@buoy-gg/ask-buoy 7.0.33

package/lib/module/store/useAskBuoy.js

@@ -0,0 +1,293 @@
+"use strict";
+
+/**
+ * Wire the sheet to the agent.
+ *
+ * Two things here are load-bearing:
+ *
+ * 1. DISPATCH GOES THROUGH `dispatchToolAction`, the same on-device seam a
+ *    Scenario step and a desktop click use. No second adapter map, nothing
+ *    that can drift from what the broker sees.
+ * 2. THE SESSION IS REBUILT WHEN THE TOOL LIST CHANGES. The adapter map is a
+ *    memo whose contents depend on which packages resolved and whether a
+ *    QueryClientProvider is above FloatingDevTools — it is per-app and per
+ *    render, never a constant. A session that cached the tool list at open
+ *    would offer the model tools that are no longer there.
+ */
+import { useCallback, useEffect, useMemo, useRef, useSyncExternalStore } from "react";
+import { Platform } from "react-native";
+import { dispatchToolAction, listSnapshotToolIds, listToolActions, readToolSnapshot, waitForToolRegistry } from "@buoy-gg/shared-ui";
+import { answerToText, CATALOG, createAskBuoySession, runGatedAction, SNAPSHOT_ACTION } from "@buoy-gg/agent-core";
+import { askBuoyStore } from "./askBuoyStore";
+const isRelease = typeof __DEV__ !== "undefined" && !__DEV__;
+export function useAskBuoyState() {
+  return useSyncExternalStore(askBuoyStore.subscribe, askBuoyStore.getState, askBuoyStore.getState);
+}
+export function useAskBuoy(config) {
+  const state = useAskBuoyState();
+  const sessionRef = useRef(null);
+  const abortRef = useRef(null);
+  // Read through a ref where a stable callback needs the LATEST config (the
+  // onEvent tap) without re-creating the callback per render.
+  const configRef = useRef(config);
+  configRef.current = config;
+  const configured = !!config?.endpoint && !!config?.model;
+
+  // Recomputed each render: the set of dispatchable tools is not a constant.
+  //
+  // `getSnapshot` is folded in here because half of Buoy's read surface is not
+  // an action at all — console entries, network events, routes and env live
+  // only in the adapter's snapshot. Without this the model is offered a
+  // console tool whose sole action wipes the logs, and no way to read them.
+  const availableActions = useMemo(() => {
+    try {
+      const actions = listToolActions();
+      for (const toolId of listSnapshotToolIds()) {
+        if (!actions[toolId]) actions[toolId] = [];
+        if (!actions[toolId].includes(SNAPSHOT_ACTION)) {
+          actions[toolId] = [SNAPSHOT_ACTION, ...actions[toolId]];
+        }
+      }
+      return actions;
+    } catch {
+      return {};
+    }
+  }, []);
+  const toolKey = Object.keys(availableActions).sort().join(",");
+  useEffect(() => {
+    askBuoyStore.setConfigured(configured);
+    if (!configured || !config) {
+      sessionRef.current = null;
+      askBuoyStore.setNotice("Ask Buoy isn't set up in this app yet. A developer needs to point it at your team's AI endpoint.");
+      return;
+    }
+    // The classic first-run mistake, caught statically: a provider's own URL
+    // with the wrong protocol fails with a raw error that says nothing about
+    // the one-line fix. ONLY the canonical provider hosts are checked — a
+    // gateway may legitimately speak either protocol on any path (our own dev
+    // gateway serves OpenAI framing on /v1/messages, and a path-based version
+    // of this check flagged it on the first device run).
+    const protocol = config.protocol ?? "anthropic";
+    if (isRelease && config.apiKey) {
+      askBuoyStore.setNotice("This build carries a plaintext apiKey — that's dev-only and it ships to every install. Use the headers callback with your own gateway for distributed builds.");
+    } else if (protocol === "anthropic" && /^https?:\/\/api\.openai\.com\//i.test(config.endpoint)) {
+      askBuoyStore.setNotice('This endpoint is api.openai.com but the protocol is "anthropic". Set protocol: "openai" in the askBuoy config.');
+    } else if (protocol === "openai" && /^https?:\/\/api\.anthropic\.com\//i.test(config.endpoint)) {
+      askBuoyStore.setNotice('This endpoint is api.anthropic.com but the protocol is "openai". Remove protocol or set it to "anthropic".');
+    } else {
+      askBuoyStore.setNotice(null);
+    }
+
+    // Reuse the held session while nothing material changed. The transcript
+    // already survives close/reopen in the module store; without this the
+    // session and ledger did not — reopening the sheet swapped in an empty
+    // ledger (undo bar gone, agent changes still live in the app) and a blank
+    // model memory behind a transcript that still showed the conversation.
+    // The tool list is deliberately NOT part of this signature. Packages
+    // register a frame or two apart, so `toolKey` legitimately changes right
+    // after open — and keying on it silently rebuilt the session mid-chat,
+    // throwing away the conversation, the model's memory and the undo ledger
+    // while the transcript (a separate store) kept rendering as if nothing
+    // happened. Verified on device: a destructive change went unrecorded
+    // because it landed in a ledger that had just been replaced.
+    const signature = [config.endpoint, config.protocol ?? "anthropic", config.model].join("|");
+    const held = askBuoyStore.getHeldSession();
+    if (held && held.signature === signature) {
+      sessionRef.current = held.session;
+      held.session.setAvailableActions(availableActions);
+      askBuoyStore.setLedger(held.session.ledger);
+      return;
+    }
+    const session = createAskBuoySession({
+      endpoint: config.endpoint,
+      protocol: config.protocol ?? "anthropic",
+      model: config.model,
+      headers: config.headers,
+      apiKey: config.apiKey,
+      maxTokens: config.maxTokens,
+      anthropicVersion: config.anthropicVersion,
+      requestOverrides: config.requestOverrides,
+      // Host-declared custom tools join the built-in catalog. toProviderTools
+      // still filters against the live registry, so a descriptor whose
+      // `custom:<id>` adapter never registered is simply not offered.
+      catalog: config.tools?.length ? [...CATALOG, ...config.tools] : undefined,
+      dispatch: dispatchToolAction,
+      readSnapshot: readToolSnapshot,
+      availableActions,
+      policy: config.policy,
+      context: config.context,
+      isRelease,
+      appName: config.appName,
+      platform: Platform.OS,
+      requestApproval: input => askBuoyStore.askApproval(input)
+    });
+    sessionRef.current = session;
+    askBuoyStore.holdSession(session, signature);
+    askBuoyStore.setLedger(session.ledger);
+
+    // The registry publishes on mount, a frame or two after first paint. Warm
+    // the grounding once it is there so the first question does not pay for it.
+    let cancelled = false;
+    void waitForToolRegistry().then(ready => {
+      if (ready && !cancelled) void session.prime();
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [configured, config, availableActions, toolKey]);
+
+  /** Stream one turn into a fresh assistant bubble. Callers set up the user side. */
+  const runTurn = useCallback(text => {
+    const session = sessionRef.current;
+    if (!session) return;
+    askBuoyStore.beginTurn();
+    const messageId = askBuoyStore.startAssistant();
+    const controller = new AbortController();
+    abortRef.current = controller;
+    const onEvent = configRef.current?.onEvent;
+    void (async () => {
+      try {
+        for await (const ev of session.send(text, controller.signal)) {
+          askBuoyStore.applyEvent(messageId, ev);
+          if (onEvent) {
+            try {
+              onEvent(ev);
+            } catch {
+              // The audit tap must never take the chat down.
+            }
+          }
+        }
+      } catch (err) {
+        askBuoyStore.applyEvent(messageId, {
+          type: "error",
+          message: err instanceof Error ? err.message : "Something went wrong talking to your AI endpoint."
+        });
+      } finally {
+        askBuoyStore.finishAssistant(messageId);
+        abortRef.current = null;
+      }
+    })();
+  }, []);
+  const send = useCallback(text => {
+    const trimmed = text.trim();
+    if (!sessionRef.current || !trimmed) return;
+
+    // Typed mid-turn: park it. The composer already cleared the field, and
+    // silently dropping the words was the worst of all outcomes.
+    if (askBuoyStore.getState().busy) {
+      askBuoyStore.setQueued(trimmed);
+      return;
+    }
+
+    // Typing past an Ask block IS an answer: the block is skipped and locks.
+    // Without this the composer stayed on "Pick an option above…" forever and
+    // a stale choice sat tappable in the history.
+    const awaiting = askBuoyStore.getState().awaitingBlockId;
+    if (awaiting) askBuoyStore.recordAnswer({
+      blockId: awaiting,
+      kind: "skipped"
+    });
+    askBuoyStore.addUser(trimmed);
+    runTurn(trimmed);
+  }, [runTurn]);
+  const retry = useCallback(() => {
+    const {
+      messages,
+      busy
+    } = askBuoyStore.getState();
+    if (busy || !sessionRef.current) return;
+    const lastUser = [...messages].reverse().find(m => m.role === "user");
+    if (!lastUser) return;
+    // Replace the failed bubble rather than stacking a second one under it.
+    const last = messages[messages.length - 1];
+    if (last && last.role === "assistant" && last.error) askBuoyStore.removeMessage(last.id);
+    runTurn(lastUser.text);
+  }, [runTurn]);
+  const stop = useCallback(() => {
+    // A pending approval parks an unresolved promise inside the engine; the
+    // abort signal is only read between steps, so Stop must also answer the
+    // approval (as declined) or the generator hangs forever.
+    if (askBuoyStore.getState().pending) askBuoyStore.answerApproval(false);
+    abortRef.current?.abort();
+    abortRef.current = null;
+  }, []);
+
+  // Flush the parked message the moment the turn ends.
+  const queued = state.queued;
+  useEffect(() => {
+    if (!state.busy && queued) {
+      askBuoyStore.setQueued(null);
+      send(queued);
+    }
+  }, [state.busy, queued, send]);
+  const reset = useCallback(() => {
+    abortRef.current?.abort();
+    sessionRef.current?.reset();
+    askBuoyStore.reset();
+  }, []);
+  const approve = useCallback(approved => {
+    askBuoyStore.answerApproval(approved);
+  }, []);
+  const answer = useCallback(a => {
+    askBuoyStore.recordAnswer(a);
+    // Plain words to the model, never JSON: "Business checkout", "Yes, go ahead."
+    send(answerToText(a));
+  }, [send]);
+
+  /**
+   * Block buttons. `send` is a chat reply; `dispatch` runs the action through
+   * `runGatedAction` — the SAME validation, policy and ledger path a model
+   * call takes, minus the model. The first version called `dispatchToolAction`
+   * raw, which made a model-authored button an invisible, ungoverned,
+   * unundoable mutation while the `buoy_ui` schema promised the opposite.
+   * The human's tap satisfies `requireApproval`; deny lists, read-only mode
+   * and release refusals still stand. Button state is tracked so a tap shows
+   * running → done and can't double-fire.
+   * (`minimize` / `openTool` are the sheet's to handle; see AskBuoyModal.)
+   */
+  const runAction = useCallback(async (action, blockId) => {
+    if (action.send) {
+      send(action.send);
+      return;
+    }
+    if (!action.dispatch) return;
+    const key = `${blockId}:${action.label}`;
+    const ledger = askBuoyStore.getLedger();
+    if (!ledger) {
+      askBuoyStore.setNotice(`${action.label} failed — no active Ask Buoy session.`);
+      return;
+    }
+    askBuoyStore.setActionState(key, "running");
+    const outcome = await runGatedAction({
+      toolId: action.dispatch.toolId,
+      action: action.dispatch.action,
+      params: action.dispatch.params ?? {},
+      dispatch: dispatchToolAction,
+      ledger,
+      policy: config?.policy ?? {},
+      isRelease,
+      // Same merged catalog the session offers, so a button on a custom
+      // tool's block is not refused as unknown.
+      catalog: config?.tools?.length ? [...CATALOG, ...config.tools] : undefined
+    });
+    if (outcome.ok) {
+      askBuoyStore.setActionState(key, "done");
+    } else {
+      askBuoyStore.setActionState(key, "failed");
+      askBuoyStore.setNotice(`${action.label} failed — ${outcome.error}`);
+    }
+  }, [send, config]);
+  return {
+    state,
+    send,
+    stop,
+    reset,
+    approve,
+    retry,
+    answer,
+    runAction,
+    configured,
+    toolCount: Object.keys(availableActions).length
+  };
+}
+//# sourceMappingURL=useAskBuoy.js.map

