@geminixiang/mikan 1.0.0-beta.35 → 1.0.0-beta.37

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AASjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { execFile } from \"child_process\";\nimport { promisify } from \"util\";\nimport type {\n  ImmediateEventPayload,\n  OneShotEventPayload,\n  PeriodicEventPayload,\n} from \"./harness/event-format.js\";\nimport type { ExtensionBlockAction } from \"./harness/extensions/types.js\";\nimport type { SubagentRunStatus } from \"./harness/types.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\n// ── adapter ───────────────────────────────────────────────────────────────────\n\nexport type ConversationKind = \"direct\" | \"shared\";\n\nexport type PlatformName = \"slack\" | \"discord\" | \"telegram\" | \"github\";\n\n/** Canonical platform-plus-raw identifier for one conversation office. */\nexport interface OfficeAddress {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n}\n\n/** Stable, filesystem-safe identity derived from an OfficeAddress. */\nexport type OfficeKey = string & { readonly __brand: \"OfficeKey\" };\n\nexport type OfficeMigrationStatus = \"needs-owner\" | \"prepared\" | \"moving\" | \"committed\" | \"failed\";\n\nexport interface OfficeMigrationRecord {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n  readonly targetDir?: string;\n  readonly status: OfficeMigrationStatus;\n  readonly error?: string;\n  readonly updatedAt: string;\n}\n\n/**\n * Directory entry for one conversation office. The workspace dir name stops\n * carrying the raw platform id once the ADR 0005 layout migration lands, so\n * the registry is the durable raw-id ↔ office mapping used for enumeration.\n */\nexport interface OfficeRecord {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n  readonly recordedAt: string;\n}\n\nexport interface OfficeRegistryState {\n  readonly version: 1;\n  readonly enabledPlatforms: readonly PlatformName[];\n  readonly offices: readonly OfficeRecord[];\n  readonly migrations: readonly OfficeMigrationRecord[];\n}\n\nexport interface OfficeMigrationPreparation {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n}\n\n/**\n * Who can drive conversations on a platform — gates ambient credential policy.\n *\n * - `membership`: only invited workspace/server members (Slack/Discord/Telegram).\n *   Safe to copy `sandbox.defaultSharedVault` into new conversation vaults.\n * - `open-trigger`: broader trigger surface (e.g. GitHub repo writers on public\n *   issues/PRs). Ambient shared vault must not apply; use host-side platform\n *   identity or an explicitly provisioned vault.\n */\nexport type PlatformTrustModel = \"membership\" | \"open-trigger\";\n\nexport interface ConversationMessage {\n  id: string;\n  /** Canonical identity of the conversation office. */\n  address: OfficeAddress;\n  /** @deprecated Use address.conversationId except at platform I/O seams. */\n  conversationId?: string;\n  sessionKey: string;\n  conversationKind: ConversationKind;\n  userId: string;\n  userName?: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  threadTs?: string;\n}\n\nexport interface ChatToolResult {\n  toolName: string;\n  label?: string;\n  args?: Record<string, unknown>;\n  result: string;\n  isError: boolean;\n  durationMs: number;\n}\n\n/**\n * Derived from the run status rather than restated, so a new terminal status\n * in the harness reaches the dashboard instead of silently rendering as a\n * status the marker tables never learned about.\n */\nexport type SubagentProgressStatus = SubagentRunStatus | \"pending\" | \"running\" | \"skipped\";\n\nexport interface SubagentProgressNode {\n  id: string;\n  label: string;\n  status: SubagentProgressStatus;\n  /** Profile the node ran under; the first thing to check when a run is ungrounded. */\n  profile?: string;\n  turns?: number;\n  toolCalls?: number;\n  toolCallCounts?: Record<string, number>;\n  tokens?: number;\n  costUsd?: number;\n  durationMs?: number;\n  reason?: string;\n  cleanupPending?: boolean;\n}\n\nexport interface SubagentProgressSnapshot {\n  mode: \"single\" | \"parallel\" | \"dag\";\n  nodes: SubagentProgressNode[];\n}\n\nexport interface ConversationResponder {\n  respond(text: string): Promise<void>;\n  appendResponseDelta?(delta: string): Promise<void>;\n  finishResponse?(finalText?: string): Promise<void>;\n  replaceResponse(text: string, options?: { createOverflowLink?: () => string }): Promise<void>;\n  /**\n   * Override only to convert the subagent dashboard for a pipeline that is\n   * not response-source Markdown (Telegram HTML). Absent, the harness composes\n   * the Markdown dashboard — optionally followed by the final answer — through\n   * `replaceResponse`.\n   */\n  replaceSubagentProgress?(progress: SubagentProgressSnapshot, finalText?: string): Promise<void>;\n  respondDiagnostic(text: string, options?: { style?: \"muted\" | \"error\" }): Promise<void>;\n  respondToolResult(result: ChatToolResult): Promise<void>;\n  setTyping(isTyping: boolean): Promise<void>;\n  setWorking(working: boolean): Promise<void>;\n  uploadFile(filePath: string, title?: string): Promise<void>;\n  /**\n   * React to the message that triggered this run with an emoji short name\n   * (no colons). