@chibitek/chibi 0.1.157 → 0.1.160

package/dist-server/server/mcp-public-registry.js

@@ -0,0 +1,325 @@
+// The Plugins window's MCP Marketplace, backed by the official MCP Registry
+// (https://registry.modelcontextprotocol.io, public, no key). This module
+// fetches and normalizes registry pages and turns one entry, or a featured
+// service from shared/mcp-featured.ts, into a config.json `mcpServers` entry.
+// Adding goes through the same rules as every other MCP server: the entry is
+// saved switched off, secrets are kept in its env or headers like any other
+// server's, and nothing here logs a value.
+import { featuredMcpIcon, featuredMcpServer, MCP_FEATURED } from "../shared/mcp-featured.js";
+import { slugMcpName } from "./mcp-registry.js";
+export const MCP_REGISTRY_BASE = "https://registry.modelcontextprotocol.io";
+/** The OAuth bridge Atomic already runs remote servers through (see
+ * electron/chibitek-defaults.mjs MCP_REMOTE_PACKAGE; a test keeps them equal).
+ * Pinned so its saved sign-ins survive a new mcp-remote release. */
+export const MCP_REMOTE_PACKAGE = "mcp-remote@0.14.3";
+const CACHE_MS = 60 * 60 * 1000;
+const CACHE_MAX = 200;
+const TIMEOUT_MS = 8_000;
+const PAGE_SIZE = 30;
+const OFFICIAL = "io.modelcontextprotocol.registry/official";
+export const REGISTRY_OFFLINE_MESSAGE = "The MCP Registry could not be reached. Check your internet connection and try again.";
+export class RegistryUnavailableError extends Error {
+    constructor() {
+        super(REGISTRY_OFFLINE_MESSAGE);
+        this.name = "RegistryUnavailableError";
+    }
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function httpsUrl(value) {
+    const raw = text(value);
+    if (!raw)
+        return undefined;
+    try {
+        const url = new URL(raw);
+        return url.protocol === "https:" ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const featuredByRegistryName = new Map(MCP_FEATURED.filter((server) => server.registryName).map((server) => [server.registryName, server]));
+/** "io.github.acme/thing" -> "acme", "com.notion/mcp" -> "notion.com". */
+export function publisherFor(name) {
+    const namespace = name.split("/")[0] ?? name;
+    if (namespace.startsWith("io.github."))
+        return namespace.slice("io.github.".length);
+    return namespace.split(".").reverse().join(".");
+}
+/** "notion-mcp-server" -> "Notion Mcp Server" when the entry has no title. */
+function titleFor(name) {
+    const leaf = name.split("/").pop() ?? name;
+    return leaf.split(/[-_.]+/).filter(Boolean).map((word) => word[0].toUpperCase() + word.slice(1)).join(" ") || name;
+}
+function githubOwner(repositoryUrl) {
+    if (!repositoryUrl)
+        return undefined;
+    const match = /^https:\/\/github\.com\/([A-Za-z0-9-]{1,39})(?:\/|$)/.exec(repositoryUrl);
+    return match?.[1];
+}
+function input(kind, raw) {
+    const item = record(raw);
+    const name = text(item.name);
+    if (!name)
+        return null;
+    const description = text(item.description);
+    return {
+        kind,
+        name,
+        ...(description ? { description: description.slice(0, 300) } : {}),
+        required: item.isRequired === true,
+        secret: item.isSecret === true,
+        ...(kind === "header" && text(item.value) ? { template: text(item.value) } : {}),
+    };
+}
+function remotes(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.flatMap((entry) => {
+        const item = record(entry);
+        const url = httpsUrl(item.url);
+        // A URL with {placeholders} needs per-person values Atomic cannot guess.
+        if (!url || /[{}]|%7B|%7D/i.test(url))
+            return [];
+        const type = item.type === "sse" ? "sse" : item.type === "streamable-http" ? "http" : null;
+        if (!type)
+            return [];
+        const headers = Array.isArray(item.headers) ? item.headers.map((header) => input("header", header)).filter((header) => header !== null) : [];
+        return [{ type, url, headers }];
+    });
+}
+function packages(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.flatMap((entry) => {
+        const item = record(entry);
+        const registryType = text(item.registryType);
+        const identifier = text(item.identifier);
+        if (!registryType || !identifier)
+            return [];
+        const env = Array.isArray(item.environmentVariables)
+            ? item.environmentVariables.map((variable) => input("env", variable)).filter((variable) => variable !== null)
+            : [];
+        return [{
+                registryType,
+                identifier,
+                ...(text(item.version) ? { version: text(item.version) } : {}),
+                ...(text(record(item.transport).type) ? { transport: text(record(item.transport).type) } : {}),
+                ...(text(item.runtimeHint) ? { runtimeHint: text(item.runtimeHint) } : {}),
