Self,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { Agent } from './agent.ts';\nimport {\n  type ApprovalJudge,\n  type Approvals,\n  attachApprovals,\n  type DecidedBy,\n} from './approvals/index.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport { createGuests, type Guests } from './guests/index.ts';\nimport { admitGuest, guestOpener } from './guests/serve.ts';\nimport type { UserClients } from './kernel/users.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { createMonitor, type MonitorOptions } from './monitor/index.ts';\nimport { viewRemote } from './readonly.ts';\nimport { type AgentRemote, createRemote } from './remote/host.ts';\nimport { createPages, ownedPages, type Pages } from './remote/pages.ts';\nimport type { SecretName } from './secrets/names.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AgentControl,\n  type AgentGuest,\n  AgentGuestService,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSettings,\n  AgentTranscript,\n  CONTROL_METHODS,\n  CONTROL_READS,\n  type Command,\n  GUEST_METHODS,\n  PAGE_METHODS,\n  type PrivateRevision,\n  REMOTE_METHODS,\n  REMOTE_READS,\n  SETTINGS_METHODS,\n} from './services.ts';\nimport {\n  AGENT_HOST,\n  type AgentPrincipal,\n  type GuestPrincipal,\n  guestOf,\n  principalKey,\n  readable,\n  readablesOf,\n  type Seat,\n  seatOf,\n  served,\n} from './serving.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { slimmer, type Thumbnail, thumbnail } from './thumbs.ts';\nimport { type LabelsRuntime, visibleLabels, watchLabel } from './titles/labels.ts';\nimport type { Uploads } from './uploads.ts';\nimport { agentViews } from './views.ts';\nimport { type PortEndpoint, PortLink } from './wire.ts';\n\nexport interface ConnectOptions {\n  readOnly?: boolean;\n  pages?: boolean;\n  guest?: { id: string; label: string };\n}\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  readonly users?: UserClients;\n  readonly pages: Pages;\n  readonly guests: Guests;\n  readonly approvals: Approvals;\n  connect(endpoint: PortEndpoint, options?: ConnectOptions): void;\n  close(): Promise<void>;\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  signIn: async () => null,\n  dismissMoved: async () => {},\n};\n\nasync function follow(\n  agent: Agent,\n  context: Context,\n  slim: (view: ConversationView) => ConversationView\n) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(slim(attached.value));\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, slim(value));\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, slim(next.value));\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    refresh: () => state.replace(context, slim(attached.value)),\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport interface HostSecrets {\n  vault: ReplicatedState<VaultState>;\n  list(): readonly SecretName[];\n  close?(): void;\n}\n\nconst idleVault = replicatedState<VaultState>({\n  port: 'none',\n  needed: false,\n  version: 0,\n  locked: 'no',\n  held: 0,\n});\n\nfunction gatedControls(\n  control: AgentControl,\n  shown: (entry: number) => boolean,\n  views: () => readonly ConversationView[],\n  labels: ReplicatedState<Record<string, string>>\n) {\n  const visible = (entry: number) =>\n    views().some((view) => view.entries.some((item) => item.id === entry));\n  const gated =\n    (allowed: (entry: number) => boolean): AgentControl['image'] =>\n    async (ref, using) =>\n      allowed(ref.entry) ? control.image(ref, using) : { data: null, mimeType: null };\n  const trusted: AgentControl = { ...control, image: gated(shown) };\n  const viewed: AgentControl = { ...control, image: gated(visible), toolLabel: watchLabel(labels) };\n  return { trusted, viewed };\n}\n\nconst noRevision = () => replicatedState<PrivateRevision>({ revision: 0 });\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n    users?: UserClients;\n    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users'>;\n    pages?: Pages;\n    secrets?: HostSecrets;\n    uploads?: Uploads;\n    thumbnail?: Thumbnail;\n    labels?: LabelsRuntime;\n    approvals?: Approvals;\n    judge?: ApprovalJudge;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  let refresh = () => {};\n  const slims = slimmer(options.thumbnail ?? thumbnail, () => refresh());\n  const transcript = await follow(agent, context, slims.slim);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context, slims.slim);\n  refresh = () => {\n    transcript.refresh();\n    mounted.refresh();\n  };\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const pages = options.pages ?? createPages();\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const approvals =\n    options.approvals ??