package/lib/module/store/useAskBuoy.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useCallback","useEffect","useMemo","useRef","useSyncExternalStore","Platform","dispatchToolAction","listSnapshotToolIds","listToolActions","readToolSnapshot","waitForToolRegistry","answerToText","CATALOG","createAskBuoySession","runGatedAction","SNAPSHOT_ACTION","askBuoyStore","isRelease","__DEV__","useAskBuoyState","subscribe","getState","useAskBuoy","config","state","sessionRef","abortRef","configRef","current","configured","endpoint","model","availableActions","actions","toolId","includes","toolKey","Object","keys","sort","join","setConfigured","setNotice","protocol","apiKey","test","signature","held","getHeldSession","session","setAvailableActions","setLedger","ledger","headers","maxTokens","anthropicVersion","requestOverrides","catalog","tools","length","undefined","dispatch","readSnapshot","policy","context","appName","platform","OS","requestApproval","input","askApproval","holdSession","cancelled","then","ready","prime","runTurn","text","beginTurn","messageId","startAssistant","controller","AbortController","onEvent","ev","send","signal","applyEvent","err","type","message","Error","finishAssistant","trimmed","trim","busy","setQueued","awaiting","awaitingBlockId","recordAnswer","blockId","kind","addUser","retry","messages","lastUser","reverse","find","m","role","last","error","removeMessage","id","stop","pending","answerApproval","abort","queued","reset","approve","approved","answer","a","runAction","action","key","label","getLedger","setActionState","outcome","params","ok","toolCount"],"sourceRoot":"../../../src","sources":["store/useAskBuoy.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,WAAW,EAAEC,SAAS,EAAEC,OAAO,EAAEC,MAAM,EAAEC,oBAAoB,QAAQ,OAAO;AACrF,SAASC,QAAQ,QAAQ,cAAc;AACvC,SACEC,kBAAkB,EAClBC,mBAAmB,EACnBC,eAAe,EACfC,gBAAgB,EAChBC,mBAAmB,QACd,oBAAoB;AAC3B,SACEC,YAAY,EACZC,OAAO,EACPC,oBAAoB,EACpBC,cAAc,EACdC,eAAe,QAIV,qBAAqB;AAE5B,SAASC,YAAY,QAA2B,gBAAgB;AAGhE,MAAMC,SAAS,GAAG,OAAOC,OAAO,KAAK,WAAW,IAAI,CAACA,OAAO;AAE5D,OAAO,SAASC,eAAeA,CAAA,EAAiB;EAC9C,OAAOf,oBAAoB,CAACY,YAAY,CAACI,SAAS,EAAEJ,YAAY,CAACK,QAAQ,EAAEL,YAAY,CAACK,QAAQ,CAAC;AACnG;AAmBA,OAAO,SAASC,UAAUA,CAACC,MAAiC,EAAqB;EAC/E,MAAMC,KAAK,GAAGL,eAAe,CAAC,CAAC;EAC/B,MAAMM,UAAU,GAAGtB,MAAM,CAAwB,IAAI,CAAC;EACtD,MAAMuB,QAAQ,GAAGvB,MAAM,CAAyB,IAAI,CAAC;EACrD;EACA;EACA,MAAMwB,SAAS,GAAGxB,MAAM,CAACoB,MAAM,CAAC;EAChCI,SAAS,CAACC,OAAO,GAAGL,MAAM;EAC1B,MAAMM,UAAU,GAAG,CAAC,CAACN,MAAM,EAAEO,QAAQ,IAAI,CAAC,CAACP,MAAM,EAAEQ,KAAK;;EAExD;EACA;EACA;EACA;EACA;EACA;EACA,MAAMC,gBAAgB,GAAG9B,OAAO,CAAC,MAAM;IACrC,IAAI;MACF,MAAM+B,OAAO,GAAGzB,eAAe,CAAC,CAAC;MACjC,KAAK,MAAM0B,MAAM,IAAI3B,mBAAmB,CAAC,CAAC,EAAE;QAC1C,IAAI,CAAC0B,OAAO,CAACC,MAAM,CAAC,EAAED,OAAO,CAACC,MAAM,CAAC,GAAG,EAAE;QAC1C,IAAI,CAACD,OAAO,CAACC,MAAM,CAAC,CAACC,QAAQ,CAACpB,eAAe,CAAC,EAAE;UAC9CkB,OAAO,CAACC,MAAM,CAAC,GAAG,CAACnB,eAAe,EAAE,GAAGkB,OAAO,CAACC,MAAM,CAAC,CAAC;QACzD;MACF;MACA,OAAOD,OAAO;IAChB,CAAC,CAAC,MAAM;MACN,OAAO,CAAC,CAAC;IACX;EACF,CAAC,EAAE,EAAE,CAAC;EAEN,MAAMG,OAAO,GAAGC,MAAM,CAACC,IAAI,CAACN,gBAAgB,CAAC,CAACO,IAAI,CAAC,CAAC,CAACC,IAAI,CAAC,GAAG,CAAC;EAE9DvC,SAAS,CAAC,MAAM;IACde,YAAY,CAACyB,aAAa,CAACZ,UAAU,CAAC;IACtC,IAAI,CAACA,UAAU,IAAI,CAACN,MAAM,EAAE;MAC1BE,UAAU,CAACG,OAAO,GAAG,IAAI;MACzBZ,YAAY,CAAC0B,SAAS,CACpB,kGACF,CAAC;MACD;IACF;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAMC,QAAQ,GAAGpB,MAAM,CAACoB,QAAQ,IAAI,WAAW;IAC/C,IAAI1B,SAAS,IAAIM,MAAM,CAACqB,MAAM,EAAE;MAC9B5B,YAAY,CAAC0B,SAAS,CACpB,+JACF,CAAC;IACH,CAAC,MAAM,IAAIC,QAAQ,KAAK,WAAW,IAAI,iCAAiC,CAACE,IAAI,CAACtB,MAAM,CAACO,QAAQ,CAAC,EAAE;MAC9Fd,YAAY,CAAC0B,SAAS,CACpB,gHACF,CAAC;IACH,CAAC,MAAM,IAAIC,QAAQ,KAAK,QAAQ,IAAI,oCAAoC,CAACE,IAAI,CAACtB,MAAM,CAACO,QAAQ,CAAC,EAAE;MAC9Fd,YAAY,CAAC0B,SAAS,CACpB,4GACF,CAAC;IACH,CAAC,MAAM;MACL1B,YAAY,CAAC0B,SAAS,CAAC,IAAI,CAAC;IAC9B;;IAEA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAMI,SAAS,GAAG,CAACvB,MAAM,CAACO,QAAQ,EAAEP,MAAM,CAACoB,QAAQ,IAAI,WAAW,EAAEpB,MAAM,CAACQ,KAAK,CAAC,CAACS,IAAI,CAAC,GAAG,CAAC;IAC3F,MAAMO,IAAI,GAAG/B,YAAY,CAACgC,cAAc,CAAC,CAAC;IAC1C,IAAID,IAAI,IAAIA,IAAI,CAACD,SAAS,KAAKA,SAAS,EAAE;MACxCrB,UAAU,CAACG,OAAO,GAAGmB,IAAI,CAACE,OAAO;MACjCF,IAAI,CAACE,OAAO,CAACC,mBAAmB,CAAClB,gBAAgB,CAAC;MAClDhB,YAAY,CAACmC,SAAS,CAACJ,IAAI,CAACE,OAAO,CAACG,MAAM,CAAC;MAC3C;IACF;IAEA,MAAMH,OAAO,GAAGpC,oBAAoB,CAAC;MACnCiB,QAAQ,EAAEP,MAAM,CAACO,QAAQ;MACzBa,QAAQ,EAAEpB,MAAM,CAACoB,QAAQ,IAAI,WAAW;MACxCZ,KAAK,EAAER,MAAM,CAACQ,KAAK;MACnBsB,OAAO,EAAE9B,MAAM,CAAC8B,OAAO;MACvBT,MAAM,EAAErB,MAAM,CAACqB,MAAM;MACrBU,SAAS,EAAE/B,MAAM,CAAC+B,SAAS;MAC3BC,gBAAgB,EAAEhC,MAAM,CAACgC,gBAAgB;MACzCC,gBAAgB,EAAEjC,MAAM,CAACiC,gBAAgB;MACzC;MACA;MACA;MACAC,OAAO,EAAElC,MAAM,CAACmC,KAAK,EAAEC,MAAM,GAAG,CAAC,GAAG/C,OAAO,EAAE,GAAGW,MAAM,CAACmC,KAAK,CAAC,GAAGE,SAAS;MACzEC,QAAQ,EAAEvD,kBAAkB;MAC5BwD,YAAY,EAAErD,gBAAgB;MAC9BuB,gBAAgB;MAChB+B,MAAM,EAAExC,MAAM,CAACwC,MAAM;MACrBC,OAAO,EAAEzC,MAAM,CAACyC,OAAO;MACvB/C,SAAS;MACTgD,OAAO,EAAE1C,MAAM,CAAC0C,OAAO;MACvBC,QAAQ,EAAE7D,QAAQ,CAAC8D,EAAE;MACrBC,eAAe,EAAGC,KAAK,IAAKrD,YAAY,CAACsD,WAAW,CAACD,KAAK;IAC5D,CAAC,CAAC;IACF5C,UAAU,CAACG,OAAO,GAAGqB,OAAO;IAC5BjC,YAAY,CAACuD,WAAW,CAACtB,OAAO,EAAEH,SAAS,CAAC;IAC5C9B,YAAY,CAACmC,SAAS,CAACF,OAAO,CAACG,MAAM,CAAC;;IAEtC;IACA;IACA,IAAIoB,SAAS,GAAG,KAAK;IACrB,KAAK9D,mBAAmB,CAAC,CAAC,CAAC+D,IAAI,CAAEC,KAAK,IAAK;MACzC,IAAIA,KAAK,IAAI,CAACF,SAAS,EAAE,KAAKvB,OAAO,CAAC0B,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC;IACF,OAAO,MAAM;MACXH,SAAS,GAAG,IAAI;IAClB,CAAC;EACH,CAAC,EAAE,CAAC3C,UAAU,EAAEN,MAAM,EAAES,gBAAgB,EAAEI,OAAO,CAAC,CAAC;;EAEnD;EACA,MAAMwC,OAAO,GAAG5E,WAAW,CAAE6E,IAAY,IAAK;IAC5C,MAAM5B,OAAO,GAAGxB,UAAU,CAACG,OAAO;IAClC,IAAI,CAACqB,OAAO,EAAE;IACdjC,YAAY,CAAC8D,SAAS,CAAC,CAAC;IACxB,MAAMC,SAAS,GAAG/D,YAAY,CAACgE,cAAc,CAAC,CAAC;IAC/C,MAAMC,UAAU,GAAG,IAAIC,eAAe,CAAC,CAAC;IACxCxD,QAAQ,CAACE,OAAO,GAAGqD,UAAU;IAE7B,MAAME,OAAO,GAAGxD,SAAS,CAACC,OAAO,EAAEuD,OAAO;IAC1C,KAAK,CAAC,YAAY;MAChB,IAAI;QACF,WAAW,MAAMC,EAAE,IAAInC,OAAO,CAACoC,IAAI,CAACR,IAAI,EAAEI,UAAU,CAACK,MAAM,CAAC,EAAE;UAC5DtE,YAAY,CAACuE,UAAU,CAACR,SAAS,EAAEK,EAAE,CAAC;UACtC,IAAID,OAAO,EAAE;YACX,IAAI;cACFA,OAAO,CAACC,EAAE,CAAC;YACb,CAAC,CAAC,MAAM;cACN;YAAA;UAEJ;QACF;MACF,CAAC,CAAC,OAAOI,GAAG,EAAE;QACZxE,YAAY,CAACuE,UAAU,CAACR,SAAS,EAAE;UACjCU,IAAI,EAAE,OAAO;UACbC,OAAO,EACLF,GAAG,YAAYG,KAAK,GAChBH,GAAG,CAACE,OAAO,GACX;QACR,CAAC,CAAC;MACJ,CAAC,SAAS;QACR1E,YAAY,CAAC4E,eAAe,CAACb,SAAS,CAAC;QACvCrD,QAAQ,CAACE,OAAO,GAAG,IAAI;MACzB;IACF,CAAC,EAAE,CAAC;EACN,CAAC,EAAE,EAAE,CAAC;EAEN,MAAMyD,IAAI,GAAGrF,WAAW,CACrB6E,IAAY,IAAK;IAChB,MAAMgB,OAAO,GAAGhB,IAAI,CAACiB,IAAI,CAAC,CAAC;IAC3B,IAAI,CAACrE,UAAU,CAACG,OAAO,IAAI,CAACiE,OAAO,EAAE;;IAErC;IACA;IACA,IAAI7E,YAAY,CAACK,QAAQ,CAAC,CAAC,CAAC0E,IAAI,EAAE;MAChC/E,YAAY,CAACgF,SAAS,CAACH,OAAO,CAAC;MAC/B;IACF;;IAEA;IACA;IACA;IACA,MAAMI,QAAQ,GAAGjF,YAAY,CAACK,QAAQ,CAAC,CAAC,CAAC6E,eAAe;IACxD,IAAID,QAAQ,EAAEjF,YAAY,CAACmF,YAAY,CAAC;MAAEC,OAAO,EAAEH,QAAQ;MAAEI,IAAI,EAAE;IAAU,CAAC,CAAC;IAE/ErF,YAAY,CAACsF,OAAO,CAACT,OAAO,CAAC;IAC7BjB,OAAO,CAACiB,OAAO,CAAC;EAClB,CAAC,EACD,CAACjB,OAAO,CACV,CAAC;EAED,MAAM2B,KAAK,GAAGvG,WAAW,CAAC,MAAM;IAC9B,MAAM;MAAEwG,QAAQ;MAAET;IAAK,CAAC,GAAG/E,YAAY,CAACK,QAAQ,CAAC,CAAC;IAClD,IAAI0E,IAAI,IAAI,CAACtE,UAAU,CAACG,OAAO,EAAE;IACjC,MAAM6E,QAAQ,GAAG,CAAC,GAAGD,QAAQ,CAAC,CAACE,OAAO,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,IAAI,KAAK,MAAM,CAAC;IACvE,IAAI,CAACJ,QAAQ,EAAE;IACf;IACA,MAAMK,IAAI,GAAGN,QAAQ,CAACA,QAAQ,CAAC7C,MAAM,GAAG,CAAC,CAAC;IAC1C,IAAImD,IAAI,IAAIA,IAAI,CAACD,IAAI,KAAK,WAAW,IAAIC,IAAI,CAACC,KAAK,EAAE/F,YAAY,CAACgG,aAAa,CAACF,IAAI,CAACG,EAAE,CAAC;IACxFrC,OAAO,CAAC6B,QAAQ,CAAC5B,IAAI,CAAC;EACxB,CAAC,EAAE,CAACD,OAAO,CAAC,CAAC;EAEb,MAAMsC,IAAI,GAAGlH,WAAW,CAAC,MAAM;IAC7B;IACA;IACA;IACA,IAAIgB,YAAY,CAACK,QAAQ,CAAC,CAAC,CAAC8F,OAAO,EAAEnG,YAAY,CAACoG,cAAc,CAAC,KAAK,CAAC;IACvE1F,QAAQ,CAACE,OAAO,EAAEyF,KAAK,CAAC,CAAC;IACzB3F,QAAQ,CAACE,OAAO,GAAG,IAAI;EACzB,CAAC,EAAE,EAAE,CAAC;;EAEN;EACA,MAAM0F,MAAM,GAAG9F,KAAK,CAAC8F,MAAM;EAC3BrH,SAAS,CAAC,MAAM;IACd,IAAI,CAACuB,KAAK,CAACuE,IAAI,IAAIuB,MAAM,EAAE;MACzBtG,YAAY,CAACgF,SAAS,CAAC,IAAI,CAAC;MAC5BX,IAAI,CAACiC,MAAM,CAAC;IACd;EACF,CAAC,EAAE,CAAC9F,KAAK,CAACuE,IAAI,EAAEuB,MAAM,EAAEjC,IAAI,CAAC,CAAC;EAE9B,MAAMkC,KAAK,GAAGvH,WAAW,CAAC,MAAM;IAC9B0B,QAAQ,CAACE,OAAO,EAAEyF,KAAK,CAAC,CAAC;IACzB5F,UAAU,CAACG,OAAO,EAAE2F,KAAK,CAAC,CAAC;IAC3BvG,YAAY,CAACuG,KAAK,CAAC,CAAC;EACtB,CAAC,EAAE,EAAE,CAAC;EAEN,MAAMC,OAAO,GAAGxH,WAAW,CAAEyH,QAAiB,IAAK;IACjDzG,YAAY,CAACoG,cAAc,CAACK,QAAQ,CAAC;EACvC,CAAC,EAAE,EAAE,CAAC;EAEN,MAAMC,MAAM,GAAG1H,WAAW,CACvB2H,CAAc,IAAK;IAClB3G,YAAY,CAACmF,YAAY,CAACwB,CAAC,CAAC;IAC5B;IACAtC,IAAI,CAAC1E,YAAY,CAACgH,CAAC,CAAC,CAAC;EACvB,CAAC,EACD,CAACtC,IAAI,CACP,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMuC,SAAS,GAAG5H,WAAW,CAC3B,OAAO6H,MAAmB,EAAEzB,OAAe,KAAK;IAC9C,IAAIyB,MAAM,CAACxC,IAAI,EAAE;MACfA,IAAI,CAACwC,MAAM,CAACxC,IAAI,CAAC;MACjB;IACF;IACA,IAAI,CAACwC,MAAM,CAAChE,QAAQ,EAAE;IACtB,MAAMiE,GAAG,GAAG,GAAG1B,OAAO,IAAIyB,MAAM,CAACE,KAAK,EAAE;IACxC,MAAM3E,MAAM,GAAGpC,YAAY,CAACgH,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC5E,MAAM,EAAE;MACXpC,YAAY,CAAC0B,SAAS,CAAC,GAAGmF,MAAM,CAACE,KAAK,uCAAuC,CAAC;MAC9E;IACF;IACA/G,YAAY,CAACiH,cAAc,CAACH,GAAG,EAAE,SAAS,CAAC;IAC3C,MAAMI,OAAO,GAAG,MAAMpH,cAAc,CAAC;MACnCoB,MAAM,EAAE2F,MAAM,CAAChE,QAAQ,CAAC3B,MAAM;MAC9B2F,MAAM,EAAEA,MAAM,CAAChE,QAAQ,CAACgE,MAAM;MAC9BM,MAAM,EAAEN,MAAM,CAAChE,QAAQ,CAACsE,MAAM,IAAI,CAAC,CAAC;MACpCtE,QAAQ,EAAEvD,kBAAkB;MAC5B8C,MAAM;MACNW,MAAM,EAAExC,MAAM,EAAEwC,MAAM,IAAI,CAAC,CAAC;MAC5B9C,SAAS;MACT;MACA;MACAwC,OAAO,EAAElC,MAAM,EAAEmC,KAAK,EAAEC,MAAM,GAAG,CAAC,GAAG/C,OAAO,EAAE,GAAGW,MAAM,CAACmC,KAAK,CAAC,GAAGE;IACnE,CAAC,CAAC;IACF,IAAIsE,OAAO,CAACE,EAAE,EAAE;MACdpH,YAAY,CAACiH,cAAc,CAACH,GAAG,EAAE,MAAM,CAAC;IAC1C,CAAC,MAAM;MACL9G,YAAY,CAACiH,cAAc,CAACH,GAAG,EAAE,QAAQ,CAAC;MAC1C9G,YAAY,CAAC0B,SAAS,CAAC,GAAGmF,MAAM,CAACE,KAAK,aAAaG,OAAO,CAACnB,KAAK,EAAE,CAAC;IACrE;EACF,CAAC,EACD,CAAC1B,IAAI,EAAE9D,MAAM,CACf,CAAC;EAED,OAAO;IACLC,KAAK;IACL6D,IAAI;IACJ6B,IAAI;IACJK,KAAK;IACLC,OAAO;IACPjB,KAAK;IACLmB,MAAM;IACNE,SAAS;IACT/F,UAAU;IACVwG,SAAS,EAAEhG,MAAM,CAACC,IAAI,CAACN,gBAAgB,CAAC,CAAC2B;EAC3C,CAAC;AACH","ignoreList":[]}