+                env,
+            }];
+    });
+}
+const SAFE_PACKAGE = /^(@[a-z0-9][\w.-]*\/)?[A-Za-z0-9][\w.-]*$/;
+const SAFE_VERSION = /^[\w.+-]{1,64}$/;
+/** Remote first (nothing to install), then npm, then PyPI. A remote whose
+ * headers are all optional is assumed to sign in with OAuth, so it runs
+ * through the mcp-remote bridge; one that requires a header (an API key) is
+ * kept as a plain URL entry with that header. */
+function installPlan(server) {
+    const remote = server.remotes.find((item) => item.type === "http") ?? server.remotes.find((item) => item.type === "sse");
+    if (remote)
+        return { kind: "remote", remote, oauth: !remote.headers.some((header) => header.required) };
+    const stdio = (item) => !item.transport || item.transport === "stdio";
+    const npm = server.packages.find((item) => item.registryType === "npm" && stdio(item) && SAFE_PACKAGE.test(item.identifier));
+    if (npm)
+        return { kind: "npm", pkg: npm };
+    const pypi = server.packages.find((item) => item.registryType === "pypi" && stdio(item) && SAFE_PACKAGE.test(item.identifier));
+    if (pypi)
+        return { kind: "pypi", pkg: pypi };
+    return null;
+}
+function planInputs(plan) {
+    if (!plan)
+        return [];
+    const list = plan.kind === "remote"
+        ? plan.oauth ? [] : plan.remote.headers.map(({ template: _template, ...header }) => header)
+        : plan.pkg.env;
+    return [...list].sort((a, b) => Number(b.required) - Number(a.required));
+}
+/** One registry list entry to the shape the renderer shows, or null when it
+ * is not the latest version or not usable at all. */
+export function normalizeRegistryEntry(raw) {
+    const entry = record(raw);
+    const server = record(entry.server);
+    const meta = record(record(entry._meta)[OFFICIAL]);
+    if (meta.isLatest === false)
+        return null;
+    if (typeof meta.status === "string" && meta.status !== "active")
+        return null;
+    const name = text(server.name);
+    if (!name)
+        return null;
+    const repositoryUrl = httpsUrl(record(server.repository).url);
+    const websiteUrl = httpsUrl(server.websiteUrl);
+    const featured = featuredByRegistryName.get(name);
+    const icons = Array.isArray(server.icons) ? server.icons : [];
+    const registryIcon = icons.map((icon) => httpsUrl(record(icon).src)).find(Boolean);
+    const owner = githubOwner(repositoryUrl);
+    const iconUrl = featured
+        ? featuredMcpIcon(featured.id)
+        : registryIcon ?? (owner ? `https://github.com/${owner}.png?size=64` : undefined);
+    const normalized = {
+        id: name,
+        name,
+        title: text(server.title) ?? featured?.name ?? titleFor(name),
+        description: (text(server.description) ?? "").slice(0, 400),
+        publisher: publisherFor(name),
+        version: text(server.version) ?? "",
+        ...(repositoryUrl ? { repositoryUrl } : {}),
+        ...(websiteUrl ? { websiteUrl } : {}),
+        remotes: remotes(server.remotes),
+        packages: packages(server.packages),
+        ...(iconUrl ? { iconUrl } : {}),
+        ...(featured ? { featured: featured.id } : {}),
+    };
+    const plan = installPlan(normalized);
+    return { ...normalized, install: plan?.kind ?? null, inputs: planInputs(plan) };
+}
+/** Normalize a page: latest versions only, one card per server name. */
+export function normalizeRegistryPage(body) {
+    const page = record(body);
+    const seen = new Set();
+    const servers = [];
+    for (const raw of Array.isArray(page.servers) ? page.servers : []) {
+        const server = normalizeRegistryEntry(raw);
+        if (!server || seen.has(server.id))
+            continue;
+        seen.add(server.id);
+        servers.push(server);
+    }
+    const nextCursor = text(record(page.metadata).nextCursor);
+    return { servers, ...(nextCursor ? { nextCursor } : {}) };
+}
+/** A registry client with a one-hour in-memory cache. Every failure (offline,
+ * timeout, a registry error) becomes RegistryUnavailableError. */
+export function createMcpPublicRegistry(options = {}) {
+    const doFetch = options.fetch ?? fetch;
+    const base = options.base ?? MCP_REGISTRY_BASE;
+    const now = options.now ?? Date.now;
+    const cache = new Map();
+    async function getJson(url) {
+        const hit = cache.get(url);
+        if (hit && now() - hit.at < CACHE_MS)
+            return hit.value;
+        let response;
+        try {
+            response = await doFetch(url, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(TIMEOUT_MS) });
+        }
+        catch {
+            throw new RegistryUnavailableError();
+        }
+        if (response.status === 404)
+            return null;
+        if (!response.ok)
+            throw new RegistryUnavailableError();
+        let value;
+        try {
+            value = await response.json();
