@fugood/buttress-server 2.25.5 → 2.25.7

package/lib/routes/agents.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Agent endpoints (EXPERIMENTAL).
+ *
+ *   GET  /agents                          configured agent names
+ *   POST /agents/:name/run                run a prompt; ?stream=1 for SSE events
+ *                                         (first a `session` event with the id,
+ *                                         then `agent` events, then result/error)
+ *   GET  /agents/:name/sessions           newest-first session summaries
+ *   GET  /agents/:name/sessions/:id       full transcript (pi messages)
+ *   POST /agents/:name/sessions/:id/abort abort the active run on a session
+ *
+ * Configured via [[agents]] tables. These endpoints double as the surface the
+ * `bricks-buttress agent` CLI (and future clients) consume.
+ *
+ * Auth mirrors the functions surface, not the open inference endpoints:
+ * agents execute local functions, so an unbound server rejects every call
+ * unless `[agents_options] allow_unauthenticated = true`. A bound server
+ * accepts workspace JWTs. The server's own ephemeral internal token (also
+ * written to the 0600 runtime file for same-host CLIs) is always accepted.
+ */
+import { type AgentsService } from '../agent/types';
+/**
+ * Slim pi agent events for the wire. `message_update` carries the FULL partial
+ * assistant message on every delta — per-token that would dwarf the payload —
+ * and tool results can be huge; clients that want the transcript fetch it
+ * from the sessions endpoint afterwards.
+ */
+export declare const slimAgentEvent: (event: any) => unknown;
+export declare function streamAgentRun(agents: AgentsService, name: string, body: {
+    prompt: string;
+    sessionId?: string;
+    fork?: boolean;
+}, signal: AbortSignal | undefined): AsyncGenerator<{
+    readonly event: string;
+    readonly data: string;
+}, void, unknown>;
+export default function factory(agents: AgentsService): import("../types").ButtressApp;

package/lib/routes/anthropic-messages.d.ts

@@ -11,7 +11,7 @@
  *
  * Note: This feature is experimental and may change in future versions.
  */
-import type { EventStream, Config } from '../types';
+import type { EventStream } from '../types';
 /**
  * Stream an Anthropic Messages SSE response from the backend stream.
  *
@@ -52,4 +52,4 @@ export declare function streamAnthropicMessage(completionStream: ReadableStream<
     readonly event: "message_stop";
     readonly data: string;
 }, void, unknown>;
-export default function factory({ global: globalConfig }: Config): import("../types").ButtressApp;
+export default function factory(): import("../types").ButtressApp;

package/lib/routes/index.d.ts

@@ -4,3 +4,4 @@ export { default as status } from './status';
 export { default as openaiCompatFactory } from './openai-compat';
 export { default as anthropicMessagesFactory } from './anthropic-messages';
 export { default as functionsFactory } from './functions';
+export { default as agentsFactory } from './agents';

package/lib/routes/openai-compat.d.ts

@@ -6,7 +6,7 @@
  *
  * Note: This feature is experimental and may change in future versions.
  */
-import type { EventStream, Config } from '../types';
+import type { EventStream } from '../types';
 /**
  * Stream an OpenAI-compatible chat completion (SSE) from the backend stream.
  * Mirrors collectChatCompletion (the non-streaming path).
@@ -14,4 +14,4 @@ import type { EventStream, Config } from '../types';
 export declare function streamChatCompletion(completionStream: ReadableStream<EventStream>, completionId: string, created: number, modelId: string, includeUsage: boolean): AsyncGenerator<{
     readonly data: string;
 }, void, unknown>;
-export default function factory({ global: globalConfig }: Config): import("../types").ButtressApp;
+export default function factory(): import("../types").ButtressApp;

