@chibitek/chibi 0.1.161 → 0.1.168

package/dist-server/server/drivers/claude.js

@@ -33,6 +33,8 @@ import { SPAWNED_PROXIES } from "../proxy-paths.js";
 import { rtkRewrite } from "../rtk-rewrite.js";
 import { volatileNote, volatileSectionsOf, withNote } from "./volatile-notes.js";
 import { extractMcpImages } from "../mcp-tool-images.js";
+import { claudeUserMessage, diagnosticClaudeUserMessage } from "./claude-stdin.js";
+import { createClaudeElicitations } from "./claude-elicitation.js";
 import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
 const CONNECTOR_CACHE_MS = 5 * 60 * 1000;
 /** Parent-session credentials/routing that a named account must not inherit.
@@ -812,45 +814,6 @@ function decodeConfig(raw) {
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
     };
 }
-/** Claude's stream-json input accepts the same image source blocks as the
- * Anthropic Messages API. Keep the old string form for text-only turns so a
- * CLI update cannot disturb the overwhelmingly common path. */
-function claudeUserMessage(text, images) {
-    if (!images?.length)
-        return { type: "user", message: { role: "user", content: text } };
-    const content = images.map((image) => ({
-        type: "image",
-        source: {
-            type: "base64",
-            media_type: image.mime,
-            data: readFileSync(image.path).toString("base64"),
-        },
-    }));
-    if (text)
-        content.push({ type: "text", text });
-    return { type: "user", message: { role: "user", content } };
-}
-/** Native traces are routinely attached to bug reports. Preserve the image
- * block's shape and size for debugging, but never persist its base64 bytes. */
-function diagnosticClaudeUserMessage(message) {
-    if (!Array.isArray(message.message.content))
-        return message;
-    return {
-        ...message,
-        message: {
-            ...message.message,
-            content: message.message.content.map((block) => block.type === "image"
-                ? {
-                    ...block,
-                    source: {
-                        ...block.source,
-                        data: `[image data: ${block.source.data.length} base64 chars]`,
-                    },
-                }
-                : block),
-        },
-    };
-}
 export const ClaudeDriver = {
     driverKind: DRIVER_KIND,
     metadata: { displayName: "Claude", supportsMultipleInstances: true },
@@ -919,6 +882,7 @@ export const ClaudeDriver = {
         const sumCost = (a, b) => a === null ? b : b === null ? a : a + b;
         const STEER_FOLLOWUP_MS = 1_500;
         const sessions = new Map();
+        const elicitations = createClaudeElicitations({ emit: (event) => emit(event), base: (threadId, turnId) => base(threadId, turnId) });
         // "Always allow this session", per thread: the actions the person allowed
         // for the native Claude session. Kept here, not on the broker, so a
         // relaunch with --resume (idle close, retry) still honors them; a fresh
@@ -960,6 +924,7 @@ export const ClaudeDriver = {
             if (!s || s.closing)
                 return;
             s.closing = true;
+            elicitations.endThread(threadId);
             if (s.idleTimer)
                 clearTimeout(s.idleTimer);
             // Broker ownership belongs to this session. Detach and close it now,
@@ -1831,6 +1796,22 @@ export const ClaudeDriver = {
                         }
                         break;
                     }
+                    case "control_request":
+                        // an MCP server's confirmation question (server/drivers/claude-elicitation.ts)
+                        elicitations.handle(o, {
+                            threadId,
+                            turnId: currentTurnId(),
+                            closing: session.closing,
+                            write: (frame) => {
+                                try {
+                                    if (session.child.stdin.writable && !session.child.stdin.destroyed)
+                                        session.child.stdin.write(JSON.stringify(frame) + "\n");
+                                    appendNative(threadId, { dir: "out", source: "claude.sdk.message", msg: frame });
+                                }
+                                catch { }
+                            },
+                        });
+                        break;
                     case "user":
                         for (const b of Array.isArray(o.message?.content) ? o.message.content : []) {
                             if (b.type === "tool_result") {
@@ -2272,6 +2253,9 @@ export const ClaudeDriver = {
                 steer,
                 interruptTurn: async (threadId) => active.get(threadId)?.stop(),
                 respondToRequest: async (threadId, requestId, decision) => {
+                    const confirmation = elicitations.respond(threadId, requestId, decision);
+                    if (confirmation)
+                        return confirmation;
                     // fail-closed by construction: no broker, or an ask that already
                     // timed out / settled, is `unavailable` — the caller denies
                     const broker = sessions.get(threadId)?.broker ?? active.get(threadId)?.broker;

