@alisio/server 0.1.0-alpha.8 → 0.1.1

package/dist/routes/commands.js

@@ -1,11 +1,13 @@
-import { agentIdFromCommand, CommandCatalog } from "@alisio/core";
+import { agentIdFromCommand, CommandCatalog, describePermissionStatus, FULL_ACCESS_WARNING, formatChangelogMarkdown, formatGoalStatus, formatReloadReport, GOAL_HELP, loadChangelog, modeToPreset, PERMISSION_MODE_TABLE, PERMISSION_USAGE, parseGoalCommand, parsePermissionCommand, presetToMode, selectEntries, } from "@alisio/core";
 import { activateSessionAgent } from "../host/agents.js";
+import { presetInfo } from "../host/presets.js";
 import { readJson } from "../http/body.js";
 import { HttpError } from "../http/errors.js";
 import { is, validate } from "../schemas.js";
+import { goalError } from "./goal.js";
 import { RecentRequests } from "./prompts.js";
 /** Commands that change the session's own run state: refused while it runs or compacts. */
-const EXCLUSIVE = new Set(["model", "compact"]);
+const EXCLUSIVE = new Set(["model", "compact", "reload"]);
 /**
  * The `/ask` prompt: the TUI sends the same instruction (packages/cli/src/tui/app.ts); both turn
  * the user's question into a multiple-choice `ask_user_question` call.
@@ -22,7 +24,7 @@ const helpText = (commands) => [
     "",
     ...commands.map((c) => `- \`/${c.name}${c.argumentHint ? ` ${c.argumentHint}` : ""}\` — ${c.description}${c.aliases?.length ? ` (${c.aliases.map((a) => `/${a}`).join(", ")})` : ""}`),
     "",
-    "**Keys**: Enter send · Shift+Enter newline · ↑↓ prompt history · `/` focus the composer · Esc close popovers",
+    "**Keys**: Enter send · Shift+Enter newline · Shift+Tab cycle agents · ↑↓ prompt history · `/` focus the composer · Esc close popovers",
 ].join("\n");
 /**
  * The shared slash-command catalog for the web (RF-07): `GET /api/commands` lists the commands
@@ -53,6 +55,8 @@ export function registerCommandRoutes(router, ctx) {
             requestId: { check: is.requestId(), required: true },
             name: { check: is.nonEmpty(200), required: true },
             args: { check: is.string(100_000) },
+            // `/goal <objective>` over an existing goal needs the user's confirmation.
+            confirm: { check: is.boolean() },
         });
         if (recent.has(session.id, input.requestId))
             return { body: { duplicate: true } };
@@ -86,6 +90,122 @@ export function registerCommandRoutes(router, ctx) {
         if (descriptor.name !== "btw")
             sessions.notify(session.id);
         return { body: outcome };
+        /**
+         * `/permission`: web clients open the permissions popover for the bare command; API callers
+         * get the status and the saved permissions as text. `ask|auto|full` sets the session preset
+         * (the same change as the composer menu), within the server's capability ceiling.
+         */
+        /**
+         * `/goal`: the same grammar as the TUI (`parseGoalCommand`). Web clients drive the goal bar
+         * with the goal routes and send the typed command here; `effects: ["goal_edit"]` tells a
+         * client to open its edit field (`/goal edit` without text).
+         */
+        function goalCommand() {
+            const parsed = parseGoalCommand(args);
+            const service = opened.app.goals;
+            const done = (output, extra = {}) => {
+                ctx.goals?.refresh(session.id);
+                setImmediate(() => ctx.goals?.pump(session.id));
+                return { output, tone: "notice", effects: ["goal"], ...extra };
+            };
+            const check = (outcome) => {
+                if (!outcome.ok)
+                    throw goalError(outcome.code, outcome.message);
+                return outcome.goal;
+            };
+            switch (parsed.type) {
+                case "error":
+                    throw new Error(parsed.message);
+                case "help":
+                    return { output: GOAL_HELP };
+                case "show": {
+                    const info = ctx.goals?.info(session.id);
+                    return info
+                        ? { output: formatGoalStatus(info), effects: ["goal"] }
+                        : {
+                            output: "No goal in this session. Start one with /goal <objective>.",
+                            tone: "notice",
+                        };
+                }
+                case "pause":
+                    check(service.pause(session.id));
+                    return done("Goal paused: it will not continue until you resume it.");
+                case "resume":
+                    check(service.resume(session.id));
+                    return done("Goal resumed.");
+                case "clear":
+                    check(service.clear(session.id));
+                    return done("Goal cleared.");
+                case "edit":
+                    if (parsed.objective === undefined) {
+                        const current = service.get(session.id);
+                        if (!current)
+                            throw goalError("not_found", "This session has no goal.");