+        }
+        catch {
+            throw new RegistryUnavailableError();
+        }
+        if (cache.size >= CACHE_MAX)
+            cache.delete(cache.keys().next().value);
+        cache.set(url, { at: now(), value });
+        return value;
+    }
+    return {
+        async search({ search, cursor }) {
+            const params = new URLSearchParams({ limit: String(PAGE_SIZE), version: "latest" });
+            const query = search?.trim().slice(0, 100);
+            if (query)
+                params.set("search", query);
+            if (cursor)
+                params.set("cursor", cursor.slice(0, 300));
+            return normalizeRegistryPage(await getJson(`${base}/v0/servers?${params}`));
+        },
+        async get(id) {
+            const body = await getJson(`${base}/v0/servers/${encodeURIComponent(id)}/versions/latest`);
+            return body === null ? null : normalizeRegistryEntry(body);
+        },
+    };
+}
+/** A free config name from the server's own name: "notion", then "notion-2". */
+export function freeMcpName(preferred, taken) {
+    const base = slugMcpName(preferred) || "mcp-server";
+    if (!taken(base))
+        return base;
+    for (let n = 2; n < 100; n += 1) {
+        const candidate = `${base.slice(0, 32 - String(n).length - 1)}-${n}`;
+        if (!taken(candidate))
+            return candidate;
+    }
+    return `${base.slice(0, 23)}-${Date.now().toString(36).slice(-8)}`;
+}
+function bridgeEntry(url) {
+    return { command: "npx", args: ["-y", MCP_REMOTE_PACKAGE, url], env: {} };
+}
+function cleanValues(values) {
+    const out = {};
+    for (const [key, value] of Object.entries(record(values))) {
+        if (typeof value === "string" && value.trim())
+            out[key] = value.trim();
+    }
+    return out;
+}
+/** The config entry a featured service becomes: its official URL through the
+ * OAuth bridge. */
+export function planFeaturedAdd(featured, taken) {
+    return { ok: true, name: freeMcpName(featured.id, taken), entry: bridgeEntry(featured.url), kind: "remote", oauth: true };
+}
+/** The config entry a registry server becomes, with the person's values for
+ * its inputs. Required inputs that are missing are refused with the list, so
+ * the renderer can ask for them. */
+export function planRegistryAdd(server, rawValues, taken) {
+    const values = cleanValues(rawValues);
+    const plan = installPlan(server);
+    if (!plan) {
+        const docker = server.packages.some((item) => item.registryType === "oci" || item.registryType === "docker");
+        return {
+            ok: false,
+            status: 400,
+            code: "unsupported",
+            error: docker
+                ? `${server.title} only ships as a Docker image, which Atomic can't add for you yet. Add it by hand under MCP servers.`
+                : `${server.title} doesn't offer a remote address or an npm or PyPI package, so Atomic can't add it for you. Add it by hand under MCP servers.`,
+        };
+    }
+    const inputs = planInputs(plan);
+    const missing = inputs.filter((item) => item.required && !values[item.name]);
+    if (missing.length) {
+        return { ok: false, status: 400, code: "needs_input", inputs, error: `${server.title} needs ${missing.map((item) => item.name).join(", ")} before it can be added.` };
+    }
+    const name = freeMcpName(server.featured ?? server.name.split("/").pop() ?? server.title, taken);
+    if (plan.kind === "remote") {
+        if (plan.oauth)
+            return { ok: true, name, entry: bridgeEntry(plan.remote.url), kind: "remote", oauth: true };
+        const headers = {};
+        for (const header of plan.remote.headers) {
+            const value = values[header.name];
+            if (!value)
+                continue;
+            // "Bearer {api_key}" -> "Bearer <value>" unless the value already is the whole header.
+            headers[header.name] = header.template && /\{[^}]+\}/.test(header.template) && !/\s/.test(value)
+                ? header.template.replace(/\{[^}]+\}/, value)
+                : value;
+        }
+        return { ok: true, name, entry: { type: plan.remote.type, url: plan.remote.url, headers }, kind: "remote", oauth: false };
+    }
+    const env = {};
+    for (const variable of plan.pkg.env) {
+        if (values[variable.name])
+            env[variable.name] = values[variable.name];
+    }
+    const version = plan.pkg.version && SAFE_VERSION.test(plan.pkg.version) ? plan.pkg.version : undefined;
+    if (plan.kind === "npm") {
+        return { ok: true, name, entry: { command: "npx", args: ["-y", version ? `${plan.pkg.identifier}@${version}` : plan.pkg.identifier], env }, kind: "npm", oauth: false };
+    }
+    return { ok: true, name, entry: { command: "uvx", args: [plan.pkg.identifier], env }, kind: "pypi", oauth: false };
+}
+export { featuredMcpServer };