package/dist-server/server/drivers/codex-elicitation.js

@@ -0,0 +1,93 @@
+// MCP elicitation forms Codex's app-server forwards (mcpServer/elicitation/request)
+// that Atomic can answer on a permission card: Codex's own app-access approvals,
+// and a configured server's plain confirmation (server/mcp-elicitation.ts).
+import { elicitationConfirm } from "../mcp-elicitation.js";
+const plainRecord = (value) => value && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+export const containsControlCharacter = (value) => {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+};
+function boundedLabel(value) {
+    if (typeof value !== "string")
+        return null;
+    const label = value.trim();
+    return label && label.length <= 160 && !containsControlCharacter(label) ? label : null;
+}
+function ordinaryApprovalValue(value) {
+    const normalized = value.trim().toLowerCase();
+    if (/session|always|permanent|forever|persistent/.test(normalized))
+        return false;
+    return normalized === "once" || /^(?:accept|approve|allow)(?:ed|[-_]?once)?$/.test(normalized);
+}
+/** Recognize only schema-backed app-access approvals. Arbitrary MCP forms
+ * (credentials, free text, URLs, or required fields without a one-time enum)
+ * remain user input and are declined; Full access never fabricates them. */
+export function mcpAppApprovalForm(params) {
+    const request = plainRecord(params);
+    if (!request || request.mode !== "form")
+        return null;
+    const metadata = plainRecord(request._meta);
+    const target = plainRecord(metadata?.target);
+    const toolParams = plainRecord(metadata?.tool_params);
+    const message = boundedLabel(request.message) ?? "App access requested";
+    const appName = [
+        metadata?.app_name,
+        metadata?.appName,
+        metadata?.app,
+        target?.app,
+        target?.name,
+        toolParams?.app_name,
+        toolParams?.app,
+        metadata?.connector_name,
+        metadata?.connectorName,
+    ].map(boundedLabel).find(Boolean) ?? message.match(/^Allow ChatGPT to use (.+?)\?$/i)?.[1]?.trim();
+    // The application identity is the second half of the discriminator. A
+    // required approval-looking enum by itself must not turn an arbitrary form
+    // into a permission prompt.
+    if (!appName)
+        return null;
+    const schema = plainRecord(request.requestedSchema);
+    const properties = plainRecord(schema?.properties);
+    const required = schema?.required;
+    if (!properties ||
+        !Array.isArray(required) ||
+        required.length === 0 ||
+        required.length > 8 ||
+        !required.every((key) => typeof key === "string" && key.length > 0 && key.length <= 100))
+        return null;
+    const content = {};
+    for (const key of required) {
+        const field = plainRecord(properties[key]);
+        if (!field)
+            return null;
+        const enumValues = Array.isArray(field.enum)
+            ? field.enum.filter((value) => typeof value === "string")
+            : [];
+        const oneOfValues = Array.isArray(field.oneOf)
+            ? field.oneOf
+                .map((option) => boundedLabel(plainRecord(option)?.const))
+                .filter((value) => Boolean(value))
+            : [];
+        const chosen = [...oneOfValues, ...enumValues].find(ordinaryApprovalValue);
+        if (!chosen)
+            return null;
+        content[key] = chosen;
+    }
+    const tool = boundedLabel(appName) ?? boundedLabel(request.serverName) ?? "app_access";
+    return { tool, summary: message, allowResult: { action: "accept", content } };
+}
+/** A configured server (by its mount name) asking the person to confirm a
+ * change: Addigy confirms every write this way. The card always needs the
+ * person, whatever the approval mode. Null for anything else. */
+export function codexServerConfirm(params, customByMountName) {
+    const serverName = plainRecord(params)?.serverName;
+    if (typeof serverName !== "string" || !customByMountName.has(serverName))
+        return null;
+    return elicitationConfirm(params);
+}

