@alisio/server 0.1.0-alpha.1

package/dist/routes/management.js

@@ -0,0 +1,326 @@
+/**
+ * Management routes (RF-14, §8.2): plugins, skills, MCP servers, agent presets and settings of
+ * one workspace application. Responses are path- and credential-safe: MCP commands, arguments
+ * and URLs are never sent, skills carry no file paths. Changes that alter the slash-command
+ * catalog broadcast `catalog_changed` so every open palette refreshes.
+ */
+import { isAbsolute, join } from "node:path";
+import { agentCatalogFromState, CommandCatalog, configFile, configHome, isSettableSettingKey, pluginPrefix, resolveActiveAgent, settableSettings, } from "@alisio/core";
+import { readJson } from "../http/body.js";
+import { HttpError } from "../http/errors.js";
+import { is, validate } from "../schemas.js";
+/** Resolves `?workspace=` / `{workspace}` (an opaque id or an absolute path) to its open app. */
+export async function workspaceApp(workspaces, reference) {
+    if (!reference)
+        throw new HttpError("validation_failed", "workspace is required", { fields: ["workspace"] });
+    const path = isAbsolute(reference)
+        ? await workspaces.canonical(reference)
+        : await workspaces.pathOf(reference);
+    if (!path)
+        throw new HttpError("not_found", "Workspace not found");
+    return workspaces.openPath(path);
+}
+const UNTRUSTED = "Trust this workspace from the terminal (run alisio in it) to manage its plugins here";
+const message = (error) => (error instanceof Error ? error.message : String(error));
+/**
+ * Plugin and skill toggles persist a project override; the running app reflects plugin changes
+ * only after a restart. The server recycles the workspace app as soon as it has no runs (now,
+ * or when its last run finishes), so the change applies without restarting `alisio serve`.
+ */
+export class WorkspaceRecycler {
+    ctx;
+    pending = new Set();
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    /** Recycles now when idle; otherwise once the workspace's runs finish. */
+    async request(id) {
+        if (this.ctx.scheduler.busyWorkspace(id)) {
+            this.pending.add(id);
+            return undefined;
+        }
+        this.pending.delete(id);
+        const reopened = await this.ctx.workspaces.recycle(id);
+        this.announce(id, ["plugins", "commands", "skills", "agents", "mcp"]);
+        return reopened;
+    }
+    /** Called when a run finishes: applies a deferred recycle once nothing runs. */
+    idle(id) {
+        if (!this.pending.has(id) || this.ctx.scheduler.busyWorkspace(id))
+            return;
+        void this.request(id).catch(() => { });
+    }
+    announce(workspaceId, scopes) {
+        for (const scope of scopes)
+            this.ctx.broadcast({ t: "catalog_changed", workspaceId, scope });
+    }
+}
+function pluginInfo(opened, entry) {
+    const prefix = pluginPrefix(entry.id);
+    const tools = opened.app.plugins
+        .toolsOf(entry.id)
+        .map((name) => (name.startsWith(`${prefix}_`) ? name.slice(prefix.length + 1) : name))
+        .sort();
+    const commands = new CommandCatalog(opened.app)
+        .list()
+        .filter((c) => c.source === "plugin" && c.owner === entry.id)
+        .map((c) => c.name)
+        .sort();
+    const untrusted = !opened.trusted && entry.manageable;
+    return {
+        id: entry.id,
+        name: entry.name,
+        description: entry.description,
+        ...(entry.version ? { version: entry.version } : {}),
+        categories: [...entry.categories],
+        builtin: entry.builtin,
+        source: entry.source,
+        status: entry.status,
+        enabled: entry.enabled,
+        manageable: entry.manageable && !untrusted,
+        ...(untrusted
+            ? { diagnostic: UNTRUSTED }
+            : entry.diagnostic
+                ? { diagnostic: entry.diagnostic }
+                : {}),
+        tools,
+        commands,
+        toolPrefix: prefix,
+    };
+}
+function skillInfo(skill) {
+    return {
+        id: skill.id,
+        name: skill.name,
+        displayId: skill.displayId,
+        description: skill.description,
+        scope: skill.scope,
+        source: skill.source,
+        ...(skill.owner ? { owner: { id: skill.owner.id, name: skill.owner.name } } : {}),
+        manageable: skill.manageable,
+        locked: skill.locked,
+        enabled: skill.enabled,
+        effective: skill.effective,
+        ...(skill.shadowedBy ? { shadowedBy: skill.shadowedBy } : {}),
+        approximateTokens: skill.approximateTokens,
+    };
+}
+/** MCP server status without the command line, arguments or URL (they may carry tokens). */
+function mcpWire(info) {
+    return {
+        name: info.name,
+        displayName: info.displayName,
+        source: info.source.kind,
+        status: info.status,
+        enabled: info.enabled,
+        transport: info.transport,
+        capabilities: [...info.capabilities],
+        counts: { ...info.counts },
