@chloejs/core 0.2.4 → 0.3.0

package/ops/test.ts

@@ -2,21 +2,27 @@
 //
 // A job is code, so it is tested rather than scored: `npm run evals` is for
 // the prompts, and this is for the machinery underneath them. Nothing here
-// touches the real database or the real gateway. The database is in memory and
-// the gateway is a server on a loopback port that answers whatever the case
-// says, so a model step is exercised without spending anything.
+// touches the real database, the real gateway or a real mail account. The
+// database is in memory, the gateway is a server on a loopback port that
+// answers whatever the case says, so a model step is exercised without
+// spending anything, and mail goes to the log.
 //
 // These are set rather than left to settings.json, because a setting in a file
 // applies here too: a box with model.via "claude" would otherwise run every
 // case against a real subscription, slowly, and score differently from the
 // next box.
 process.env.AGENTS_DB = ":memory:";
-// A folder of its own, so a case that writes state (an account, a note) cannot
-// land in the real one. Set before any import, like the database above.
+// Folders of their own, so a case that writes state (an account) or a note
+// cannot land in the real ones. Set before any import, like the database above.
 process.env.AGENTS_STATE = (await import("node:fs")).mkdtempSync(`${(await import("node:os")).tmpdir()}/chloe-test-`);
+process.env.AGENTS_MEMORY = `${process.env.AGENTS_STATE}/memory`;
 process.env.OWNER = "test:somebody";
 process.env.AI_GATEWAY_API_KEY = "test";
 process.env.MODEL_VIA = "gateway";
+// Signing in and getting locked out both mail, and the addresses used here are
+// made up. Without this the suite sends two real emails on a box that has a
+// mail key, because the alert settings are read from the same file.
+process.env.EMAIL_PROVIDER = "none";
 
 import { existsSync } from "node:fs";
 import { createServer } from "node:http";
@@ -559,6 +565,23 @@ about("a model step that never fits");
     "a",
   );
   is("a setting nobody set is empty rather than missing", readSettings({}, {}).node, "");
+  is("each agent's own settings are under its name", readSettings({}, { agents: { tempo: { telegram: "t" } } }).agents.tempo.telegram, "t");
+  is("and what it does not say is empty", readSettings({}, { agents: { tempo: { telegram: "t" } } }).agents.tempo.slack.app_token, "");
+  let misspelt = "";
+  try {
+    readSettings({}, { agents: { tempo: { telegarm: "t" } } });
+  } catch (error) {
+    misspelt = error instanceof Error ? error.message : "";
+  }
+  is("a misspelt key under an agent is refused rather than ignored", misspelt.includes("telegarm"), true);
+  {
+    const { settings, unclaimed } = await import("@chloejs/core");
+    const before = settings.agents;
+    settings.agents = { tempo: { telegram: "t", slack: { bot_token: "", app_token: "" } } };
+    is("an entry for an agent that exists is claimed", unclaimed(["tempo"]), []);
+    is("one left behind by a rename is not", unclaimed(["growth"]), ["tempo"]);
+    settings.agents = before;
+  }
   is("an environment variable beats the files", setting("fromfile", "TEST_SETTING_WINS"), "fromfile");
   process.env.TEST_SETTING_WINS = "fromenv";
   is("once there is one", setting("fromfile", "TEST_SETTING_WINS"), "fromenv");
@@ -800,7 +823,7 @@ about("a model step that never fits");
 {
   about("a note two jobs want at the same moment");
 
-  const { STATE, note } = await import("@chloejs/core");
+  const { MEMORIES, note } = await import("@chloejs/core");
   const shape = z.object({ sites: z.record(z.string(), z.string()) }).catch({ sites: {} });
   const kept = note("test-note", "sites", shape);
 
@@ -823,9 +846,9 @@ about("a model step that never fits");
   const counts = (await Promise.all(reads)).map((one) => Object.keys(one.sites).length);
   is("nobody reads a half written note", counts.filter((n) => n !== 1 && n !== 20_000), []);
   is("and the note itself is whole afterwards", Object.keys((await kept.read()).sites).length, 20_000);
-  const left = (await readdir(join(STATE, "test-note"))).filter((f) => f.endsWith(".part"));
+  const left = (await readdir(join(MEMORIES, "test-note"))).filter((f) => f.endsWith(".part"));
   is("the temporary file is renamed, not left behind", left, []);
-  await rm(join(STATE, "test-note"), { recursive: true, force: true });
+  await rm(join(MEMORIES, "test-note"), { recursive: true, force: true });
 }
 
