@datalayer/agent-runtimes 1.3.53 → 1.3.54

package/lib/loop/apps/visitorToken.d.ts

@@ -0,0 +1,35 @@
+/** Where a conversation without an account runs: the visitors' runtime, and what it is for. */
+export type DatalayerVisitors = {
+    /** The visitors' runtime, as the chat addresses it. */
+    url: string;
+    /** The application the visitor's token is for: an example's id, or `at:<slug>`. */
+    app: string;
+    /** ai-inference, which mints the visitor's token. */
+    inferenceUrl: string;
+};
+/** A visitor's id: what ai-inference accepts (8 to 64 letters, digits or dashes). */
+export declare function isVisitorId(value: string | null | undefined): value is string;
+/** The id this tab keeps for its visitor, or `''` until ai-inference made one. */
+export declare function keptVisitorId(): string;
+/** A visitor's token, and when it is to be minted again. */
+export type VisitorToken = {
+    token: string;
+    visitor: string;
+    /** Epoch milliseconds: the token's own lifetime from now. */
+    renewAt: number;
+};
+/** The body ai-inference is asked with. */
+export declare function visitorTokenRequest(app: string, visitor: string): {
+    app: string;
+    visitor?: string;
+};
+/** Mint a visitor's token for an application; throws with ai-inference's sentence. */
+export declare function fetchVisitorToken(inferenceUrl: string, app: string, visitor?: string, fetcher?: typeof fetch): Promise<VisitorToken>;
+/**
+ * The visitor's token for an application while `visitors` is set: minted at
+ * once and again before it runs out. `error` says why none could be had.
+ */
+export declare function useVisitorToken(visitors: DatalayerVisitors | undefined): {
+    token?: string;
+    error?: string;
+};

package/lib/loop/apps/visitorToken.js

@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * A visitor's token, for a conversation without an account on the visitors'
+ * runtime (LOOP R-30).
+ *
+ * ai-inference mints it (`POST /anonymous/token`) naming the visitor — the id
+ * this tab keeps for them, so that a new token is the same visitor, whose
+ * session, turns and rate it does not reset — and the one application it is
+ * for: an example's id, or `at:<slug>` for an application at its address.
+ * It lives minutes, so it is minted again before it runs out: what limits a
+ * visitor is on the servers (turns a day, a session's minutes, a rate and a
+ * ceiling for the day), not the life of a key.
+ *
+ * @module loop/apps/visitorToken
+ */
+import { useEffect, useState } from 'react';
+/** The id this tab keeps for its visitor. */
+const VISITOR_KEY = 'datalayer-loop-visitor';
+/** Minted again this long before the token runs out. */
+const MARGIN_MS = 30_000;
+/** A visitor's id: what ai-inference accepts (8 to 64 letters, digits or dashes). */
+export function isVisitorId(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9-]{8,64}$/.test(value);
+}
+/** The id this tab keeps for its visitor, or `''` until ai-inference made one. */
+export function keptVisitorId() {
+    try {
+        const kept = window.sessionStorage.getItem(VISITOR_KEY);
+        return isVisitorId(kept) ? kept : '';
+    }
+    catch {
+        return '';
+    }
+}
+function keepVisitorId(visitor) {
+    try {
+        window.sessionStorage.setItem(VISITOR_KEY, visitor);
+    }
+    catch {
+        // A tab that keeps nothing is a new visitor at each token.
+    }
+}
+/** The body ai-inference is asked with. */
+export function visitorTokenRequest(app, visitor) {
+    return isVisitorId(visitor) ? { app, visitor } : { app };
+}
+/** Mint a visitor's token for an application; throws with ai-inference's sentence. */
+export async function fetchVisitorToken(inferenceUrl, app, visitor = keptVisitorId(), fetcher = fetch) {
+    const base = inferenceUrl.replace(/\/+$/, '');
+    const response = await fetcher(`${base}/api/ai-inference/v1/anonymous/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(visitorTokenRequest(app, visitor)),
+    });
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok || !body.token) {
+        throw new Error(body.detail ||
+            `A visitor's token was refused by ${base} (HTTP ${response.status}).`);
+    }
+    if (isVisitorId(body.visitor)) {
+        keepVisitorId(body.visitor);
+    }
+    const lifetimeMs = Math.max(60_000, (body.expires_in ?? 300) * 1000);
+    return {
+        token: body.token,
+        visitor: body.visitor ?? visitor,
+        renewAt: Date.now() + lifetimeMs - MARGIN_MS,
+    };
+}
+/**
+ * The visitor's token for an application while `visitors` is set: minted at
+ * once and again before it runs out. `error` says why none could be had.
+ */
+export function useVisitorToken(visitors) {
+    const [state, setState] = useState({});
+    const app = visitors?.app;
+    const inferenceUrl = visitors?.inferenceUrl;
+    useEffect(() => {
+        if (!app || !inferenceUrl) {
+            setState({});
+            return;
+        }
+        let cancelled = false;
+        let timer;
+        const mint = () => {
+            fetchVisitorToken(inferenceUrl, app)
+                .then(minted => {
+                if (cancelled) {
+                    return;
+                }
+                setState({ token: minted.token });
+                timer = setTimeout(mint, Math.max(5_000, minted.renewAt - Date.now()));
+            })
+                .catch((error) => {
+                if (!cancelled) {
+                    setState({
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            });
+        };
+        mint();
+        return () => {
+            cancelled = true;
+            if (timer) {
+                clearTimeout(timer);
+            }
+        };
+    }, [app, inferenceUrl]);
+    return state;
+}