package/dist-server/server/message-reactions.js

@@ -0,0 +1,11 @@
+import { isReactionEmoji } from "../shared/emoji.js";
+import { json, readBody } from "./harness/http.js";
+export async function reactToMessage(store, req, res, threadId, messageId) {
+    const body = await readBody(req);
+    if (!isReactionEmoji(body.emoji))
+        return json(res, 400, { error: "Choose one emoji" });
+    const message = store.toggleReaction(threadId, messageId, body.emoji, "user");
+    if (!message)
+        return json(res, 404, { error: "no such message" });
+    return json(res, 200, { message });
+}

package/dist-server/server/model-evidence-context.js

@@ -0,0 +1,18 @@
+export { ModelEvidenceLedger } from "./model-evidence.js";
+// Snapshot the same class choices the model picker displays before routing mutates the task.
+import { threadEngineMode } from "../shared/engine-tiers.js";
+export function createModelExpectation(context) {
+    return (threadId, instanceId, provider) => {
+        const profile = context.store.botByThread(threadId) ?? context.store.bot(context.speakerBot(threadId) ?? "");
+        if (!profile)
+            return null;
+        const task = context.store.taskByThread(profile.id, threadId);
+        const selection = context.turnEngineOverrides.get(threadId) ?? context.roomTurnSelections.get(threadId) ?? task?.modelSelection ?? profile.modelSelection;
+        const modelClass = context.enginePlan(profile, threadId).modelClass;
+        const mode = threadEngineMode(profile, task ?? {});
+        const preview = mode.kind === "pinned" ? undefined : context.botClassChoices(profile, threadId).options.find(option => option.modelClass === modelClass);
+        return { botId: profile.id, threadId, label: `${mode.kind === "tier" ? "Automatic: " : ""}${modelClass} · ${preview?.label ?? selection.model}`, modelClass,
+            model: preview?.selection?.model ?? selection.model, requestedModel: selection.model,
+            instanceId: instanceId ?? selection.instanceId, provider: provider ?? context.registry.get(selection.instanceId)?.driverKind ?? "unknown" };
+    };
+}

