@anhlp/alp-paseo 0.0.1-beta.3 → 0.0.1-beta.4

package/NOTICE

@@ -12,15 +12,11 @@ This package includes software from Paseo (https://github.com/getpaseo/paseo),
 Copyright (c) 2025-present Mohamed Boudra, licensed under the Apache License,
 Version 2.0. Third-party components incorporated into Paseo remain licensed
 under the licenses provided by their respective copyright holders.
+LICENSE.paseo.txt is Paseo's licence as Paseo ships it.
 
-All of it is taken from Paseo at commit
+Except for provider-prompt.ts noted below, the following is taken from Paseo at commit
 b63a325be3d3ae444fbd38815658cca01ab1288f (0.11.2) and changed for ALP:
 
-* server/dist/web-app: Paseo's web app (packages/app), built with the patches
-  in ALP's paseo-web/patches. Its NOTICE.txt says what they change,
-  LICENSE.paseo.txt is Paseo's licence as Paseo ships it, and
-  THIRD-PARTY-NOTICES.txt reproduces the licences of the third-party
-  packages bundled into the app.
 * server/dist: code from Paseo's daemon (packages/server/src/server), each
   source file in ALP's integrations/paseo/server/paseo saying what changed:
   - agent/chat-search/index.ts (chat-search.ts)
@@ -32,3 +28,10 @@ b63a325be3d3ae444fbd38815658cca01ab1288f (0.11.2) and changed for ALP:
   - utils/diff-highlighter.ts, its unified-diff parser (checkout.ts)
 * server/dist also bundles Paseo's @getpaseo/protocol and @getpaseo/relay;
   see server/dist/THIRD-PARTY-NOTICES.txt.
+
+* server/provider-prompt.ts adapts renderPromptAttachmentAsText from
+  packages/server/src/server/agent/prompt-attachments.ts at
+  cafe4b01c8522ff39560241c5deb01427dc8dc5b (0.12.0), identical at
+  ab10a6694ccf068959d1a6b67b6c915e21a9fe91 (0.11.1). It renders textual
+  context as user text, preserves images and uploads for their dedicated paths,
+  and applies the protocol's GitHub default when forge is omitted.

package/README.md

@@ -34,14 +34,33 @@ as a full screen from the chat:
   lists the open tasks. Tapping one opens it; **All tasks** opens the board.
 - `/alp-tasks` opens the board, and `/alp-tasks <id>` opens that task.
 
-## Host settings on the ALP web app
-
-Settings → Host exposes **Templates**, **Agents**, **Skills**, **Hooks**, and
-**MCP servers** directly. Templates opens the Phở/Cafe team editor for models,
-members, delegation, supervisor, and house rules. Changes are saved in the selected
-host's ALP library; saving a built-in entry creates an override. The ALP plugin
-settings screen and the ALP project panel remain available for library management
-and project overrides.
+## Host settings
+
+The ALP plugin settings screen and the ALP project panel manage the host's ALP
+library (teams, agents, skills, hooks, MCP servers) and project overrides; saving a
+built-in entry creates an override. ALP's patched build of Paseo's web app, which
+also showed these under Settings → Host, was removed (t-55ce.3). ALP's own web app
+(`alp web`) shows the library under Settings, within the limits in
+[web.md](https://github.com/phucanh08/alp/blob/main/docs/alp/web.md).
+
+## Managed worktree removal through the web facade
+
+The facade accepts Paseo's native `paseo_worktree_archive_request`. Set
+`scope: "worktree"` to remove an ALP-managed user worktree, targeting its
+`workspaceId` or absolute `worktreePath` (or `repoRoot` and `branchName`). If
+multiple target fields are supplied they must agree. A workspace archived earlier
+can still be targeted explicitly. Removal retains the Git branch.
+
+The daemon's `workspace.worktree.remove` is the sole deletion authority. It checks
+the creator, approved mapping, checkout identity, dirty files, runtime admission,
+leases, assignments and saved session history. A refusal leaves workspace metadata
+and checkout files intact; sessions are never archived to bypass these checks.
+External checkouts cannot be deleted. Older daemons return an upgrade error.
+
+Omitting `scope`, choosing `scope: "workspace"`, or using
+`archive_workspace_request` only archives the workspace. As in supported Paseo
+0.11.1–0.12.x, the legacy `deleteWorktreeFromDisk` flag does not request deletion.
+This follows [Paseo's native archive contract](https://github.com/getpaseo/paseo/blob/b63a325be3d3ae444fbd38815658cca01ab1288f/packages/server/src/server/worktree/commands.ts#L121).
 