\n    (await attachApprovals(\n      { harness: agent.harness, ...(options.judge ? { judge: options.judge } : {}) },\n      context\n    ));\n  const monitor = createMonitor({\n    ...options.monitor,\n    harness: agent.harness,\n    agents: agent.agents,\n    views: mounted.views,\n    context,\n  });\n  const guests = await createGuests({\n    harness: agent.harness,\n    agents: agent.agents,\n    approvals,\n    context,\n  });\n  const control = createAgentControl(\n    agent.harness,\n    agent,\n    deliveries,\n    options.licks,\n    options.scoops,\n    options.skills,\n    options.sprinkles,\n    options.memory,\n    options.freezer,\n    options.changes,\n    monitor,\n    options.secrets?.list,\n    options.uploads,\n    options.labels,\n    guests\n  );\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    vault: options.secrets?.vault ?? idleVault,\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  const shownViews = () => [state.value, ...Object.values(mounted.views.value)];\n  const kept = options.labels?.labels ?? replicatedState<Record<string, string>>({});\n  const labels = visibleLabels(kept, [state, mounted.views], shownViews);\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    privateRevision: options.skills?.privateRevision ?? noRevision(),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n    monitor: monitor.state,\n    vault: options.secrets?.vault ?? idleVault,\n    labels: labels.state,\n    guests: guests.seats,\n    approvals: approvals.state,\n  };\n  const settings = options.settings ?? noSettings;\n  const gates = gatedControls(control, slims.shown, shownViews, transcriptService.labels);\n  const { trusted, viewed } = gates;\n  const host = serveAgent({\n    trusted,\n    viewed,\n    transcript: transcriptService,\n    viewMonitor: monitor.viewState,\n    settings,\n    remote,\n    pages,\n    guest: guestOpener(guests, agent.agents, mounted.views, context, approvals.state),\n    decide: (by) => (id, decision, reason, using) =>\n      approvals.decide(id, decision, reason, by, using),\n  });\n  const offGuests = guests.onEnd((id) => {\n    void host.invalidatePrincipal((principal) => guestOf(principal)?.id === id);\n  });\n  let links = 0;\n  return {\n    serverId,\n    agent,\n    pages,\n    guests,\n    approvals,\n    ...(options.users ? { users: options.users } : {}),\n    connect(endpoint, connectOptions) {\n      if (connectOptions?.guest) {\n        links += 1;\n        admitGuest(guests, endpoint, connectOptions.guest, serverId, links, host);\n        return;\n      }\n      const seat: Seat = connectOptions?.readOnly\n        ? 'view'\n        : connectOptions?.pages === false\n          ? 'control'\n          : 'owner';\n      links += 1;\n      const link = new PortLink(endpoint);\n      link.greet(serverId);\n      host.accept(link, { principal: { seat, link: links } satisfies AgentPrincipal });\n    },\n    async close() {\n      offGuests();\n      await host.close();\n      guests.dispose();\n      await pages.dispose();\n      await monitor.dispose();\n      await remote.dispose();\n      deliveries.dispose();\n      approvals.close();\n      transcript.dispose();\n      mounted.dispose();\n      labels.dispose();\n      slims.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      options.secrets?.close?.