+        ...(info.diagnostic ? { diagnostic: info.diagnostic } : {}),
+    };
+}
+function mcpOverview(opened) {
+    return {
+        permission: opened.app.mcpRuntimePermission(),
+        persisted: opened.app.mcpAllowPersisted(),
+        servers: opened.app.mcp.list().map(mcpWire),
+    };
+}
+function settingValue(config, key) {
+    const [section, leaf] = key.split(".");
+    const value = config[section]?.[leaf];
+    return typeof value === "string" || typeof value === "number" || typeof value === "boolean"
+        ? value
+        : undefined;
+}
+export function registerManagementRoutes(router, ctx, recycler) {
+    const open = (reference) => workspaceApp(ctx.workspaces, reference);
+    // ---- Plugins ------------------------------------------------------------------------------
+    router.get("/api/plugins", async ({ url }) => {
+        const opened = await open(url.searchParams.get("workspace"));
+        return { body: opened.app.pluginCatalog().map((entry) => pluginInfo(opened, entry)) };
+    });
+    router.patch("/api/plugins/:id", async ({ req, url, params }) => {
+        const input = validate(await readJson(req), {
+            enabled: { check: is.boolean(), required: true },
+            workspace: { check: is.nonEmpty(4096) },
+        });
+        let opened = await open(input.workspace ?? url.searchParams.get("workspace"));
+        const id = params.id ?? "";
+        const entry = opened.app.pluginCatalog().find((p) => p.id === id);
+        if (!entry)
+            throw new HttpError("not_found", "Plugin not found");
+        const info = pluginInfo(opened, entry);
+        if (!info.manageable)
+            throw new HttpError("not_manageable", info.diagnostic ?? "This plugin cannot be managed here");
+        let updated;
+        try {
+            updated = await opened.app.setPluginEnabled(id, input.enabled);
+        }
+        catch (error) {
+            throw new HttpError("validation_failed", message(error), { fields: ["enabled"] });
+        }
+        if (updated.status === "restart-required") {
+            const reopened = await recycler.request(opened.id);
+            if (reopened)
+                opened = reopened;
+        }
+        recycler.announce(opened.id, ["plugins", "commands"]);
+        const current = opened.app.pluginCatalog().find((p) => p.id === id) ?? updated;
+        return { body: pluginInfo(opened, current) };
+    });
+    // ---- Skills -------------------------------------------------------------------------------
+    router.get("/api/skills", async ({ url }) => {
+        const opened = await open(url.searchParams.get("workspace"));
+        return { body: opened.app.skillCatalog().map(skillInfo) };
+    });
+    router.patch("/api/skills/:id", async ({ req, url, params }) => {
+        const input = validate(await readJson(req), {
+            enabled: { check: is.boolean(), required: true },
+            workspace: { check: is.nonEmpty(4096) },
+        });
+        const opened = await open(input.workspace ?? url.searchParams.get("workspace"));
+        const id = params.id ?? "";
+        const skill = opened.app.skillCatalog().find((s) => s.id === id && s.effective);
+        if (!skill)
+            throw new HttpError("not_found", "Skill not found");
+        if (!skill.manageable || skill.locked)
+            throw new HttpError("not_manageable", "This skill is locked by its plugin");
+        try {
+            await opened.app.setSkillEnabled(id, input.enabled);
+        }
+        catch (error) {
+            const text = message(error);
+            if (/trust/i.test(text))
+                throw new HttpError("not_manageable", text);
+            throw new HttpError("validation_failed", text, { fields: ["enabled"] });
+        }
+        recycler.announce(opened.id, ["skills", "commands"]);
+        const current = opened.app.skillCatalog().find((s) => s.id === id && s.effective) ?? skill;
+        return { body: skillInfo(current) };
+    });
+    // ---- MCP ----------------------------------------------------------------------------------
+    router.get("/api/mcp", async ({ url }) => {
+        const opened = await open(url.searchParams.get("workspace"));
+        return { body: mcpOverview(opened) };
+    });
+    router.patch("/api/mcp/:name", async ({ req, url, params }) => {
+        const input = validate(await readJson(req), {
+            enabled: { check: is.boolean(), required: true },
+            connect: { check: is.boolean() },
+            workspace: { check: is.nonEmpty(4096) },
+        });
+        const opened = await open(input.workspace ?? url.searchParams.get("workspace"));
+        const name = params.name ?? "";
+        if (!opened.app.config.mcpSources[name])
+            throw new HttpError("not_found", "MCP server not found");
+        if (ctx.base.readOnly)
+            throw new HttpError("mcp_not_permitted", "MCP changes are unavailable under --read-only");