package/dist-server/server/model-evidence.js

@@ -0,0 +1,145 @@
+// Name: model-evidence; author: Atomic Engineering; date: 2026-10-27.
+// Append-only identity history beside the existing usage ledger, without prompts.
+import { randomUUID } from "node:crypto";
+import { mkdirSync, appendFileSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { modelEvidenceMetrics } from "../shared/model-evidence.js";
+export { modelEvidenceMetrics };
+const safe = (value) => typeof value === "string" && /^[\w .:/@+()[\]-]{1,200}$/u.test(value) ? value : undefined;
+export class ModelEvidenceLedger {
+    active = new Map();
+    byTurn = new Map();
+    failures = 0;
+    dataDir;
+    constructor(dataDir) { this.dataDir = dataDir; }
+    begin(expected, continuation = false) {
+        const prior = this.active.get(expected.threadId);
+        const attempt = { expected: { ...expected, ...(continuation && prior ? { label: prior.expected.label, modelClass: prior.expected.modelClass, model: prior.expected.model } : {}) }, logicalTurnId: continuation && prior ? prior.logicalTurnId : randomUUID(), attemptId: randomUUID() };
+        this.active.set(expected.threadId, attempt);
+        this.write(attempt, { kind: "dispatch", level: expected.requestedModel || expected.model ? "requested-only" : "unknown" });
+        return attempt.attemptId;
+    }
+    finishDispatch(threadId, attemptId) {
+        const attempt = this.active.get(threadId);
+        if (attempt?.attemptId === attemptId)
+            this.write(attempt, { kind: "completed", level: "unknown", ok: false, reason: "dispatch ended before provider completion" });
+    }
+    write(attempt, fields) {
+        const row = { ...attempt.expected, version: 1, id: randomUUID(), at: new Date().toISOString(),
+            logicalTurnId: attempt.logicalTurnId, attemptId: attempt.attemptId, ...(attempt.turnId ? { turnId: attempt.turnId } : {}), ...fields };
+        try {
+            const directory = join(this.dataDir, "model-evidence");
+            mkdirSync(directory, { recursive: true, mode: 0o700 });
+            appendFileSync(join(directory, `${row.at.slice(0, 7)}.jsonl`), JSON.stringify(row) + "\n", { mode: 0o600 });
+        }
+        catch {
+            this.failures++;
+            if (this.failures === 1)
+                console.error("[model-evidence] Cannot persist model history; queries will report incomplete evidence.");
+        }
+    }
+    observe(event, expectation) {
+        if (!["turn.started", "session.started", "model.evidence", "model.call", "turn.retrying", "turn.engine_failover", "session.model-fallback", "turn.completed", "session.exited"].includes(event.type))
+            return;
+        const turnKey = event.turnId ? JSON.stringify([event.threadId, event.providerInstanceId ?? event.provider, event.turnId]) : undefined;
+        let attempt = turnKey ? this.byTurn.get(turnKey) : undefined;
+        if (!attempt) {
+            attempt = this.active.get(event.threadId);
+            if (!attempt || (event.type === "turn.started" && attempt.turnId && attempt.turnId !== event.turnId)) {
+                const expected = expectation();
+                if (!expected)
+                    return;
+                this.begin(expected);
+                attempt = this.active.get(event.threadId);
+            }
+            if (event.turnId) {
+                attempt.turnId = event.turnId;
+                this.byTurn.set(turnKey, attempt);
+            }
+        }
+        const base = { provider: event.provider, instanceId: event.providerInstanceId ?? attempt.expected.instanceId };
+        switch (event.type) {
+            case "turn.started":
+                this.write(attempt, { ...base, kind: "start", level: "requested-only" });
+                break;
+            case "model.call":
+                this.write(attempt, { ...base, kind: "call", level: "unknown", callId: event.callId });
+                break;
+            case "model.evidence":