+                        return { output: current.objective, tone: "notice", effects: ["goal_edit"] };
+                    }
+                    check(service.edit(session.id, parsed.objective));
+                    return done("Goal objective updated.");
+                case "budget":
+                    check(service.setBudget(session.id, parsed.tokens));
+                    return done(parsed.tokens === null ? "Goal token budget removed." : "Goal token budget set.");
+                case "create": {
+                    const replace = !!input.confirm;
+                    check(service.create(session.id, {
+                        objective: parsed.objective,
+                        ...(parsed.tokenBudget ? { tokenBudget: parsed.tokenBudget } : {}),
+                        ...(replace ? { replace: true } : {}),
+                    }));
+                    return done("Goal started.");
+                }
+            }
+        }
+        function permission() {
+            const parsed = parsePermissionCommand(args);
+            if (parsed.type === "invalid")
+                throw new Error(PERMISSION_USAGE);
+            const current = sessions.detail(session);
+            const status = (preset) => {
+                const info = presetInfo(preset, sessions.ceiling);
+                return [
+                    describePermissionStatus({
+                        mode: presetToMode(preset) ?? "locked",
+                        policy: info.policy,
+                        approvals: info.approvals,
+                    }),
+                    ...(info.reason ? ["", `Note: ${info.reason}.`] : []),
+                ].join("\n");
+            };
+            if (parsed.type === "set") {
+                const preset = modeToPreset(parsed.mode);
+                const info = presetInfo(preset, sessions.ceiling);
+                if (!info.available)
+                    throw new HttpError("capability_ceiling", info.reason ?? "That mode is not available under the server flags");
+                sessions.setOptions(session.id, { preset });
+                sessions.resetPolicy(session.id);
+                return {
+                    output: [
+                        `Permission mode: **${PERMISSION_MODE_TABLE[parsed.mode].label}**. ${PERMISSION_MODE_TABLE[parsed.mode].summary}`,
+                        ...(parsed.mode === "full" ? ["", FULL_ACCESS_WARNING] : []),
+                        ...(info.reason ? ["", `Note: ${info.reason}.`] : []),
+                    ].join("\n"),
+                    tone: "notice",
+                    effects: ["preset"],
+                };
+            }
+            const live = opened.app.capabilityGrants.live(session.id);
+            return {
+                output: [
+                    status(current.preset),
+                    "",
+                    "**Saved permissions**",
+                    "",
+                    ...(live.length
+                        ? live.map((g) => `- ${g.capability} · allowed for this session · since ${new Date(g.createdAt).toISOString()} (${g.source})`)
+                        : ["No saved permissions in this session."]),
+                ].join("\n"),
+                tone: parsed.type === "status" ? "notice" : "info",
+            };
+        }
         async function run() {
             if (!descriptor)
                 throw new HttpError("unknown_command", `Unknown command /${name}`);
@@ -111,16 +231,21 @@ export function registerCommandRoutes(router, ctx) {
             }
             if (descriptor.name === "help")
                 return { output: helpText(catalog.list("web")) };
-            if (descriptor.name === "permissions") {
-                // Web clients open the permissions popover instead; API callers get the list as text.
-                const live = opened.app.capabilityGrants.live(session.id);
+            if (descriptor.name === "permission")
+                return permission();
+            if (descriptor.name === "goal")
+                return goalCommand();
+            if (descriptor.name === "reload") {
+                if (!ctx.reload)
+                    throw new Error("/reload is unavailable here");
+                return { output: formatReloadReport(await ctx.reload(opened.id)), effects: ["catalog"] };
+            }
+            if (descriptor.name === "changelog") {
+                const selected = selectEntries(loadChangelog(), { ...(args ? { version: args } : {}) });
+                if (!selected.found)
+                    throw new Error(`No changelog entry for version ${args}`);
                 return {
-                    output: live.length
-                        ? live
-                            .map((g) => `- ${g.capability} · allowed for this session · since ${new Date(g.createdAt).toISOString()} (${g.source})`)
-                            .join("\n")
-                        : "No saved permissions in this session.",
-                    tone: "notice",
+                    output: `**Alisio ${ctx.version ?? "dev"}**\n\n${formatChangelogMarkdown(selected.entries)}`,
                 };
             }
             if (descriptor.name === "artifacts") {