 {
@@ -920,7 +943,49 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
 
 {
   about("telegram");
-  const { listen } = await import("#chloe/channels/telegram.ts");
+  const { listen, telegramChannel, telegramHtml, inPieces } = await import("#chloe/channels/telegram.ts");
+
+  is(
+    "markdown arrives as telegram's own formatting",
+    telegramHtml("**Blocked on you:**\n1. `main` needs a fast-forward, see [the log](https://example.com/a?b=1&c=2).\n- *one* item"),
+    "<b>Blocked on you:</b>\n1. <code>main</code> needs a fast-forward, see <a href=\"https://example.com/a?b=1&amp;c=2\">the log</a>.\n• <i>one</i> item",
+  );
+  is("a heading is a bold line", telegramHtml("## Numbers"), "<b>Numbers</b>");
+  is("what telegram would read as a tag is escaped", telegramHtml("1 < 2 & 3 > 2"), "1 &lt; 2 &amp; 3 &gt; 2");
+  is("nothing inside code is read as formatting", telegramHtml("`**not bold** <b>`"), "<code>**not bold** &lt;b&gt;</code>");
+  is("a code block keeps its lines", telegramHtml("```\na < b\n  c\n```"), "<pre>a &lt; b\n  c</pre>");
+  is("a quote is a quote", telegramHtml("> said\n> twice"), "<blockquote>said\ntwice</blockquote>");
+  is("a link that is not a web or mail address stays as written", telegramHtml("[go](javascript:alert(1))"), "[go](javascript:alert(1))");
+  is("underscores in a name are left alone", telegramHtml("run_script and ship_code_change"), "run_script and ship_code_change");
+  is("a sum is not italics", telegramHtml("2 * 3 * 4"), "2 * 3 * 4");
+  is("a long reply is cut at a line break", inPieces("aaaa\nbbbb\ncc", 10), ["aaaa\nbbbb", "cc"]);
+  is("and one with none is cut where it has to be", inPieces("abcdefghij", 4), ["abcd", "efgh", "ij"]);
+
+  {
+    // Two agents, one with a bot in settings and one without. Each reads its
+    // own entry, by the name it has when the channel starts.
+    const { settings } = await import("@chloejs/core");
+    const before = settings.agents;
+    settings.agents = { first: { telegram: "first-bot", slack: { bot_token: "", app_token: "" } } };
+    const said: string[] = [];
+    const log = console.error;
+    console.error = (line: string) => void said.push(line);
+    const channel = telegramChannel({ api: "http://127.0.0.1:9" });
+    channel.start(() => ({ name: "second" }) as any).stop();
+    channel.start(() => ({ name: "first" }) as any).stop();
+    console.error = log;
+    settings.agents = before;
+    is("an agent with no entry has no bot, and is not handed another's", said.some((l) => l.includes("second has a Telegram channel but no bot")), true);
+    is("an agent with one uses its own", said.some((l) => l.includes("first has a Telegram channel but no bot")), false);
+  }
+  is(
+    "a channel says what it was made with, so a reload can tell an edit from none",
+    [
+      telegramChannel({ allowFrom: [1] }).madeWith === telegramChannel({ allowFrom: [1] }).madeWith,
+      telegramChannel({ allowFrom: [1] }).madeWith === telegramChannel({ allowFrom: [1], sendWhileWorking: true }).madeWith,
+    ],
+    [true, false],
+  );
 
   // A stand-in Telegram: each update is handed out once, a file is always the
   // same four bytes, and everything the bot sends is written down.
@@ -932,7 +997,14 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
     request.on("end", () => {
       if (request.url!.startsWith("/file/")) return void response.end("PNG!");
       const method = request.url!.split("/").pop()!;
-      calls.push({ method, body: JSON.parse(raw || "{}"), token: request.url!.split("/")[1].slice(3) });
+      const body = JSON.parse(raw || "{}");
+      const token = request.url!.split("/")[1].slice(3);
+      // The bot called "picky" refuses every formatted message, as Telegram
+      // does one whose tags it cannot read.
+      if (token === "picky" && body.parse_mode) {
+        return void response.end(JSON.stringify({ ok: false, description: "Bad Request: can't parse entities" }));
+      }
+      calls.push({ method, body, token });
       const result =
         method === "getUpdates" ? inbox.splice(0)
         : method === "getMe" ? { id: 999, is_bot: true, username: "testbot" }
@@ -972,6 +1044,15 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   // messages out once and for all, unlike Telegram. Let it land first.
   await pause(100);
   is("it clears a webhook first, or Telegram refuses to hand out messages", calls.some((c) => c.method === "deleteWebhook"), true);
+  is("a reply goes as telegram's formatting", calls.find((c) => c.method === "sendMessage")?.body.parse_mode, "HTML");
+
+  const picky = listen({ name: "test", token: "picky", api, agent: () => agent });
+  inbox.push(privately(2, stranger, "hi"));
+  for (let i = 0; i < 100 && !calls.some((c) => c.token === "picky" && c.method === "sendMessage"); i++) await pause(20);
+  picky.stop();
+  await pause(100);
+  const plain = calls.find((c) => c.token === "picky" && c.method === "sendMessage");
+  is("a reply telegram refuses to format is sent again as plain words", [plain?.body.parse_mode, typeof plain?.body.text], [undefined, "string"]);
   is("with nobody allowed yet, a private message is told its user id", said()[0]?.startsWith("9: Your Telegram user id is 9."), true);
 
