@fitchmultz/pi-subagents 0.49.1 → 0.50.0

package/src/pi-intercom/bridge-config.ts

@@ -1,10 +1,8 @@
-import { realpathSync, statSync } from "node:fs";
 import { isAbsolute } from "node:path";
 import { createSecureContext } from "node:tls";
 import { parseEnv } from "node:util";
 import { isUnknownArray } from "../shared/unknown.ts";
-import { BODY_LIMIT, object, label, fingerprint } from "./bridge-protocol.ts";
-import { launchPolicy, type LaunchPolicy } from "./bridge-launch-policy.ts";
+import { BODY_LIMIT, object, label, fingerprint, log } from "./bridge-protocol.ts";
 import { stateDirectory } from "./bridge-storage.ts";
 import { readBridgeFile } from "./bridge-files.ts";
 
@@ -41,7 +39,6 @@ export interface Identity {
   readonly fingerprint256: string;
   readonly name: string;
   readonly cwd: string;
-  readonly launch?: LaunchPolicy;
   readonly wake?: WakePolicy;
 }
 export interface Config {
@@ -60,30 +57,35 @@ function identities(value: unknown): Map<string, Identity> {
   }
   const clients = new Map<string, Identity>();
   const names = new Set<string>();
+  let retiredLaunch = false;
   for (const raw of value) {
-    const entry = object(raw, ["fingerprint256", "name", "cwd", "launch", "wake"]);
+    const entry = object(raw, ["fingerprint256", "name", "cwd", "wake", "launch"]);
+    retiredLaunch ||= Object.hasOwn(entry, "launch");
     const fingerprint256 = fingerprint(entry.fingerprint256);
     const name = label(entry.name, "name", 128).trim();
     const cwd = label(entry.cwd, "cwd", 4096);
     if (!isAbsolute(cwd)) {
       throw new Error("Client cwd must be absolute.");
     }
-    const launch = launchPolicy(entry.launch);
-    if (launch && !statSync(cwd).isDirectory()) {
-      throw new Error("Launch cwd must be an existing directory.");
-    }
+
     if (clients.has(fingerprint256) || names.has(name.toLowerCase())) {
       throw new Error("Client fingerprints and names must be unique.");
     }
     clients.set(fingerprint256, {
       fingerprint256,
       name,
-      cwd: launch ? realpathSync(cwd) : cwd,
-      launch,
+      cwd,
       wake: wakePolicy(entry.wake),
     });
     names.add(name.toLowerCase());
   }
+  if (retiredLaunch) {
+    log("deprecated_config_field", {
+      field: "clients[].launch",
+      action: "ignored",
+      note: "Remote launch is retired. Remove this field when convenient; no launch permission is granted.",
+    });
+  }
   return clients;
 }
 
@@ -94,19 +96,6 @@ function configInput(path: string): Record<string, unknown> {
   return object(raw, ["port", "ca", "cert", "key", "clients", "stateDir"]);
 }
 
-/** Recipient admission reads private policy and the public CA, never the server key. */
-export function loadControlPolicy(path: string): {
-  readonly clients: ReadonlyMap<string, Identity>;
-  readonly ca: Buffer;
-} {
-  const input = configInput(path);
-  const ca = label(input.ca, "ca path", 4096);
-  if (!isAbsolute(ca)) {
-    throw new Error("CA path must be absolute.");
-  }
-  return { clients: identities(input.clients), ca: readBridgeFile(ca, false, 1024 * 1024) };
-}
-
 export function loadConfig(path: string): Config {
   const input = configInput(path);
   const port = input.port === undefined ? 9443 : input.port;

package/src/pi-intercom/bridge-http.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { BODY_LIMIT, Fault, BroadcastFault } from "./bridge-protocol.ts";
+import { BODY_LIMIT, Fault } from "./bridge-protocol.ts";
 import { errorMessage, type UnknownRecord } from "../shared/unknown.ts";
 