package/dist/routes/goal.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The goal of a root session (`/goal`): read it, create or replace it, edit its objective or
+ * token budget, pause, resume, clear. The same auth, Host and Origin rules as every other `/api`
+ * route apply. Every change is a compare-and-set in the core: a client may send what it last saw
+ * (`expect: {goalId, epoch}`) and gets `409 goal_conflict` when another surface (or the agent)
+ * changed the goal since. A change that lets the goal run (create, resume, a re-armed budget)
+ * also makes it continue now; changes arrive in every window as `goal_changed` frames.
+ *
+ * Only the user changes a goal through here; the model has `update_goal` (complete / blocked).
+ */
+import type { GoalErrorCode } from "@alisio/core";
+import type { GoalDriver } from "../host/goal.ts";
+import type { SessionService } from "../host/sessions.ts";
+import { HttpError } from "../http/errors.ts";
+import type { Router } from "../http/router.ts";
+/** The HTTP error of a refused goal operation. */
+export declare function goalError(code: GoalErrorCode, message: string): HttpError;
+export declare function registerGoalRoutes(router: Router, ctx: {
+    sessions: SessionService;
+    goals: Pick<GoalDriver, "info" | "pump" | "refresh">;
+}): void;

package/dist/routes/goal.js

@@ -0,0 +1,121 @@
+import { GOAL_OBJECTIVE_MAX } from "@alisio/core";
+import { readJson } from "../http/body.js";
+import { HttpError } from "../http/errors.js";
+import { is, validate } from "../schemas.js";
+const BUDGET = is.integer(1, 1_000_000_000);
+const nullableBudget = (v) => v === null || BUDGET(v);
+const EXPECT = (v) => is.object()(v) &&
+    Object.keys(v).every((key) => key === "goalId" || key === "epoch") &&
+    (v.goalId === undefined ||
+        is.nonEmpty(64)(v.goalId)) &&
+    (v.epoch === undefined ||
+        is.integer(0, Number.MAX_SAFE_INTEGER)(v.epoch));
+/** The HTTP error of a refused goal operation. */
+export function goalError(code, message) {
+    switch (code) {
+        case "disabled":
+            return new HttpError("goal_disabled", message);
+        case "not_found":
+            return new HttpError("goal_not_found", message);
+        case "invalid":
+            return new HttpError("validation_failed", message, { fields: ["objective"] });
+        default:
+            return new HttpError("goal_conflict", message, { reason: code });
+    }
+}
+export function registerGoalRoutes(router, ctx) {
+    const { sessions, goals } = ctx;
+    /** The root session and its workspace's goal service (opened on demand). */
+    const open = async (sid, writing) => {
+        const session = sessions.get(sid ?? "");
+        if (session.parentId)
+            throw new HttpError("validation_failed", "Goals belong to a root session, not a subagent.", {
+                fields: ["sid"],
+            });
+        if (writing && session.archivedAt)
+            throw new HttpError("validation_failed", "The session is archived.", { fields: ["sid"] });
+        const { app } = await sessions.app(session);
+        return { session, service: app.goals };
+    };
+    const reply = (sessionId) => ({ body: { goal: goals.info(sessionId) ?? null } });
+    const settled = (sessionId) => {
+        goals.refresh(sessionId);
+        setImmediate(() => goals.pump(sessionId));
+        return reply(sessionId);
+    };
+    router.get("/api/sessions/:sid/goal", async ({ params }) => {
+        const { session } = await open(params.sid, false);
+        return reply(session.id);
+    });
+    router.put("/api/sessions/:sid/goal", async ({ req, params }) => {
+        const input = validate(await readJson(req), {
+            objective: { check: is.nonEmpty(GOAL_OBJECTIVE_MAX + 200), required: true },
+            tokenBudget: { check: nullableBudget },
+            replace: { check: is.boolean() },
+            expect: { check: EXPECT },
+        });
+        const { session, service } = await open(params.sid, true);
+        const outcome = service.create(session.id, {
+            objective: input.objective,
+            ...(typeof input.tokenBudget === "number" ? { tokenBudget: input.tokenBudget } : {}),
+            ...(input.replace ? { replace: true } : {}),
+        }, input.expect);
+        if (!outcome.ok)
+            throw goalError(outcome.code, outcome.message);
+        return settled(session.id);
+    });
+    router.patch("/api/sessions/:sid/goal", async ({ req, params }) => {