();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n      await options.users?.close();\n    },\n  };\n}\n\ninterface Served {\n  trusted: AgentControl;\n  viewed: AgentControl;\n  transcript: Record<keyof AgentTranscript, ReplicatedState<unknown>>;\n  viewMonitor: ReplicatedState<unknown>;\n  settings: AgentSettings;\n  remote: AgentRemote;\n  pages: Pages;\n  guest?: (principal: GuestPrincipal) => { value: AgentGuest; dispose(): void } | undefined;\n  decide: (by: DecidedBy) => AgentControl['decide'];\n}\n\nexport const CLOSED_TO_GUESTS = 'a guest seat has only its transcript and propose';\n\nconst opened = new WeakSet<object>();\n\nexport const openToGuests = <F extends object>(factory: F): F => {\n  opened.add(factory);\n  return factory;\n};\n\nexport function closedToGuests(host: Host): Host {\n  const serve = ((type: never, factory: (...args: unknown[]) => unknown, options?: never) =>\n    host.serve(\n      type,\n      (opened.has(factory)\n        ? factory\n        : (input: unknown, principal: unknown, self: unknown) => {\n            if (seatOf(principal as never) === 'guest') throw forbidden(CLOSED_TO_GUESTS);\n            return factory(input, principal, self);\n          }) as never,\n      options\n    )) as Host['serve'];\n  return new Proxy(host, {\n    get(target, key) {\n      if (key === 'serve') return serve;\n      const value = Reflect.get(target, key, target) as unknown;\n      return typeof value === 'function' ? value.bind(target) : value;\n    },\n  });\n}\n\nexport function lazily<T>(state: () => ReplicatedState<T>): Readable<T> {\n  return {\n    get value() {\n      return readable(state()).value;\n    },\n    subscribe: (listener) => readable(state()).subscribe(listener),\n    events: (listener) => readable(state()).events(listener),\n  };\n}\n\nexport const GUEST_MANAGERS: ReadonlySet<Seat> = new Set<Seat>(['owner']);\n\nexport const OWNER_GUESTS = 'only the owner can invite or revoke guests';\n\nconst notOwner = () => Promise.reject(forbidden(OWNER_GUESTS));\n\nconst seated = (serving: Served, seat: Seat): AgentControl => ({\n  ...serving.trusted,\n  decide: serving.decide(seat === 'owner' ? 'owner' : 'follower'),\n  ...(GUEST_MANAGERS.has(seat) ? {} : { guestOpen: notOwner, guestRevoke: notOwner }),\n});\n\nexport function serveAgent(serving: Served): Host {\n  const host = closedToGuests(createHost({ name: AGENT_HOST, principalKey }));\n  const viewing = { ...serving.transcript, monitor: serving.viewMonitor };\n  host.serve(AgentControl, ((_input: unknown, principal: unknown) => {\n    const seat = seatOf(principal);\n    if (seat === 'view') return { kind: 'view', ...served(() => serving.viewed, CONTROL_READS) };\n    const control = seated(serving, seat);\n    return { kind: 'control', ...served(() => control, CONTROL_METHODS) };\n  }) as never);\n  host.serve(AgentTranscript, ((_input: unknown, principal: unknown) => ({\n    kind: 'transcript',\n    ...readablesOf(seatOf(principal) === 'view' ? viewing : serving.transcript),\n  })) as never);\n  host.serve(AgentSettings, ((_input: unknown, principal: unknown) => ({\n    kind: seatOf(principal) === 'view' ? 'view' : 'settings',\n    state: readable(serving.settings.state),\n    ...(seatOf(principal) === 'view' ? {} : served(() => serving.settings, SETTINGS_METHODS)),\n  })) as never);\n  host.serve(AgentRemoteService, ((_input: unknown, principal: unknown) => {\n    if (seatOf(principal) !== 'view')\n      return { kind: 'remote', ...served(() => serving.remote, REMOTE_METHODS) };\n    const scoped = viewRemote(serving.remote);\n    return { kind: 'watch', ...served(() => scoped, REMOTE_READS) };\n  }) as never);\n  host.serve(AgentPagesService, ((_input: unknown, principal: unknown, self: Self) => {\n    if (seatOf(principal) !== 'owner') return { kind: 'none' };\n    const held = self.resources({\n      mine: resource({\n        rev: 1,\n        open: () => ownedPages(serving.pages),\n        close: (mine) => mine.release(),\n      }),\n    });\n    return { kind: 'pages', ...served(() => held.mine.value, PAGE_METHODS) };\n  }) as never);\n  host.serve(\n    AgentGuestService,\n    openToGuests((_input: unknown, principal: unknown, self: Self) => {\n      const guest = guestOf(principal as never);\n      if (!guest) return { kind: 'none' };\n      const opening = serving.guest?.(guest);\n      if (!opening) throw forbidden(CLOSED_TO_GUESTS);\n      const held = self.resources({\n        seat: resource({ rev: 1, open: () => opening, close: (made) => made.dispose() }),\n      });\n      const later = (name: 'transcript' | 'seat' | 'proposals') =>\n        lazily(() => held.seat.value.value[name] as ReplicatedState<unknown>);\n      return {\n        kind: 'guest',\n        transcript: later('transcript'),\n        seat: later('seat'),\n        proposals: later('proposals'),\n        ...served(() => held.seat.value.value, GUEST_METHODS),\n      };\n    }) as never\n  );\n  return host;\n}\n"],