package/dist-server/server/drivers/codex.js

@@ -15,6 +15,8 @@ import { describeProbeFailure, describeSpawnFailure, killCliTree, probeCli, spaw
 import { setupLog } from "../setup-log.js";
 import { isHarnessOwnedMcpEnvName } from "../mcp-registry.js";
 import { toolAnnotations } from "../mcp-tool-hints.js";
+import { elicitationAnswer, elicitationSummary, elicitationTool } from "../mcp-elicitation.js";
+import { codexServerConfirm, containsControlCharacter, mcpAppApprovalForm } from "./codex-elicitation.js";
 import { newEventId, newId } from "../contracts.js";
 import { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 import { codexLocalProviderArgs } from "./local-inject.js";
@@ -181,83 +183,6 @@ function additionalPermissionSummary(permissions, reason) {
 const plainRecord = (value) => value && typeof value === "object" && !Array.isArray(value)
     ? value
     : null;
-const containsControlCharacter = (value) => {
-    for (const character of value) {
-        const code = character.charCodeAt(0);
-        if (code <= 0x1f || code === 0x7f)
-            return true;
-    }
-    return false;
-};
-function boundedLabel(value) {
-    if (typeof value !== "string")
-        return null;
-    const label = value.trim();
-    return label && label.length <= 160 && !containsControlCharacter(label) ? label : null;
-}
-function ordinaryApprovalValue(value) {
-    const normalized = value.trim().toLowerCase();
-    if (/session|always|permanent|forever|persistent/.test(normalized))
-        return false;
-    return normalized === "once" || /^(?:accept|approve|allow)(?:ed|[-_]?once)?$/.test(normalized);
-}
-/** Recognize only schema-backed app-access approvals. Arbitrary MCP forms
- * (credentials, free text, URLs, or required fields without a one-time enum)
- * remain user input and are declined; Full access never fabricates them. */
-function mcpAppApprovalForm(params) {
-    const request = plainRecord(params);
-    if (!request || request.mode !== "form")
-        return null;
-    const metadata = plainRecord(request._meta);
-    const target = plainRecord(metadata?.target);
-    const toolParams = plainRecord(metadata?.tool_params);
-    const message = boundedLabel(request.message) ?? "App access requested";
-    const appName = [
-        metadata?.app_name,
-        metadata?.appName,
-        metadata?.app,
-        target?.app,
-        target?.name,
-        toolParams?.app_name,
-        toolParams?.app,
-        metadata?.connector_name,
-        metadata?.connectorName,
-    ].map(boundedLabel).find(Boolean) ?? message.match(/^Allow ChatGPT to use (.+?)\?$/i)?.[1]?.trim();
-    // The application identity is the second half of the discriminator. A
-    // required approval-looking enum by itself must not turn an arbitrary form
-    // into a permission prompt.
-    if (!appName)
-        return null;
-    const schema = plainRecord(request.requestedSchema);
-    const properties = plainRecord(schema?.properties);
-    const required = schema?.required;
-    if (!properties ||
-        !Array.isArray(required) ||
-        required.length === 0 ||
-        required.length > 8 ||
-        !required.every((key) => typeof key === "string" && key.length > 0 && key.length <= 100))
-        return null;
-    const content = {};
-    for (const key of required) {
-        const field = plainRecord(properties[key]);
-        if (!field)
-            return null;
-        const enumValues = Array.isArray(field.enum)
-            ? field.enum.filter((value) => typeof value === "string")
-            : [];
-        const oneOfValues = Array.isArray(field.oneOf)
-            ? field.oneOf
-                .map((option) => boundedLabel(plainRecord(option)?.const))
-                .filter((value) => Boolean(value))
-            : [];
-        const chosen = [...oneOfValues, ...enumValues].find(ordinaryApprovalValue);
-        if (!chosen)
-            return null;
-        content[key] = chosen;
-    }
-    const tool = boundedLabel(appName) ?? boundedLabel(request.serverName) ?? "app_access";
-    return { tool, summary: message, allowResult: { action: "accept", content } };
-}
 /** Codex persists these values on its native thread. Keep them explicit on
  * start, resume, and every turn so switching modes cannot leave a more
  * permissive sandbox/reviewer stuck to the next request. */
@@ -920,7 +845,9 @@ export const CodexDriver = {
                     const isLegacyMcpPermission = method === "mcpServer/elicitation/request" &&
                         params?._meta?.codex_approval_kind === "mcp_tool_call";
                     const mcpAppApproval = isMcpElicitation ? mcpAppApprovalForm(params) : null;
-                    const isMcpPermission = isLegacyMcpPermission || mcpAppApproval !== null;
+                    // one of the person's own servers confirming a change (Addigy's writes)
+                    const serverConfirm = isMcpElicitation && !isLegacyMcpPermission && !mcpAppApproval ? codexServerConfirm(params, customByMountName) : null;
+                    const isMcpPermission = isLegacyMcpPermission || mcpAppApproval !== null || serverConfirm !== null;
                     const isQuestion = method === "item/tool/requestUserInput";
                     const isAdditionalPermission = method === "item/permissions/requestApproval";
                     const isPermission = legacy || isMcpPermission || isAdditionalPermission ||
@@ -976,25 +903,29 @@ export const CodexDriver = {
                     const mcpToolRef = customServer && mcpTool
                         ? { server: customServer, tool: mcpTool, ...(toolAnnotations(params?._meta?.annotations) ? { annotations: toolAnnotations(params._meta.annotations) } : {}) }
                         : undefined;
-                    const tool = mcpAppApproval
-                        ? mcpAppApproval.tool