 ## Install
 
@@ -51,7 +70,7 @@ exactly `@0.0.1-beta.3`). See the
 [release notes](https://github.com/phucanh08/alp/blob/main/docs/alp/beta-release-notes.md) and
 [install, upgrade and removal steps](https://github.com/phucanh08/alp/blob/main/docs/alp/beta-install.md).
 
-Requires Paseo `>=0.11.1 <0.13.0` (0.11.x or 0.12.x), Node.js 22 (22.12 or later) or 24 on Linux or macOS
+Requires Paseo `>=0.11.1 <1.0.0` (the published `0.0.1-beta.3` declares `<0.13.0`, so 0.11.x or 0.12.x), Node.js 22 (22.12 or later) or 24 on Linux or macOS
 (Windows and Node.js 26 are experimental), and an authenticated native Codex or Claude Code
 executable on PATH.
 
@@ -98,6 +117,20 @@ reports that alpd.js was not found, run `alp daemon start` once, or set
 environment. `ALP_HOME` (default `~/.alp`) selects the daemon's directory and
 must match between the CLI and Paseo.
 
+The provider offers images when alpd's connection handshake (or `daemon.hello`
+for an embedded connection) lists `prompt.images`, and Paseo requests them.
+Individual sessions still validate runtime support and image limits. The offer
+is fixed for the provider connection; a replacement backend validates each prompt.
+Missing or failed capability discovery leaves images unavailable.
+
+Forge issues and change requests, legacy GitHub attachments, reviews, and text
+context are sent as ordinary user text using Paseo's attachment rendering. Bodies
+and review lines retain their content and order; context metadata grants no system
+authority. Uploaded files continue through alpd's attachment store. Native command prompts
+(`{ type: "command", name, arguments }`) are unsupported: the provider does not
+advertise `prompt.command` and rejects them before waking or contacting a session.
+It does not translate commands into prose.
+
 Closing an agent in Paseo stops watching it; work in progress finishes in
 alpd. Use interrupt to stop work. You talk with main: when main asks you a
 question with `alp_ask`, Paseo shows it as a question prompt; your answer, or a
@@ -151,16 +184,21 @@ npm run test -w @anhlp/alp-paseo
 npm pack -w @anhlp/alp-paseo
 ```
 
-`integrations/paseo` owns the plugin client, server, shared types and manifest. The build writes the self-contained server bundles (including the integration entry `server/dist/main.js` and `server/dist/alpd.js`) and the web app to `server/dist`; only the plugin package ships these Paseo artifacts. The npm package is `@anhlp/alp-paseo` (`alp-paseo-plugin` up to 0.10.0); the Paseo plugin ID remains `alp-provider`.
+`integrations/paseo` owns the plugin client, server, shared types and manifest. The build writes the self-contained server bundles (including the integration entry `server/dist/main.js` and `server/dist/alpd.js`) to `server/dist`; only the plugin package ships these Paseo artifacts. It no longer builds or ships Paseo's web app (removed in t-55ce.3); the package ships Paseo's licence as `LICENSE.paseo.txt` for the code it takes from Paseo. The npm package is `@anhlp/alp-paseo` (`alp-paseo-plugin` up to 0.10.0); the Paseo plugin ID remains `alp-provider`.
+
+<a id="optional-web-installation"></a>
 
-## Optional web installation
+## Optional standalone integration (relay pairing)
 
-`@anhlp/alp` and the six core packages install without Paseo. To use the web UI:
+`@anhlp/alp` and the six core packages install without Paseo. `alp web` no longer needs this
+package: from the release after `0.0.1-beta.3` it runs the CLI's own `alp-web` service
+([web.md](https://github.com/phucanh08/alp/blob/main/docs/alp/web.md)). This package's standalone
+integration (integration `paseo`) is what pairs Paseo's app on another device through the relay:
 