+                this.write(attempt, { ...base, kind: "evidence", level: safe(event.model) ? event.level : "unknown",
+                    ...(safe(event.model) ? { reportedModel: safe(event.model) } : {}), callId: event.callId, responseId: safe(event.responseId) });
+                break;
+            case "session.started":
+                this.write(attempt, { ...base, kind: "evidence", level: safe(event.model) ? event.modelEvidenceLevel ?? "requested-only" : "unknown", reportedModel: safe(event.model) });
+                break;
+            case "turn.retrying": {
+                this.write(attempt, { ...base, kind: "retry", level: "unknown", reason: safe(event.reason) });
+                // CLI retries reuse their native turn id, but are distinct attempts.
+                this.begin(attempt.expected, true);
+                const retry = this.active.get(event.threadId);
+                retry.turnId = event.turnId;
+                if (turnKey)
+                    this.byTurn.set(turnKey, retry);
+                break;
+            }
+            case "turn.engine_failover":
+            case "session.model-fallback":
+                this.write(attempt, { ...base, kind: "fallback", level: "unknown", reason: safe(event.reason) ?? "provider fallback" });
+                break;
+            case "turn.completed":
+                this.write(attempt, { ...base, kind: "completed", level: "unknown", ok: event.ok });
+                break;
+            case "session.exited":
+                this.write(attempt, { ...base, kind: "exited", level: "unknown" });
+                break;
+        }
+        // ponytail: bounded correlation cache; durable history remains on disk.
+        if (this.byTurn.size > 10000)
+            this.byTurn.delete(this.byTurn.keys().next().value);
+        if (this.active.size > 10000)
+            this.active.delete(this.active.keys().next().value);
+    }
+    query(botId, threadId, from, to) {
+        const directory = join(this.dataDir, "model-evidence");
+        const rows = [];
+        let incomplete = this.failures > 0;
+        let files = [];
+        try {
+            files = readdirSync(directory).filter(file => /^\d{4}-\d{2}\.jsonl$/.test(file)).sort();
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                incomplete = true;
+        }
+        for (const file of files) {
+            if (file.slice(0, 7) < from.toISOString().slice(0, 7) || file.slice(0, 7) > to.toISOString().slice(0, 7))
+                continue;
+            try {
+                for (const line of readFileSync(join(directory, file), "utf8").split("\n").filter(Boolean)) {
+                    try {
+                        const row = JSON.parse(line);
+                        if (row.version !== 1 || !row.logicalTurnId || !row.attemptId) {
+                            incomplete = true;
+                            continue;
+                        }
+                        if (row.botId === botId && row.threadId === threadId && row.at >= from.toISOString() && row.at <= to.toISOString())
+                            rows.push(row);
+                    }
+                    catch {
+                        incomplete = true;
+                    }
+                }
+            }
+            catch {
+                incomplete = true;
+            }
+        }
+        const latestDispatch = rows.findLast(row => row.kind === "dispatch");
+        const latest = latestDispatch && rows.findLast(row => row.attemptId === latestDispatch.attemptId);
+        // Late exit/events from an older attempt must not settle a newer attempt.
+        const running = latest && !rows.some(row => row.attemptId === latest.attemptId && ["completed", "exited"].includes(row.kind));
+        return { rows, metrics: modelEvidenceMetrics(rows), incomplete, writeFailures: this.failures,
+            current: running && this.active.has(threadId) ? latest.logicalTurnId : null,
+            interrupted: Boolean(running && !this.active.has(threadId)), last: latest?.logicalTurnId ?? null };
+    }
+}

