@chatpanel/events 0.102.0 → 0.103.1

package/library.js

@@ -1,284 +1,15 @@
-// THE LIBRARY — one record model for chats, notes, meetings and briefs.
-//
-// WHY THIS IS IN THE SHARED PACKAGE. "What is a record" is currently answered three times
-// and the three answers already disagree:
-//
-//   • the extension builds rich source records (conversationSource / meetingSource /
-//     noteSource / briefSource), each with its own title, date and body rules;
-//   • the gateway re-derives them in `backup-ingest.js`, whose own comment calls it "a
-//     SIMPLIFIED MIRROR of the extension's" — a mirror is a copy that drifts;
-//   • a desktop or mobile client would make a third, and three implementations of "what is
-//     the title of a meeting" become three different titles for the same meeting.
-//
-// The projection is pure: records in, a normalized record out. No storage, no crypto, no
-// platform. Each host keeps its own persistence (IndexedDB, SQLite, Core Data) and calls
-// this to decide WHAT it is storing — the P8 split the store already uses.
-//
-// THE ID GRAMMAR IS THE CONTRACT. `chat:<id>`, `note:<id>`, `meeting:<id>`, `brief:<id>`.
-// The gateway's warm index, the MCP tools, `find_related`, the omni bar and every citation
-// already speak it; writing it down here is what stops a fourth client inventing
-// `chats/<id>` and silently failing to join.
-//
-// NAMED `normalizeStoredRecord`, NOT `normalizeStoredRecord`, on purpose: `curate.js` already
-// exports the latter and it does the OTHER job — coercing anything into the flat survey
-// shape a curation pass reads. Two functions named the same in one package, one lossy and
-// one lossless, is a trap for whoever imports the wrong one.
-//
-// LOSSY AND LOSSLESS ARE DIFFERENT QUESTIONS, and conflating them is what made the gateway's
-// mirror drift. `toSearchRecord` is deliberately lossy — it is the flat {id,title,type,date,
-// text} the BM25 index wants. `normalizeStoredRecord` is lossless — it is the full record a client
-// stores and round-trips. A client that needs to SHOW a chat must never reconstruct it from
-// a search record.
+class s extends Error{constructor(e){super(e),this.name="LibraryError"}}const m=Object.freeze(["chat","note","meeting","brief"]),l=new Set(m);function u(t){const e=String(t||""),n=e.indexOf(":");if(n<=0)return null;const r=e.slice(0,n),o=e.slice(n+1);return!l.has(r)||!o?null:{kind:r,localId:o}}function S(t,e){if(!l.has(t))throw new s(`unknown record kind: ${t}`);const n=String(e||"");if(!n)throw new s("a record id needs a local id");if(n.includes(":"))throw new s(`local id may not contain ":" — got ${n}`);return`${t}:${n}`}function T(t){return u(t)!==null}const f=48;function p(t,e="Untitled"){const n=String(t||"").split(`
+`).map(r=>r.replace(/^\s*#{1,6}\s*/,"").replace(/[*_`>~]+/g,"").trim()).find(r=>r.length>0);return n?n.length>f?`${n.slice(0,f-1).trimEnd()}…`:n:e}const d=(t,e=0)=>Number.isFinite(Number(t))?Number(t):e,i=t=>typeof t=="string"?t:t==null?"":String(t);function c(t={},{now:e=0}={}){const n=u(t.id);if(!n)throw new s(`not a record id: ${JSON.stringify(t.id)}`);const r=d(t.createdAt,d(t.date,e));return{id:t.id,kind:n.kind,localId:n.localId,title:i(t.title).trim()||x(n.kind,t),tags:y(t.tags),createdAt:r,updatedAt:d(t.updatedAt,r),deletedAt:d(t.deletedAt,0)||0,body:t.body??null,meta:t.meta&&typeof t.meta=="object"?t.meta:{}}}function x(t,e){return t==="note"?p(e?.body?.markdown??e?.body,"Untitled note"):t==="meeting"?"Untitled meeting":t==="brief"?"Untitled brief":"New chat"}function y(t){if(!Array.isArray(t))return[];const e=[];for(const n of t){const r=i(n).trim();r&&!e.includes(r)&&e.push(r)}return e}function I(t){try{return c(t),!0}catch{return!1}}const A={assistant:"Assistant",system:"System",user:"You"};function L(t){const e=c(t);return e.deletedAt?null:{id:e.id,type:e.kind,title:e.title,date:e.updatedAt||e.createdAt,text:h(e)}}function h(t){const e=t.kind?t:c(t),n=`${b(e.kind)}: ${e.title}`,r=e.tags.length?`