package/lib/module/sync/askBuoySyncAdapter.js

@@ -0,0 +1,114 @@
+"use strict";
+
+/**
+ * The sync adapter, so Buoy Desktop and MCP can see what Ask Buoy is doing.
+ *
+ * Read-heavy on purpose. There is no `send` action: letting a remote client
+ * put words in the agent's mouth would mean anyone who can reach the broker —
+ * which has no authentication at all, binds 0.0.0.0, and accepts any client
+ * calling itself "Dashboard" — could drive a mutating agent on a tester's
+ * device. The chat is initiated on-device, by a person, full stop.
+ *
+ * `undoAll` IS exposed, because the asymmetry is deliberate: putting things
+ * back is the safe direction, and a dev watching from the desktop should be
+ * able to clean up a device without walking over to it.
+ *
+ * The transcript is redacted before it crosses the wire. Action results the
+ * agent read can contain storage values and response bodies, and this socket
+ * broadcasts to every connected dashboard — it already leaks license keys the
+ * same way.
+ */
+import { dispatchToolAction, redactForWire } from "./wire";
+import { isReversible } from "@buoy-gg/agent-core";
+import { askBuoyStore } from "../store/askBuoyStore";
+export const ASK_BUOY_ADAPTER_VERSION = 1;
+export const askBuoySyncAdapter = {
+  version: ASK_BUOY_ADAPTER_VERSION,
+  getSnapshot() {
+    const state = askBuoyStore.getState();
+    const ledger = askBuoyStore.getLedger();
+    const entries = ledger?.list() ?? [];
+    const outstanding = entries.filter(e => !e.undoneAt);
+    return {
+      version: ASK_BUOY_ADAPTER_VERSION,
+      busy: state.busy,
+      configured: state.configured,
+      notice: state.notice,
+      messageCount: state.messages.length,
+      // Only the shape of the conversation, never tool payloads.
+      messages: state.messages.map(m => ({
+        id: m.id,
+        role: m.role,
+        text: redactForWire(m.text),
+        streaming: !!m.streaming,
+        toolCalls: m.toolCalls.map(c => ({
+          toolId: c.toolId,
+          action: c.action,
+          status: c.status
+        }))
+      })),
+      // Session token totals, so a desktop/MCP observer can meter cost.
+      usage: state.usage,
+      pendingApproval: state.pending ? {
+        toolId: state.pending.toolId,
+        action: state.pending.action,
+        label: state.pending.label
+      } : null,
+      changes: {
+        // Transients (navigation, taps) are one-shot actions, not changes —
+        // same rule as the on-device bar, so desktop and device tell one story.
+        reversible: outstanding.filter(e => isReversible(e.effect)).length,
+        permanent: outstanding.filter(e => e.effect.kind !== "transient" && !isReversible(e.effect)).length,
+        transients: outstanding.filter(e => e.effect.kind === "transient").length,
+        items: outstanding.map(e => ({
+          kind: e.effect.kind,
+          label: e.effect.label
+        }))
+      }
+    };
+  },
+  subscribe(onChange) {
+    const offStore = askBuoyStore.subscribe(onChange);
+    const offLedger = askBuoyStore.getLedger()?.subscribe(onChange);
+    return () => {
+      offStore();
+      offLedger?.();
+    };
+  },
+  actions: {
+    /** What the agent changed, and whether it can be put back. */
+    listChanges: () => {
+      const entries = askBuoyStore.getLedger()?.list() ?? [];
+      return entries.filter(e => !e.undoneAt).map(e => ({
+        id: e.id,
+        at: e.at,
+        toolId: e.toolId,
+        action: e.action,
+        kind: e.effect.kind,
+        label: e.effect.label,
+        reversible: isReversible(e.effect)
+      }));
+    },
+    /** Put back everything that can be put back. Safe direction only. */
+    undoAll: async () => {
+      const ledger = askBuoyStore.getLedger();
+      if (!ledger) return {
+        ok: false,
+        error: "No Ask Buoy session on this device."
+      };
+      const outcome = await ledger.revertAll(dispatchToolAction);
+      return {
+        ok: true,
+        ...outcome
+      };
+    },
+    /** Clear the transcript and the ledger. Does not undo anything. */
+    reset: () => {
+      askBuoyStore.reset();
+      return {
+        ok: true
+      };
+    }
+  }
+};
+//# sourceMappingURL=askBuoySyncAdapter.js.map