+        const connect = !!input.connect && input.enabled;
+        if (connect && opened.app.mcpRuntimePermission() !== "granted")
+            throw new HttpError("mcp_not_permitted", "Grant MCP access for this workspace first (MCP servers run with your user privileges)");
+        try {
+            await opened.app.setMcpEnabled(name, input.enabled, connect);
+        }
+        catch {
+            // A failed connection is reported through the server's status and diagnostic.
+        }
+        recycler.announce(opened.id, ["mcp"]);
+        return { body: mcpWire(opened.app.mcp.info(name)) };
+    });
+    router.post("/api/mcp/consent", async ({ req }) => {
+        const input = validate(await readJson(req), {
+            workspace: { check: is.nonEmpty(4096), required: true },
+            // Explicit confirmation is required: the UI shows what MCP access means first.
+            confirmed: { check: (v) => v === true, required: true },
+            remember: { check: is.boolean() },
+        });
+        const opened = await open(input.workspace);
+        if (ctx.base.readOnly)
+            throw new HttpError("mcp_not_permitted", "MCP is unavailable under --read-only");
+        try {
+            if (input.remember)
+                await opened.app.rememberGlobalMcpConsent("interactive-web");
+            else
+                opened.app.grantMcpRuntimePermission({ source: "interactive-web", confirmed: true });
+        }
+        catch (error) {
+            throw new HttpError("mcp_not_permitted", message(error));
+        }
+        recycler.announce(opened.id, ["mcp"]);
+        return { body: mcpOverview(opened) };
+    });
+    // ---- Agent presets ------------------------------------------------------------------------
+    router.get("/api/agents", async ({ url }) => {
+        const opened = await open(url.searchParams.get("workspace"));
+        let state;
+        try {
+            state = opened.app.plugins.pluginState("subagents", "mainAgents");
+        }
+        catch {
+            /* contributions are best-effort */
+        }
+        const agents = agentCatalogFromState(state);
+        const fallback = resolveActiveAgent(agents, opened.app.config.agents.active).id;
+        return {
+            body: agents.map((agent) => ({
+                id: agent.id,
+                name: agent.name,
+                description: agent.description,
+                ...(agent.instructions ? { instructions: agent.instructions } : {}),
+                ...(agent.model ? { model: agent.model } : {}),
+                ...(agent.readOnly ? { readOnly: true } : {}),
+                source: agent.source,
+                default: agent.id === fallback,
+            })),
+        };
+    });
+    // ---- Settings -----------------------------------------------------------------------------
+    router.get("/api/settings", async ({ url }) => {
+        const opened = await open(url.searchParams.get("workspace"));
+        const base = ctx.base;
+        const body = {
+            configPath: configFile(opened.path, base.config ? { file: base.config } : { trustProject: opened.trusted }),
+            settingsPath: join(configHome(), "config.json"),
+            providersPath: opened.app.providerSettings.profilesPath,
+            trusted: opened.trusted,
+            readOnly: !!base.readOnly,
+            settings: settableSettings().map((setting) => {
+                const value = settingValue(opened.app.config, setting.key);
+                return {
+                    key: setting.key,
+                    kind: setting.kind,
+                    ...(setting.options ? { options: setting.options } : {}),
+                    ...(value !== undefined ? { value } : {}),
+                };
+            }),
+        };
+        return { body };
+    });
+    router.patch("/api/settings", async ({ req }) => {
+        const input = validate(await readJson(req), {
+            workspace: { check: is.nonEmpty(4096), required: true },
+            key: { check: (v) => typeof v === "string" && isSettableSettingKey(v), required: true },
+            value: {
+                check: (v) => v === null ||
+                    typeof v === "boolean" ||
+                    (typeof v === "number" && Number.isFinite(v)) ||
+                    (typeof v === "string" && v.length <= 1_000),
+                required: true,
+            },
+        });
+        const opened = await open(input.workspace);
+        if (ctx.base.readOnly)
+            throw new HttpError("capability_ceiling", "Settings changes are unavailable under --read-only");
+        const key = input.key;
+        try {
+            await opened.app.updateSetting(key, input.value === null ? undefined : input.value);
+        }
+        catch (error) {
+            throw new HttpError("validation_failed", message(error), { fields: ["value"] });
+        }
+        if (key.startsWith("agents."))