+Tags: ${e.tags.join(", ")}`:"";return`${n}${r}
 
-export class LibraryError extends Error {
-  constructor(message) { super(message); this.name = 'LibraryError'; }
-}
+${g(e)}`.trim()}function b(t){return t==="chat"?"CHAT":t==="note"?"NOTE":t==="meeting"?"MEETING":"BRIEF"}function g(t){const e=t.body;if(e==null)return"";if(typeof e=="string")return e;const n=typeof e.text=="string"?e.text:"";if(t.kind==="chat")return(e.messages||[]).filter(o=>o&&o.content).map(o=>`${A[o.role]||"You"}: ${E(o.content)}`).join(`
 
-/** The four record kinds. Ordered as the UI orders them, not alphabetically. */
-export const RECORD_KINDS = Object.freeze(['chat', 'note', 'meeting', 'brief']);
+`)||n;if(t.kind==="note")return i(e.markdown??e.text);if(t.kind==="meeting"){const r=i(e.notes),o=(e.segments||[]).map(a=>`${i(a.speaker)||"?"}: ${i(a.text)}`).join(`
+`);return[r,o].filter(Boolean).join(`
 
-const KIND_SET = new Set(RECORD_KINDS);
+`)||n}if(t.kind==="brief"){const r=(e.claims||[]).map(o=>i(o.text)).filter(Boolean).join(`
+`);return[i(e.summary),r].filter(Boolean).join(`
 
-/** `chat:abc` → { kind:'chat', localId:'abc' }; anything else → null. */
-export function parseRecordId(recordId) {
-  const s = String(recordId || '');
-  const colon = s.indexOf(':');
-  if (colon <= 0) return null;
-  const kind = s.slice(0, colon);
-  const localId = s.slice(colon + 1);
-  if (!KIND_SET.has(kind) || !localId) return null;
-  return { kind, localId };
-}
-
-/** The inverse. Throws rather than producing an id nothing else will match. */
-export function makeRecordId(kind, localId) {
-  if (!KIND_SET.has(kind)) throw new LibraryError(`unknown record kind: ${kind}`);
-  const id = String(localId || '');
-  if (!id) throw new LibraryError('a record id needs a local id');
-  if (id.includes(':')) throw new LibraryError(`local id may not contain ":" — got ${id}`);
-  return `${kind}:${id}`;
-}
-
-export function isRecordId(value) {
-  return parseRecordId(value) !== null;
-}
-
-// --------------------------------------------------------------------------
-// Titles
-// --------------------------------------------------------------------------
-
-/** The single length a record title may be — the extension's MAX_TITLE_LEN, shared. */
-export const MAX_TITLE_LEN = 48;
-
-/**
- * First non-empty line, stripped of markdown furniture, clamped.
- *
- * Notes derive their title from the body when the user has not set one, and the meeting
- * autotitler falls back here too. Keeping it in one place is what stops "# Rollback runbook"
- * becoming the title in one client and "Rollback runbook" in another.
- */
-export function deriveTitle(body, fallback = 'Untitled') {
-  const first = String(body || '')
-    .split('\n')
-    .map((l) => l.replace(/^\s*#{1,6}\s*/, '').replace(/[*_`>~]+/g, '').trim())
-    .find((l) => l.length > 0);
-  if (!first) return fallback;
-  return first.length > MAX_TITLE_LEN ? `${first.slice(0, MAX_TITLE_LEN - 1).trimEnd()}…` : first;
-}
-
-// --------------------------------------------------------------------------
-// Normalization — the lossless shape
-// --------------------------------------------------------------------------
-
-const num = (v, dflt = 0) => (Number.isFinite(Number(v)) ? Number(v) : dflt);
-const str = (v) => (typeof v === 'string' ? v : v == null ? '' : String(v));
-
-/**
- * A stored record, whatever client wrote it.