package/lib/tui-7B7x6A08.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a as e,t}from"./client-BCBBen9i.mjs";import{Container as n,Editor as r,Loader as i,Markdown as a,ProcessTerminal as o,Text as s,TuiMainScreen as c}from"@earendil-works/pi-tui";const l=e=>t=>`\x1b[${e}m${t}\x1b[0m`,u=l(`2`),d=l(`1`),f=l(`36`),p=l(`33`),m=l(`31`),h=l(`32`),g=l(`35`),_={heading:e=>d(f(e)),link:f,linkUrl:e=>u(f(e)),code:p,codeBlock:p,codeBlockBorder:u,quote:u,quoteBorder:u,hr:u,listBullet:f,bold:d,italic:l(`3`),strikethrough:l(`9`),underline:l(`4`)},v={borderColor:u,selectList:{selectedPrefix:f,selectedText:d,description:u,scrollInfo:u,noMatch:u}},y=(e,t)=>e.length>t?`${e.slice(0,t)}…`:e;var b=class{tui;chat;thinking=null;thinkingBuffer=``;answer=null;answerBuffer=``;constructor(e,t){this.tui=e,this.chat=t}touch(){this.tui.requestRender()}appendThinking(e){this.thinking||(this.thinking=new s(``,0,0),this.chat.addChild(this.thinking)),this.thinkingBuffer+=e,this.thinking.setText(u(this.thinkingBuffer.trimEnd())),this.touch()}appendAnswer(e){this.answer||(this.answer=new a(``,0,0,_),this.chat.addChild(this.answer)),this.answerBuffer+=e,this.answer.setText(this.answerBuffer),this.touch()}addLine(e){this.answer=null,this.answerBuffer=``,this.chat.addChild(new s(e,0,0)),this.touch()}};const x=async({connection:a,agentName:l,sessionId:_,fork:x})=>{let S=new o,C=new c(S);S.setTitle(`buttress agent · ${l}`);let w=new n,T=new s(``,0,0),E=new r(C,v);C.addChild(w),C.addChild(T),C.addChild(E),C.setFocus(E);let D=_,O=x,k=null,A=null,j=e=>{T.setText(e),C.requestRender()},M=()=>{A||(A=new i(C,f,u,`thinking…`),w.addChild(A),C.requestRender())},N=()=>{A&&(w.removeChild(A),A=null,C.requestRender())},P=`${d(l)} ${u(`@ ${a.baseUrl}`)}`+(D?` ${u(`(${O?`forking`:`continuing`} ${D})`)}`:``);w.addChild(new s(P,0,0)),j(u(`Enter to send · /new fresh session · /exit or Ctrl+C to quit`));let F=async()=>{C.stop(),await S.drainInput().catch(()=>{}),process.exit(0)};C.addInputListener(e=>{if(e===``)return k?(k.abort(),k=null,{consume:!0}):(F(),{consume:!0})});let I=async n=>{w.addChild(new s(`${f(`>`)} ${n}`,0,0));let r=new b(C,w),i=D;k=new AbortController,M(),j(u(`running · Ctrl+C aborts this turn`));let o;try{o=await e(a,l,{prompt:n,sessionId:D??void 0,fork:O},{signal:k.signal,onFrame:({event:e,payload:t})=>{if(e===`session`&&t?.sessionId){t.sessionId!==D&&(D=t.sessionId,w.addChild(new s(u(`session ${D}`),0,0)));return}if(e!==`agent`)return;N();let n=t?.event;if(t?.type===`message_update`&&n)n.type===`thinking_delta`?r.appendThinking(n.delta??``):n.type===`text_delta`&&r.appendAnswer(n.delta??``);else if(t?.type===`tool_execution_start`){let e=JSON.stringify(t.args??{});r.addLine(`${p(`⚙ ${t.toolName}`)}${u(`(${y(e,120)})`)}`)}else t?.type===`tool_execution_end`?r.addLine(t.isError?m(`✗ ${t.toolName} failed`):u(`✓ ${t.toolName}`)):t?.type===`tool_emit`&&r.addLine(u(`  ${t.toolName} → ${t.event}`))}})}catch(e){o={kind:`error`,message:e?.message||String(e),sessionId:D}}if(N(),k=null,o.kind===`result`){let{result:e}=o;D=e.sessionId??D;let t=e.usage||{};w.addChild(new s(u(`— ${e.stopReason} · ${t.totalTurns??`?`} turn(s) · ${t.input??0} in / ${t.output??0} out · session ${D}`),0,0))}else o.kind===`aborted`?(D=o.sessionId??D,w.addChild(new s(p(`(aborted — session is continuable)`),0,0))):o.kind===`error`?(D=o.sessionId??D,w.addChild(new s(m(`Run failed: ${o.message}`),0,0))):w.addChild(new s(m(`Connection lost mid-run.`),0,0));t(i,D)&&(O=!1),j(u(`Enter to send · /new fresh session · /exit or Ctrl+C to quit`)),C.requestRender()};E.onSubmit=e=>{let t=e.trim();if(E.setText(``),t){if(k){j(p(`A turn is still running — Ctrl+C aborts it.`));return}if(t===`/exit`||t===`/quit`){F();return}if(t===`/new`){D=null,O=!1,w.addChild(new s(`${h(`•`)} ${u(`started a fresh session`)}`,0,0)),C.requestRender();return}if(t===`/session`){w.addChild(new s(u(D?`session ${D}`:`no session yet`),0,0)),C.requestRender();return}I(t)}},w.addChild(new s(u(g(`ready`)),0,0)),C.start(),await new Promise(()=>{})};export{x as runAgentTui};