-                        : isLegacyMcpPermission
-                            ? (mcpTool ?? "mcp")
+                    const tool = serverConfirm
+                        ? elicitationTool(customByMountName.get(params.serverName))
+                        : mcpAppApproval
+                            ? mcpAppApproval.tool
+                            : isLegacyMcpPermission
+                                ? (mcpTool ?? "mcp")
+                                : isAdditionalPermission
+                                    ? "permissions"
+                                    : method === "item/fileChange/requestApproval" || method === "applyPatchApproval"
+                                        ? "edit"
+                                        : isQuestion
+                                            ? "ask_user"
+                                            : "shell";
+                    const permissionResult = (allow) => serverConfirm
+                        ? elicitationAnswer(serverConfirm, allow)
+                        : isMcpPermission
+                            ? allow
+                                ? (mcpAppApproval?.allowResult ?? { action: "accept", content: {} })
+                                : { action: "decline" }
                             : isAdditionalPermission
-                                ? "permissions"
-                                : method === "item/fileChange/requestApproval" || method === "applyPatchApproval"
-                                    ? "edit"
-                                    : isQuestion
-                                        ? "ask_user"
-                                        : "shell";
-                    const permissionResult = (allow) => isMcpPermission
-                        ? allow
-                            ? (mcpAppApproval?.allowResult ?? { action: "accept", content: {} })
-                            : { action: "decline" }
-                        : isAdditionalPermission
-                            ? { permissions: allow ? grantedPermissions(params.permissions) : {}, scope: "turn" }
-                            : { decision: allow ? (legacy ? "approved" : "accept") : legacy ? "denied" : "decline" };
-                    if (autoAcceptPermissions && isPermission) {
+                                ? { permissions: allow ? grantedPermissions(params.permissions) : {}, scope: "turn" }
+                                : { decision: allow ? (legacy ? "approved" : "accept") : legacy ? "denied" : "decline" };
+                    if (autoAcceptPermissions && isPermission && !serverConfirm) {
                         return send({
                             jsonrpc: "2.0",
                             id: msg.id,
@@ -1004,15 +935,17 @@ export const CodexDriver = {
                     const requestId = newId();
                     const summary = isAdditionalPermission
                         ? additionalPermissionSummary(params.permissions, params.reason)
-                        : isMcpPermission
-                            ? (mcpAppApproval?.summary ?? (typeof params.message === "string" ? params.message : "MCP access requested"))
-                            : typeof params.command === "string"
-                                ? params.command
-                                : Array.isArray(params.questions)
-                                    ? params.questions.map((q) => q.question ?? q.header).filter(Boolean).join(" · ")
-                                    : typeof params.reason === "string"
-                                        ? params.reason
-                                        : tool;
+                        : serverConfirm
+                            ? elicitationSummary(customByMountName.get(params.serverName), serverConfirm)
+                            : isMcpPermission
+                                ? (mcpAppApproval?.summary ?? (typeof params.message === "string" ? params.message : "MCP access requested"))
+                                : typeof params.command === "string"
+                                    ? params.command
+                                    : Array.isArray(params.questions)
+                                        ? params.questions.map((q) => q.question ?? q.header).filter(Boolean).join(" · ")
+                                        : typeof params.reason === "string"
+                                            ? params.reason
+                                            : tool;
                     const choices = isQuestion
                         ? (params.questions?.[0]?.options ?? []).map((o) => o.label).slice(0, 5)
                         : undefined;
@@ -1031,7 +964,8 @@ export const CodexDriver = {
                             send({
                                 jsonrpc: "2.0",
                                 id: msg.id,
-                                result: permissionResult(behavior === "allow"),
+                                // a server's question nobody answered is "no answer", not a no
+                                result: serverConfirm && source !== "user" ? { action: "cancel" } : permissionResult(behavior === "allow"),
                             });
                         }
                         emit({ ...base(threadId, turnId), type: "request.resolved", requestId, behavior, source });
@@ -1048,7 +982,7 @@ export const CodexDriver = {
                         summary,
                         choices,
                         approvalScope: controlsHost ? "local-computer" : undefined,
-                        requiresExplicitApproval: isAdditionalPermission || undefined,
+                        requiresExplicitApproval: isAdditionalPermission || serverConfirm !== null || undefined,
                         ...(mcpToolRef ? { mcpTool: mcpToolRef } : {}),
                     });
                 };