- *
- * `body` is the kind-specific payload and is carried VERBATIM — messages for a chat,
- * segments for a meeting, markdown for a note. This module refuses to flatten it, because
- * flattening is exactly the lossy step that belongs in `toSearchRecord` and nowhere else.
- */
-export function normalizeStoredRecord(input = {}, { now = 0 } = {}) {
-  const parsed = parseRecordId(input.id);
-  if (!parsed) throw new LibraryError(`not a record id: ${JSON.stringify(input.id)}`);
-  const createdAt = num(input.createdAt, num(input.date, now));
-  return {
-    id: input.id,
-    kind: parsed.kind,
-    localId: parsed.localId,
-    title: str(input.title).trim() || defaultTitleFor(parsed.kind, input),
-    tags: normalizeTagList(input.tags),
-    createdAt,
-    // A record with no updatedAt sorts by when it was made, not to the bottom of the list.
-    updatedAt: num(input.updatedAt, createdAt),
-    // Soft delete. A removal has to be REPRESENTABLE or it cannot replicate: a record that
-    // is merely absent from one side is indistinguishable from one that side has not seen.
-    deletedAt: num(input.deletedAt, 0) || 0,
-    body: input.body ?? null,
-    meta: input.meta && typeof input.meta === 'object' ? input.meta : {},
-  };
-}
-
-function defaultTitleFor(kind, input) {
-  if (kind === 'note') return deriveTitle(input?.body?.markdown ?? input?.body, 'Untitled note');
-  if (kind === 'meeting') return 'Untitled meeting';
-  if (kind === 'brief') return 'Untitled brief';
-  return 'New chat';
-}
-
-/**
- * Tags are a shared vocabulary — `tags.js` owns the rules. This is the shallow guard for
- * callers that hand us junk; it deliberately does NOT re-implement normalization, so a
- * client that cares passes tags through `normalizeTags` first.
- */
-function normalizeTagList(tags) {
-  if (!Array.isArray(tags)) return [];
-  const out = [];
-  for (const t of tags) {
-    const s = str(t).trim();
-    if (s && !out.includes(s)) out.push(s);
-  }
-  return out;
-}
-
-export function isValidStoredRecord(rec) {
-  try { normalizeStoredRecord(rec); return true; } catch { return false; }
-}
-
-// --------------------------------------------------------------------------
-// Projection — the lossy shape the search index wants
-// --------------------------------------------------------------------------
-
-const ROLE_LABEL = { assistant: 'Assistant', system: 'System', user: 'You' };
-
-/**
- * A record → the flat `{ id, type, title, date, text }` the warm index stores.
- *
- * This is the function the gateway's `backupToRecords` was a copy of. Note what it does NOT
- * do: it never invents an id, never guesses a kind, and never returns a record for something
- * it does not understand — a silent wrong answer in a search index is worse than a gap,
- * because the gap is visible.
- */
-export function toSearchRecord(record) {
-  const rec = normalizeStoredRecord(record);
-  if (rec.deletedAt) return null;
-  return {
-    id: rec.id,
-    type: rec.kind,
-    title: rec.title,
-    date: rec.updatedAt || rec.createdAt,
-    text: searchTextFor(rec),
-  };
-}
-
-/** The body of a record as one searchable string. Exported because callers index in batches. */
-export function searchTextFor(record) {
-  const rec = record.kind ? record : normalizeStoredRecord(record);
-  const head = `${kindLabel(rec.kind)}: ${rec.title}`;
-  const tagLine = rec.tags.length ? `\nTags: ${rec.tags.join(', ')}` : '';
-  return `${head}${tagLine}\n\n${bodyText(rec)}`.trim();
-}
-
-function kindLabel(kind) {
-  return kind === 'chat' ? 'CHAT' : kind === 'note' ? 'NOTE' : kind === 'meeting' ? 'MEETING' : 'BRIEF';
-}
-
-function bodyText(rec) {
-  const b = rec.body;
-  if (b == null) return '';
-  if (typeof b === 'string') return b;
-
-  // A record may arrive FLATTENED rather than structured — the gateway's warm index stores
-  // `{ text }` for every kind, with no message list and no markdown. Falling through the
-  // kind-specific branches would project it to the empty string, which is worse than it
-  // sounds: the record is stored, listed and counted, but is invisible to search and shows
-  // an empty preview. So a flat `text` is honoured for any kind, and the structured
-  // extraction below wins whenever it actually finds something.
