@fungi.computer/oyster 0.6.0 → 0.8.0

package/dist/page/app-permissions.d.ts

@@ -0,0 +1,11 @@
+import { type AppPermissionsPort } from "../apps/permissions.js";
+/** The shared editor's host navigation guard, not an approval decision. */
+export type PermissionLeaveState = "clean" | "dirty" | "pending" | "uncertain";
+export type AppPermissionsViewProps = Readonly<{
+    port: AppPermissionsPort;
+    appKey: string;
+    onAccepted?: () => Promise<void>;
+    onStateChange?: (state: PermissionLeaveState) => void;
+}>;
+/** One editor; each App owns its draft and pending-request lifetime on reuse. */
+export declare function AppPermissionsView(props: AppPermissionsViewProps): import("react/jsx-runtime").JSX.Element;

package/dist/page/app-permissions.js

@@ -0,0 +1,296 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useId, useRef, useState } from "react";
+import { Button } from "@fungi.computer/caps/components/button";
+import { Card, CardContent } from "@fungi.computer/caps/components/card";
+import { Checkbox } from "@fungi.computer/caps/components/checkbox";
+import { DataList, DataRow } from "@fungi.computer/caps/components/data-list";
+import { Form, FormFooter } from "@fungi.computer/caps/components/field";
+import { IconCheckbox } from "@fungi.computer/caps/components/icon-checkbox";
+import { Status } from "@fungi.computer/caps/components/status";
+import { Display, ScreenCell, ScreenCells, } from "@fungi.computer/caps/components/surface";
+import { Sigil } from "@fungi.computer/sigils";
+import { permissionCatalog } from "../apps/catalog.js";
+import { draftOf, editPermissions, permissionScreen, planGrantChange, rebaseDraft, } from "../apps/permissions.js";
+/** One editor; each App owns its draft and pending-request lifetime on reuse. */
+export function AppPermissionsView(props) {
+    return _jsx(PermissionEditor, { ...props }, props.appKey);
+}
+function PermissionEditor({ port, appKey, onAccepted, onStateChange, }) {
+    const [view, setView] = useState(null);
+    const [draft, setDraft] = useState(new Map());
+    const [saving, setSaving] = useState(false);
+    const [uncertain, setUncertain] = useState(false);
+    const [retired, setRetired] = useState(false);
+    const [refreshNeeded, setRefreshNeeded] = useState(false);
+    const [message, setMessage] = useState(null);
+    const [loadError, setLoadError] = useState(false);
+    const [reload, setReload] = useState(0);
+    const mounted = useRef(true);
+    const legendId = useId();
+    const retire = useCallback(() => {
+        setRetired(true);
+        setUncertain(false);
+        setMessage("This App is no longer available. Reload before trying again.");
+    }, []);
+    useEffect(() => {
+        mounted.current = true;
+        let current = true;
+        setLoadError(false);
+        void port.read(appKey).then((next) => {
+            if (!current)
+                return;
+            if (next === "unavailable") {
+                retire();
+                return;
+            }
+            setView(next);
+            setDraft(draftOf(next.permissions.authority));
+        }, () => {
+            if (current)
+                setLoadError(true);
+        });
+        return () => {
+            current = false;
+            mounted.current = false;
+        };
+    }, [port, appKey, reload, retire]);
+    const changes = view === null ? [] : planGrantChange(view.permissions.authority, draft);
+    const leaveState = saving
+        ? "pending"
+        : retired
+            ? "clean"
+            : uncertain
+                ? "uncertain"
+                : changes.length > 0
+                    ? "dirty"
+                    : "clean";
+    useEffect(() => onStateChange?.(leaveState), [onStateChange, leaveState]);
+    async function refreshAfterAcceptance() {
+        try {
+            await onAccepted?.();
+            if (!mounted.current)
+                return;
+            setRefreshNeeded(false);
+            setMessage("Permissions saved.");
+        }
+        catch (cause) {
+            console.error("App permissions surrounding-screen refresh failed", cause);
+            if (!mounted.current)
+                return;
+            setRefreshNeeded(true);
+            setMessage("Permissions saved. The surrounding screen could not refresh.");
+        }
+    }
+    async function retryRefresh() {
+        setSaving(true);
+        try {
+            await refreshAfterAcceptance();
+        }
+        finally {
+            if (mounted.current)
+                setSaving(false);
+        }
+    }
+    async function save() {