package/lib/module/sync/askBuoySyncAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["dispatchToolAction","redactForWire","isReversible","askBuoyStore","ASK_BUOY_ADAPTER_VERSION","askBuoySyncAdapter","version","getSnapshot","state","getState","ledger","getLedger","entries","list","outstanding","filter","e","undoneAt","busy","configured","notice","messageCount","messages","length","map","m","id","role","text","streaming","toolCalls","c","toolId","action","status","usage","pendingApproval","pending","label","changes","reversible","effect","permanent","kind","transients","items","subscribe","onChange","offStore","offLedger","actions","listChanges","at","undoAll","ok","error","outcome","revertAll","reset"],"sourceRoot":"../../../src","sources":["sync/askBuoySyncAdapter.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,kBAAkB,EAAEC,aAAa,QAAQ,QAAQ;AAC1D,SAASC,YAAY,QAAQ,qBAAqB;AAClD,SAASC,YAAY,QAAQ,uBAAuB;AAEpD,OAAO,MAAMC,wBAAwB,GAAG,CAAC;AAEzC,OAAO,MAAMC,kBAAkB,GAAG;EAChCC,OAAO,EAAEF,wBAAwB;EAEjCG,WAAWA,CAAA,EAAG;IACZ,MAAMC,KAAK,GAAGL,YAAY,CAACM,QAAQ,CAAC,CAAC;IACrC,MAAMC,MAAM,GAAGP,YAAY,CAACQ,SAAS,CAAC,CAAC;IACvC,MAAMC,OAAO,GAAGF,MAAM,EAAEG,IAAI,CAAC,CAAC,IAAI,EAAE;IACpC,MAAMC,WAAW,GAAGF,OAAO,CAACG,MAAM,CAAEC,CAAC,IAAK,CAACA,CAAC,CAACC,QAAQ,CAAC;IAEtD,OAAO;MACLX,OAAO,EAAEF,wBAAwB;MACjCc,IAAI,EAAEV,KAAK,CAACU,IAAI;MAChBC,UAAU,EAAEX,KAAK,CAACW,UAAU;MAC5BC,MAAM,EAAEZ,KAAK,CAACY,MAAM;MACpBC,YAAY,EAAEb,KAAK,CAACc,QAAQ,CAACC,MAAM;MACnC;MACAD,QAAQ,EAAEd,KAAK,CAACc,QAAQ,CAACE,GAAG,CAAEC,CAAC,KAAM;QACnCC,EAAE,EAAED,CAAC,CAACC,EAAE;QACRC,IAAI,EAAEF,CAAC,CAACE,IAAI;QACZC,IAAI,EAAE3B,aAAa,CAACwB,CAAC,CAACG,IAAI,CAAC;QAC3BC,SAAS,EAAE,CAAC,CAACJ,CAAC,CAACI,SAAS;QACxBC,SAAS,EAAEL,CAAC,CAACK,SAAS,CAACN,GAAG,CAAEO,CAAC,KAAM;UACjCC,MAAM,EAAED,CAAC,CAACC,MAAM;UAChBC,MAAM,EAAEF,CAAC,CAACE,MAAM;UAChBC,MAAM,EAAEH,CAAC,CAACG;QACZ,CAAC,CAAC;MACJ,CAAC,CAAC,CAAC;MACH;MACAC,KAAK,EAAE3B,KAAK,CAAC2B,KAAK;MAClBC,eAAe,EAAE5B,KAAK,CAAC6B,OAAO,GAC1B;QACEL,MAAM,EAAExB,KAAK,CAAC6B,OAAO,CAACL,MAAM;QAC5BC,MAAM,EAAEzB,KAAK,CAAC6B,OAAO,CAACJ,MAAM;QAC5BK,KAAK,EAAE9B,KAAK,CAAC6B,OAAO,CAACC;MACvB,CAAC,GACD,IAAI;MACRC,OAAO,EAAE;QACP;QACA;QACAC,UAAU,EAAE1B,WAAW,CAACC,MAAM,CAAEC,CAAC,IAAKd,YAAY,CAACc,CAAC,CAACyB,MAAM,CAAC,CAAC,CAAClB,MAAM;QACpEmB,SAAS,EAAE5B,WAAW,CAACC,MAAM,CAC1BC,CAAC,IAAKA,CAAC,CAACyB,MAAM,CAACE,IAAI,KAAK,WAAW,IAAI,CAACzC,YAAY,CAACc,CAAC,CAACyB,MAAM,CAChE,CAAC,CAAClB,MAAM;QACRqB,UAAU,EAAE9B,WAAW,CAACC,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACyB,MAAM,CAACE,IAAI,KAAK,WAAW,CAAC,CAACpB,MAAM;QAC3EsB,KAAK,EAAE/B,WAAW,CAACU,GAAG,CAAER,CAAC,KAAM;UAAE2B,IAAI,EAAE3B,CAAC,CAACyB,MAAM,CAACE,IAAI;UAAEL,KAAK,EAAEtB,CAAC,CAACyB,MAAM,CAACH;QAAM,CAAC,CAAC;MAChF;IACF,CAAC;EACH,CAAC;EAEDQ,SAASA,CAACC,QAAoB,EAAE;IAC9B,MAAMC,QAAQ,GAAG7C,YAAY,CAAC2C,SAAS,CAACC,QAAQ,CAAC;IACjD,MAAME,SAAS,GAAG9C,YAAY,CAACQ,SAAS,CAAC,CAAC,EAAEmC,SAAS,CAACC,QAAQ,CAAC;IAC/D,OAAO,MAAM;MACXC,QAAQ,CAAC,CAAC;MACVC,SAAS,GAAG,CAAC;IACf,CAAC;EACH,CAAC;EAEDC,OAAO,EAAE;IACP;IACAC,WAAW,EAAEA,CAAA,KAAM;MACjB,MAAMvC,OAAO,GAAGT,YAAY,CAACQ,SAAS,CAAC,CAAC,EAAEE,IAAI,CAAC,CAAC,IAAI,EAAE;MACtD,OAAOD,OAAO,CACXG,MAAM,CAAEC,CAAC,IAAK,CAACA,CAAC,CAACC,QAAQ,CAAC,CAC1BO,GAAG,CAAER,CAAC,KAAM;QACXU,EAAE,EAAEV,CAAC,CAACU,EAAE;QACR0B,EAAE,EAAEpC,CAAC,CAACoC,EAAE;QACRpB,MAAM,EAAEhB,CAAC,CAACgB,MAAM;QAChBC,MAAM,EAAEjB,CAAC,CAACiB,MAAM;QAChBU,IAAI,EAAE3B,CAAC,CAACyB,MAAM,CAACE,IAAI;QACnBL,KAAK,EAAEtB,CAAC,CAACyB,MAAM,CAACH,KAAK;QACrBE,UAAU,EAAEtC,YAAY,CAACc,CAAC,CAACyB,MAAM;MACnC,CAAC,CAAC,CAAC;IACP,CAAC;IAED;IACAY,OAAO,EAAE,MAAAA,CAAA,KAAY;MACnB,MAAM3C,MAAM,GAAGP,YAAY,CAACQ,SAAS,CAAC,CAAC;MACvC,IAAI,CAACD,MAAM,EAAE,OAAO;QAAE4C,EAAE,EAAE,KAAK;QAAEC,KAAK,EAAE;MAAsC,CAAC;MAC/E,MAAMC,OAAO,GAAG,MAAM9C,MAAM,CAAC+C,SAAS,CAACzD,kBAAkB,CAAC;MAC1D,OAAO;QAAEsD,EAAE,EAAE,IAAI;QAAE,GAAGE;MAAQ,CAAC;IACjC,CAAC;IAED;IACAE,KAAK,EAAEA,CAAA,KAAM;MACXvD,YAAY,CAACuD,KAAK,CAAC,CAAC;MACpB,OAAO;QAAEJ,EAAE,EAAE;MAAK,CAAC;IACrB;EACF;AACF,CAAC","ignoreList":[]}

package/lib/module/sync/askBuoySyncAdapter.test.js

@@ -0,0 +1,135 @@
+"use strict";
+
+/**
+ * What Ask Buoy is allowed to put on the broker wire, and what it refuses to
+ * accept from it.
+ *
+ * Both directions matter. The broker has no authentication, accepts any client
+ * that calls itself "Dashboard", and forwards to every connected dashboard — it
+ * already broadcasts license keys that way. So: no tool results go out, and no
+ * remote client can make the agent say anything.
+ */
+import { beforeEach, describe, expect, it } from "vitest";
+import { EffectLedger } from "@buoy-gg/agent-core";
+import { askBuoySyncAdapter } from "./askBuoySyncAdapter";
+import { redactForWire } from "./wire";
+import { askBuoyStore } from "../store/askBuoyStore";
+beforeEach(() => {