 export interface RequestContext {
@@ -105,7 +105,6 @@ export function reply(
 export function replyFault(res: ServerResponse, requestId: string, fault: Fault): void {
   reply(res, requestId, fault.status, {
     ok: false,
-    ...(fault instanceof BroadcastFault ? fault.outcome : {}),
     error: { code: fault.code, message: fault.message, ...fault.details },
   });
 }

package/src/pi-intercom/bridge-mailbox.ts

@@ -1,8 +1,7 @@
 import type { DatabaseSync } from "node:sqlite";
 import { privateDatabase } from "./bridge-storage.ts";
 import { isRecord, type UnknownRecord } from "../shared/unknown.ts";
-import { normalizeMessage, normalizeSessionInfo } from "./types.ts";
-import type { Envelope } from "./bridge-ask.ts";
+import { normalizeMessage, normalizeSessionInfo, type Message, type SessionInfo } from "./types.ts";
 import {
   Fault,
   INBOX_BYTES,
@@ -10,6 +9,11 @@ import {
   fingerprint as certificateFingerprint,
 } from "./bridge-protocol.ts";
 
+export interface Envelope {
+  readonly from: SessionInfo;
+  readonly message: Message;
+}
+
 interface Entry extends Envelope {
   readonly sequence: number;
   readonly bytes: number;
@@ -192,19 +196,15 @@ export class Mailbox {
   }
   ack(ids: readonly string[]): UnknownRecord {
     const acked: string[] = [];
-    const retained: string[] = [];
     for (const id of ids) {
       const entry = this.get(id);
-      if (entry?.message.expectsReply === true) {
-        // Durable consumer intake owns the primary wake; keep only the reply obligation here.
+      if (entry) {
         this.notificationAccepted(id);
-        retained.push(id);
-      } else if (entry) {
         this.remove(id);
         acked.push(id);
       }
     }
-    return { acked, retained };
+    return { acked };
   }
   page(after: number, limit: number): InboxPage {
     return this.readPage(after, limit, false);

package/src/pi-intercom/bridge-protocol.ts

@@ -1,7 +1,6 @@
 import { errorMessage, isRecord, type UnknownRecord } from "../shared/unknown.ts";
 
 export const BODY_LIMIT = 64 * 1024;
-export const ASK_TIMEOUT = 120000;
 export const INBOX_COUNT = 256;
 export const INBOX_BYTES = 4 * 1024 * 1024;
 
@@ -17,20 +16,17 @@ export class Fault extends Error {
   }
 }
 
-export class BroadcastFault extends Fault {
-  readonly outcome: UnknownRecord;
-  constructor(fault: Fault, outcome: UnknownRecord) {
-    super(fault.status, fault.code, fault.message, fault.details);
-    this.outcome = { ...outcome, status: "partial" };
-  }
-}
-
 export function object(value: unknown, fields: readonly string[]): UnknownRecord {
   if (!isRecord(value)) {
     throw new Fault(400, "invalid_input", "Expected a JSON object.");
   }
-  if (Object.keys(value).some((key) => !fields.includes(key))) {
-    throw new Fault(400, "invalid_input", "Unknown field.");
+  const unknown = Object.keys(value).find((key) => !fields.includes(key));
+  if (unknown !== undefined) {
+    throw new Fault(
+      400,
+      "invalid_input",
+      `Unknown field ${JSON.stringify(label(unknown, "field name", 128))}.`,
+    );
   }
   return value;
 }

package/src/pi-intercom/bridge-routes.ts

@@ -1,13 +1,9 @@
 import type { IncomingMessage } from "node:http";
 import { isUnknownArray } from "../shared/unknown.ts";
-import { ASK_TIMEOUT, Fault, INBOX_COUNT, label, object, text } from "./bridge-protocol.ts";
+import { Fault, INBOX_COUNT, label, object, text } from "./bridge-protocol.ts";
 import { body } from "./bridge-http.ts";
-import type { CatalogQuery } from "./bridge-catalog.ts";
-import { groupDefinition, type GroupDefinition } from "./bridge-groups.ts";
-import { isControlVerb, type NativeControlVerb } from "./native-control-protocol.ts";
-import { transcriptOptions, type TranscriptOptions } from "./transcript.ts";
 