+        const isMounted = () => mounted.current;
+        if (view === null || saving || retired || !view.canEdit)
+            return;
+        setSaving(true);
+        setRefreshNeeded(false);
+        setMessage(null);
+        try {
+            if (!uncertain) {
+                const result = await port.submit(appKey, {
+                    storeGeneration: view.storeGeneration,
+                    authorityVersion: view.permissions.authority.authorityVersion,
+                    artifactDigest: view.artifactDigest,
+                }, changes);
+                if (!isMounted())
+                    return;
+                if (result === "unavailable") {
+                    retire();
+                    return;
+                }
+                if (result === "unconfirmed") {
+                    setUncertain(true);
+                    setMessage("The change could not be confirmed. Review current permissions before trying again.");
+                    return;
+                }
+                if (result === "refused") {
+                    setMessage("This permission change was refused. No approval was confirmed.");
+                    return;
+                }
+                if (result === "accepted") {
+                    // A failed read after a successful write must not replay the old draft.
+                    setUncertain(true);
+                    const next = await port.read(appKey);
+                    if (!isMounted())
+                        return;
+                    if (next === "unavailable") {
+                        retire();
+                        return;
+                    }
+                    setView(next);
+                    setDraft(draftOf(next.permissions.authority));
+                    setUncertain(false);
+                    await refreshAfterAcceptance();
+                    return;
+                }
+            }
+            const next = await port.read(appKey);
+            if (!isMounted())
+                return;
+            if (next === "unavailable") {
+                retire();
+                return;
+            }
+            setView(next);
+            setDraft(rebaseDraft(draft, view.permissions.authority, next.permissions.authority));
+            setUncertain(false);
+            setMessage("Current permissions loaded. Review your edits before saving again.");
+        }
+        catch (cause) {
+            console.error("App permissions could not be confirmed", cause);
+            if (isMounted()) {
+                setUncertain(true);
+                setMessage("The change could not be confirmed. Review current permissions before trying again.");
+            }
+        }
+        finally {
+            if (isMounted())
+                setSaving(false);
+        }
+    }
+    if (loadError)
+        return (_jsxs("div", { role: "alert", children: ["Permissions could not be loaded.", _jsx(Button, { type: "button", onClick: () => {
+                        setReload((value) => value + 1);
+                    }, children: "Retry permissions" })] }));
+    if (view === null)
+        return _jsx("p", { role: "status", children: retired ? message : "Loading permissions…" });
+    const authority = {
+        ...view.permissions.authority,
+        approvedGrants: [...draft].flatMap(([capability, grant]) => grant === null
+            ? []
+            : [{ capability, capabilityApproved: true, ...grant }]),
+    };
+    const screen = permissionScreen({
+        ...view.permissions,
+        authority,
+        resources: view.resources,
+        canEdit: view.canEdit,
+    });
+    const baseline = permissionScreen({
+        ...view.permissions,
+        resources: view.resources,
+        canEdit: view.canEdit,
+    });
+    const disabled = !screen.canEdit || saving || uncertain || retired;
+    const edit = (change) => {
+        setDraft((current) => editPermissions(current, change, view.permissions.declaredOperations));
+    };
+    const shell = screen.groups
+        .flatMap((group) => group.switches)
+        .find((column) => column.capability === "team.workbenchHost");
+    const shellChanged = changes.some((change) => change.capability === "team.workbenchHost");
+    const groups = screen.groups.filter((group) => group.id !== "shell");
+    const pending = baseline.pending.filter((capability) => capability !== "team.workbenchHost");
+    return (_jsxs(Form, { style: { maxWidth: "46rem" }, onSubmit: (event) => {
+            event.preventDefault();
+            void save();