+        const input = validate(await readJson(req), {
+            objective: { check: is.nonEmpty(GOAL_OBJECTIVE_MAX + 200) },
+            tokenBudget: { check: nullableBudget },
+            expect: { check: EXPECT },
+        });
+        if (input.objective === undefined && input.tokenBudget === undefined)
+            throw new HttpError("validation_failed", "Send an objective or a tokenBudget to change", {
+                fields: ["objective", "tokenBudget"],
+            });
+        const { session, service } = await open(params.sid, true);
+        // The expectation applies to the first change; the second sees the epoch the first produced.
+        let expect = input.expect;
+        if (input.objective !== undefined) {
+            const outcome = service.edit(session.id, input.objective, expect);
+            if (!outcome.ok)
+                throw goalError(outcome.code, outcome.message);
+            expect = { goalId: outcome.goal.goalId, epoch: outcome.goal.epoch };
+        }
+        if (input.tokenBudget !== undefined) {
+            const outcome = service.setBudget(session.id, input.tokenBudget, expect);
+            if (!outcome.ok)
+                throw goalError(outcome.code, outcome.message);
+        }
+        return settled(session.id);
+    });
+    router.delete("/api/sessions/:sid/goal", async ({ params, url }) => {
+        const { session, service } = await open(params.sid, true);
+        const epoch = url.searchParams.get("epoch");
+        const goalId = url.searchParams.get("goalId");
+        const outcome = service.clear(session.id, {
+            ...(goalId ? { goalId } : {}),
+            ...(epoch !== null && epoch !== "" && Number.isInteger(Number(epoch))
+                ? { epoch: Number(epoch) }
+                : {}),
+        });
+        if (!outcome.ok)
+            throw goalError(outcome.code, outcome.message);
+        goals.refresh(session.id);
+        return reply(session.id);
+    });
+    for (const action of ["pause", "resume"])
+        router.post(`/api/sessions/:sid/goal/${action}`, async ({ req, params }) => {
+            const input = validate(await readJson(req), {
+                expect: { check: EXPECT },
+            });
+            const { session, service } = await open(params.sid, true);
+            const outcome = action === "pause"
+                ? service.pause(session.id, input.expect)
+                : service.resume(session.id, input.expect);
+            if (!outcome.ok)
+                throw goalError(outcome.code, outcome.message);
+            return settled(session.id);
+        });
+}

package/dist/routes/management.d.ts

@@ -1,4 +1,4 @@
-import type { ServerFrame } from "@alisio/sdk";
+import type { ReloadReport, ServerFrame } from "@alisio/sdk";
 import type { RunScheduler } from "../host/run-scheduler.ts";
 import type { OpenWorkspace, ServerAppOptions, WorkspaceHost } from "../host/workspace-host.ts";
 import type { Router } from "../http/router.ts";
@@ -8,6 +8,8 @@ type CatalogScope = Extract<ServerFrame, {
 export interface ManagementContext {
     workspaces: WorkspaceHost;
     scheduler: RunScheduler;
+    /** Whether a workspace has live background tasks (closing its application would kill them). */
+    tasksLive?: (workspaceId: string) => boolean;
     base: ServerAppOptions;
     broadcast: (frame: ServerFrame) => void;
 }
@@ -22,11 +24,19 @@ export declare class WorkspaceRecycler {
     private ctx;
     private pending;
     constructor(ctx: ManagementContext);
-    /** Recycles now when idle; otherwise once the workspace's runs finish. */
+    /** Runs or live background tasks (the application's close would kill them). */
+    private busy;
+    /** Recycles now when idle; otherwise once the workspace's runs and tasks finish. */
     request(id: string): Promise<OpenWorkspace | undefined>;
     /** Called when a run finishes: applies a deferred recycle once nothing runs. */
     idle(id: string): void;
     announce(workspaceId: string, scopes: CatalogScope[]): void;
+    /**
+     * `/reload`: refused while the workspace has runs (409 `runs_active`); otherwise validates the
+     * configuration, builds the new app next to the current one and swaps (a broken configuration
+     * leaves the workspace untouched). Every catalog is announced so open palettes refresh.
+     */
+    reload(id: string): Promise<ReloadReport>;
 }
 export declare function registerManagementRoutes(router: Router, ctx: ManagementContext, recycler: WorkspaceRecycler): void;
 export {};