   calls.length = 0;
@@ -1087,6 +1168,42 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   const { recall: recalled } = await import("#chloe/model/memory.ts");
   is("and the exchange is kept in that chat's conversation", recalled("test/telegram--100").map((m) => m.content).slice(-2), ["\u201cA line from a book.\u201d \u2014 A Book", whole]);
   is("the / menu is the agent's jobs", calls.find((c) => c.method === "setMyCommands")?.body.commands, [{ command: "highlights", description: "highlights" }]);
+
+  // Two messages a second apart are one message, and the answer goes under the
+  // first of them. A share that arrives as a quote and then a comment is why.
+  calls.length = 0;
+  handed.length = 0;
+  const sixth = listen({ name: "test", token: "j", api, allowFrom: [7], inGroups: "always", stackWithin: 1, agent: () => reader });
+  inbox.push(inGroup(41, me, "\u201cA line.\u201d \u2014 A Book"));
+  await pause(200);
+  inbox.push(inGroup(42, me, "and what I thought of it"));
+  await settle(1);
+  sixth.stop();
+  await pause(100);
+  is("messages sent close together are handled as one", handed, ["\u201cA line.\u201d \u2014 A Book\n\nand what I thought of it"]);
+  is("and the answer replies to the first of them", calls.find((c) => c.method === "sendMessage")?.body.reply_parameters, { message_id: 41 });
+
+  // A run that failed says so. Saying it is already running would send
+  // somebody looking for a run that is not there.
+  calls.length = 0;
+  const breaks = {
+    ...codeJob("highlights", async () => {
+      throw new Error("the page would not write");
+    }),
+    input: z.object({ text: z.string() }),
+    answers: (text: string) => text.startsWith("\u201c"),
+  } as Job;
+  delete breaks.cron;
+  const broken = agentFor(breaks);
+  const failing = startClock(() => new Map([["test", broken]]));
+  const seventh = listen({ name: "test", token: "j", api, allowFrom: [7], inGroups: "always", agent: () => broken });
+  inbox.push(inGroup(43, me, "\u201cAnother line.\u201d \u2014 A Book"));
+  await settle(1);
+  seventh.stop();
+  failing.stop();
+  await pause(100);
+  is("a failed job says what failed, not that it is already running", said(), ["-100: highlights failed. the page would not write"]);
+
   telegram.close();
 
 }
@@ -1373,6 +1490,9 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   await receive(brief, { channel: "test", chat: "c", thread: "test/old", from: { id: "1", name: "Me" }, text: "and today?", private: true }, { chatHistory: { messages: 1 } });
   const shownTo = lastAsked.filter((m) => m.role !== "system").map((m) => m.content);
   is("a channel's chatHistory is what a turn on it is shown", shownTo, ["just now", "and today?"]);
+  const system = lastAsked.find((m) => m.role === "system")?.content ?? "";
+  is("a turn on a channel is told who it is talking to, and to say you", system.includes('You are talking with Me on test, directly. Write to them as "you"'), true);
+  is("and not that its lines on the way are sent, when they are not", system.includes("sent to them straight away"), false);
 