+  "mappings": "AAAA;AAAA,EAEE;AAAA,EACA;AAAA,EAIA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,0BAA0B;AAGnC;AAAA,EAGE;AAAA,OAEK;AAGP,SAAS,0BAA2D;AACpE,SAAS,uBAAuB;AAEhC,SAAS,oBAAiC;AAC1C,SAAS,YAAY,mBAAmB;AAKxC,SAAS,qBAA0C;AACnD,SAAS,kBAAkB;AAC3B,SAA2B,oBAAoB;AAC/C,SAAS,aAAa,kBAA8B;AAGpD;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,SAAyB,iBAAiB;AACnD,SAA6B,eAAe,kBAAkB;AAE9D,SAAS,kBAAkB;AAC3B,SAA4B,gBAAgB;AAmB5C,MAAM,aAA4B;AAAA,EAChC,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnD,SAAS,YAAY;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,YAAY,YAAY;AAAA,EAAC;AAAA,EACzB,QAAQ,YAAY;AAAA,EACpB,cAAc,YAAY;AAAA,EAAC;AAC7B;AAEA,eAAe,OACb,OACA,SACA,MACA;AACA,MAAI,WAAW,MAAM,MAAM,KAAK,EAAE,UAAU,OAAO;AACnD,QAAM,QAAQ,gBAAkC,KAAK,SAAS,KAAK,CAAC;AACpE,QAAM,SAAS,CAAC,OAAyB,SAAkB,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC;AAC1F,MAAI,MAAM,SAAS,UAAU,MAAM;AACnC,QAAM,OAAO,MAAM,OAAO,OAAO,iBAAiB;AAChD,UAAM,OAAO,MAAM,aAAa,UAAU,OAAO;AACjD,QAAI;AACJ,aAAS,QAAQ;AACjB,eAAW;AACX,UAAM,QAAQ,SAAS,KAAK,KAAK,KAAK,CAAC;AACvC,UAAM,KAAK,UAAU,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM,MAAM,QAAQ,SAAS,KAAK,SAAS,KAAK,CAAC;AAAA,IAC1D,UAAU;AACR,WAAK;AACL,UAAI;AACJ,eAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;AAQA,MAAM,YAAY,gBAA4B;AAAA,EAC5C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,MAAM;AACR,CAAC;AAED,SAAS,cACP,SACA,OACA,OACA,QACA;AACA,QAAM,UAAU,CAAC,UACf,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,QAAQ,KAAK,CAAC,SAAS,KAAK,OAAO,KAAK,CAAC;AACvE,QAAM,QACJ,CAAC,YACD,OAAO,KAAK,UACV,QAAQ,IAAI,KAAK,IAAI,QAAQ,MAAM,KAAK,KAAK,IAAI,EAAE,MAAM,MAAM,UAAU,KAAK;AAClF,QAAM,UAAwB,EAAE,GAAG,SAAS,OAAO,MAAM,KAAK,EAAE;AAChE,QAAM,SAAuB,EAAE,GAAG,SAAS,OAAO,MAAM,OAAO,GAAG,WAAW,WAAW,MAAM,EAAE;AAChG,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,MAAM,aAAa,MAAM,gBAAiC,EAAE,UAAU,EAAE,CAAC;AAEzE,eAAsB,UACpB,OACA,UAqBI,CAAC,GACe;AACpB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY,OAAO,WAAW;AACvD,MAAI,UAAU,MAAM;AAAA,EAAC;AACrB,QAAM,QAAQ,QAAQ,QAAQ,aAAa,WAAW,MAAM,QAAQ,CAAC;AACrE,QAAM,aAAa,MAAM,OAAO,OAAO,SAAS,MAAM,IAAI;AAC1D,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,SAAS,MAAM,IAAI;AAC3D,YAAU,MAAM;AACd,eAAW,QAAQ;AACnB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAC3C,QAAM,UAAU,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,MAAM,UAAU,KAAK,CAAC;AACvE,QAAM,QAAQ,QAAQ,SAAS,YAAY;AAC3C,QAAM,aAAa,gBAAgB,MAAM,SAAS,OAAO,OAAO;AAChE,QAAM,YACJ,QAAQ,aACP,MAAM;AAAA,IACL,EAAE,SAAS,MAAM,SAAS,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC,EAAG;AAAA,IAC7E;AAAA,EACF;AACF,QAAM,UAAU,cAAc;AAAA,IAC5B,GAAG,QAAQ;AAAA,IACX,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,QAAQ;AAAA,IACf;AAAA,EACF,CAAC;AACD,QAAM,SAAS,MAAM,aAAa;AAAA,IAChC,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,UAAU;AAAA,IACd,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,EACF;AACA,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,SAAS,UAAU,QAAQ,KAAK,SAAS,KAAK;AAAA,IACrD,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,MAAM,aAAa,SAAS,OAAO;AACjC,UAAI,CAAC,QAAS,QAAO,MAAM,KAAK;AAChC,YAAM,QAAQ,MAAM,MAAM,OAAO,aAAa,SAAS,KAAK;AAC5D,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG;AAC3D,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,QAAM,aAAa,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,OAAO,QAAQ,MAAM,KAAK,CAAC;AAC5E,QAAM,OAAO,QAAQ,QAAQ,UAAU,gBAAwC,CAAC,CAAC;AACjF,QAAM,SAAS,cAAc,MAAM,CAAC,OAAO,QAAQ,KAAK,GAAG,UAAU;AACrE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,UAAU,QAAQ,QAAQ,YAAY,gBAA2B,CAAC,CAAC;AAAA,IACnE,iBAAiB,QAAQ,QAAQ,mBAAmB,WAAW;AAAA,IAC/D,WAAW,QAAQ,WAAW,aAAa,gBAA4B,CAAC,CAAC;AAAA,IACzE,UAAU,QAAQ,QAAQ,YAAY,gBAA+B,CAAC,CAAC;AAAA,IACvE,cAAc,QAAQ,QAAQ,UAAU,gBAA+B,CAAC,CAAC;AAAA,IACzE,QAAQ,QAAQ,SAAS,UAAU,gBAA8B,CAAC,CAAC;AAAA,IACnE,SACE,QAAQ,SAAS,QAAQ,gBAA6B,EAAE,aAAa,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,IAC1F,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,WAAW,UAAU;AAAA,EACvB;AACA,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,QAAQ,cAAc,SAAS,MAAM,OAAO,YAAY,kBAAkB,MAAM;AACtF,QAAM,EAAE,SAAS,OAAO,IAAI;AAC5B,QAAM,OAAO,WAAW;AAAA,IACtB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,YAAY,QAAQ,MAAM,QAAQ,QAAQ,OAAO,SAAS,UAAU,KAAK;AAAA,IAChF,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,QAAQ,UACrC,UAAU,OAAO,IAAI,UAAU,QAAQ,IAAI,KAAK;AAAA,EACpD,CAAC;AACD,QAAM,YAAY,OAAO,MAAM,CAAC,OAAO;AACrC,SAAK,KAAK,oBAAoB,CAAC,cAAc,QAAQ,SAAS,GAAG,OAAO,EAAE;AAAA,EAC5E,CAAC;AACD,MAAI,QAAQ;AACZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,QAAQ,UAAU,gBAAgB;AAChC,UAAI,gBAAgB,OAAO;AACzB,iBAAS;AACT,mBAAW,QAAQ,UAAU,eAAe,OAAO,UAAU,OAAO,IAAI;AACxE;AAAA,MACF;AACA,YAAM,OAAa,gBAAgB,WAC/B,SACA,gBAAgB,UAAU,QACxB,YACA;AACN,eAAS;AACT,YAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,WAAK,MAAM,QAAQ;AACnB,WAAK,OAAO,MAAM,EAAE,WAAW,EAAE,MAAM,MAAM,MAAM,EAA2B,CAAC;AAAA,IACjF;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU;AACV,YAAM,KAAK,MAAM;AACjB,aAAO,QAAQ;AACf,YAAM,MAAM,QAAQ;AACpB,YAAM,QAAQ,QAAQ;AACtB,YAAM,OAAO,QAAQ;AACrB,iBAAW,QAAQ;AACnB,gBAAU,MAAM;AAChB,iBAAW,QAAQ;AACnB,cAAQ,QAAQ;AAChB,aAAO,QAAQ;AACf,YAAM,QAAQ;AACd,iBAAW,OAAO,QAAS,KAAI;AAC/B,cAAQ,SAAS,MAAM;AACvB,cAAQ,SAAS,QAAQ;AACzB,YAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,WAAW,MAAM,OAAO;AACtC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAChC,YAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO;AAC3C,YAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM;AAClB,YAAM,QAAQ,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAcO,MAAM,mBAAmB;AAEhC,MAAM,SAAS,oBAAI,QAAgB;AAE5B,MAAM,eAAe,CAAmB,YAAkB;AAC/D,SAAO,IAAI,OAAO;AAClB,SAAO;AACT;AAEO,SAAS,eAAe,MAAkB;AAC/C,QAAM,SAAS,CAAC,MAAa,SAA0C,YACrE,KAAK;AAAA,IACH;AAAA,IACC,OAAO,IAAI,OAAO,IACf,UACA,CAAC,OAAgB,WAAoB,SAAkB;AACrD,UAAI,OAAO,SAAkB,MAAM,QAAS,OAAM,UAAU,gBAAgB;AAC5E,aAAO,QAAQ,OAAO,WAAW,IAAI;AAAA,IACvC;AAAA,IACJ;AAAA,EACF;AACF,SAAO,IAAI,MAAM,MAAM;AAAA,IACrB,IAAI,QAAQ,KAAK;AACf,UAAI,QAAQ,QAAS,QAAO;AAC5B,YAAM,QAAQ,QAAQ,IAAI,QAAQ,KAAK,MAAM;AAC7C,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;AAEO,SAAS,OAAU,OAA8C;AACtE,SAAO;AAAA,IACL,IAAI,QAAQ;AACV,aAAO,SAAS,MAAM,CAAC,EAAE;AAAA,IAC3B;AAAA,IACA,WAAW,CAAC,aAAa,SAAS,MAAM,CAAC,EAAE,UAAU,QAAQ;AAAA,IAC7D,QAAQ,CAAC,aAAa,SAAS,MAAM,CAAC,EAAE,OAAO,QAAQ;AAAA,EACzD;AACF;AAEO,MAAM,iBAAoC,oBAAI,IAAU,CAAC,OAAO,CAAC;AAEjE,MAAM,eAAe;AAE5B,MAAM,WAAW,MAAM,QAAQ,OAAO,UAAU,YAAY,CAAC;AAE7D,MAAM,SAAS,CAAC,SAAiB,UAA8B;AAAA,EAC7D,GAAG,QAAQ;AAAA,EACX,QAAQ,QAAQ,OAAO,SAAS,UAAU,UAAU,UAAU;AAAA,EAC9D,GAAI,eAAe,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,WAAW,UAAU,aAAa,SAAS;AACnF;AAEO,SAAS,WAAW,SAAuB;AAChD,QAAM,OAAO,eAAe,WAAW,EAAE,MAAM,YAAY,aAAa,CAAC,CAAC;AAC1E,QAAM,UAAU,EAAE,GAAG,QAAQ,YAAY,SAAS,QAAQ,YAAY;AACtE,OAAK,MAAM,eAAe,CAAC,QAAiB,cAAuB;AACjE,UAAM,OAAO,OAAO,SAAS;AAC7B,QAAI,SAAS,OAAQ,QAAO,EAAE,MAAM,QAAQ,GAAG,OAAO,MAAM,QAAQ,QAAQ,aAAa,EAAE;AAC3F,UAAM,UAAU,OAAO,SAAS,IAAI;AACpC,WAAO,EAAE,MAAM,WAAW,GAAG,OAAO,MAAM,SAAS,eAAe,EAAE;AAAA,EACtE,EAAW;AACX,OAAK,MAAM,kBAAkB,CAAC,QAAiB,eAAwB;AAAA,IACrE,MAAM;AAAA,IACN,GAAG,YAAY,OAAO,SAAS,MAAM,SAAS,UAAU,QAAQ,UAAU;AAAA,EAC5E,GAAY;AACZ,OAAK,MAAM,gBAAgB,CAAC,QAAiB,eAAwB;AAAA,IACnE,MAAM,OAAO,SAAS,MAAM,SAAS,SAAS;AAAA,IAC9C,OAAO,SAAS,QAAQ,SAAS,KAAK;AAAA,IACtC,GAAI,OAAO,SAAS,MAAM,SAAS,CAAC,IAAI,OAAO,MAAM,QAAQ,UAAU,gBAAgB;AAAA,EACzF,GAAY;AACZ,OAAK,MAAM,qBAAqB,CAAC,QAAiB,cAAuB;AACvE,QAAI,OAAO,SAAS,MAAM;AACxB,aAAO,EAAE,MAAM,UAAU,GAAG,OAAO,MAAM,QAAQ,QAAQ,cAAc,EAAE;AAC3E,UAAM,SAAS,WAAW,QAAQ,MAAM;AACxC,WAAO,EAAE,MAAM,SAAS,GAAG,OAAO,MAAM,QAAQ,YAAY,EAAE;AAAA,EAChE,EAAW;AACX,OAAK,MAAM,oBAAoB,CAAC,QAAiB,WAAoB,SAAe;AAClF,QAAI,OAAO,SAAS,MAAM,QAAS,QAAO,EAAE,MAAM,OAAO;AACzD,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,MAAM,SAAS;AAAA,QACb,KAAK;AAAA,QACL,MAAM,MAAM,WAAW,QAAQ,KAAK;AAAA,QACpC,OAAO,CAAC,SAAS,KAAK,