-  const flat = typeof b.text === 'string' ? b.text : '';
-
-  if (rec.kind === 'chat') {
-    const turns = (b.messages || [])
-      .filter((m) => m && m.content)
-      .map((m) => `${ROLE_LABEL[m.role] || 'You'}: ${textOfContent(m.content)}`)
-      .join('\n\n');
-    return turns || flat;
-  }
-  if (rec.kind === 'note') return str(b.markdown ?? b.text);
-  if (rec.kind === 'meeting') {
-    const notes = str(b.notes);
-    const segs = (b.segments || [])
-      .map((s) => `${str(s.speaker) || '?'}: ${str(s.text)}`)
-      .join('\n');
-    return [notes, segs].filter(Boolean).join('\n\n') || flat;
-  }
-  if (rec.kind === 'brief') {
-    const claims = (b.claims || []).map((c) => str(c.text)).filter(Boolean).join('\n');
-    return [str(b.summary), claims].filter(Boolean).join('\n\n') || flat;
-  }
-  return flat;
-}
-
-/**
- * A message's content may be a string or a multimodal part list. An image part contributes
- * nothing to a text index, and stringifying the object would put `[object Object]` into the
- * corpus — which is not a hypothetical, it is what naive JSON handling does here.
- */
-function textOfContent(content) {
-  if (typeof content === 'string') return content;
-  if (!Array.isArray(content)) return '';
-  return content
-    .map((part) => (typeof part === 'string' ? part : part && part.type === 'text' ? str(part.text) : ''))
-    .filter(Boolean)
-    .join(' ');
-}
-
-// --------------------------------------------------------------------------
-// Counting — so every surface reports the same number
-// --------------------------------------------------------------------------
-
-/** Words in a note body, by the same rule everywhere. */
-export function wordCount(text) {
-  const t = str(text).trim();
-  return t ? t.split(/\s+/).length : 0;
-}
-
-/**
- * Header lines the warm text form carries under its title — `Date: …`, `Platform: meet` —
- * which are metadata, not the preview a row wants. A row already shows the date; a snippet
- * that repeats it says nothing. `You:` / a speaker's name are NOT in this set on purpose:
- * those lines are the content.
- */
-const META_LINE_RE = /^(Date|Platform|Model|Agent|Tags|Source|Kind|Created|Updated|Started|Ended|Duration|Participants|Attendees|URL|Link):\s/i;
-
-/** A short preview for a list row, so a list renders without opening every body. */
-export function snippetOf(text, max = 110) {
-  const lines = str(text).split('\n');
-  if (lines.length === 1) return lines[0].replace(/[#*_`>~]+/g, '').replace(/\s+/g, ' ').trim().slice(0, max);
-  let i = 1; // the first line is the title
-  while (i < lines.length && (!lines[i].trim() || META_LINE_RE.test(lines[i].trim()))) i += 1;
-  const rest = lines.slice(i).join('\n');
-  return rest.replace(/[#*_`>~]+/g, '').replace(/\s+/g, ' ').trim().slice(0, max);
-}
-
-/**
- * The index entry a list view renders from — everything needed to draw a row and nothing
- * that requires reading the body a second time.