package/lib/types.d.ts

@@ -53,6 +53,10 @@ export type GlobalConfig = {
         config?: Record<string, any>;
         cors_allowed_origins?: string | string[];
     };
+    /** `[[agents]]` tables; validated by `agent/config.ts` at startup. */
+    agents?: Record<string, any>[];
+    /** `[agents_options]`: sessions_dir, retention, max_depth, allow_unauthenticated. */
+    agents_options?: Record<string, any>;
 } & Record<string, any>;
 export type AutodiscoverConfig = {
     udp: {
@@ -135,6 +139,11 @@ export type ServerInfo = {
         enabled: boolean;
         count: number;
     };
+    /** Agent surface: a flag and a count, for the same ANNOUNCE-size reason. */
+    agents?: {
+        enabled: boolean;
+        count: number;
+    };
 };
 export type EventStream = {
     event: string;

package/lib/utils/cors.check.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/utils/cors.d.ts

@@ -0,0 +1,72 @@
+import type { Config } from '../types';
+/**
+ * The server's whole CORS policy, decided in one place, by path.
+ *
+ * Every surface used to install its own `@elysiajs/cors` plugin on its own
+ * router. That does not do what it looks like it does: the plugin works through
+ * an `onRequest` hook, which Elysia runs *before* routing and therefore applies
+ * app-wide regardless of the router it was mounted on, and the plugins' default
+ * response headers all merge into one map on the root app. The four policies
+ * ended up fighting over a single set of `Access-Control-*` headers, last
+ * writer winning:
+ *
+ *  - `/buttress/info` ran without an explicit `allowedHeaders`, which makes
+ *    @elysiajs/cors echo the request's own header names back. That answer
+ *    overwrote every other surface's allow-list, so `Content-Type` was missing
+ *    from it and any browser `POST /functions/<name>` with a JSON body failed
+ *    preflight — the symptom that surfaced this.
+ *  - With that route disabled the *last registered* plugin's header list won
+ *    instead, so `/anthropic-messages` was served `/functions`'s list and lost
+ *    `x-api-key` / `anthropic-version`.
+ *  - `handleOrigin` only ever sets `Access-Control-Allow-Origin` on a match and
+ *    never clears it on a miss, so an origin allow-listed for one surface stayed
+ *    reflected on the others — per-surface `cors_allowed_origins` meant nothing.
+ *
+ * Hence: one hook, one policy per request, chosen by path. A request that no
+ * policy owns gets no `Access-Control-*` headers at all.
+ *
+ * This is CORS only — it decides what a *browser* is willing to hand to script.
+ * It is not the access gate. `functionsAuthGuard` (cross-site `Origin` /
+ * `Sec-Fetch-Site` check) and `buttressAuthGuard` (workspace JWT) still run on
+ * every call and are what actually keeps callers out.
+ */
+export type CorsPolicy = {
+    /** Path the policy owns: this exact path, or anything below it. */
+    path: string;
+    /** `true` reflects whatever `Origin` asked. Only for surfaces with no secrets. */
+    origin: true | string | string[];
+    methods: string[];
+    allowedHeaders: string[];
+    /** Preflight cache lifetime, in seconds. */
+    maxAge: number;
+    /**
+     * Emit `Access-Control-Allow-Credentials`. Never combined with `origin: true`:
+     * reflecting an arbitrary origin *and* allowing credentials is the pairing
+     * that turns a public endpoint into a cross-site read primitive.