package/lib/loop/embed/LoopEmbed.js

@@ -76,6 +76,7 @@ export function LoopEmbed({ agentId = '', showHeader = false, chatHeaderActions,
         preset.showTokenUsage,
         // By its content: an application's spec written inline is a new object each render.
         JSON.stringify(preset.datalayerCreatePayload ?? null),
+        JSON.stringify(preset.datalayerVisitors ?? null),
         preset.defaultEditor,
         preset.showViewSelector,
         preset.hideChatHeader,

package/lib/loop/plugins/agents/DatalayerAgentBridge.js

@@ -22,6 +22,9 @@ export function DatalayerAgentBridge() {
     const agentsConfig = reactor.getConfig(AGENTS_PLUGIN_NAME);
     const agentSpecId = agentsConfig?.datalayerAgentSpecId ?? DEFAULT_DATALAYER_AGENTSPEC;
     const createPayload = agentsConfig?.datalayerCreatePayload;
+    // A conversation without an account (LOOP R-30): the agent is already on
+    // the visitors' runtime, kept warm there; nothing is allocated or made.
+    const visitors = agentsConfig?.datalayerVisitors;
     const service = useOptionalSandboxService();
     const target = useSignalValue(service?.target ?? IDLE_SANDBOX_TARGET_SIGNAL);
     const onDatalayer = target === 'datalayer';
@@ -65,13 +68,22 @@ export function DatalayerAgentBridge() {
         agentSpecId,
         agentConfig,
         variant: 'cloud-pydanticai',
-        autoStart: onDatalayer,
-        autoCreateAgent: onDatalayer,
+        autoStart: onDatalayer && !visitors,
+        autoCreateAgent: onDatalayer && !visitors,
     });
     useEffect(() => {
         if (!service || !onDatalayer) {
             return;
         }
+        if (visitors) {
+            service.report({
+                variant: 'datalayer',
+                // No sandbox: a visitor's application runs no code.
+                sandbox_running: false,
+                agent_base_url: visitors.url,
+            });
+            return;
+        }
         if (error) {
             // The reason travels with the state. "connected-dead" and a column of
             // "unknown" is what a reader saw before, which names the symptom and
@@ -106,7 +118,7 @@ export function DatalayerAgentBridge() {
             // host's server for an agent that is not on it.
             agent_base_url: runtime.agentBaseUrl,
         });
-    }, [service, onDatalayer, runtime, status, error]);
+    }, [service, onDatalayer, runtime, status, error, visitors]);
     return null;
 }
 export default DatalayerAgentBridge;

package/lib/loop/plugins/agents/plugin.d.ts

@@ -1,3 +1,21 @@
+/**
+ * The Agents plugin: where the agent runs, and the sandbox that comes with it.
+ *
+ * It was the "code sandbox" plugin, and the rename follows what the choice
+ * came to mean. Picking a target used to say only where *code* ran; now it
+ * decides where the *agent* runs too — in this page with the Vercel AI SDK, or
+ * on a server with pydantic-ai — because the location is what a harness can
+ * be, whatever a spec asks for. One control, one answer.
+ *
+ * It owns the sandbox and publishes it as a service; the notebook and document
+ * plugins depend on this plugin rather than on a connection of their own.
+ *
+ * Which agentspec the session runs is a different question, and belongs to
+ * `@datalayer/loop-plugin-agentspecs`.
+ *
+ * @module loop/plugins/agents/plugin
+ */
+import type { DatalayerVisitors } from '../../apps/visitorToken';
 import type { ReactorSlotComponent } from '@datalayer/reactor/react';
 import type { ServiceManagerSource } from './browserService';
 import { type TeamSelection } from './team';
@@ -79,6 +97,12 @@ export type AgentsConfig = {
      * decides its tool calls by its rules (LOOP R-05, R-03).
      */
     datalayerCreatePayload?: Record<string, unknown>;
+    /**
+     * A conversation without an account (LOOP R-30): the application's agent
+     * is already on the visitors' runtime, so nothing is allocated or created,
+     * and the chat speaks to it with a visitor's token for the application.
+     */
+    datalayerVisitors?: DatalayerVisitors;
     /**
      * The target is the host's decision, not the reader's: started there even
      * with the control hidden. For an application that runs where it is

package/lib/loop/plugins/agents/plugin.js

@@ -2,23 +2,6 @@
  * Copyright (c) 2025-2026 Datalayer, Inc.
  * Distributed under the terms of the Modified BSD License.
  */
-/**
- * The Agents plugin: where the agent runs, and the sandbox that comes with it.
- *
- * It was the "code sandbox" plugin, and the rename follows what the choice
- * came to mean. Picking a target used to say only where *code* ran; now it
- * decides where the *agent* runs too — in this page with the Vercel AI SDK, or
- * on a server with pydantic-ai — because the location is what a harness can
- * be, whatever a spec asks for. One control, one answer.
- *
- * It owns the sandbox and publishes it as a service; the notebook and document
- * plugins depend on this plugin rather than on a connection of their own.
- *
- * Which agentspec the session runs is a different question, and belongs to
- * `@datalayer/loop-plugin-agentspecs`.
- *
- * @module loop/plugins/agents/plugin
- */
 import { ServerIcon } from '@primer/octicons-react';
 import { contribution, definePlugin } from '@datalayer/reactor';
 import { LoopAgentBlueprint, LoopAgentGate, LoopCommand, LoopSlots, LoopViewType, } from '../../core';

package/lib/loop/plugins/chat/ChatView.js

@@ -36,6 +36,8 @@ import { CHAT_PLUGIN_NAME } from './index';
 import { INPUT_PROMPT_PLUGIN_NAME, } from '../input-prompt';
 import { agentRuntimeStore, useAgentRuntimeContextSnapshot, } from '../../../stores';
 import { useIAMStore } from '../../../state';
+import { useVisitorToken } from '../../apps/visitorToken';
+import { AGENTS_PLUGIN_NAME } from '../agents/plugin';
 import { useConfig } from '../../../hooks/useConfig';
 import { useSkills, useSkillActions } from '../../../hooks/useSkills';
 import { AI_MODEL_CATALOGUE, isChatModel } from '../../../specs/models';
@@ -1137,7 +1139,14 @@ export default function ChatView({ workspace }) {
      * chat says so with the person's token. The embed hands its own.
      */
     const runsApp = Boolean(blueprintTurn?.createPayload?.app_spec);
-    const iamToken = useIAMStore(state => state.token);
+    const memberToken = useIAMStore(state => state.token);
+    /*
+     * Without an account (LOOP R-30) the application runs on the visitors'
+     * runtime, which answers a visitor's token for it and nobody signed in.
+     */
+    const visitors = reactor.getConfig(AGENTS_PLUGIN_NAME)?.datalayerVisitors;
+    const visitor = useVisitorToken(visitors);
+    const iamToken = visitors ? visitor.token : memberToken;
     const protocol = useMemo(() => inPage
         ? browserProtocolConfig({
             agentId: member?.specId ?? agentId,