 ```sh
 npm install -g @anhlp/alp@beta @anhlp/alp-paseo@beta
-alp-web-integration --register
-alp web --print
+alp-paseo-integration --register
+alp web pair --on       # starts the integration, turns the relay on, prints the link and password
 alp web pair --off
 ```
 
@@ -169,7 +207,7 @@ React Native are optional peers that the Paseo app provides, so npm does not ins
 Do not use `--legacy-peer-deps` for a standalone installation unless you supply the required
 peers explicitly. The binary is also discoverable on PATH, so registration is optional
 for a global install. For a local install, run
-`./node_modules/.bin/alp-web-integration --register` with the intended `ALP_HOME`.
+`./node_modules/.bin/alp-paseo-integration --register` with the intended `ALP_HOME`.
 
 A plugin directory managed by `paseo plugin add npm:…` is not a standalone web
 installation. Paseo installs it without peers and supplies `@getpaseo/plugin` through
@@ -177,8 +215,8 @@ its plugin loader. Running `node <managed-plugin>/server/dist/main.js --register
 directly bypasses that loader and can fail with `ERR_MODULE_NOT_FOUND` for
 `@getpaseo/plugin`; this invocation from the managed directory is unsupported
 ([#154](https://github.com/phucanh08/alp/issues/154)). Use the normal npm installation
-and `alp-web-integration --register` shown above. For a local npm installation with
-required peers, use `./node_modules/.bin/alp-web-integration --register` with the
+and `alp-paseo-integration --register` shown above. For a local npm installation with
+required peers, use `./node_modules/.bin/alp-paseo-integration --register` with the
 intended `ALP_HOME`. Registration records the entry path; it does not install missing
 peers or turn a host-managed plugin into a standalone installation.
 
@@ -187,11 +225,22 @@ available independently of this standalone web process.
 
 Core upgrades no longer update a bundled plugin: upgrade `@anhlp/alp-paseo`
 separately, and re-register if its installation location changes. Keep existing
-`web` settings, `web.json` token/server identity and ALP session storage.
-`alp web`, `alp web --print`, `alp web pair --on/--off`, `ALP_WEB_INTEGRATION`,
-`ALP_INTEGRATION_ENTRY`, `ALP_DAEMON_ENTRY`, `ALP_SUPERVISE` and `ALP_HOME` retain
-their meanings. Without the plugin, web commands explain how to install it;
-CLI, daemon, IPC and ACP remain usable.
+`web` settings and ALP session storage. The integration is named `paseo`: it keeps its token and
+server identity in `paseo.json` (carried over once from a `web.json` written before the rename),
+locks `integrations/paseo.lock`, registers `integrations/paseo.json` and binds a port the system
+picks, since `web.port` and `web.json` now belong to `alp-web`. `alp-web-integration` remains an
+alias of `alp-paseo-integration` for one release, and a home that has only the old
+`integrations/web.json` descriptor still starts it, with a hint to re-register.
+When Paseo's app asks for a password, give it the one `alp web pair` prints.
+`ALP_PASEO_INTEGRATION` names the integration's entry; `ALP_WEB_INTEGRATION` is read for it too,
+after `ALP_PASEO_INTEGRATION`, for one release, and never selects what `alp web` runs.
+`alp web pair --on/--off`, `ALP_INTEGRATION_ENTRY`, `ALP_DAEMON_ENTRY`, `ALP_SUPERVISE` and
+`ALP_HOME` retain their meanings. `alp web` and `alp web --print` now open the CLI's `alp-web`