   // What the model writes on its way to an answer is sent as it goes only when
   // the channel asks for it, and always before the answer.
@@ -1382,6 +1502,10 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
     receive(brief, { channel: "test", chat: "w", thread: "test/while", from: { id: "1", name: "Me" }, text: "how is it?", private: true },
       { sendWhileWorking }, { send: async (text) => void onTheWay.push(text) });
   answers.push({ content: "Let me check.", tool_calls: [look] }, "All fine.");
+  await talk(true);
+  is("with sendWhileWorking on, it is told its lines on the way reach them", lastAsked.find((m) => m.role === "system")?.content.includes("sent to them straight away"), true);
+  onTheWay.length = 0;
+  answers.push({ content: "Let me check.", tool_calls: [look] }, "All fine.");
   const quiet = await talk(false);
   is("off, only the answer comes back", [onTheWay, quiet?.text], [[], "All fine."]);
   answers.push({ content: "Let me check.", tool_calls: [look] }, "All fine.");
@@ -1390,6 +1514,299 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   is("and kept in the conversation", recall("test/while").map((m) => m.content).slice(-3), ["how is it?", "Let me check.", "All fine."]);
 }
 
+{
+  about("adding to the end of a note");
+
+  const { writeFiles } = await import("@chloejs/core/services");
+  const { mkdtemp, readFile } = await import("node:fs/promises");
+  const folder = await mkdtemp(`${(await import("node:os")).tmpdir()}/chloe-append-`);
+  await writeFiles(folder, "LESSONS.md", "# Lessons\n\n- one");
+  await writeFiles(folder, "LESSONS.md", "- two\n", { append: true });
+  is("what was there stays, and the new part starts on a line of its own", await readFile(`${folder}/LESSONS.md`, "utf8"), "# Lessons\n\n- one\n- two\n");
+  await writeFiles(folder, "new/list.md", "- first\n", { append: true });
+  is("adding to a file that is not there yet makes it", await readFile(`${folder}/new/list.md`, "utf8"), "- first\n");
+}
+
+{
+  about("an agent's history, in git");
+
+  const { execFileSync } = await import("node:child_process");
+  const { chmod, mkdtemp, mkdir: makeDir, readFile: get, writeFile: put } = await import("node:fs/promises");
+  const { realpathSync } = await import("node:fs");
+  const { jobsOf, loadAll, markdownJob } = await import("#chloe/load/load.ts");
+  const { setAgentDirs } = await import("#chloe/core/paths.ts");
+  const { change, makeRepo, markSeen, undo } = await import("#chloe/services/historyService.ts");
+  const { whyNot, writeOwn } = await import("#chloe/services/ownFilesService.ts");
+  const { runScripts } = await import("#chloe/services/scriptsService.ts");
+  const { agentChanges } = await import("#chloe/serve/changes.ts");
+  const { open, tree } = await import("#chloe/serve/files.ts");
+
+  // What this box's git calls a person, for the commits a person makes.
+  const identity = ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL"];
+  const before = identity.map((key) => process.env[key]);
+  process.env.GIT_AUTHOR_NAME = process.env.GIT_COMMITTER_NAME = "a person";
+  process.env.GIT_AUTHOR_EMAIL = process.env.GIT_COMMITTER_EMAIL = "person@example.com";
+  const git = (cwd: string, ...args: string[]) => execFileSync("git", args, { cwd, encoding: "utf8" }).trim();
+  const failed = (error: Error) => error.message;
+
+  // The repo the agents are written in, with somebody's work in progress in it.
+  const repo = realpathSync(await mkdtemp(join(tmpdir(), "chloe-history-")));
+  const folder = join(repo, "agents", "keeper");
+  await makeDir(join(folder, "jobs"), { recursive: true });
+  await makeDir(join(folder, "skills"), { recursive: true });
+  await put(join(folder, "instructions.md"), "Be brief.");
+  await put(join(folder, "PERMISSIONS.md"), "| deploy | no |");
+  await put(join(folder, "skills", "deploys.md"), "---\nname: deploys\ndescription: how\n---\nDo it.");
+  await put(join(folder, "jobs", "build.ts"), "// a job made of code");
+  await put(join(folder, "jobs", "build.md"), "The words of that job.");
+  await put(join(folder, "jobs", "weekly.md"), "---\ncron: 0 8 * * 1\n---\nLook back.");
+  git(repo, "init", "-q", "-b", "main");
+  git(repo, "add", "-A");
+  git(repo, "commit", "-q", "-m", "the agent as a person wrote it");
+  await put(join(repo, "half-done.ts"), "work in progress");
+
+  // The memories start keeping history as the agents load: one repository,