+  askBuoyStore.reset();
+  askBuoyStore.setLedger(null);
+});
+describe("the wire surface", () => {
+  it("exposes no action that can make the agent talk", () => {
+    // A `send` here would let anyone on the LAN drive a mutating agent on a
+    // tester's phone. The conversation starts on-device, by a person.
+    const actions = Object.keys(askBuoySyncAdapter.actions);
+    expect(actions).not.toContain("send");
+    expect(actions).not.toContain("ask");
+    expect(actions).not.toContain("prompt");
+    expect(actions.sort()).toEqual(["listChanges", "reset", "undoAll"]);
+  });
+  it("puts the shape of the conversation on the wire, never tool payloads", () => {
+    askBuoyStore.addUser("what is in storage");
+    const id = askBuoyStore.startAssistant();
+    askBuoyStore.applyEvent(id, {
+      type: "tool-start",
+      id: "c1",
+      toolId: "storage",
+      action: "async.getItem",
+      label: "Read session",
+      description: "Read one AsyncStorage key"
+    });
+    askBuoyStore.applyEvent(id, {
+      type: "tool-end",
+      id: "c1",
+      ok: true,
+      summary: "eyJhbGciOiJIUzI1NiJ9.super.secret"
+    });
+    const snap = askBuoySyncAdapter.getSnapshot();
+    const call = snap.messages[1].toolCalls[0];
+    expect(call).toEqual({
+      toolId: "storage",
+      action: "async.getItem",
+      status: "ok"
+    });
+    // The result summary is not on the wire at all — there is no field for it.
+    expect(JSON.stringify(snap)).not.toContain("super.secret");
+  });
+  it("redacts credentials that made it into the assistant's prose", () => {
+    askBuoyStore.addUser("show me the auth header");
+    const id = askBuoyStore.startAssistant();
+    askBuoyStore.applyEvent(id, {
+      type: "text",
+      delta: "It sends Authorization: Bearer abcdef0123456789ghijkl to the API."
+    });
+    const snap = askBuoySyncAdapter.getSnapshot();
+    expect(JSON.stringify(snap)).not.toContain("abcdef0123456789ghijkl");
+  });
+  it("reports reversible and permanent changes separately", () => {
+    const ledger = new EffectLedger();
+    askBuoyStore.setLedger(ledger);
+    ledger.record("storage", "async.setItem", {
+      kind: "storage-write",
+      toolId: "storage",
+      action: "async.setItem",
+      key: "points",
+      before: "240",
+      label: "Set points to 1500"
+    });
+    ledger.record("perf-monitor", "clearAll", {
+      kind: "transient",
+      label: "Cleared samples"
+    });
+    // A store write with no captured prior state: recorded, visible, and
+    // NOT something Undo can deliver — it must count as permanent.
+    ledger.record("zustand", "setState", {
+      kind: "state-write",
+      toolId: "zustand",
+      action: "setState",
+      label: "Update the cart store"
+    });
+    const snap = askBuoySyncAdapter.getSnapshot();
+    expect(snap.changes.reversible).toBe(1);
+    // The transient is an ACTION, not a change — it must not inflate
+    // "permanent" (that read "Changed this app · N permanent" after a
+    // read-only tour). It is still reported, in its own count.
+    expect(snap.changes.permanent).toBe(1);
+    expect(snap.changes.transients).toBe(1);
+  });
+});
+describe("redactForWire", () => {
+  it("removes bearer tokens, JWTs, api keys and license keys", () => {
+    const cases = ["Authorization: Bearer abcdefghijklmnop123456", "token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9abcdefgh", "key sk-abcdefghijklmnop1234", "license BUOY-ABCD-1234-EFGH", 'the header is "x-api-key": "supersecretvalue"'];
+    for (const input of cases) {
+      expect(redactForWire(input)).toContain("removed]");
+    }
+  });
+  it("leaves ordinary prose alone", () => {
+    const text = "The /menu call returned 200 with 12 items and the burger was in stock.";
+    expect(redactForWire(text)).toBe(text);
+  });
+});
+describe("undo from the desktop", () => {
+  it("is allowed, because putting things back is the safe direction", async () => {
+    const ledger = new EffectLedger();
+    askBuoyStore.setLedger(ledger);
+    const store = new Map([["points", "1500"]]);
+    ledger.record("storage", "async.setItem", {
+      kind: "storage-write",
+      toolId: "storage",
+      action: "async.setItem",
+      key: "points",
+      before: "240",
+      label: "Set points to 1500"
+    });
+
+    // The adapter dispatches through the real seam; stub it at the ledger.
+    await ledger.revertAll(async (_t, action, params) => {
+      const p = params;
+      if (action === "async.setItem") store.set(p.key, p.value);
+      return undefined;
+    });
+    expect(store.get("points")).toBe("240");
+  });
+});
+//# sourceMappingURL=askBuoySyncAdapter.test.js.map