package/dist-server/server/port-in-use.js

@@ -0,0 +1,21 @@
+import { connect } from "node:net";
+/** True when anything accepts TCP on 127.0.0.1:port, not just an Atomic server. */
+export function portInUse(port) {
+    return new Promise((done) => {
+        const socket = connect({ host: "127.0.0.1", port });
+        socket.setTimeout(1000);
+        socket.once("connect", () => { socket.destroy(); done(true); });
+        socket.once("timeout", () => { socket.destroy(); done(false); });
+        socket.once("error", () => done(false));
+    });
+}
+/** The server binds port and port + 1 (webhooks); report the first busy one. */
+export async function reportBusyPort(port, dataDirFlag) {
+    for (const candidate of [port, Number(process.env.OMB_WEBHOOK_PORT || port + 1)]) {
+        if (!(await portInUse(candidate)))
+            continue;
+        console.error(`Port ${candidate} is already in use by another app. Choose a free port, for example: chibi start --port ${port + 20}${dataDirFlag}`);
+        return true;
+    }
+    return false;
+}

package/dist-server/server/session-fallback.js

@@ -0,0 +1,76 @@
+// Session fallback for company subscription bots (docs/chibitek/engine-tiers.md,
+// "Subscription bots: the one failover exception"). When no account of the
+// bot's own provider can take a turn, one conversation may run on the same
+// class from another provider's subscription for up to SESSION_FALLBACK_TURNS
+// turns. The bot's own default never changes; the next turn tries its own
+// provider first again.
+import { SESSION_FALLBACK_TURNS } from "../shared/subscription-bots.js";
+export { SESSION_FALLBACK_TURNS };
+// ponytail: in memory, so a restart gives a conversation its 50 turns again;
+// persist on the task record if that matters.
+const fallbacks = new Map();
+/** The thread's own provider took this turn: it leaves the fallback (its count stays). */
+export function leaveSessionFallback(threadId) {
+    const entry = fallbacks.get(threadId);
+    if (entry)
+        entry.active = false;
+}
+/** Enter (or stay on) the fallback for this thread. A new turn counts one;
+ * a failover within a turn already on it counts nothing. False once the
+ * conversation has used its turns. */
+export function enterSessionFallback(threadId, newTurn) {
+    const entry = fallbacks.get(threadId) ?? { turns: 0, active: false };
+    if (entry.active && !newTurn)
+        return true;
+    if (entry.turns >= SESSION_FALLBACK_TURNS) {
+        entry.active = false;
+        fallbacks.set(threadId, entry);
+        return false;
+    }
+    entry.turns += 1;
+    entry.active = true;
+    fallbacks.set(threadId, entry);
+    return true;
+}
+/** Turn start for a subscription bot: its own provider's engine (which
+ * leaves the fallback), else, on its stop, the fallback's, counted as a
+ * turn. No fallback keeps the stop; past the limit, `spent` of it. */
+export function ownOrFallback(threadId, own, fallback, isStop, spent) {
+    try {
+        const choice = own();
+        leaveSessionFallback(threadId);
+        return choice;
+    }
+    catch (stop) {
+        if (!isStop(stop))
+            throw stop;
+        let choice;
+        try {
+            choice = fallback();
+        }
+        catch {
+            choice = undefined;
+        }
+        if (choice === undefined)
+            throw stop;
+        if (!enterSessionFallback(threadId, true))
+            throw spent(stop);
+        return choice;
+    }
+}
+export function onSessionFallback(threadId) {
+    return fallbacks.get(threadId)?.active === true;
+}
+export function sessionFallbackTurns(threadId) {
+    return fallbacks.get(threadId)?.turns ?? 0;
+}
+/** The bot as a fallback turn runs it: an ordinary company bot, so the
+ * ladder and every gate read it without the provider lock. */
+export function withoutSubscription(bot) {
+    const { subscription: _subscription, ...rest } = bot;
+    return rest;
+}
+/** The line a company subscription bot stops with once its fallback turns are used. */
+export function sessionFallbackSpentLine(line) {
+    return `${line} This conversation already used its ${SESSION_FALLBACK_TURNS} turns on another provider; download a handoff or hand it to another bot.`;
+}

package/dist-server/server/vault/routes.js

@@ -0,0 +1,43 @@
+import { PASS } from "../routes/table.js";
+import { VaultError } from "./store.js";
+/** The owner is supplied by the authenticated host, never from request JSON.
+ * Authorization runs on reads too, and is checked again after reading a body. */
+export function createVaultRoutes(deps) {
+    return async ({ req, res, path, method, auth, json, readBody }) => {
+        if (path !== "/api/vault" && !path.startsWith("/api/vault/"))
+            return PASS;
+        res.setHeader("cache-control", "no-store");
+        const ownerId = deps.owner(req, auth);
+        if (!ownerId)
+            return json(res, 403, { error: "Only the Vault owner can manage saved items." });
+        const store = deps.store();
+        if (!store)
+            return json(res, 503, { error: "Vault encryption is unavailable. Unlock the secure store and try again." });
+        const item = /^\/api\/vault\/([0-9a-f-]{36})$/.exec(path);
+        if (path !== "/api/vault" && !item)
+            return json(res, 404, { error: "Vault item is unavailable." });
+        if (!(path === "/api/vault" ? ["GET", "POST"] : ["PUT", "DELETE"]).includes(method))
+            return json(res, 405, { error: "Method not allowed." });
+        try {
+            if (method === "GET")
+                return json(res, 200, { items: store.list(ownerId) });
+            const body = method === "DELETE" ? undefined : await readBody(req).catch(() => null);
+            if (deps.owner(req, auth) !== ownerId || deps.store() !== store)
+                return json(res, 403, { error: "Vault access changed. Try again." });
+            if (method === "POST")
+                return json(res, 201, { item: store.create(ownerId, body) });
+            if (method === "PUT" && item)
+                return json(res, 200, { item: store.update(ownerId, item[1], body) });
+            if (method === "DELETE" && item) {
+                store.remove(ownerId, item[1]);
+                return json(res, 200, { removed: true });
+            }
+        }
+        catch (error) {
+            // No raw parser, filesystem, crypto or browser error crosses this route.
+            if (error instanceof VaultError)
+                return json(res, 400, { error: error.message });
+            return json(res, 503, { error: "Vault could not complete the request." });
+        }
+    };
+}