+        }, children: [!screen.canEdit && _jsx("p", { children: "Only an owner can change these permissions." }), pending.length > 0 && (_jsxs("p", { children: ["Needs approval:", " ", pending
+                        .map((capability) => permissionCatalog[capability].label)
+                        .join(", ")] })), shell !== undefined && (_jsx(ShellPermissionRow, { column: shell, changed: shellChanged, otherChanges: changes.length > 1, disabled: disabled, onToggle: () => {
+                    edit({
+                        kind: "switch",
+                        capability: "team.workbenchHost",
+                        on: !shell.on,
+                    });
+                }, onCancel: () => {
+                    setDraft((current) => new Map(current).set("team.workbenchHost", draftOf(view.permissions.authority).get("team.workbenchHost") ??
+                        null));
+                } })), groups.length > 0 && (_jsx(Display, { size: "sm", "aria-label": `${view.appName} permissions`, children: _jsx(ScreenCells, { appearance: "compact", children: groups.map((group) => (_jsxs("section", { "aria-label": `${group.id} permissions`, children: [_jsx("h3", { children: group.id }), group.rows.map((row) => (_jsx(ScreenCell, { appearance: "compact", icon: _jsx(Sigil, { name: group.scope === "computer" ? "computer" : "listAgents" }), legend: row.label, children: row.cells.map((cell) => {
+                                    const column = group.columns.find((item) => item.capability === cell.capability);
+                                    if (column === undefined)
+                                        return null;
+                                    return (_jsx(IconCheckbox, { appearance: "compact", icon: _jsx(Sigil, { name: column.sigil }), caption: column.caption, label: `${row.label}: ${column.label}`, "aria-describedby": `${legendId}-${cell.capability}`, checked: cell.state !== "off", disabled: disabled || cell.state === "via-all", onChange: (event) => {
+                                            edit(row.resource === "all"
+                                                ? {
+                                                    kind: "all",
+                                                    capability: cell.capability,
+                                                    on: event.target.checked,
+                                                }
+                                                : {
+                                                    kind: "resource",
+                                                    capability: cell.capability,
+                                                    resource: row.resource,
+                                                    on: event.target.checked,
+                                                });
+                                        } }, cell.capability));
+                                }) }, row.resource === "all"
+                                ? "all"
+                                : `${row.resource.kind}:${row.resource.id}`))), group.switches.map((column) => (_jsx(ScreenCell, { appearance: "compact", legend: column.label, children: _jsx(IconCheckbox, { appearance: "compact", icon: _jsx(Sigil, { name: column.sigil }), caption: column.caption, label: column.label, "aria-describedby": `${legendId}-${column.capability}`, checked: column.on, disabled: disabled ||
+                                        permissionCatalog[column.capability].consent ===
+                                            "affordance", onChange: (event) => {
+                                        edit({
+                                            kind: "switch",
+                                            capability: column.capability,
+                                            on: event.target.checked,
+                                        });
+                                    } }) }, column.capability))), group.operations.map((operation) => (_jsxs("label", { children: [_jsx(Checkbox, { checked: operation.on, disabled: disabled, onChange: (event) => {
+                                            edit({
+                                                kind: "operation",
+                                                capability: operation.capability,
+                                                operation: operation.operation,
+                                                on: event.target.checked,
+                                            });