- */
-export function toIndexEntry(record) {
-  const rec = normalizeStoredRecord(record);
-  const text = bodyText(rec);
-  return {
-    id: rec.id,
-    kind: rec.kind,
-    title: rec.title,
-    tags: rec.tags,
-    snippet: snippetOf(text),
-    words: wordCount(text),
-    chars: text.length,
-    createdAt: rec.createdAt,
-    updatedAt: rec.updatedAt,
-    deletedAt: rec.deletedAt,
-  };
-}
+`)||n}return n}function E(t){return typeof t=="string"?t:Array.isArray(t)?t.map(e=>typeof e=="string"?e:e&&e.type==="text"?i(e.text):"").filter(Boolean).join(" "):""}function w(t){const e=i(t).trim();return e?e.split(/\s+/).length:0}const $=/^(Date|Platform|Model|Agent|Tags|Source|Kind|Created|Updated|Started|Ended|Duration|Participants|Attendees|URL|Link):\s/i;function k(t,e=110){const n=i(t).split(`
+`);if(n.length===1)return n[0].replace(/[#*_`>~]+/g,"").replace(/\s+/g," ").trim().slice(0,e);let r=1;for(;r<n.length&&(!n[r].trim()||$.test(n[r].trim()));)r+=1;return n.slice(r).join(`
+`).replace(/[#*_`>~]+/g,"").replace(/\s+/g," ").trim().slice(0,e)}function R(t){const e=c(t),n=g(e);return{id:e.id,kind:e.kind,title:e.title,tags:e.tags,snippet:k(n),words:w(n),chars:n.length,createdAt:e.createdAt,updatedAt:e.updatedAt,deletedAt:e.deletedAt}}export{s as LibraryError,f as MAX_TITLE_LEN,m as RECORD_KINDS,p as deriveTitle,T as isRecordId,I as isValidStoredRecord,S as makeRecordId,c as normalizeStoredRecord,u as parseRecordId,h as searchTextFor,k as snippetOf,R as toIndexEntry,L as toSearchRecord,w as wordCount};

package/loop.js

@@ -1,132 +1 @@
-// The loop contract — turn lifetime belongs to the kernel, not to the loop.
-//
-// We already run four loops: chat, meeting scribe, watch, and the notes swarm. They were
-// never expressed once; each surface grew its own, and the shared parts were copied. On
-// 2026-08-16 that produced a real bug — `streamChat` opened a turn, one exit path
-// returned above the close, and every finished note reported itself as still running.
-//
-// The fix that day was to route both exits through one helper. The fix here is that
-// there is nothing to route: a loop's `run` receives a context with NO way to open or
-// close a turn. The runner opens before calling it and closes in `finally`, so "forgot to
-// close on one path" is not a mistake a loop author is able to make. That is the
-// difference between a bug fixed and a bug class removed.
-//
-// The runner takes `now`/`newId` rather than reading a clock, matching event.js: this
-// package stays pure so the identical code runs in the extension, gateway and bridge, and
-// so replay is reproducible (order.js never consults wall time; I6 asserts it).
-
-export const LOOP_KINDS = Object.freeze(['chat', 'note', 'meeting', 'watch', 'assist', 'suggestion', 'topics', 'other']);
-
-export class LoopError extends Error {
-  constructor(code, message) { super(message); this.name = 'LoopError'; this.code = code; }
-}
-
-/**
- * Declare a loop. A declaration is inert — it names a kind and supplies `run`; the runner
- * supplies everything about when a turn exists.
- */
-export function defineLoop({ id, kind = 'other', run, background = false }) {
-  if (!id) throw new LoopError('BAD_LOOP', 'loop.id required');
-  if (typeof run !== 'function') throw new LoopError('BAD_LOOP', `loop '${id}': run required`);
-  return Object.freeze({ id, kind, run, background: !!background });
-}
-
-/**
- * @param emit    `(type, payload)` — the host maps these to the event schema. Kept as a
- *                plain hook so this module has no dependency on the log, matching registry.js.
- * @param decide  optional `(guard, request) => decision` — normally `kernel.decide`. A
- *                security plugin can refuse a turn before any model call happens, which is
- *                the whole reason guards exist below the loop rather than inside it.
- */
-export function createTurnRunner({ now = () => 0, newId, emit = () => {}, decide = null } = {}) {
-  if (typeof newId !== 'function') throw new LoopError('BAD_RUNNER', 'newId required — the runner must not invent identity');
-
-  /**
-   * Run one turn of `loop`. Returns whatever `run` returned.
-   *
-   * `request.turnId` lets a caller supply identity it already has (the side panel's
-   * assistant-message id), so the turn record and the tool events that reference it group
-   * into ONE run rather than two — the mismatch that split runs in Activity.