package/dist-server/server/engine-platform-fleet.js

@@ -0,0 +1,32 @@
+// Which engines the runtime fleet carries on this OS. The gate itself lives in
+// shared/engine-platforms.ts (e.g. Qwen off on Windows for now); this module
+// applies it to instance maps so server/config.ts stays a config loader.
+import { engineOnPlatform } from "../shared/engine-platforms.js";
+/** Apple Intelligence runs only on Apple silicon Macs; elsewhere the engine
+ * is left out of the fleet rather than listed as unavailable. */
+export function onDeviceFleet(platform = process.platform, arch = process.arch) {
+    return platform === "darwin" && arch === "arm64"
+        ? { appleIntelligence: { driver: "appleIntelligence", displayName: "Apple Intelligence (on this Mac)" } }
+        : {};
+}
+/** An engine switched off on this OS gets no runtime instance: not in the
+ * picker, not installable, and a caller looking one up finds nothing to load.
+ * Only the runtime map drops it; a saved entry stays on disk and comes back
+ * when the engine is turned on again. Mutates and returns `map`. */
+export function dropEnginesOffPlatform(map, platform) {
+    for (const [id, entry] of Object.entries(map)) {
+        if (!engineOnPlatform(entry.driver, platform))
+            delete map[id];
+    }
+    return map;
+}
+/** The runtime map leaves out engines switched off on this OS; a save must not
+ * erase them from config.json, so saved entries for them go back into `map`
+ * exactly as saved. Mutates and returns `map`. */
+export function restoreEnginesOffPlatform(map, saved, platform) {
+    for (const [id, entry] of Object.entries(saved ?? {})) {
+        if (!Object.hasOwn(map, id) && !engineOnPlatform(entry.driver, platform))
+            map[id] = structuredClone(entry);
+    }
+    return map;
+}

package/dist-server/server/external-room.js

@@ -0,0 +1,24 @@
+// Who an external (shared) room admits: people, each with their own
+// orchestrator, and no other bot. A guest team's specialists stay home and
+// work through the orchestrator its person brought (Erick's rule, 2026-10-27).
+//
+// Pure: no store, no server. The invite flow supplies the records.
+import { isPrimaryBot } from "../shared/primary-bot.js";
+/** How many people one external room holds, each bringing one orchestrator.
+ * One value so it can be raised later. */
+export const EXTERNAL_ROOM_MAX_HUMANS = 4;
+const key = (email) => email.trim().toLowerCase();
+/** Why `email` cannot join, or undefined when it may. */
+export function externalRoomHumanProblem(guests, email) {
+    if (guests.some(guest => key(guest.email) === key(email)))
+        return undefined;
+    if (guests.length >= EXTERNAL_ROOM_MAX_HUMANS)
+        return `An external room holds at most ${EXTERNAL_ROOM_MAX_HUMANS} people`;
+}
+/** Why `bot` cannot join, or undefined when it may: it must be the
+ * orchestrator one of the room's people brought. */
+export function externalRoomBotProblem(guests, bot) {
+    const brought = guests.some(guest => guest.orchestratorId === bot.id);
+    if (!brought || !(bot.chiefOfStaff || isPrimaryBot(bot)))
+        return "An external room admits people and each person's own orchestrator only";
+}