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH,CAAC;AACD,WAAO,EAAE,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,YAAY,EAAE;AAAA,EACzE,EAAW;AACX,OAAK;AAAA,IACH;AAAA,IACA,aAAa,CAAC,QAAiB,WAAoB,SAAe;AAChE,YAAM,QAAQ,QAAQ,SAAkB;AACxC,UAAI,CAAC,MAAO,QAAO,EAAE,MAAM,OAAO;AAClC,YAAM,UAAU,QAAQ,QAAQ,KAAK;AACrC,UAAI,CAAC,QAAS,OAAM,UAAU,gBAAgB;AAC9C,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B,MAAM,SAAS,EAAE,KAAK,GAAG,MAAM,MAAM,SAAS,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;AAAA,MACjF,CAAC;AACD,YAAM,QAAQ,CAAC,SACb,OAAO,MAAM,KAAK,KAAK,MAAM,MAAM,IAAI,CAA6B;AACtE,aAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY,MAAM,YAAY;AAAA,QAC9B,MAAM,MAAM,MAAM;AAAA,QAClB,WAAW,MAAM,WAAW;AAAA,QAC5B,GAAG,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO,aAAa;AAAA,MACtD;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/index.js

@@ -15,8 +15,24 @@ import { answerText, openAgent } from "./agent.js";
 import {
   APPROVAL_MS,
   ApprovalsDoc,
+  approvalJudge,
   attachApprovals,
-  REASONS
+  DEFAULT_POLICY,
+  JUDGE_ALLOW,
+  JUDGE_DENY,
+  JUDGE_KIND,
+  JUDGE_MODEL,
+  JUDGE_QUESTIONS,
+  judgeModelOf,
+  judgeSpender,
+  judgeState,
+  ownerIntent,
+  POLICY_FILE,
+  REASONS,
+  seedPolicy,
+  VERDICT_REASONS,
+  verdictOf,
+  verdictRecorder
 } from "./approvals/index.js";
 import {
   FILE_LIMIT,
@@ -27,6 +43,11 @@ import {
 } from "./attachments.js";
 import { connectAgent } from "./client.js";
 import { createAgentControl } from "./control.js";
+import {
+  connectGuest,
+  GUEST_ONLY,
+  SEAT_REFUSED
+} from "./guests/client.js";
 import { hostAgent } from "./host.js";
 import { HOME, kernelEnvironment, SliccKernelEnv } from "./kernel/env.js";
 import {
@@ -93,19 +114,29 @@ export {
   ApprovalsDoc,
   BEDROCK,
   DEFAULT_MODEL,
+  DEFAULT_POLICY,
   DEFAULT_REGIONS,
   FILE_LIMIT,
+  GUEST_ONLY,
   HOME,
   IMAGE_LIMIT,
+  JUDGE_ALLOW,
+  JUDGE_DENY,
+  JUDGE_KIND,
+  JUDGE_MODEL,
+  JUDGE_QUESTIONS,
   LINK_PROTOCOL,
+  POLICY_FILE,
   PREFERRED_MODELS,
   PortLink,
   REASONS,
+  SEAT_REFUSED,
   SESSION_HEADER,
   SliccKernelEnv,
   SliccPrompt,
   TOTAL_LIMIT,
   UPLOADS,
+  VERDICT_REASONS,
   VERSION_HEADER,
   WasmSqliteDatabase,
   adminOver,
@@ -116,22 +147,29 @@ export {
   adobeProvider,
   adobeUsage,
   answerText,
+  approvalJudge,
   attachApprovals,
   connectAgent,
+  connectGuest,
   createAgentControl,
   createAgentSettings,
   createPages,
   createSliccModels,
   hostAgent,
+  judgeModelOf,
+  judgeSpender,
+  judgeState,
   kernelEnvironment,
   kernelPort,
   kernelPorts,
   openAgent,
   openMemorySqliteStorage,
   openOpfsSqliteStorage,
+  ownerIntent,
   preferredModel,
   resolveDefaultModel,
   runAgentWorker,
+  seedPolicy,
   serveAdmin,
   serveConnections,
   sliccPrompt,
@@ -143,6 +181,8 @@ export {
   upload,
   userClients,
   userParts,
+  verdictOf,
+  verdictRecorder,
   withAdobeIdentity,
   withDefaultRegions
 };

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeClassifiers,\n  adobeConfig,\n  adobeIdentity,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n  SESSION_HEADER,\n  VERSION_HEADER,\n  withAdobeIdentity,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport {\n  APPROVAL_MS,\n  type Approval,\n  type ApprovalAnswer,\n  type ApprovalDecided,\n  type ApprovalDraft,\n  type ApprovalKind,\n  type ApprovalRequester,\n  type ApprovalState,\n  type Approvals,\n  ApprovalsDoc,\n  type ApprovalTier,\n  type ApprovalVerdict,\n  attachApprovals,\n  type DecidedBy,\n  REASONS,\n} from './approvals/index.ts';\nexport {\n  FILE_LIMIT,\n  IMAGE_LIMIT,\n  type SendAttachment,\n  type ShownAttachment,\n  splitUser,\n  TOTAL_LIMIT,\n  userParts,\n} from './attachments.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport { type AgentHost, type ConnectOptions, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport {\n  adminOver,\n  type KernelAdmin,\n  type KernelGroup,\n  type KernelGroups,\n  type KernelUser,\n  type KernelUsers,\n  serveAdmin,\n  type UserClient,\n  type UserClients,\n  type UserConnect,\n  type UserSpec,\n  userClients,\n} from './kernel/users.