-   */
-  async function run(loop, request = {}) {
-    if (!loop || typeof loop.run !== 'function') throw new LoopError('BAD_LOOP', 'runner.run needs a loop with run()');
-
-    const turnId = request.turnId || newId();
-    const kind = request.kind || loop.kind || 'other';
-
-    // Ask BEFORE opening a turn: a denied turn should leave no trace of having started,
-    // and a guard that only ran after the model call would be documentation, not a guard.
-    if (decide) {
-      const d = decide('turn.start', { turnId, kind, loopId: loop.id, ...request });
-      if (d && d.allow === false) {
-        emit('policy.denied', { turnId, kind, loopId: loop.id, reasons: d.reasons || [] });
-        throw new LoopError('DENIED', `turn denied: ${(d.reasons || []).join('; ') || 'policy'}`);
-      }
-    }
-
-    // The turn began when the USER acted, not when the model call did. Everything between
-    // — assembling tools, connecting to MCP servers — is time they waited, and a duration
-    // that excludes it says 2.6s about a message that took 48. Callers that know the real
-    // moment pass it; the rest fall back to now.
-    const startedAt = Number.isFinite(request.startedAt) ? request.startedAt : now();
-    let closed = false;
-    // Facts the loop learns while running — token usage, the model that actually served
-    // it — belong on the turn record. The loop may CONTRIBUTE them; it still cannot
-    // decide when the turn ends. Handing over the payload is not the same as handing over
-    // the lifetime, and only the second one was ever the problem.
-    let reported = {};
-    // The ONE place a turn closes. Idempotent because a retry path or a double-catch must
-    // not be able to write two endings for one turn — a log that can say a turn ended
-    // twice cannot be replayed.
-    const close = (reason, produced) => {
-      if (closed) return;
-      closed = true;
-      emit('turn.ended', { ...reported, turnId, reason, stepped: !!produced, ms: now() - startedAt, kind });
-    };
-
-    emit('turn.started', {
-      turnId, kind, loopId: loop.id,
-      agentId: request.agentId || null,
-      // WHICH THREAD THIS BELONGS TO. A run on its own is not the unit anyone reasons about —
-      // a conversation is, and a meeting or a note can hold many runs (live monitors,
-      // summaries, a swarm of agents). Without both halves the log is 1,205 unrelated rows.
-      surface: request.surface || null,
-      sourceId: request.sourceId || null,
-      background: request.background ?? loop.background,
-    });
-
-    let produced = false;
-    try {
-      // NOTE what this context does NOT contain: no close, no end, no turn handle. A loop
-      // cannot leave its own turn open because it was never given the ability to close it.
-      const result = await loop.run({
-        turnId,
-        kind,
-        signal: request.signal,
-        request,
-        /** Report that something reached the user — this is a fact about the turn, not control over it. */
-        produced: () => { produced = true; },
-        /**
-         * Contribute facts to the turn record (tokens, model, cost). Merged into
-         * `turn.ended`, and never able to overwrite the fields the runner owns — a loop
-         * that could rewrite its own turnId or reason would be holding lifetime again by
-         * another name.
-         */
-        report: (fields) => { if (fields && typeof fields === 'object') reported = { ...reported, ...fields }; },
-        /** Loops emit their own domain events; lifetime is still not theirs. */
-        emit: (type, payload) => emit(type, { turnId, ...payload }),
-      });
-      if (result !== undefined && result !== null && result !== '') produced = true;
-      close(request.signal?.aborted ? 'aborted' : 'ok', produced);
-      return result;
-    } catch (err) {
-      // An abort is not a failure: the user asking it to stop and the loop breaking are
-      // different facts, and collapsing them makes the log useless for the question people
-      // actually ask ("did it fail, or did I stop it?").