-export type MessagingOperation =
+export type Operation =
   | { readonly route: "GET /v1/list" | "POST /v1/register" }
   | {
       readonly route: "GET /v1/inbox";
@@ -22,84 +18,16 @@ export type MessagingOperation =
       readonly message: string;
       readonly passive?: boolean;
       readonly messageId?: string;
-    }
-  | {
-      readonly route: "POST /v1/ask";
-      readonly to: string;
-      readonly message: string;
-      readonly timeoutMs: number;
-    }
-  | { readonly route: "POST /v1/reply"; readonly replyTo: string; readonly message: string };
-export type Operation =
-  | MessagingOperation
-  | { readonly route: "GET /v1/sessions"; readonly query?: CatalogQuery }
-  | { readonly route: "POST /v1/start"; readonly name: string }
-  | {
-      readonly route: "POST /v1/spawn";
-      readonly name: string;
-      readonly cwd?: string;
-      readonly provider?: string;
-      readonly model?: string;
-      readonly task?: string;
-    }
-  | {
-      readonly route: "POST /v1/resume";
-      readonly sessionId?: string;
-      readonly target?: string;
-      readonly name?: string;
-      readonly task?: string;
-    }
-  | {
-      readonly route: "POST /v1/stop" | "POST /v1/cancel";
-      readonly sessionId: string;
-      readonly timeoutMs: number;
-    }
-  | { readonly route: "GET /v1/groups" }
-  | { readonly route: "POST /v1/groups"; readonly group: GroupDefinition }
-  | { readonly route: "POST /v1/broadcast"; readonly message: string; readonly group?: string }
-  | {
-      readonly route: "POST /v1/control";
-      readonly to: string;
-      readonly verb: NativeControlVerb;
-      readonly options?: TranscriptOptions;
-      readonly timeoutMs: number;
-    }
-  | {
-      readonly route: "GET /v1/transcript";
-      readonly target: string;
-      readonly options: TranscriptOptions;
-      readonly timeoutMs: number;
+      readonly replyTo?: string;
+      readonly expectsReply?: boolean;
     };
-type Route = Operation["route"] | "POST /v1/transcript" | "POST /v1/capabilities";
-type MessagingRoute =
-  | MessagingOperation["route"]
-  | "GET /v1/groups"
-  | "GET /v1/sessions"
-  | "GET /v1/transcript"
-  | "POST /v1/control"
-  | "POST /v1/transcript"
-  | "POST /v1/capabilities";
+type Route = Operation["route"];
 const fields = {
   "GET /v1/list": [],
   "GET /v1/inbox": [],
   "POST /v1/register": [],
   "POST /v1/ack": ["ids"],
-  "POST /v1/send": ["to", "message", "passive", "messageId"],
-  "POST /v1/ask": ["to", "message", "timeoutMs"],
-  "POST /v1/reply": ["replyTo", "message"],
-  "POST /v1/start": ["name"],
-  "POST /v1/spawn": ["name", "cwd", "task", "provider", "model"],
-  "POST /v1/resume": ["sessionId", "name", "target", "task"],
-  "GET /v1/sessions": [],
-  "POST /v1/stop": ["sessionId", "target", "to", "mode", "timeoutMs"],
-  "POST /v1/cancel": ["sessionId", "target", "to", "timeoutMs"],
-  "GET /v1/groups": [],
-  "POST /v1/groups": ["name", "members", "namePattern", "cwdPattern", "match"],
-  "POST /v1/broadcast": ["message", "group"],
-  "POST /v1/control": ["to", "verb", "options", "timeoutMs"],
-  "POST /v1/capabilities": ["to", "timeoutMs"],
-  "POST /v1/transcript": ["to", "limit", "maxBytes", "cursor", "timeoutMs"],
-  "GET /v1/transcript": ["target", "limit", "maxBytes", "cursor", "timeoutMs"],
+  "POST /v1/send": ["to", "message", "passive", "messageId", "replyTo", "expectsReply"],
 };
 function isRoute(route: string): route is Route {
   return Object.hasOwn(fields, route);
@@ -115,15 +43,8 @@ export function routeFor(req: IncomingMessage): Route {
   if (!isRoute(route)) {