+            recycler.announce(opened.id, ["agents"]);
+        return { body: { message: `Saved ${key}` } };
+    });
+}

package/dist/routes/prompts.d.ts

@@ -0,0 +1,22 @@
+import type { RunScheduler } from "../host/run-scheduler.ts";
+import type { SessionService } from "../host/sessions.ts";
+import type { Router } from "../http/router.ts";
+/**
+ * In-memory idempotency for requests that do not create a run (enqueued prompts, commands):
+ * the last 100 request ids per session for 10 minutes. Lost on restart, like the runner's
+ * own enqueue queue.
+ */
+export declare class RecentRequests {
+    private limit;
+    private ttlMs;
+    private seen;
+    constructor(limit?: number, ttlMs?: number);
+    has(sessionId: string, requestId: string, now?: number): boolean;
+    add(sessionId: string, requestId: string, now?: number): void;
+}
+/** Prompts (idempotent by `requestId`), cancellation and manual compaction. */
+export declare function registerPromptRoutes(router: Router, ctx: {
+    sessions: SessionService;
+    scheduler: RunScheduler;
+    recent?: RecentRequests;
+}): void;

package/dist/routes/prompts.js

@@ -0,0 +1,153 @@
+import { randomUUID } from "node:crypto";
+import { readJson } from "../http/body.js";
+import { HttpError } from "../http/errors.js";
+import { is, validate } from "../schemas.js";
+/**
+ * In-memory idempotency for requests that do not create a run (enqueued prompts, commands):
+ * the last 100 request ids per session for 10 minutes. Lost on restart, like the runner's
+ * own enqueue queue.
+ */
+export class RecentRequests {
+    limit;
+    ttlMs;
+    seen = new Map();
+    constructor(limit = 100, ttlMs = 10 * 60_000) {
+        this.limit = limit;
+        this.ttlMs = ttlMs;
+    }
+    has(sessionId, requestId, now = Date.now()) {
+        const expires = this.seen.get(sessionId)?.get(requestId);
+        return expires !== undefined && expires > now;
+    }
+    add(sessionId, requestId, now = Date.now()) {
+        const entries = this.seen.get(sessionId) ?? new Map();
+        entries.set(requestId, now + this.ttlMs);
+        for (const [id, expires] of entries)
+            if (expires <= now)
+                entries.delete(id);
+        while (entries.size > this.limit)
+            entries.delete(entries.keys().next().value);
+        this.seen.set(sessionId, entries);
+    }
+}
+const isBlobRef = (value) => {
+    const ref = value;
+    return (!!ref &&
+        typeof ref === "object" &&
+        typeof ref.hash === "string" &&
+        /^[0-9a-f]{64}$/.test(ref.hash) &&
+        typeof ref.mimeType === "string" &&
+        typeof ref.bytes === "number");
+};
+/** Prompts (idempotent by `requestId`), cancellation and manual compaction. */
+export function registerPromptRoutes(router, ctx) {
+    const { sessions, scheduler } = ctx;
+    const recent = ctx.recent ?? new RecentRequests();
+    router.post("/api/sessions/:sid/prompts", async ({ req, params, correlationId }) => {
+        const session = sessions.get(params.sid ?? "");
+        const input = validate(await readJson(req), {
+            requestId: { check: is.requestId(), required: true },
+            text: { check: is.string(200_000), required: true },
+            attachments: { check: is.array(isBlobRef, 16) },
+            display: { check: is.string(1_000) },
+        });
+        if (session.parentId)
+            throw new HttpError("session_busy", "Child sessions run under their parent session");
+        const duplicate = () => {
+            const run = sessions.runByRequest(session.id, input.requestId);
+            if (run)
+                return { status: 200, body: { runId: run.id, status: run.status, duplicate: true } };
+            if (recent.has(session.id, input.requestId))
+                return { status: 202, body: { status: "enqueued", duplicate: true } };
+            return undefined;
+        };
+        const again = duplicate();
+        if (again)
+            return again;
+        if (sessions.lockedBy(session.id))
+            throw new HttpError("session_locked", "Another Alisio process (for example the TUI) is using this session");
+        const opened = await sessions.app(session);
+        // Everything below runs in one tick: idempotency checks and the insert cannot interleave.