+     */
+    credentials: boolean;
+    /** Answer Chrome's Private Network Access opt-in when the client asks for it. */
+    privateNetwork?: boolean;
+};
+/**
+ * Build the policy table from config. The `enable*` flags mirror the conditions
+ * `startServer` mounts each router under, so a surface that isn't served never
+ * gets a CORS answer either.
+ */
+export declare const buildCorsPolicies: (config: Config, enabled?: {
+    openaiCompat?: boolean;
+    anthropicMessages?: boolean;
+    functions?: boolean;
+}) => CorsPolicy[];
+/**
+ * Install the policy table as the single writer of `Access-Control-*` headers.
+ *
+ * Preflights are answered from the hook rather than from `OPTIONS` routes: the
+ * hook runs before routing, so there is nothing to collide with a real route,
+ * and a preflight for an unmounted path simply falls through to a 404. A bare
+ * `OPTIONS` with no `Access-Control-Request-Method` is not a preflight and is
+ * left to routing.
+ */
+export declare const installCors: <T extends {
+    onRequest: (handler: any) => unknown;
+}>(app: T, policies: CorsPolicy[]) => T;

package/lib/utils/workspaceState.d.ts

@@ -11,9 +11,18 @@ export interface ServerKeyPair {
     privateKeyPkcs8: string;
     kid: string;
 }
+export interface BankBinding {
+    /** Public Data Bank API base URL, e.g. https://bank.bricks.tools */
+    endpoint: string;
+    spacename: string;
+    spacekey: string;
+    keyName?: string;
+    issuedAt?: string;
+}
 export interface WorkspaceState {
     workspace: WorkspaceBinding | null;
     serverKeyPair: ServerKeyPair | null;
+    bank: BankBinding | null;
 }
 export declare const resolveStateDir: () => string;
 export declare const resolveStatePath: () => string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fugood/buttress-server",
-  "version": "2.25.5",
+  "version": "2.25.7",
   "main": "lib/index.mjs",
   "types": "lib/index.d.ts",
   "type": "module",
@@ -19,7 +19,7 @@
   ],
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "build": "tsdown -c rolldown.config.js --config-loader native && tsc --noCheck --emitDeclarationOnly",
+    "build": "tsdown -c rolldown.config.js --config-loader native && tsc --noCheck --emitDeclarationOnly && cp ../buttress-backend-core/src/backends/mlx-bridge.py lib/mlx-bridge.py",
     "build:dist": "$npm_execpath scripts/build-distribution.js",
     "release": "$npm_execpath scripts/build-distribution.js",
     "release-beta": "$npm_execpath scripts/build-distribution.js --beta",
@@ -37,13 +37,16 @@
   ],
   "license": "MIT",
   "dependencies": {
+    "@earendil-works/pi-agent-core": "^0.85.0",
+    "@earendil-works/pi-ai": "0.85.0",
+    "@earendil-works/pi-tui": "^0.85.0",
     "@elysiajs/cors": "^1.1.1",
     "@elysiajs/node": "^1.4.2",
-    "@fugood/llama.node": "^1.8.0-rc.4",
-    "@fugood/whisper.node": "^1.1.1",
+    "@fugood/llama.node": "^1.8.0-rc.5",
+    "@fugood/whisper.node": "^1.1.3",
     "@huggingface/gguf": "^0.3.2",
     "@iarna/toml": "^3.0.0",
-    "@modelcontextprotocol/sdk": "^1.15.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "bytes": "^3.1.0",
     "chroma-js": "^2.1.2",
     "elysia": "^1.4.19",
@@ -69,5 +72,5 @@
     "tsdown": "^0.22.4",
     "typescript": "^7.0.2"
   },
-  "gitHead": "d58ebf08bbac8100493d91a00cf724f3b313de6b"
+  "gitHead": "984a440ed04862f12c65f3cf62bdc70a938fcdd6"
 }