+  // beside the agents rather than inside any of their folders, a folder each.
+  const memories = join(repo, "memory");
+  const memory = join(memories, "keeper");
+  const theirs = join(memories, "other");
+  await makeDir(memory, { recursive: true });
+  await makeDir(theirs, { recursive: true });
+  await put(join(memory, "STATUS.md"), "old news");
+  await makeRepo(memories, "keeper");
+  is("the memories are one repository of their own", git(memory, "rev-parse", "--show-toplevel"), memories);
+  is(
+    "holding what was already there, under the agent's name",
+    git(memories, "log", "--format=%an: %s"),
+    "keeper: What was here when this folder started keeping its history",
+  );
+  is("and the repository around them leaves them alone", git(repo, "status", "--porcelain"), "?? half-done.ts");
+
+  // Somebody changes it by hand, then a run changes it.
+  await put(join(memory, "notes.md"), "written by hand");
+  const status = codeJob(
+    "status",
+    async ({ step, memory: at }) => step("write", () => put(join(at, "STATUS.md"), "new news").then(() => "done")),
+    undefined,
+    () => "wrote the status",
+  );
+  const keeper: Agent = { ...agentFor(status), name: "keeper", folder, memory: { folder: memory, commit: "each run" } };
+  const ran = await work({ agent: keeper, job: status });
+  is(
+    "a change made outside a run is committed before it, under this box's git name",
+    git(memory, "log", "-1", "--skip=1", "--format=%an: %s"),
+    "a person: Changed outside a run",
+  );
+  is(
+    "and what the run changed is committed after it, under the agent's name",
+    git(memory, "log", "-1", "--format=%an <%ae>: %s"),
+    "keeper <>: status: wrote the status",
+  );
+  is("ending with the run it came from", git(memory, "log", "-1", "--format=%b"), `Run: ${ran.runId}`);
+  is(
+    "which lists it",
+    JSON.parse(row(ran.runId).commits).map((one: { in: string; subject: string }) => [one.in, one.subject]),
+    [["memory", "status: wrote the status"]],
+  );
+  const quiet = await work({ agent: keeper, job: codeJob("nothing", async () => "ok") });
+  is("a run that changed nothing makes no commit", row(quiet.runId).commits, null);
+
+  // The folder beside it is another agent's memory, in the same repository.
+  await put(join(theirs, "journal.md"), "nobody has committed this");
+  await work({ agent: keeper, job: status });
+  is(
+    "a run commits its own memory and leaves the one beside it alone",
+    git(memories, "status", "--porcelain", "-uall"),
+    "?? other/journal.md",
+  );
+
+  // What it may change of its own folder.
+  const home = { name: "keeper", folder, memory: { folder: memory } };
+  const rules = { files: ["md", "txt", "json"], except: ["PERMISSIONS.md"] };
+  const may = (path: string) => whyNot(home, rules, path) ?? "yes";
+  is("it may change its instructions", may("instructions.md"), "yes");
+  is("and a skill", may("skills/deploys.md"), "yes");
+  is("but not what is kept back for a person", may("PERMISSIONS.md"), "it is kept back for a person to change");
+  is("nor anything in a folder of code", may("tools/check.md"), "tools/ is code");
+  is("nor a file of code", may("jobs/build.ts"), "it is code");
+  is("nor an ending it was not given", may("notes.html"), "only files ending in .md, .txt, .json can be written");
+  is(
+    "nor its memory, which has tools of its own, when somebody keeps that inside its folder",
+    whyNot({ ...home, memory: { folder: join(folder, "memory") } }, rules, "memory/STATUS.md") ?? "yes",
+    "that is your memory, which you write with write_notes",
+  );
+  is("nor what marks its runs", may("evals/status.json"), "evals/ is how your runs are marked");
+  is("nor a file no loader would read", may("skills/deploys/SKILL.md"), "a file in a folder inside skills/ is never read");
+  is(
+    "nor a skill that is not markdown",
+    may("skills/deploys.txt"),
+    "a skill is one markdown file, and anything else in skills/ is never read",
+  );
+  is("nor anything outside its folder", await Promise.resolve().then(() => may("../other/x.md")).catch(failed), `Path is outside ${folder}: ../other/x.md`);
+
+  const wrote = (path: string, content: string, message = "a change worth making") =>
+    writeOwn(home, rules, path, content, message).then((done) => done.commit ?? "not committed", failed);
+  is(
+    "a job that would not load is refused",