+        const retried = duplicate();
+        if (retried)
+            return retried;
+        const job = scheduler.job(session.id);
+        if (job || scheduler.busy(session.id) || opened.app.runner.isRunning(session.id)) {
+            if (job?.status === "queued" || scheduler.compacting(session.id))
+                throw new HttpError("session_busy", "The session is waiting for or compacting a run");
+            if (input.attachments?.length)
+                throw new HttpError("session_busy", "The session is running; only text can be queued (retry attachments when idle)");
+            opened.app.runner.enqueue(session.id, input.text);
+            recent.add(session.id, input.requestId);
+            return { status: 202, body: { status: "enqueued" } };
+        }
+        const attachments = [];
+        for (const ref of input.attachments ?? [])
+            try {
+                attachments.push(opened.app.blobs.attachment(ref));
+            }
+            catch {
+                throw new HttpError("validation_failed", "Unknown or invalid attachment", {
+                    fields: ["attachments"],
+                });
+            }
+        const { run, created } = sessions.beginRun({
+            id: randomUUID(),
+            session: session.id,
+            status: "queued",
+            requestId: input.requestId,
+            correlationId,
+            model: session.model,
+        });
+        if (!created)
+            return {
+                status: 200,
+                body: { runId: run.id, status: run.status, duplicate: true },
+            };
+        const status = scheduler.submit({
+            runId: run.id,
+            sessionId: session.id,
+            workspaceId: opened.id,
+            app: opened.app,
+            text: input.text,
+            correlationId,
+            ...(attachments.length ? { attachments } : {}),
+            ...(input.display ? { display: input.display } : {}),
+            options: () => sessions.runOptions(session.id),
+        });
+        return { status: 202, body: { runId: run.id, status } };
+    });
+    router.post("/api/sessions/:sid/cancel", async ({ req, params }) => {
+        const session = sessions.get(params.sid ?? "");
+        const { runId } = validate(await readJson(req), {
+            runId: { check: is.nonEmpty(100) },
+        });
+        if (scheduler.cancel(session.id, runId))
+            return { body: { cancelled: true } };
+        const opened = sessions.openApp(session);
+        const aborted = !runId && !!opened?.app.runner.abort(session.id);
+        return { body: { cancelled: aborted } };
+    });
+    router.post("/api/sessions/:sid/compact", async ({ req, params }) => {
+        const session = sessions.get(params.sid ?? "");
+        const { focus } = validate(await readJson(req), {
+            focus: { check: is.string(2_000) },
+        });
+        if (sessions.lockedBy(session.id))
+            throw new HttpError("session_locked", "Another Alisio process is using this session");
+        const opened = await sessions.app(session);
+        if (scheduler.busy(session.id) || opened.app.runner.isRunning(session.id))
+            throw new HttpError("session_busy", "The session is running");
+        const controller = new AbortController();
+        const work = opened.app.runner.compact(session.id, {
+            ...(focus?.trim() ? { focus: focus.trim() } : {}),
+            signal: controller.signal,
+        });
+        scheduler.track(session.id, opened.id, work, {
+            abort: () => controller.abort(new Error("Cancelled")),
+            onDone: () => sessions.notify(session.id),
+        });
+        sessions.notify(session.id);
+        return { status: 202, body: { status: "started" } };
+    });
+}

package/dist/routes/providers.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from "../http/router.ts";
+import { type ManagementContext, type WorkspaceRecycler } from "./management.ts";
+export declare function registerProviderRoutes(router: Router, ctx: ManagementContext, recycler: WorkspaceRecycler): void;