package/public/status.html

@@ -610,6 +610,16 @@
           <span class="badge badge-info" id="functionsCount">0 functions</span>
         </div>
         <div id="functionsSummary"></div>
+        <div class="section" id="functionsDaemonsSection" style="display:none">
+          <div class="section-title collapsible" onclick="toggleSection(this)">Daemons</div>
+          <div class="collapsible-content" id="functionsDaemons"></div>
+        </div>
+        <div class="section" id="functionsDaemonHistorySection" style="display:none">
+          <div class="section-title collapsible" onclick="toggleSection(this)">Daemon Activity</div>
+          <div class="collapsible-content" id="functionsDaemonHistory">
+            <div class="empty-state">No daemon activity</div>
+          </div>
+        </div>
         <div class="section">
           <div class="section-title collapsible" onclick="toggleSection(this)">Call History</div>
           <div class="collapsible-content" id="functionsCallHistory">
@@ -1287,8 +1297,10 @@
       if (!fns.enabled) return
 
       const count = fns.count ?? 0
+      const daemonCount = fns.daemonCount ?? 0
       document.getElementById('functionsCount').textContent =
-        `${count} function${count !== 1 ? 's' : ''}`
+        `${count} function${count !== 1 ? 's' : ''}` +
+        (daemonCount > 0 ? ` · ${daemonCount} daemon${daemonCount !== 1 ? 's' : ''}` : '')
 
       const c = fns.counters || {}
       const summary = document.getElementById('functionsSummary')
@@ -1309,6 +1321,7 @@
                 </thead>
                 <tbody>
                   ${stat('Calls', c.calls?.total ?? 0, c.calls?.failed ? `${c.calls.failed} failed` : '')}
+                  ${stat('Daemon runs', c.daemons?.invocations ?? 0, c.daemons?.failed ? `${c.daemons.failed} failed` : '')}
                   ${stat('Uploads', `${c.uploads?.total ?? 0} (${formatBytes(c.uploads?.bytes ?? 0)})`, c.uploads?.failed ? `${c.uploads.failed} failed` : '')}
                   ${stat('Downloads', `${c.downloads?.total ?? 0} (${formatBytes(c.downloads?.bytes ?? 0)})`, c.downloads?.missed ? `${c.downloads.missed} missed` : '')}
                   ${stat('Auth checks', c.auth?.total ?? 0, c.auth?.denied ? `${c.auth.denied} denied` : '')}
@@ -1319,6 +1332,8 @@
         `
       })
 
+      renderFunctionsDaemons(fns.daemons || [], fns.history?.daemons || [])
+
       const history = fns.history || {}
       const statusBadge = i => i.success ?
         '<span class="badge badge-success">Success</span>' :
@@ -1362,6 +1377,67 @@
       ])
     }
 