-      close(request.signal?.aborted ? 'aborted' : 'error', produced);
-      throw err;
-    }
-  }
-
-  return { run };
-}
+const I=Object.freeze(["chat","note","meeting","watch","assist","suggestion","topics","other"]);class c extends Error{constructor(i,t){super(t),this.name="LoopError",this.code=i}}function O({id:o,kind:i="other",run:t,background:s=!1}){if(!o)throw new c("BAD_LOOP","loop.id required");if(typeof t!="function")throw new c("BAD_LOOP",`loop '${o}': run required`);return Object.freeze({id:o,kind:i,run:t,background:!!s})}function y({now:o=()=>0,newId:i,emit:t=()=>{},decide:s=null}={}){if(typeof i!="function")throw new c("BAD_RUNNER","newId required — the runner must not invent identity");async function w(e,n={}){if(!e||typeof e.run!="function")throw new c("BAD_LOOP","runner.run needs a loop with run()");const u=n.turnId||i(),a=n.kind||e.kind||"other";if(s){const r=s("turn.start",{turnId:u,kind:a,loopId:e.id,...n});if(r&&r.allow===!1)throw t("policy.denied",{turnId:u,kind:a,loopId:e.id,reasons:r.reasons||[]}),new c("DENIED",`turn denied: ${(r.reasons||[]).join("; ")||"policy"}`)}const g=Number.isFinite(n.startedAt)?n.startedAt:o();let p=!1,l={};const h=(r,d)=>{p||(p=!0,t("turn.ended",{...l,turnId:u,reason:r,stepped:!!d,ms:o()-g,kind:a}))};t("turn.started",{turnId:u,kind:a,loopId:e.id,agentId:n.agentId||null,surface:n.surface||null,sourceId:n.sourceId||null,background:n.background??e.background});let f=!1;try{const r=await e.run({turnId:u,kind:a,signal:n.signal,request:n,produced:()=>{f=!0},report:d=>{d&&typeof d=="object"&&(l={...l,...d})},emit:(d,b)=>t(d,{turnId:u,...b})});return r!=null&&r!==""&&(f=!0),h(n.signal?.aborted?"aborted":"ok",f),r}catch(r){throw h(n.signal?.aborted?"aborted":"error",f),r}}return{run:w}}export{I as LOOP_KINDS,c as LoopError,y as createTurnRunner,O as defineLoop};

package/manifest.js

@@ -1,107 +1 @@
-// What is installed, and what the user has switched off.
-//
-// Four registries now exist — adapters, tool groups, search engines, sources — and each is
-// small and correct on its own. What none of them can answer is the question a user asks:
-// "what is running, and can I turn that off?" Answering it in four places would be the
-// duplication that already bit us with the engine list, one level up.
-//
-// So the KERNEL owns the manifest and the registries consult it. This is admission control,
-// not a rewrite: a registry keeps its own shape and simply refuses to offer something the
-// user has disabled. It is also the seam that makes user-contributed plugins possible —
-// once a plugin can arrive from outside, "is this allowed to run" must be asked somewhere
-// that is not the plugin itself.
-//
-// Persistence is INJECTED. Where the toggles live is a platform question (chrome.storage,
-// a file, a database) and the manifest has no business knowing.
-
-export class ManifestError extends Error {
-  constructor(code, message) { super(message); this.name = 'ManifestError'; this.code = code; }
-}
-
-/** Where a plugin came from. `user` is the one that must never skip a guard. */
-export const SOURCES = Object.freeze(['built-in', 'user']);
-
-/**
- * @param required ids that cannot be disabled, whatever the stored state says. Security is
- *        the canonical member: a mandatory plugin the user can switch off is not mandatory,
- *        it is a default.
- * @param disabled the user's stored choices — ids they have turned OFF. Stored as the
- *        exception rather than the full state on purpose: a plugin added in a later release
- *        is then enabled by default without a migration, because absence means "not
- *        disabled" rather than "unknown".
- */
-export function createManifest({ required = ['security'], disabled = [], onChange = null } = {}) {
-  const entries = new Map();
-  const off = new Set(disabled);
-  const req = new Set(required);
-
-  const notify = () => { if (onChange) onChange([...off].sort()); };
-
-  return {
-    /**
-     * Declare something installed. Idempotent, so a registry can register on every build
-     * without accumulating duplicates.