+    await wrote("jobs/weekly.md", "---\ncron: every monday\n---\nLook back."),
+    'jobs/weekly.md would not load as a job: its cron line does not read: A cron line needs five fields, got 2: "every monday".',
+  );
+  is(
+    "so is a setting no job reads",
+    await wrote("jobs/weekly.md", "---\nretries: 3\n---\nLook back."),
+    "jobs/weekly.md would not load as a job: it has retries at the top, and a job only reads cron, description, timezone, model.",
+  );
+  is(
+    "and a job made to run more than once an hour",
+    await wrote("jobs/weekly.md", "---\ncron: */5 * * * *\n---\nLook back."),
+    'A job you write runs at most once an hour: give its cron line one minute, like "0 7 * * *".',
+  );
+  is("and JSON that does not parse", (await wrote("targets.json", "{ nope")).startsWith("targets.json is not valid JSON"), true);
+  is("and a file with nothing in it", await wrote("instructions.md", "  \n"), "instructions.md would be empty. Write what it should say.");
+  const made = await wrote("jobs/weekly.md", "---\ncron: 0 9 * * 1\ntimezone: America/New_York\n---\nLook back at the week.");
+  is("a job that loads is written and committed", /^[0-9a-f]{12}$/.test(made), true);
+  is("under the agent's name, with its message", git(repo, "log", "-1", "--format=%an: %s"), "keeper: a change worth making");
+  is("and nothing of anybody else's went with it", git(repo, "status", "--porcelain"), "?? half-done.ts");
+  is(
+    "writing it does not make it a job, because jobs are named in agent.ts",
+    (await jobsOf("keeper", folder, [])).map((one) => one.id),
+    [],
+  );
+  is(
+    "naming it makes it one, and the words of a job made of code are not a job",
+    (await jobsOf("keeper", folder, [markdownJob("jobs/weekly.md")])).map((one) => [one.id, one.cron]),
+    [["weekly", "0 9 * * 1"]],
+  );
+  is(
+    "and a job that is not there yet is refused, because only a person can name it",
+    await wrote("jobs/monthly.md", "---\ncron: 0 9 1 * *\n---\nLook back further."),
+    "jobs/monthly.md would be a new job, and a job only runs once it is named in agent.ts, which only a person can change. " +
+      "Ask for it, and change a job that is already there meanwhile.",
+  );
+  await put(join(folder, "instructions.md"), "Be brief, and say so.");
+  is(
+    "a file somebody is in the middle of changing is left alone",
+    await wrote("instructions.md", "Be long."),
+    "instructions.md has changes nobody has committed yet, and writing it would put them under your name. " +
+      "Leave it for now, and say that you could not change it and why.",
+  );
+  git(repo, "checkout", "-q", "--", "agents/keeper/instructions.md");
+
+  // A change made during a run belongs to that run.
+  const improve = codeJob("improve", async ({ step }) =>
+    step("rewrite the skill", () =>
+      writeOwn(home, rules, "skills/deploys.md", "---\nname: deploys\ndescription: how\n---\nShip it small.", "the skill says how to ship"),
+    ).then(() => "ok"),
+  );
+  const improved = await work({ agent: keeper, job: improve });
+  is(
+    "a change made during a run is listed on that run",
+    JSON.parse(row(improved.runId).commits).map((one: { in: string; subject: string }) => [one.in, one.subject]),
+    [["folder", "the skill says how to ship"]],
+  );
+  is("and says which run it came from", git(repo, "log", "-1", "--format=%b"), `Run: ${improved.runId}`);
+
+  // The site's view of it.
+  const all = await agentChanges(keeper, {}, "test");
+  is(
+    "both places are listed",
+    all.changes.map((one) => `${one.in} ${one.by}: ${one.subject}`).sort(),
+    [
+      "folder a person: the agent as a person wrote it",
+      "folder keeper: a change worth making",
+      "folder keeper: the skill says how to ship",
+      "memory a person: Changed outside a run",
+      "memory keeper: What was here when this folder started keeping its history",
+      "memory keeper: status: wrote the status",
+    ],
+  );
+  is("what the agent did is new until somebody looks", all.unseen, 4);
+  markSeen("keeper");
+  is("and then it is not", (await agentChanges(keeper, {}, "test")).unseen, 0);
+  const history = (await agentChanges(keeper, { place: "memory", path: "STATUS.md" }, "test")).changes;
+  is(
+    "one file's history is the commits that touched it, newest first",
+    history.map((one) => one.subject),
+    ["status: wrote the status", "What was here when this folder started keeping its history"],