     throw new Fault(404, "not_found", "Unknown method or path.");
   }
-  if (
-    req.url?.includes("?") === true &&
-    !["GET /v1/inbox", "GET /v1/sessions", "GET /v1/transcript"].includes(route)
-  ) {
-    throw new Fault(
-      400,
-      "invalid_input",
-      "Query parameters are only supported for inbox, sessions and transcript.",
-    );
+  if (req.url?.includes("?") === true && route !== "GET /v1/inbox") {
+    throw new Fault(400, "invalid_input", "Query parameters are only supported for inbox.");
   }
   checkGetBody(req);
   return route;
@@ -137,15 +58,19 @@ function checkGetBody(req: IncomingMessage): void {
     throw new Fault(400, "invalid_input", "GET requests must not have a body.");
   }
 }
-function queryFor(req: IncomingMessage, allowed: readonly string[]): URLSearchParams {
+function queryFor(req: IncomingMessage): URLSearchParams {
   const query = new URL(req.url ?? "", "https://127.0.0.1").searchParams;
-  if ([...query.keys()].some((key) => !allowed.includes(key) || query.getAll(key).length !== 1)) {
+  if (
+    [...query.keys()].some(
+      (key) => !["after", "limit", "waitMs"].includes(key) || query.getAll(key).length !== 1,
+    )
+  ) {
     throw new Fault(400, "invalid_input", "Unknown or repeated query parameter.");
   }
   return query;
 }
 function inboxQuery(req: IncomingMessage): Extract<Operation, { readonly route: "GET /v1/inbox" }> {
-  const query = queryFor(req, ["after", "limit", "waitMs"]);
+  const query = queryFor(req);
   const after = query.get("after") ?? "0";
   const limit = query.get("limit") ?? String(INBOX_COUNT);
   const waitMs = query.get("waitMs") ?? "0";
@@ -169,137 +94,18 @@ function inboxQuery(req: IncomingMessage): Extract<Operation, { readonly route:
     waitMs: Number(waitMs),
   };
 }
-function pageNumber(value: string | null, fallback: number, min: number, max: number): number {
-  const number = value === null ? fallback : Number(value);
-  if (value === "" || !Number.isSafeInteger(number) || number < min || number > max) {
-    throw new Fault(400, "invalid_input", "Invalid catalog pagination.");
-  }
-  return number;
-}
-function queryBoolean(value: string | null): boolean {
-  if (value !== null && value !== "true" && value !== "false") {
-    throw new Fault(400, "invalid_input", "Catalog switches must be true or false.");
-  }
-  return value === "true";
-}
-function catalogQuery(req: IncomingMessage): CatalogQuery | undefined {
-  if (req.url?.includes("?") !== true) {
-    return undefined;
-  }
-  const params = queryFor(req, ["live", "saved", "q", "offset", "limit"]);
-  return {
-    live: queryBoolean(params.get("live")),
-    saved: queryBoolean(params.get("saved")),
-    q: params.has("q") ? label(params.get("q"), "catalog filter", 128) : undefined,
-    offset: pageNumber(params.get("offset"), 0, 0, Number.MAX_SAFE_INTEGER),
-    limit: pageNumber(params.get("limit"), 50, 1, 100),
-  };
-}
-function timeout(value: unknown, control = false): number {
-  const defaultMs = control ? 3000 : ASK_TIMEOUT;
-  const ms = value === undefined ? defaultMs : value;
-  const max = control ? 10000 : ASK_TIMEOUT;
-  if (typeof ms !== "number" || !Number.isInteger(ms) || ms < 100 || ms > max) {
-    throw new Fault(400, "invalid_input", `timeoutMs must be an integer from 100 to ${max}.`);
-  }
-  return ms;
-}
-function resume(
-  input: Readonly<Record<string, unknown>>,
-): Extract<Operation, { readonly route: "POST /v1/resume" }> {
-  if (["sessionId", "name", "target"].filter((key) => input[key] !== undefined).length !== 1) {
-    throw new Fault(
-      400,
-      "invalid_input",
-      "Resume requires exactly one of sessionId, name or target.",
-    );
-  }
-  const sessionId =
-    input.sessionId === undefined ? undefined : label(input.sessionId, "native session ID", 128);
-  if (sessionId !== undefined && !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(sessionId)) {
-    throw new Fault(400, "invalid_input", "Resume takes a native ID, never a journal path.");
-  }
-  return {
-    route: "POST /v1/resume",
-    sessionId,
-    target:
-      input.target === undefined ? undefined : label(input.target, "resume target", 256).trim(),
-    name:
-      input.name === undefined ? undefined : label(input.name, "saved session name", 256).trim(),
-    task: input.task === undefined ? undefined : text(input.task),
-  };
-}
-function stop(
-  route: "POST /v1/stop" | "POST /v1/cancel",
-  input: Readonly<Record<string, unknown>>,
-): Extract<Operation, { readonly route: "POST /v1/stop" | "POST /v1/cancel" }> {
-  if (["sessionId", "target", "to"].filter((key) => input[key] !== undefined).length !== 1) {
-    throw new Fault(400, "invalid_input", "Control requires exactly one sessionId, target or to.");
-  }
-  const mode = input.mode ?? "kill";
-  if (mode !== "kill" && mode !== "cancel") {
-    throw new Fault(400, "invalid_input", "Stop mode must be cancel or kill.");
-  }
-  return {
-    route: mode === "cancel" ? "POST /v1/cancel" : route,
-    sessionId: label(input.sessionId ?? input.target ?? input.to, "session target", 256).trim(),
-    timeoutMs: timeout(input.timeoutMs, true),
-  };
-}
-function nativeControl(
-  route: Route,
-  input: Readonly<Record<string, unknown>>,
-): Extract<Operation, { readonly route: "POST /v1/control" | "GET /v1/transcript" }> {
-  const verb = route === "POST /v1/control" ? input.verb : route.split("/").at(-1);
-  if (!isControlVerb(verb)) {
-    throw new Fault(400, "invalid_input", "Unknown native control verb.");
-  }
-  const timeoutMs = timeout(input.timeoutMs, true);
-  const to = label(input.to ?? input.target, "session target").trim();
-  if (verb === "transcript") {
-    const options = transcriptOptions(
-      route === "POST /v1/control"
-        ? input.options
-        : { limit: input.limit, maxBytes: input.maxBytes, cursor: input.cursor },
-    );
-    return { route: "GET /v1/transcript", target: to, options, timeoutMs };
-  }
-  if (input.options !== undefined) {
-    throw new Fault(400, "invalid_input", "Only transcript accepts options.");
-  }
-  return { route: "POST /v1/control", verb, to, timeoutMs };
-}
-async function operationInput(
+export async function operationFor(
   req: IncomingMessage,
   route: Route,
   signal: AbortSignal,
-): Promise<Record<string, unknown>> {
-  if (req.method === "POST") {
-    return object(await body(req, signal), fields[route]);
-  }
-  if (route !== "GET /v1/transcript") {
-    return {};
-  }
-  const input: Record<string, unknown> = {};
-  for (const [key, value] of queryFor(req, fields[route])) {
-    input[key] = ["limit", "maxBytes", "timeoutMs"].includes(key) ? Number(value) : value;
-  }
-  return input;
-}
-function messagingOperation(
-  route: MessagingRoute,
-  input: Readonly<Record<string, unknown>>,
-  req: IncomingMessage,
-): Operation {
+): Promise<Operation> {
+  const input = req.method === "POST" ? object(await body(req, signal), fields[route]) : {};
   switch (route) {
     case "GET /v1/list":
     case "POST /v1/register":
-    case "GET /v1/groups":
       return { route };
     case "GET /v1/inbox":
       return inboxQuery(req);
-    case "GET /v1/sessions":
-      return { route, query: catalogQuery(req) };
     case "POST /v1/ack":
       if (!isUnknownArray(input.ids) || input.ids.length > INBOX_COUNT) {
         throw new Fault(400, "invalid_input", "ids must be an array of at most 256 message IDs.");
@@ -307,78 +113,24 @@ function messagingOperation(
       return { route, ids: [...new Set(input.ids.map((id) => label(id, "message ID")))] };
     case "POST /v1/send":
       return send(input);
-    case "POST /v1/ask":
-      return {
-        route,
-        message: text(input.message),
-        to: label(input.to, "to").trim(),
-        timeoutMs: timeout(input.timeoutMs),
-      };
-    case "POST /v1/reply":
-      return { route, message: text(input.message), replyTo: label(input.replyTo, "replyTo") };
-    case "GET /v1/transcript":
-    case "POST /v1/control":
-    case "POST /v1/transcript":
-    case "POST /v1/capabilities":
-      return nativeControl(route, input);
   }
 }
-function send(input: Readonly<Record<string, unknown>>): MessagingOperation {
-  if (input.passive !== undefined && typeof input.passive !== "boolean") {
-    throw new Fault(400, "invalid_input", "passive must be a boolean.");
+function send(
+  input: Readonly<Record<string, unknown>>,
+): Extract<Operation, { readonly route: "POST /v1/send" }> {
+  if (
+    (input.passive !== undefined && typeof input.passive !== "boolean") ||
+    (input.expectsReply !== undefined && typeof input.expectsReply !== "boolean")
+  ) {
+    throw new Fault(400, "invalid_input", "passive and expectsReply must be booleans.");
   }
   return {
     route: "POST /v1/send",
-    message: text(input.message),
     to: label(input.to, "to").trim(),
+    message: text(input.message),
     passive: input.passive,
     messageId: input.messageId === undefined ? undefined : label(input.messageId, "message ID"),
+    replyTo: input.replyTo === undefined ? undefined : label(input.replyTo, "replyTo"),
+    expectsReply: input.expectsReply,
   };
 }
-export async function operationFor(
-  req: IncomingMessage,
-  route: Route,
-  signal: AbortSignal,
-): Promise<Operation> {
-  const input = await operationInput(req, route, signal);
-  switch (route) {
-    case "POST /v1/start":
-      return { route, name: label(input.name, "session name", 64).trim() };
-    case "POST /v1/spawn":
-      return {
-        route,
-        name: label(input.name, "session name", 64).trim(),
-        cwd: input.cwd === undefined ? undefined : label(input.cwd, "cwd", 4096),
-        provider: input.provider === undefined ? undefined : label(input.provider, "provider", 128),
-        model: input.model === undefined ? undefined : label(input.model, "model reference", 512),
-        task: input.task === undefined ? undefined : text(input.task),
-      };
-    case "POST /v1/resume":
-      return resume(input);
-    case "POST /v1/stop":
-    case "POST /v1/cancel":
-      return stop(route, input);
-    case "POST /v1/groups":
-      return { route, group: groupDefinition(input) };
-    case "POST /v1/broadcast":
-      return {
-        route,
-        message: text(input.message),
-        group: input.group === undefined ? undefined : label(input.group, "group", 64).trim(),
-      };
-    case "GET /v1/groups":
-    case "GET /v1/inbox":
-    case "GET /v1/list":
-    case "GET /v1/sessions":
-    case "GET /v1/transcript":
-    case "POST /v1/ack":
-    case "POST /v1/ask":
-    case "POST /v1/capabilities":
-    case "POST /v1/control":
-    case "POST /v1/register":
-    case "POST /v1/reply":
-    case "POST /v1/send":
-    case "POST /v1/transcript":
-      return messagingOperation(route, input, req);
-  }
-}