-     */
-    register({ id, kind, label, source = 'built-in', description = '' }) {
-      if (!id) throw new ManifestError('BAD_ENTRY', 'plugin id required');
-      if (!SOURCES.includes(source)) throw new ManifestError('BAD_ENTRY', `plugin '${id}': unknown source '${source}'`);
-      entries.set(id, { id, kind: kind || 'plugin', label: label || id, source, description });
-      return () => entries.delete(id);
-    },
-
-    /**
-     * The question every registry asks. Unknown ids are ENABLED: a registry may consult the
-     * manifest before anything has registered, and defaulting to off would make a plugin
-     * silently vanish because of a load-order accident.
-     */
-    isEnabled(id) {
-      if (req.has(id)) return true;
-      return !off.has(id);
-    },
-
-    /** Turn something on or off. Required plugins refuse rather than reporting success. */
-    setEnabled(id, enabled) {
-      if (req.has(id) && !enabled) {
-        throw new ManifestError('REQUIRED', `'${id}' is required and cannot be disabled`);
-      }
-      const was = !off.has(id);
-      if (enabled) off.delete(id); else off.add(id);
-      if (was !== !!enabled) notify();
-      return this.isEnabled(id);
-    },
-
-    /** Everything installed, with its current state — what a settings page renders. */
-    list() {
-      return [...entries.values()]
-        .map((e) => ({ ...e, enabled: this.isEnabled(e.id), required: req.has(e.id) }))
-        .sort((a, b) => (a.kind === b.kind ? a.label.localeCompare(b.label) : a.kind.localeCompare(b.kind)));
-    },
-
-    /** Only the ids that are OFF — the shape that persists (see the note above). */
-    disabledIds: () => [...off].sort(),
-
-    /**
-     * Adopt state changed elsewhere.
-     *
-     * A manifest is not a fact read once at startup: the user toggles a plugin in one place
-     * (a settings page, another window, another device) and every OTHER place holding a
-     * manifest is now wrong. Without this, a toggle appears to do nothing until reload —
-     * which reads as the switch being broken.
-     *
-     * Deliberately does NOT notify: this is the arrival of someone else's change, and
-     * echoing it back is how two contexts write over each other forever.
-     */
-    sync(ids) {
-      const next = new Set(Array.isArray(ids) ? ids : []);
-      if (next.size === off.size && [...next].every((id) => off.has(id))) return false;
-      off.clear();
-      for (const id of next) off.add(id);
-      return true;
-    },
-
-    /** Filter a registry's candidates. The one call a registry needs to make. */
-    filter(items, idOf = (x) => x?.id) {
-      return (items || []).filter((x) => this.isEnabled(idOf(x)));
-    },
-  };
-}
+class u extends Error{constructor(i,s){super(s),this.name="ManifestError",this.code=i}}const h=Object.freeze(["built-in","user"]);function E({required:c=["security"],disabled:i=[],onChange:s=null}={}){const a=new Map,n=new Set(i),l=new Set(c),f=()=>{s&&s([...n].sort())};return{register({id:e,kind:r,label:t,source:o="built-in",description:d=""}){if(!e)throw new u("BAD_ENTRY","plugin id required");if(!h.includes(o))throw new u("BAD_ENTRY",`plugin '${e}': unknown source '${o}'`);return a.set(e,{id:e,kind:r||"plugin",label:t||e,source:o,description:d}),()=>a.delete(e)},isEnabled(e){return l.has(e)?!0:!n.has(e)},setEnabled(e,r){if(l.has(e)&&!r)throw new u("REQUIRED",`'${e}' is required and cannot be disabled`);const t=!n.has(e);return r?n.delete(e):n.add(e),t!==!!r&&f(),this.isEnabled(e)},list(){return[...a.values()].map(e=>({...e,enabled:this.isEnabled(e.id),required:l.has(e.id)})).sort((e,r)=>e.kind===r.kind?e.label.localeCompare(r.label):e.kind.localeCompare(r.kind))},disabledIds:()=>[...n].sort(),sync(e){const r=new Set(Array.isArray(e)?e:[]);if(r.size===n.size&&[...r].every(t=>n.has(t)))return!1;n.clear();for(const t of r)n.add(t);return!0},filter(e,r=t=>t?.id){return(e||[]).filter(t=>this.isEnabled(r(t)))}}}export{u as ManifestError,h as SOURCES,E as createManifest};