+  );
+  const skill = all.changes.find((one) => one.subject === "the skill says how to ship")!;
+  const shown = await change(keeper, "folder", skill.id);
+  is(
+    "one change comes with its diff, and its paths as the agent's folder sees them",
+    [shown?.files, shown?.diff.includes("+Ship it small.")],
+    [[{ path: "skills/deploys.md", status: "M" }], true],
+  );
+  const undone = await undo(keeper, "folder", skill.id);
+  is("undoing it puts the file back", await get(join(folder, "skills", "deploys.md"), "utf8"), "---\nname: deploys\ndescription: how\n---\nDo it.");
+  is("and commits that under this box's git name", git(repo, "log", "-1", "--format=%an: %s"), 'a person: Undo "the skill says how to ship"');
+  is("saying which files", undone.files, ["skills/deploys.md"]);
+  await work({
+    agent: keeper,
+    job: codeJob("again", async ({ step, memory: at }) => step("write", () => put(join(at, "STATUS.md"), "newer news").then(() => "done"))),
+  });
+  is(
+    "a change to a file that has changed since cannot be undone",
+    await undo(keeper, "memory", history[0].id).then(() => "undone", failed),
+    "STATUS.md has changed since, so undoing this would lose that change. Undo the later change first.",
+  );
+  is(
+    "nor can the first commit",
+    await undo(keeper, "memory", history[1].id).then(() => "undone", failed),
+    "This is the first commit there is, so there is nothing before it to go back to.",
+  );
+
+  // Seen from the site and from its scripts.
+  await makeDir(join(folder, "scripts"), { recursive: true });
+  await put(join(folder, "scripts", "where.sh"), '#!/bin/sh\nprintf %s "$MEMORY_FOLDER"\n');
+  await chmod(join(folder, "scripts", "where.sh"), 0o755);
+  setAgentDirs(new Map([["keeper", folder]]), new Map([["keeper", memory]]));
+  is(
+    "the site's view of an agent's folder leaves its memory out",
+    (await tree("keeper")).map((one) => one.name),
+    ["jobs", "scripts", "skills", "instructions.md", "PERMISSIONS.md"],
+  );
+  is("and will not open a file in it", await open("keeper", "memory/STATUS.md"), null);
+  is("a script is told where its agent's memory is", (await runScripts("keeper", "where.sh")).stdout, memory);
+  await loadAll();
+
+  identity.forEach((key, i) => {
+    if (before[i] === undefined) delete process.env[key];
+    else process.env[key] = before[i];
+  });
+}
+
+{
+  about("an email written in Markdown");
+
+  const { markdownToHtml, markdownToText } = await import("@chloejs/core/services");
+  const body = "## Today\n\nOne line\nwrapped here.\n\n- a **bold** item\n- [a link](https://example.com)\n\n| day | visits |\n|---|---|\n| Mon | 3 |";
+  const html = markdownToHtml(body);
+  is("lines next to each other are one paragraph", html.includes("<p style='margin:0 0 14px'>One line wrapped here.</p>"), true);
+  is("a heading is a heading", html.includes(">Today</div>"), true);
+  is("a list is a list", (html.match(/<li /g) ?? []).length, 2);
+  is("a table keeps its rows and drops the rule", (html.match(/<tr>/g) ?? []).length, 2);
+  is("what a person typed is escaped", markdownToHtml("<b>hi</b>").includes("&lt;b&gt;"), true);
+  is("a link that is not a web or mail address is only words", markdownToHtml("[go](javascript:alert(1))").includes("<a"), false);
+  is("a quote cannot end the address early", markdownToHtml("[go](https://x.com/'onmouseover='y)").includes("href='https://x.com/&#39;onmouseover=&#39;y'"), true);
+  is(
+    "the plain copy has no symbols in it",
+    markdownToText(body),
+    "Today\n\nOne line\nwrapped here.\n\n- a bold item\n- a link (https://example.com)\n\n  day: visits\n  Mon: 3",
+  );
+}
+
+{
+  about("a provider that carries nothing");
+
+  const { sendEmail } = await import("@chloejs/core/services");
+  const sent = await sendEmail({ from: "a@example.com", to: ["b@example.com"], tag: "test" }, "Hello", "A body.");
+  is("it says it was sent, with the tag in front", [sent.sent, sent.subject], [true, "[test] Hello"]);
+  is("and it has no id, because nothing carried it", sent.id, undefined);
+
+  const nobody = await sendEmail({ from: "a@example.com", to: [] }, "Hello", "A body.").catch((error: Error) => error.message);
+  is("nobody to send to is refused rather than dropped", nobody, "Nobody to send to. Give the sender at least one address in to.");
+}
+
 {
   about("reading a web page");
 