package/dist/routes/management.js

@@ -5,7 +5,7 @@
  * catalog broadcast `catalog_changed` so every open palette refreshes.
  */
 import { isAbsolute, join } from "node:path";
-import { agentCatalogFromState, analysisStatus, CommandCatalog, configFile, configHome, hashProjectConfig, isSettableSettingKey, pluginPrefix, resolveActiveAgent, setTrust, settableSettings, } from "@alisio/core";
+import { agentCatalogFromState, analysisStatus, CommandCatalog, configFile, configHome, cycleableAgents, hashProjectConfig, isSettableSettingKey, pluginPrefix, resolveActiveAgent, setTrust, settableSettings, } from "@alisio/core";
 import { readJson } from "../http/body.js";
 import { HttpError } from "../http/errors.js";
 import { is, validate } from "../schemas.js";
@@ -33,9 +33,13 @@ export class WorkspaceRecycler {
     constructor(ctx) {
         this.ctx = ctx;
     }
-    /** Recycles now when idle; otherwise once the workspace's runs finish. */
+    /** Runs or live background tasks (the application's close would kill them). */
+    busy(id) {
+        return this.ctx.scheduler.busyWorkspace(id) || !!this.ctx.tasksLive?.(id);
+    }
+    /** Recycles now when idle; otherwise once the workspace's runs and tasks finish. */
     async request(id) {
-        if (this.ctx.scheduler.busyWorkspace(id)) {
+        if (this.busy(id)) {
             this.pending.add(id);
             return undefined;
         }
@@ -46,7 +50,7 @@ export class WorkspaceRecycler {
     }
     /** Called when a run finishes: applies a deferred recycle once nothing runs. */
     idle(id) {
-        if (!this.pending.has(id) || this.ctx.scheduler.busyWorkspace(id))
+        if (!this.pending.has(id) || this.busy(id))
             return;
         void this.request(id).catch(() => { });
     }
@@ -54,7 +58,41 @@ export class WorkspaceRecycler {
         for (const scope of scopes)
             this.ctx.broadcast({ t: "catalog_changed", workspaceId, scope });
     }
+    /**
+     * `/reload`: refused while the workspace has runs (409 `runs_active`); otherwise validates the
+     * configuration, builds the new app next to the current one and swaps (a broken configuration
+     * leaves the workspace untouched). Every catalog is announced so open palettes refresh.
+     */
+    async reload(id) {
+        const { workspaces, scheduler } = this.ctx;
+        if (!(await workspaces.pathOf(id)))
+            throw new HttpError("not_found", "Workspace not found");
+        const busy = () => scheduler.busyWorkspace(id)
+            ? "Reload is only available between turns: wait for the current turn to finish."
+            : this.ctx.tasksLive?.(id)
+                ? "Reload would stop the running background tasks: stop them or wait for them to finish, then reload."
+                : undefined;
+        const reason = busy();
+        if (reason)
+            throw new HttpError("runs_active", reason);
+        this.pending.delete(id);
+        if (!workspaces.get(id)) {
+            // Nothing is loaded for this workspace yet: opening it reads the current configuration.
+            const path = (await workspaces.pathOf(id));
+            await workspaces.openPath(path);
+            this.announce(id, RELOAD_SCOPES);
+            return {
+                refreshed: [],
+                restartRequired: [],
+                warnings: ["The workspace was not open: it was opened with the current configuration."],
+            };
+        }
+        const report = await workspaces.reload(id, { busy });
+        this.announce(id, RELOAD_SCOPES);
+        return report;
+    }
 }
+const RELOAD_SCOPES = ["commands", "plugins", "skills", "agents", "mcp", "models"];
 function pluginInfo(opened, entry) {
     const prefix = pluginPrefix(entry.id);
     const tools = opened.app.plugins
@@ -263,7 +301,8 @@ export function registerManagementRoutes(router, ctx, recycler) {
         catch {
             /* contributions are best-effort */
         }
-        const agents = agentCatalogFromState(state);
+        // Stable order (build, plan, then the rest by name): the web cycles this array.
+        const agents = cycleableAgents(agentCatalogFromState(state));
         const fallback = resolveActiveAgent(agents, opened.app.config.agents.active).id;
         return {
             body: agents.map((agent) => ({
@@ -278,6 +317,10 @@ export function registerManagementRoutes(router, ctx, recycler) {
             })),
         };
     });
+    // ---- Reload ------------------------------------------------------------------------------
+    router.post("/api/workspaces/:wid/reload", async ({ params }) => ({
+        body: await recycler.reload(params.wid ?? ""),
+    }));
     // ---- Workspace trust ----------------------------------------------------------------------
     /**
      * Grants (or withdraws) project trust from the web: the same persisted, per-directory decision
@@ -371,7 +414,7 @@ export function registerManagementRoutes(router, ctx, recycler) {
             recycler.announce(opened.id, ["agents"]);
         // Analysis tools are registered when the workspace application starts: rebuild it (after its
         // runs) so `analysis.enabled` applies without restarting the server.
-        if (key === "analysis.enabled")
+        if (key === "analysis.enabled" || key === "tasks.enabled")
             void recycler.request(opened.id).catch(() => undefined);
         return { body: { message: `Saved ${key}` } };
     });