+service; this package no longer has a web app, and its listener answers plain HTTP with 404 and
+keeps only the token-guarded Paseo socket. The first `alp web` stops a pre-rename integration
+that still holds `integrations/web.lock` (only a provable same-user, same-boot owner). Without the
+plugin, `alp web pair` explains how to install it; CLI, daemon, IPC, ACP and `alp web` remain
+usable.
 
 The public provider (`alp`), plugin ID (`alp-provider`), exports (`.`, `/main`,
 `/web`, `/paseo/*`, `/panel/*`), Phở/Cafe sessions, streaming/cancel, delegation,
@@ -200,6 +249,5 @@ daemon supervision/reconnection are unchanged. `release:tarball-check` runs the
 existing provider, team, human, web, relay and transport regressions against a
 separately installed plugin and real SDK peers.
 
-For source builds, `npm run build:paseo` builds the server; `npm run build:web`
-builds the pinned web app. Plugin prepack verifies its own web artifact. Neither
-step is required by core build/prepack.
+For source builds, `npm run build:paseo` builds the server (plugin prepack runs it). It
+is not required by core build/prepack.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anhlp/alp-paseo",
-  "version": "0.0.1-beta.3",
+  "version": "0.0.1-beta.4",
   "type": "module",
   "files": [
     "paseo-plugin.json",
@@ -9,27 +9,28 @@
     "client",
     "shared",
     "server/dist",
-    "NOTICE"
+    "NOTICE",
+    "LICENSE.paseo.txt"
   ],
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.292",
     "@anthropic-ai/sdk": "0.131.0",
     "@modelcontextprotocol/sdk": "1.32.1",
     "zod": "4.4.3",
-    "@anhlp/alp-protocol": "0.0.1-beta.3",
-    "@anhlp/alp-core": "0.0.1-beta.3",
-    "@anhlp/alp-runtime": "0.0.1-beta.3",
-    "@anhlp/alp-daemon": "0.0.1-beta.3",
-    "@anhlp/alp-client": "0.0.1-beta.3",
+    "@anhlp/alp-protocol": "0.0.1-beta.4",
+    "@anhlp/alp-core": "0.0.1-beta.4",
+    "@anhlp/alp-runtime": "0.0.1-beta.4",
+    "@anhlp/alp-daemon": "0.0.1-beta.4",
+    "@anhlp/alp-client": "0.0.1-beta.4",
     "ws": "^8.22.0"
   },
   "peerDependencies": {
-    "@getpaseo/plugin": ">=0.11.1 <0.13.0",
+    "@getpaseo/plugin": ">=0.11.1 <1.0.0",
     "react": ">=19 <20",
     "react-native": ">=0.81 <0.82",
-    "@getpaseo/client": ">=0.11.1 <0.13.0",
-    "@getpaseo/protocol": ">=0.11.1 <0.13.0",
-    "@getpaseo/relay": ">=0.11.1 <0.13.0",
+    "@getpaseo/client": ">=0.11.1 <1.0.0",
+    "@getpaseo/protocol": ">=0.11.1 <1.0.0",
+    "@getpaseo/relay": ">=0.11.1 <1.0.0",
     "ws": "*"
   },
   "peerDependenciesMeta": {
@@ -62,9 +63,10 @@
   "scripts": {
     "build": "node ../../scripts/build-workspace.mjs paseo",
     "test": "node ../../scripts/test-package.mjs paseo",
-    "prepack": "npm run build && node ../../scripts/check-web-app.mjs"
+    "prepack": "npm run build"
   },
   "bin": {
+    "alp-paseo-integration": "server/dist/main.js",
     "alp-web-integration": "server/dist/main.js"
   },
   "exports": {
@@ -94,5 +96,8 @@
     "@getpaseo/relay": "0.12.0",
     "esbuild": "0.25.12",
     "react-dom": "19.1.0"
+  },
+  "optionalDependencies": {
+    "node-pty": "1.2.0-beta.15"
   }
 }

package/paseo-plugin.json

@@ -1,5 +1,5 @@
 {
   "id": "alp-provider",
   "description": "Run filesystem-defined ALP agents",
-  "requirements": { "paseo": ">=0.11.1 <0.13.0" }
+  "requirements": { "paseo": ">=0.11.1 <1.0.0" }
 }