@@ -1440,7 +1857,7 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
 {
   about("the login in front of the page");
 
-  const { createAccount, hasAccount, setCookie, signIn, signedIn } = await import("#chloe/serve/login.ts");
+  const { covers, createAccount, hasAccount, setCookie, shareLogin, signIn, signedIn } = await import("#chloe/serve/login.ts");
   const carrying = (cookie: string) => ({ headers: { cookie } }) as import("node:http").IncomingMessage;
 
   is("a fresh copy has no account", hasAccount(), false);
@@ -1461,7 +1878,22 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   is("the right password signs in", signedIn(carrying(`chloe_session=${session}`)), true);
   is("a cookie somebody edited does not", signedIn(carrying(`chloe_session=${session.slice(0, -1)}x`)), false);
   is("no cookie does not", signedIn(carrying("")), false);
-  is("signing out clears it", setCookie("", true).includes("Max-Age=0"), true);
+  is("signing out clears it", setCookie("", true)[0].includes("Max-Age=0"), true);
+  shareLogin(undefined);
+  is("with no domain the cookie is this site's alone", setCookie(session, true)[0].includes("Domain="), false);
+  is("and nowhere else is somewhere to send somebody back to", covers("https://example.com/"), false);
+
+  shareLogin("example.com");
+  is("with one, the cookie covers every site under it", setCookie(session, true)[0].includes("Domain=example.com"), true);
+  is("and signing out ends the old one too", setCookie("", true).length, 2);
+  is("a site under it is somewhere to go back to", covers("https://money.example.com/x?y=1"), true);
+  is("and so is the name itself", covers("https://example.com/"), true);
+  is("but not over plain http", covers("http://money.example.com/"), false);
+  is("nor a name that only ends the same way", covers("https://badexample.com/"), false);
+  is("nor one that only starts the same way", covers("https://example.com.evil.net/"), false);
+  is("nor something that is not an address", covers("/elsewhere"), false);
+  is("a name that is not one is refused", (() => { try { shareLogin("not a name"); return "taken"; } catch { return "refused"; } })(), "refused");
+  shareLogin(undefined);
 
   // The same value said the other way, for a caller that is not a browser.
   const bearing = (authorization: string) => ({ headers: { authorization } }) as import("node:http").IncomingMessage;
@@ -1753,6 +2185,7 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   const { serve } = await import("#chloe/serve/http.ts");
   const { makeToken, forgetTokens } = await import("#chloe/serve/tokens.ts");
   const { memoryFolder } = await import("#chloe/load/load.ts");
+  const { MEMORIES } = await import("#chloe/core/paths.ts");
 
   const folder = `${process.env.AGENTS_STATE}/memory-under-test`;
   await makeDir(`${folder}/01_projects`, { recursive: true });
@@ -1769,9 +2202,8 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   await put(`${folder}/secrets/key.txt`, "never shown");
   process.env.CHLOE_PAGE = "builtin";
 
-  // Every agent has a memory. Unsaid, it is the agent's own state folder,
-  // which is where the memory tool has always written.
-  is("unsaid, an agent's memory is its own state folder", memoryFolder("tempo"), `${process.env.AGENTS_STATE}/tempo`);
+  // Every agent has a memory. Unsaid, it is memory/ in the agent's own folder.
+  is("unsaid, an agent's memory is its own folder in memory/", memoryFolder("tempo"), `${MEMORIES}/tempo`);
   is("said, it is wherever the agent says", memoryFolder("chloe", { folder: "/somewhere" }), "/somewhere");
 
   const keeper: Agent = { ...agentFor(codeJob("unused", async () => ({}))), memory: { folder, label: "Private" } };
@@ -1822,6 +2254,7 @@ for (const agent of (await (await import("@chloejs/core")).loadAll()).values())
   const { secret } = makeToken("for a test");
   is("a token cannot read a memory at all", (await fetch(`${at}/api/agents/test/memory`, { headers: { authorization: `Bearer ${secret}` } })).status, 403);
   is("nor get a pass to one", (await fetch(`${at}/api/agents/test/memory/pass`, { headers: { authorization: `Bearer ${secret}` } })).status, 403);
+  is("nor read what changed in it", (await fetch(`${at}/api/agents/test/changes`, { headers: { authorization: `Bearer ${secret}` } })).status, 403);
 
   // The frame. This is the part the whole viewer's safety rests on.
   const { at: under } = (await (await fetch(`${at}/api/agents/test/memory/pass`, { headers: as })).json()) as { at: string };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chloejs/core",
-  "version": "0.2.4",
+  "version": "0.3.0",
   "type": "module",
   "description": "A job runner where asking a model is one kind of step.",
   "exports": {