+                                        } }), operation.operation] }, operation.operation))), _jsx("dl", { children: [...group.columns, ...group.switches].map((column) => (_jsxs("div", { id: `${legendId}-${column.capability}`, children: [_jsx("dt", { children: column.label }), _jsxs("dd", { children: [column.description, column.warning !== null && _jsx("p", { children: column.warning })] })] }, column.capability))) })] }, group.id))) }) })), screen.groups.length === 0 && _jsx("p", { children: "This App requests no permissions." }), message !== null && (_jsx("p", { role: "status", "aria-live": "polite", children: message })), ((groups.length > 0 && !shellChanged) || uncertain || refreshNeeded) && (_jsxs(FormFooter, { divider: false, children: [refreshNeeded && (_jsx(Button, { type: "button", size: "xs", variant: "outline", disabled: saving, onClick: () => void retryRefresh(), children: "Retry screen refresh" })), _jsx(Button, { type: "submit", size: "xs", variant: "outline", disabled: saving ||
+                            retired ||
+                            !screen.canEdit ||
+                            (!uncertain && changes.length === 0), children: saving
+                            ? "Saving…"
+                            : uncertain
+                                ? "Review current permissions"
+                                : "Save permissions" })] }))] }));
+}
+/** Shell is a single approval, not a resource/verb matrix. Confirmation still
+ * submits the editor's whole draft through its one atomic save. */
+function ShellPermissionRow({ column, changed, otherChanges, disabled, onToggle, onCancel, }) {
+    const { on } = column;
+    return (_jsx(Card, { variant: "outline", density: "compact", "aria-label": "Shell permissions", children: _jsxs(CardContent, { children: [_jsx(DataList, { density: "compact", children: _jsxs(DataRow, { style: {
+                            gridTemplateColumns: "20px minmax(0, 1fr) auto",
+                            alignItems: "center",
+                            gap: "var(--spacing-sm)",
+                            padding: 0,
+                            minHeight: 36,
+                        }, children: [_jsx(Sigil, { name: column.sigil, size: 20 }), _jsxs("div", { style: {
+                                    display: "flex",
+                                    alignItems: "baseline",
+                                    gap: "var(--spacing-sm)",
+                                    minWidth: 0,
+                                }, children: [_jsx("strong", { style: { whiteSpace: "nowrap", flexShrink: 0 }, children: column.label }), _jsx("span", { title: column.description, style: {
+                                            color: "var(--stipe-fg-muted)",
+                                            whiteSpace: "nowrap",
+                                            overflow: "hidden",
+                                            textOverflow: "ellipsis",
+                                        }, children: column.description })] }), _jsxs("div", { style: {
+                                    display: "flex",
+                                    alignItems: "center",
+                                    gap: "var(--spacing-sm)",
+                                }, children: [_jsx(Status, { size: "compact", glyph: "dot", tone: changed ? "warning" : on ? "success" : "neutral", "aria-label": changed
+                                            ? "Shell change not saved"
+                                            : on
+                                                ? "Shell allowed"
+                                                : "Shell not allowed" }), _jsx(Button, { type: "button", size: "xs", variant: changed || !on ? "outline" : "ghost-destructive", disabled: disabled, onClick: changed ? onCancel : onToggle, children: changed ? "Cancel" : on ? "Revoke" : "Allow" })] })] }) }), _jsx("p", { style: {
+                        margin: 0,
+                        color: "var(--stipe-fg-muted)",
+                        fontSize: "var(--text-sm)",
+                    }, children: column.warning }), changed && (_jsx(FormFooter, { divider: false, status: otherChanges
+                        ? "Save all permission edits, including Shell access?"
+                        : on
+                            ? "Allow Shell full access?"
+                            : "Revoke Shell access?", children: _jsx(Button, { type: "submit", size: "xs", variant: "outline", disabled: disabled, children: otherChanges
+                            ? "Save permissions"
+                            : on
+                                ? "Confirm allow"
+                                : "Confirm revoke" }) }))] }) }));
+}