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport {\n  type Loopback,\n  type Transport,\n  type TransportResponse,\n  transportFetch,\n} from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type KernelSource,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AgentPages,\n  createPages,\n  type PageBatch,\n  type PageCaller,\n  type PageRequest,\n  type PageResult,\n  type Pages,\n  type PagesOpened,\n  type PageTab,\n} from './remote/pages.ts';\nexport {\n  type AccountState,\n  AgentControl,\n  AgentPagesService,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  PREFERRED_MODELS,\n  preferredModel,\n  resolveDefaultModel,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { UPLOADS, type Uploads, upload } from './uploads.ts';\nexport { LINK_PROTOCOL, type PortEndpoint, PortLink } from './wire.ts';\nexport {\n  type KernelPorts,\n  kernelPort,\n  kernelPorts,\n  serveConnections,\n  type WorkerScope,\n} from './worker.ts';\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAwC,YAAY,iBAAiB;AACrE;AAAA,EACE;AAAA,EASA;AAAA,EAGA;AAAA,EAEA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC,SAA8C,iBAAiB;AAQ/D,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EAMA;AAAA,EAKA;AAAA,OACK;AACP;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AACP,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,OAQK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,SAAuB,cAAc;AAC9C,SAAS,eAAkC,gBAAgB;AAC3D;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;",
+  "sourcesContent": ["export {\n  ADOBE,\n  ADOBE_PROXY,\n  type AdobeConfig,\n  type AdobeModelInfo,\n  adobeClassifiers,\n  adobeConfig,\n  adobeIdentity,\n  adobeModel,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n  SESSION_HEADER,\n  VERSION_HEADER,\n  withAdobeIdentity,\n} from './adobe.ts';\nexport { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts';\nexport {\n  APPROVAL_MS,\n  type Approval,\n  type ApprovalAnswer,\n  type ApprovalDecided,\n  type ApprovalDraft,\n  type ApprovalJudge,\n  type ApprovalKind,\n  type ApprovalRequester,\n  type ApprovalState,\n  type Approvals,\n  ApprovalsDoc,\n  type ApprovalTier,\n  type ApprovalVerdict,\n  approvalJudge,\n  attachApprovals,\n  DEFAULT_POLICY,\n  type DecidedBy,\n  JUDGE_ALLOW,\n  JUDGE_DENY,\n  JUDGE_KIND,\n  JUDGE_MODEL,\n  JUDGE_QUESTIONS,\n  type Judgement,\n  judgeModelOf,\n  judgeSpender,\n  judgeState,\n  type OwnerIntent,\n  ownerIntent,\n  POLICY_FILE,\n  REASONS,\n  seedPolicy,\n  VERDICT_REASONS,\n  verdictOf,\n  verdictRecorder,\n} from './approvals/index.ts';\nexport {\n  FILE_LIMIT,\n  IMAGE_LIMIT,\n  type SendAttachment,\n  type ShownAttachment,\n  splitUser,\n  TOTAL_LIMIT,\n  userParts,\n} from './attachments.ts';\nexport { type AgentConnection, connectAgent } from './client.ts';\nexport { createAgentControl } from './control.ts';\nexport {\n  connectGuest,\n  GUEST_ONLY,\n  type GuestConnection,\n  SEAT_REFUSED,\n} from './guests/client.ts';\nexport type { GuestOpened, Proposed, ProposeRequest } from './guests/index.ts';\nexport type { GuestDraft, GuestGate, GuestGates, GuestSeat } from './guests/seats.ts';\nexport { type AgentHost, type ConnectOptions, hostAgent } from './host.ts';\nexport type {\n  KernelClient,\n  KernelFs,\n  KernelProcess,\n  KernelStat,\n  SpawnOptions,\n} from './kernel/client.ts';\nexport { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nexport {\n  adminOver,\n  type KernelAdmin,\n  type KernelGroup,\n  type KernelGroups,\n  type KernelUser,\n  type KernelUsers,\n  serveAdmin,\n  type UserClient,\n  type UserClients,\n  type UserConnect,\n  type UserSpec,\n  userClients,\n} from './kernel/users.ts';\nexport {\n  type AgentWorkerOptions,\n  type AgentWorkerScope,\n  type KernelAttach,\n  runAgentWorker,\n} from './main.ts';\nexport {\n  type Loopback,\n  type Transport,\n  type TransportResponse,\n  transportFetch,\n} from './net.ts';\nexport {\n  AGENT_LOCK,\n  type AgentOwner,\n  type AgentWorker,\n  type KernelSource,\n  type OwnerOptions,\n  startAgent,\n} from './owner.ts';\nexport { SliccPrompt, sliccPrompt } from './prompt.ts';\nexport {\n  type AgentPages,\n  createPages,\n  type PageBatch,\n  type