package/dist/routes/plugin-views.d.ts

@@ -0,0 +1,22 @@
+import type { SessionService } from "../host/sessions.ts";
+import { type WorkspaceHost } from "../host/workspace-host.ts";
+import type { Router } from "../http/router.ts";
+import type { Logger } from "../log.ts";
+/** Defaults; both can be lowered through `ServerOptions.views` (tests, constrained hosts). */
+export declare const VIEW_TIMEOUT_MS = 5000;
+export declare const VIEW_MAX_BYTES: number;
+export interface PluginViewRouteContext {
+    sessions: SessionService;
+    workspaces: WorkspaceHost;
+    logger: Logger;
+    timeoutMs?: number;
+    maxBytes?: number;
+}
+/**
+ * Plugin data views: `GET /api/sessions/:sid/views/:plugin/:view?<params>`. Views are read-only
+ * BY CONTRACT (a plugin is not a sandbox); the server enforces what it can: GET only, the same
+ * auth/Host/Origin rules as every `/api` route, enabled plugins only, validated parameters, a
+ * timeout and a response size cap. Parameters and results are never logged (they may carry
+ * sensitive project data such as memory).
+ */
+export declare function registerPluginViewRoutes(router: Router, ctx: PluginViewRouteContext): void;

package/dist/routes/plugin-views.js

@@ -0,0 +1,96 @@
+import { ViewRunError } from "@alisio/core";
+import { workspaceId } from "../host/workspace-host.js";
+import { HttpError } from "../http/errors.js";
+/** Defaults; both can be lowered through `ServerOptions.views` (tests, constrained hosts). */
+export const VIEW_TIMEOUT_MS = 5_000;
+export const VIEW_MAX_BYTES = 1024 * 1024;
+const MAX_PARAMS = 16;
+const MAX_KEY = 64;
+const MAX_VALUE = 512;
+/** One message for every "no such view" reason, so a probe cannot tell which plugins exist. */
+const NOT_FOUND = "View not found";
+/**
+ * Plugin data views: `GET /api/sessions/:sid/views/:plugin/:view?<params>`. Views are read-only
+ * BY CONTRACT (a plugin is not a sandbox); the server enforces what it can: GET only, the same
+ * auth/Host/Origin rules as every `/api` route, enabled plugins only, validated parameters, a
+ * timeout and a response size cap. Parameters and results are never logged (they may carry
+ * sensitive project data such as memory).
+ */
+export function registerPluginViewRoutes(router, ctx) {
+    const { sessions, workspaces, logger } = ctx;
+    const timeoutMs = ctx.timeoutMs ?? VIEW_TIMEOUT_MS;
+    const maxBytes = ctx.maxBytes ?? VIEW_MAX_BYTES;
+    router.get("/api/sessions/:sid/views/:plugin/:view", async ({ url, params, correlationId }) => {
+        const session = sessions.get(params.sid ?? "");
+        // The session's workspace must be one this server knows (and its folder must still exist).
+        if (!(await workspaces.pathOf(workspaceId(session.workspace))))
+            throw new HttpError("not_found", "Session not found");
+        const opened = await sessions.app(session);
+        const plugin = params.plugin ?? "";
+        const view = params.view ?? "";
+        const entry = opened.app.pluginCatalog().find((p) => p.id === plugin);
+        // `enabled` follows the user's choice at once; a plugin disabled while it still runs
+        // (`restart-required`) must stop answering immediately.
+        if (!entry?.enabled || !opened.app.plugins.viewsOf(plugin).some((v) => v.id === view))
+            throw new HttpError("not_found", NOT_FOUND);