package/dist/page/isolated-page-theme.d.ts

@@ -0,0 +1,2 @@
+/** Called once by an isolated page entry for its document's lifetime. */
+export declare function bootstrapIsolatedPageTheme(): void;

package/dist/page/isolated-page-theme.js

@@ -0,0 +1,11 @@
+/** Called once by an isolated page entry for its document's lifetime. */
+export function bootstrapIsolatedPageTheme() {
+    const appearance = matchMedia("(prefers-color-scheme: dark)");
+    const setTheme = () => {
+        document.documentElement.dataset.theme = appearance.matches
+            ? "mocha"
+            : "latte";
+    };
+    setTheme();
+    appearance.addEventListener("change", setTheme);
+}

package/dist/page/mount.d.ts

@@ -1,21 +1,10 @@
 import { type AppOpenInput, type AppRoleChoice } from "@fungi.computer/agar/apps";
+import { OysterAgentBrowserHost } from "./agent-browser.js";
+export type { OysterAgentBrowserHost } from "./agent-browser.js";
 import type { WhistleRuntime } from "@fungi.computer/whistle";
 import * as Schema from "effect/Schema";
-import { type CapabilityDirectory, type AgentSessionSelection } from "@fungi.computer/agar";
 import { type AppHost, type AppHostLaunch, type AppHostHandlers } from "@fungi.computer/agar/host";
 import type { WhistleJsonValue } from "@fungi.computer/whistle";
-/** One page-wide selected Session, using only its reporting App's admitted view. */
-export declare class OysterAgentBrowserHost {
-    #private;
-    /** End the selected connection with the page's own lifetime. */
-    constructor(signal: AbortSignal);
-    /** A departing or deselecting mount cannot close a different active mount. */
-    release(frame: HTMLIFrameElement): void;
-    /** Release the page's current selection; later reports cannot reconnect it. */
-    dispose(): void;
-    /** Bind the reporting mount's current command view to its explicitly selected Session. */
-    report(frame: HTMLIFrameElement, selection: AgentSessionSelection | null, capabilities: CapabilityDirectory, whistle: Pick<WhistleRuntime, "snapshot" | "execute">): Promise<void>;
-}
 /** Current server-admitted configuration for one installed App page. */
 export declare const oysterAppConfigSchema: Schema.Struct<{
     readonly workbench: Schema.Boolean;