PageCaller,\n  type PageRequest,\n  type PageResult,\n  type Pages,\n  type PagesOpened,\n  type PageTab,\n} from './remote/pages.ts';\nexport {\n  type AccountState,\n  AgentControl,\n  AgentPagesService,\n  AgentSettings,\n  type AgentSettingsChange,\n  AgentTranscript,\n  type BudgetState,\n  type ModelChoice,\n  type OperationError,\n  type PromptResult,\n  type SendMode,\n  type SendRequest,\n  type SendResponse,\n  type SettingsState,\n  type SignIn,\n} from './services.ts';\nexport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  DEFAULT_MODEL,\n  DEFAULT_REGIONS,\n  PREFERRED_MODELS,\n  preferredModel,\n  resolveDefaultModel,\n  sliccProviders,\n  withDefaultRegions,\n} from './settings.ts';\nexport {\n  AGENT_DIRECTORY,\n  type OpfsSqliteOptions,\n  openMemorySqliteStorage,\n  openOpfsSqliteStorage,\n  WasmSqliteDatabase,\n} from './sqlite.ts';\nexport { type SystemFacts, systemSection } from './system.ts';\nexport { UPLOADS, type Uploads, upload } from './uploads.ts';\nexport { LINK_PROTOCOL, type PortEndpoint, PortLink } from './wire.ts';\nexport {\n  type KernelPorts,\n  kernelPort,\n  kernelPorts,\n  serveConnections,\n  type WorkerScope,\n} from './worker.ts';\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAwC,YAAY,iBAAiB;AACrE;AAAA,EACE;AAAA,EAUA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA+B,oBAAoB;AACnD,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAGP,SAA8C,iBAAiB;AAQ/D,SAAS,MAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EAMA;AAAA,EAKA;AAAA,OACK;AACP;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EAIE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AACP,SAAS,aAAa,mBAAmB;AACzC;AAAA,EAEE;AAAA,OAQK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA2B,qBAAqB;AAChD,SAAS,SAAuB,cAAc;AAC9C,SAAS,eAAkC,gBAAgB;AAC3D;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;",
   "names": []
 }

package/dist/main.js

@@ -5,6 +5,14 @@ import {
 } from "@earendil-works/pi-durable";
 import { CodingTools } from "@earendil-works/pi-durable/tools";
 import { openAgent } from "./agent.js";
+import {
+  approvalJudge,
+  judgeModelOf,
+  judgeSpender,
+  ownerIntent,
+  seedPolicy,
+  verdictRecorder
+} from "./approvals/index.js";
 import { browserGuard } from "./browser/guard.js";
 import { attachChanges, CHANGES_MS } from "./changes/index.js";
 import {
@@ -241,6 +249,19 @@ async function settingsOf(made, mcp, moved) {
   settings.state.subscribe(() => void endpoints.models(bases()).catch(() => void 0));
   return settings;
 }
+async function setupJudge(models, home, at, agent, memories) {
+  await seedPolicy(home, BACKGROUND_CONTEXT).catch(() => false);
+  const settings = settingsText(home, HOME, at.agentDir);
+  return {
+    judge: approvalJudge({
+      models,
+      model: async (context) => judgeModelOf(await settings(context)),
+      intent: ownerIntent({ env: home, agents: agent.agents, memories }),
+      spend: judgeSpender((agentId, context) => agent.agents.conversation(agentId, context))
+    }),
+    record: verdictRecorder((agentId, context) => agent.agents.conversation(agentId, context))
+  };
+}
 function setupTitles(registry, models, home, at, opened) {
   const settings = settingsText(home, HOME, at.agentDir);
   const titleFn = titler(models, settings);
@@ -394,8 +415,8 @@ async function start(scope, ports, options, vault) {
     ...options.catalog ? { catalog: options.catalog } : {}
   });
   await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => void 0);
-  const changes = attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS });
   return hostAgent(agent, {
+    judge: await setupJudge(models, home, at, agent, () => memoryRuntime.memories.value),
     settings,
     licks: { licks: licks.licks, sources },
     scoops: { scoops: scoops.scoops, runtime },
@@ -403,7 +424,7 @@ async function start(scope, ports, options, vault) {
     sprinkles,
     memory: memoryRuntime,
     freezer,
-    changes,
+    changes: attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS }),
     pages,
     labels: await attachLabels({ ...agent, label: titles.label, vault: vault.state }),
     mcp: mcpRuntime,