package/lib/module/sync/askBuoySyncAdapter.test.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["beforeEach","describe","expect","it","EffectLedger","askBuoySyncAdapter","redactForWire","askBuoyStore","reset","setLedger","actions","Object","keys","not","toContain","sort","toEqual","addUser","id","startAssistant","applyEvent","type","toolId","action","label","description","ok","summary","snap","getSnapshot","call","messages","toolCalls","status","JSON","stringify","delta","ledger","record","kind","key","before","changes","reversible","toBe","permanent","transients","cases","input","text","store","Map","revertAll","_t","params","p","set","value","undefined","get"],"sourceRoot":"../../../src","sources":["sync/askBuoySyncAdapter.test.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,QAAQ;AACzD,SAASC,YAAY,QAAQ,qBAAqB;AAElD,SAASC,kBAAkB,QAAQ,sBAAsB;AACzD,SAASC,aAAa,QAAQ,QAAQ;AACtC,SAASC,YAAY,QAAQ,uBAAuB;AAEpDP,UAAU,CAAC,MAAM;EACfO,YAAY,CAACC,KAAK,CAAC,CAAC;EACpBD,YAAY,CAACE,SAAS,CAAC,IAAI,CAAC;AAC9B,CAAC,CAAC;AAEFR,QAAQ,CAAC,kBAAkB,EAAE,MAAM;EACjCE,EAAE,CAAC,gDAAgD,EAAE,MAAM;IACzD;IACA;IACA,MAAMO,OAAO,GAAGC,MAAM,CAACC,IAAI,CAACP,kBAAkB,CAACK,OAAO,CAAC;IACvDR,MAAM,CAACQ,OAAO,CAAC,CAACG,GAAG,CAACC,SAAS,CAAC,MAAM,CAAC;IACrCZ,MAAM,CAACQ,OAAO,CAAC,CAACG,GAAG,CAACC,SAAS,CAAC,KAAK,CAAC;IACpCZ,MAAM,CAACQ,OAAO,CAAC,CAACG,GAAG,CAACC,SAAS,CAAC,QAAQ,CAAC;IACvCZ,MAAM,CAACQ,OAAO,CAACK,IAAI,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;EACrE,CAAC,CAAC;EAEFb,EAAE,CAAC,qEAAqE,EAAE,MAAM;IAC9EI,YAAY,CAACU,OAAO,CAAC,oBAAoB,CAAC;IAC1C,MAAMC,EAAE,GAAGX,YAAY,CAACY,cAAc,CAAC,CAAC;IACxCZ,YAAY,CAACa,UAAU,CAACF,EAAE,EAAE;MAC1BG,IAAI,EAAE,YAAY;MAClBH,EAAE,EAAE,IAAI;MACRI,MAAM,EAAE,SAAS;MACjBC,MAAM,EAAE,eAAe;MACvBC,KAAK,EAAE,cAAc;MACrBC,WAAW,EAAE;IACf,CAAC,CAAC;IACFlB,YAAY,CAACa,UAAU,CAACF,EAAE,EAAE;MAC1BG,IAAI,EAAE,UAAU;MAChBH,EAAE,EAAE,IAAI;MACRQ,EAAE,EAAE,IAAI;MACRC,OAAO,EAAE;IACX,CAAC,CAAC;IAEF,MAAMC,IAAI,GAAGvB,kBAAkB,CAACwB,WAAW,CAAC,CAAC;IAC7C,MAAMC,IAAI,GAAGF,IAAI,CAACG,QAAQ,CAAC,CAAC,CAAC,CAACC,SAAS,CAAC,CAAC,CAAC;IAC1C9B,MAAM,CAAC4B,IAAI,CAAC,CAACd,OAAO,CAAC;MAAEM,MAAM,EAAE,SAAS;MAAEC,MAAM,EAAE,eAAe;MAAEU,MAAM,EAAE;IAAK,CAAC,CAAC;IAClF;IACA/B,MAAM,CAACgC,IAAI,CAACC,SAAS,CAACP,IAAI,CAAC,CAAC,CAACf,GAAG,CAACC,SAAS,CAAC,cAAc,CAAC;EAC5D,CAAC,CAAC;EAEFX,EAAE,CAAC,6DAA6D,EAAE,MAAM;IACtEI,YAAY,CAACU,OAAO,CAAC,yBAAyB,CAAC;IAC/C,MAAMC,EAAE,GAAGX,YAAY,CAACY,cAAc,CAAC,CAAC;IACxCZ,YAAY,CAACa,UAAU,CAACF,EAAE,EAAE;MAC1BG,IAAI,EAAE,MAAM;MACZe,KAAK,EAAE;IACT,CAAC,CAAC;IAEF,MAAMR,IAAI,GAAGvB,kBAAkB,CAACwB,WAAW,CAAC,CAAC;IAC7C3B,MAAM,CAACgC,IAAI,CAACC,SAAS,CAACP,IAAI,CAAC,CAAC,CAACf,GAAG,CAACC,SAAS,CAAC,wBAAwB,CAAC;EACtE,CAAC,CAAC;EAEFX,EAAE,CAAC,qDAAqD,EAAE,MAAM;IAC9D,MAAMkC,MAAM,GAAG,IAAIjC,YAAY,CAAC,CAAC;IACjCG,YAAY,CAACE,SAAS,CAAC4B,MAAM,CAAC;IAC9BA,MAAM,CAACC,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE;MACxCC,IAAI,EAAE,eAAe;MACrBjB,MAAM,EAAE,SAAS;MACjBC,MAAM,EAAE,eAAe;MACvBiB,GAAG,EAAE,QAAQ;MACbC,MAAM,EAAE,KAAK;MACbjB,KAAK,EAAE;IACT,CAAC,CAAC;IACFa,MAAM,CAACC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE;MACxCC,IAAI,EAAE,WAAW;MACjBf,KAAK,EAAE;IACT,CAAC,CAAC;IACF;IACA;IACAa,MAAM,CAACC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE;MACnCC,IAAI,EAAE,aAAa;MACnBjB,MAAM,EAAE,SAAS;MACjBC,MAAM,EAAE,UAAU;MAClBC,KAAK,EAAE;IACT,CAAC,CAAC;IAEF,MAAMI,IAAI,GAAGvB,kBAAkB,CAACwB,WAAW,CAAC,CAAC;IAC7C3B,MAAM,CAAC0B,IAAI,CAACc,OAAO,CAACC,UAAU,CAAC,CAACC,IAAI,CAAC,CAAC,CAAC;IACvC;IACA;IACA;IACA1C,MAAM,CAAC0B,IAAI,CAACc,OAAO,CAACG,SAAS,CAAC,CAACD,IAAI,CAAC,CAAC,CAAC;IACtC1C,MAAM,CAAC0B,IAAI,CAACc,OAAO,CAACI,UAAU,CAAC,CAACF,IAAI,CAAC,CAAC,CAAC;EACzC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF3C,QAAQ,CAAC,eAAe,EAAE,MAAM;EAC9BE,EAAE,CAAC,wDAAwD,EAAE,MAAM;IACjE,MAAM4C,KAAK,GAAG,CACZ,8CAA8C,EAC9C,oDAAoD,EACpD,6BAA6B,EAC7B,6BAA6B,EAC7B,+CAA+C,CAChD;IACD,KAAK,MAAMC,KAAK,IAAID,KAAK,EAAE;MACzB7C,MAAM,CAACI,aAAa,CAAC0C,KAAK,CAAC,CAAC,CAAClC,SAAS,CAAC,UAAU,CAAC;IACpD;EACF,CAAC,CAAC;EAEFX,EAAE,CAAC,6BAA6B,EAAE,MAAM;IACtC,MAAM8C,IAAI,GAAG,wEAAwE;IACrF/C,MAAM,CAACI,aAAa,CAAC2C,IAAI,CAAC,CAAC,CAACL,IAAI,CAACK,IAAI,CAAC;EACxC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEFhD,QAAQ,CAAC,uBAAuB,EAAE,MAAM;EACtCE,EAAE,CAAC,+DAA+D,EAAE,YAAY;IAC9E,MAAMkC,MAAM,GAAG,IAAIjC,YAAY,CAAC,CAAC;IACjCG,YAAY,CAACE,SAAS,CAAC4B,MAAM,CAAC;IAC9B,MAAMa,KAAK,GAAG,IAAIC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3Cd,MAAM,CAACC,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE;MACxCC,IAAI,EAAE,eAAe;MACrBjB,MAAM,EAAE,SAAS;MACjBC,MAAM,EAAE,eAAe;MACvBiB,GAAG,EAAE,QAAQ;MACbC,MAAM,EAAE,KAAK;MACbjB,KAAK,EAAE;IACT,CAAC,CAAC;;IAEF;IACA,MAAMa,MAAM,CAACe,SAAS,CAAC,OAAOC,EAAE,EAAE9B,MAAM,EAAE+B,MAAM,KAAK;MACnD,MAAMC,CAAC,GAAGD,MAAyC;MACnD,IAAI/B,MAAM,KAAK,eAAe,EAAE2B,KAAK,CAACM,GAAG,CAACD,CAAC,CAACf,GAAG,EAAEe,CAAC,CAACE,KAAM,CAAC;MAC1D,OAAOC,SAAS;IAClB,CAAC,CAAC;IAEFxD,MAAM,CAACgD,KAAK,CAACS,GAAG,CAAC,QAAQ,CAAC,CAAC,CAACf,IAAI,CAAC,KAAK,CAAC;EACzC,CAAC,CAAC;AACJ,CAAC,CAAC","ignoreList":[]}