+    // Live daemon state + recent daemon event invocations
+    function renderFunctionsDaemons(daemons, activity) {
+      const hasDaemons = daemons.length > 0
+      document.getElementById('functionsDaemonsSection').style.display = hasDaemons ? '' : 'none'
+      document.getElementById('functionsDaemonHistorySection').style.display =
+        hasDaemons || activity.length > 0 ? '' : 'none'
+
+      if (hasDaemons) {
+        const container = document.getElementById('functionsDaemons')
+        const stateBadge = d => d.state === 'running' ?
+          '<span class="badge badge-success">Running</span>' :
+          `<span class="badge badge-error">Error${d.error ? `: ${escapeHtml(d.error)}` : ''}</span>`
+        const bankBadge = d => {
+          if (!d.bankSubscriptions) return '-'
+          const cls = d.bank === 'connected' ? 'badge-success' :
+            d.bank === 'connecting' ? 'badge-info' : 'badge-warning'
+          return `<span class="badge ${cls}">${escapeHtml(d.bank || 'connecting')} (${d.bankSubscriptions})</span>`
+        }
+        withScrollPreserve(container, () => {
+          container.innerHTML = `
+            <div class="table-wrapper">
+              <div class="table-inner">
+                <table>
+                  <thead>
+                    <tr>
+                      <th>Daemon</th><th>State</th><th>Started</th><th>Timers</th>
+                      <th>Bank</th><th>Events</th><th>Runs</th>
+                    </tr>
+                  </thead>
+                  <tbody>
+                    ${daemons.map(d => `
+                      <tr>
+                        <td title="${escapeHtml(d.description || '')}">${escapeHtml(d.name)}</td>
+                        <td>${stateBadge(d)}</td>
+                        <td><span class="timestamp">${d.startedAt ? formatRelativeTime(d.startedAt) : '-'}</span></td>
+                        <td>${d.timers ?? 0}</td>
+                        <td>${bankBadge(d)}</td>
+                        <td>${d.listening ? '<span class="badge badge-info">listening</span>' : '-'}</td>
+                        <td>${d.counts?.runs ?? 0}${d.counts?.failed ? ` <span class="badge badge-error">${d.counts.failed} failed</span>` : ''}</td>
+                      </tr>
+                    `).join('')}
+                  </tbody>
+                </table>
+              </div>
+            </div>
+          `
+        })
+      }
+
+      renderHistory('functionsDaemonHistory', activity, [
+        { label: 'Time', render: i => `<span class="timestamp">${formatRelativeTime(i.timestamp)}</span>` },
+        { label: 'Daemon', render: i => escapeHtml(i.name) },
+        { label: 'Event', render: i => `<span class="badge badge-info">${escapeHtml(i.event || '-')}</span>` },
+        { label: 'Duration', render: i => `${(i.durationMs / 1000).toFixed(2)}s` },
+        { label: 'Status', render: i => i.success ?
+          '<span class="badge badge-success">Success</span>' :
+          `<span class="badge badge-error">Failed: ${escapeHtml(i.error || 'Unknown')}</span>`
+        },
+      ])
+    }
+
     // Fallback: Fetch status via HTTP polling
     let pollingInterval = null
 

package/public/lib/index.d.ts

@@ -1,27 +0,0 @@
-import type { AnyElysia } from "elysia";
-import * as backendCore from "@fugood/buttress-backend-core";
-import { AutodiscoverService } from "./autodiscover";
-import type { Config } from "./types";
-export { startModelDownload } from "@fugood/buttress-backend-core";
-export { processConfig } from "./utils/config";
-export declare const checkForUpdates: () => Promise<string | null>;
-export declare const compareVersions: (current: string, latest: string) => boolean;
-export declare const logUpdateMessage: (latestVersion: string) => void;
-export declare const checkAndNotifyUpdates: () => Promise<void>;
-export type Backend = typeof backendCore;
-export interface StartServerOptions {
-	backend?: Backend;
-	router?: AnyElysia;
-	config: Config;
-	enableOpenAICompat?: boolean;
-}
-export declare const createServer: ({ backend, router, config, enableOpenAICompat }: StartServerOptions) => Promise<{
-	app: AnyElysia;
-	config: Config;
-}>;
-export declare const startServer: ({ backend, router, config, enableOpenAICompat }: StartServerOptions) => Promise<{
-	app: AnyElysia;
-	port: number;
-	openaiEnabled: boolean;
-	autoDiscover: AutodiscoverService | null;
-}>;