+        const query = {};
+        let count = 0;
+        for (const [key, value] of url.searchParams) {
+            if (++count > MAX_PARAMS || key.length > MAX_KEY || value.length > MAX_VALUE)
+                throw new HttpError("validation_failed", "Invalid view parameters", {
+                    fields: ["(query)"],
+                });
+            if (key in query)
+                throw new HttpError("validation_failed", "Invalid view parameters", { fields: [key] });
+            query[key] = value;
+        }
+        const controller = new AbortController();
+        let timer;
+        const expired = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                controller.abort(new Error("View timed out"));
+                reject(new HttpError("view_timeout", "The view took too long"));
+            }, timeoutMs);
+        });
+        let data;
+        try {
+            data = await Promise.race([
+                opened.app.plugins.runView(plugin, view, query, {
+                    sessionId: session.id,
+                    workspace: session.workspace,
+                    signal: controller.signal,
+                }),
+                expired,
+            ]);
+        }
+        catch (error) {
+            if (error instanceof HttpError)
+                throw error;
+            if (controller.signal.aborted)
+                throw new HttpError("view_timeout", "The view took too long");
+            if (error instanceof ViewRunError) {
+                if (error.code === "not_found")
+                    throw new HttpError("not_found", NOT_FOUND);
+                if (error.code === "invalid_params")
+                    throw new HttpError("validation_failed", error.message, error.fields.length ? { fields: error.fields } : undefined);
+                // Only the error class is logged: its message may quote data the view was reading.
+                logger.warn("plugin view failed", {
+                    correlationId,
+                    sessionId: session.id,
+                    plugin,
+                    view,
+                    error: error.cause instanceof Error ? error.cause.name : "unknown",
+                });
+                throw new HttpError("view_failed", "The view failed");
+            }
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const text = JSON.stringify(data ?? null);
+        if (Buffer.byteLength(text) > maxBytes)
+            throw new HttpError("view_too_large", "The view answered more than the server allows");
+        return { body: JSON.parse(text) };
+    });
+}

package/dist/routes/sessions.js

@@ -121,6 +121,8 @@ export function registerSessionRoutes(router, ctx) {
         if (patch.preset !== undefined)
             sessions.resetPolicy(session.id);
         sessions.notify(session.id);
+        if (Object.keys(options).length)
+            sessions.optionsChanged(session.id);
         return { body: sessions.detail(sessions.get(session.id)) };
     });
     router.get("/api/sessions/:sid/messages", ({ params, url }) => {

package/dist/routes/tasks.d.ts

@@ -0,0 +1,5 @@
+import type { SessionService } from "../host/sessions.ts";
+import type { Router } from "../http/router.ts";
+export declare function registerTaskRoutes(router: Router, ctx: {
+    sessions: SessionService;
+}): void;