package/dist/page/mount.js

@@ -6,8 +6,7 @@ import { createAppSurfaceCommandHost } from "@fungi.computer/nacre/command-host"
 // App page: mounts one installed App's sandboxed frame and gives it the
 // capabilities this Oyster host provides. Bundled into `shellScript`.
 import { RpcTarget, RpcStub } from "@fungi.computer/capnweb";
-import { EventSource } from "eventsource";
-import { connectBrowser, UiBrowserError, } from "@fungi.computer/knapsack/ui/browser";
+import { OysterAgentBrowserHost } from "./agent-browser.js";
 import { createPageLifetime } from "./lifetime.js";
 import { computerTargetUrl } from "../computer-target.js";
 import * as Schema from "effect/Schema";
@@ -17,7 +16,7 @@ import { approvals } from "@fungi.computer/agar/approvals";
 import { oysterStorageHandle } from "./storage.js";
 import { appBackend, appMethods } from "@fungi.computer/agar/backend";
 import { computerList, computerPorts, computerProcesses, computerReadFile, computerTerminal, computerWriteFile, } from "@fungi.computer/agar/computer";
-import { agentList, agentManage, agentSessionRead, agentSessionWrite, openAppAgent, } from "@fungi.computer/agar/agents";
+import { agentList, agentManage, agentSessionRead, agentSessionWrite, } from "@fungi.computer/agar/agents";
 import { mediaGeneration } from "@fungi.computer/agar/media";
 import { MediaGeneration, mediaGenerationDescriptionSchema, } from "@fungi.computer/agar/media-json";
 import { registeredCapabilityHandle, } from "./capabilities.js";
@@ -27,92 +26,6 @@ import { parseJsonValue } from "@fungi.computer/whistle/wire";
 import { appDeclaredCommandSchema } from "@fungi.computer/puffball/app";
 import { TerminalCapability } from "./terminal.js";
 import { ComputerPortsHandle, ComputerProcessesHandle, } from "./computer-handles.js";
-/** One page-wide selected Session, using only its reporting App's admitted view. */
-export class OysterAgentBrowserHost {
-    #active;
-    #disposed = false;
-    /** End the selected connection with the page's own lifetime. */
-    constructor(signal) {
-        if (signal.aborted)
-            this.dispose();
-        else
-            signal.addEventListener("abort", () => {
-                this.dispose();
-            }, { once: true });
-    }
-    /** A departing or deselecting mount cannot close a different active mount. */
-    release(frame) {
-        if (this.#active?.frame !== frame)
-            return;
-        const previous = this.#active;
-        this.#active = undefined;
-        previous.close();
-    }
-    /** Release the page's current selection; later reports cannot reconnect it. */
-    dispose() {
-        this.#disposed = true;
-        if (this.#active !== undefined)
-            this.release(this.#active.frame);
-    }
-    /** Bind the reporting mount's current command view to its explicitly selected Session. */
-    async report(frame, selection, capabilities, whistle) {
-        if (this.#disposed)
-            return;
-        if (selection === null) {
-            this.release(frame);
-            return;
-        }
-        if (this.#active !== undefined)
-            this.release(this.#active.frame);
-        // Read-only Apps may observe Sessions, but cannot claim or settle UI work.
-        if (!capabilities.has(agentSessionWrite) && !capabilities.has(agentManage))
-            return;
-        let transport;
-        let connection;
-        const failure = () => {
-            console.warn("Oyster Agent browser connection failed");
-        };
-        const active = {
-            frame,
-            close: () => {
-                connection?.close();
-                if (transport !== undefined)
-                    void transport.close().catch(failure);
-            },
-        };
-        this.#active = active;
-        try {
-            transport = await openAppAgent(capabilities, {
-                agentId: selection.agentId,
-            });
-            if (this.#active !== active) {
-                await transport.close();
-                return;
-            }
-            const admitted = transport;
-            connection = connectBrowser({
-                baseUrl: `${admitted.baseUrl}/browser/sessions/${encodeURIComponent(selection.sessionId)}`,
-                whistle,
-                transport: {
-                    fetch: admitted.fetch,
-                    openEvents: (url) => new EventSource(url, { fetch: admitted.fetch }),
-                },
-            });
-            void connection.closed.catch((cause) => {
-                if (this.#active === active)
-                    this.release(frame);
-                console.warn("Oyster Agent browser connection failed", cause instanceof UiBrowserError
-                    ? cause.message
-                    : "Transport unavailable");
-            });
-        }
-        catch (cause) {
-            if (this.#active === active)
-                this.release(frame);
-            throw cause;
-        }
-    }
-}
 function agentDirectory(capabilities) {
     const directory = createCapabilityRegistry();
     const read = capabilities.find(({ id, version }) => id === agentSessionRead.id && version === agentSessionRead.version);
@@ -345,9 +258,7 @@ export async function connectOysterApp(options) {
         throw new Error("App frame is unavailable");
     const capabilities = await oysterAppCapabilities(options);
     const agents = agentDirectory(capabilities);
-    const releaseBrowser = () => {
-        options.agentBrowser.release(frame);
-    };
+    const releaseBrowser = options.agentBrowser.mount(frame, options.agentCommands);
     options.signal.addEventListener("abort", releaseBrowser, { once: true });
     const host = await connectAppHost({
         appWindow: frame.contentWindow,
@@ -377,7 +288,7 @@ export async function connectOysterApp(options) {
         handlers: {
             ...options.handlers,
             reportAgentSessionSelection: async (selection) => {
-                await options.agentBrowser.report(frame, selection, agents, options.agentCommands);
+                await options.agentBrowser.report(frame, selection, agents);
                 await options.handlers.reportAgentSessionSelection(selection);
             },
             onDisconnect: async () => {
@@ -390,6 +301,9 @@ export async function connectOysterApp(options) {
                 signal: options.signal,
             }),
         },
+    }).catch((cause) => {
+        releaseBrowser();
+        throw cause;
     });
     if (options.signal.aborted)
         host.dispose();

package/dist/page-script.d.ts

@@ -1,9 +1,6 @@
 /** The bundled App page script; the host serves it at a content-hashed path. */
 export declare const pageScript: string;
 
-/** The bundled public read-only launcher served at a content-hashed path. */
-export declare const publicHomeScript: string;
-
 /** Shared host fonts, served once as a digest-pinned stylesheet. */
 export declare const fontStyles: string;