package/lib/module/sync/wire.js

@@ -0,0 +1,47 @@
+"use strict";
+
+/**
+ * What the sync adapter is allowed to put on the broker wire.
+ *
+ * The broker has no authentication, `cors.origin: "*"`, binds every interface,
+ * and forwards to every connected dashboard — it already broadcasts each
+ * device's license key to every socket. A chat transcript is not a safe thing
+ * to add to that channel unfiltered: the agent reads storage values, network
+ * response bodies and user records, and any of it can end up quoted in an
+ * answer.
+ *
+ * So text crossing the wire is scrubbed for the shapes that are unambiguously
+ * credentials. This is a reduction in blast radius, not a guarantee — the real
+ * guarantee is that tool RESULTS never cross at all (see askBuoySyncAdapter).
+ */
+export { dispatchToolAction } from "@buoy-gg/shared-ui";
+const PATTERNS = [{
+  re: /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi,
+  label: "[bearer token removed]"
+}, {
+  re: /\beyJ[A-Za-z0-9._-]{20,}/g,
+  label: "[jwt removed]"
+}, {
+  re: /\bsk-[A-Za-z0-9_-]{16,}/g,
+  label: "[api key removed]"
+}, {
+  re: /\bBUOY-[A-Z0-9-]{8,}/g,
+  label: "[license key removed]"
+},
+// Common "key: value" credential shapes in a quoted payload.
+{
+  re: /("|')?(authorization|x-api-key|api[_-]?key|password|secret|access_token|refresh_token)\1?\s*[:=]\s*("|')?[^\s"',}]{6,}/gi,
+  label: "[credential removed]"
+}];
+export function redactForWire(text) {
+  if (!text) return text;
+  let out = text;
+  for (const {
+    re,
+    label
+  } of PATTERNS) {
+    out = out.replace(re, label);
+  }
+  return out;
+}
+//# sourceMappingURL=wire.js.map

package/lib/module/sync/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["dispatchToolAction","PATTERNS","re","label","redactForWire","text","out","replace"],"sourceRoot":"../../../src","sources":["sync/wire.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,kBAAkB,QAAQ,oBAAoB;AAEvD,MAAMC,QAAyC,GAAG,CAChD;EAAEC,EAAE,EAAE,uCAAuC;EAAEC,KAAK,EAAE;AAAyB,CAAC,EAChF;EAAED,EAAE,EAAE,2BAA2B;EAAEC,KAAK,EAAE;AAAgB,CAAC,EAC3D;EAAED,EAAE,EAAE,0BAA0B;EAAEC,KAAK,EAAE;AAAoB,CAAC,EAC9D;EAAED,EAAE,EAAE,uBAAuB;EAAEC,KAAK,EAAE;AAAwB,CAAC;AAC/D;AACA;EACED,EAAE,EAAE,0HAA0H;EAC9HC,KAAK,EAAE;AACT,CAAC,CACF;AAED,OAAO,SAASC,aAAaA,CAACC,IAAY,EAAU;EAClD,IAAI,CAACA,IAAI,EAAE,OAAOA,IAAI;EACtB,IAAIC,GAAG,GAAGD,IAAI;EACd,KAAK,MAAM;IAAEH,EAAE;IAAEC;EAAM,CAAC,IAAIF,QAAQ,EAAE;IACpCK,GAAG,GAAGA,GAAG,CAACC,OAAO,CAACL,EAAE,EAAEC,KAAK,CAAC;EAC9B;EACA,OAAOG,GAAG;AACZ","ignoreList":[]}

package/lib/module/types.js

@@ -0,0 +1,4 @@
+"use strict";
+
+export {};
+//# sourceMappingURL=types.js.map

package/lib/module/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../src","sources":["types.ts"],"mappings":"","ignoreList":[]}

package/lib/typescript/blocks/AskBlocks.d.ts

@@ -0,0 +1,11 @@
+import type { ChoiceBlock, ConfirmBlock, InputBlock } from "@buoy-gg/agent-core";
+export declare function Choice({ block }: {
+    block: ChoiceBlock;
+}): import("react").JSX.Element;
+export declare function Confirm({ block }: {
+    block: ConfirmBlock;
+}): import("react").JSX.Element;
+export declare function Input({ block }: {
+    block: InputBlock;
+}): import("react").JSX.Element;
+//# sourceMappingURL=AskBlocks.d.ts.map