package/lib/loop/presets.d.ts

@@ -137,6 +137,8 @@ export type LoopPresetOptions = {
     datalayerAgentSpecId?: string;
     /** What the agent on that runtime is created with besides its spec — an `app_spec`. */
     datalayerCreatePayload?: Record<string, unknown>;
+    /** A conversation without an account, on the visitors' runtime (LOOP R-30). */
+    datalayerVisitors?: AgentsConfig['datalayerVisitors'];
     /** The target is the host's to fix, even with the agent control hidden. */
     targetFixed?: boolean;
     /** The theme the conversation wears, by name; the person's unless said. */

package/lib/loop/presets.js

@@ -52,7 +52,7 @@ import { LoopPageLayoutPlugin } from './plugins/page-layout';
  * be installed or signed into, and the switches a demonstration wants are off.
  */
 export function loopPlugins(options = {}) {
-    const { serverUrl, target = 'browser', defaultEditor: askedEditor, showViewSelector = true, hideChatHeader = false, chatHeaderButtons = false, promptPlacement, autoFocusPrompt = true, suggestionLabels = true, fullScreenTopOffset = 0, showAgentVariants = false, agentSummary = true, teamId, teamPicker = true, pageLayout = false, pageLayoutArrangement = 'page', pageLayoutTurnPanel = 'below', pageLayoutPrompt = 'docked', pageLayoutPromptAnchor = 'top', pageLayoutSize, pageLayoutTurnPanelFooter = 'full', localAgent, localAgentSpec, datalayerAgentSpecId, datalayerCreatePayload, targetFixed, themeVariant, themeOverrides, colorMode, presence, showTokenUsage, floatingPrompt = false, editorSelector = false, editors = true, conversation = true, graph = false, commandPalette = false, pluginsPanel = false, windowFrame = false, firstPromptHook, } = options;
+    const { serverUrl, target = 'browser', defaultEditor: askedEditor, showViewSelector = true, hideChatHeader = false, chatHeaderButtons = false, promptPlacement, autoFocusPrompt = true, suggestionLabels = true, fullScreenTopOffset = 0, showAgentVariants = false, agentSummary = true, teamId, teamPicker = true, pageLayout = false, pageLayoutArrangement = 'page', pageLayoutTurnPanel = 'below', pageLayoutPrompt = 'docked', pageLayoutPromptAnchor = 'top', pageLayoutSize, pageLayoutTurnPanelFooter = 'full', localAgent, localAgentSpec, datalayerAgentSpecId, datalayerCreatePayload, datalayerVisitors, targetFixed, themeVariant, themeOverrides, colorMode, presence, showTokenUsage, floatingPrompt = false, editorSelector = false, editors = true, conversation = true, graph = false, commandPalette = false, pluginsPanel = false, windowFrame = false, firstPromptHook, } = options;
     const defaultEditor = askedEditor ?? (editors ? 'notebook' : 'none');
     // A workspace without a conversation: the theme, the shell's points, and
     // the host's chrome; its view is a host's plugin's.
@@ -111,6 +111,7 @@ export function loopPlugins(options = {}) {
             target,
             datalayerAgentSpecId,
             datalayerCreatePayload,
+            datalayerVisitors,
             targetFixed,
             showAgentVariants,
             showAgentSummary: agentSummary,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@datalayer/agent-runtimes",
-    "version": "1.3.53",
+    "version": "1.3.54",
     "type": "module",
     "workspaces": [
         ".",
@@ -147,7 +147,7 @@
         "@datalayer/agent-teams": "^1.0.0",
         "@datalayer/core": "^1.2.14",
         "@datalayer/decks": "^1.0.4",
-        "@datalayer/icons-react": "^1.0.14",
+        "@datalayer/icons-react": "^1.0.16",
         "@datalayer/jupyter-lexical": "^2.0.18",
         "@datalayer/jupyter-react": "^2.0.18",
         "@datalayer/jupyter-server-nbmodel": "^0.2.8",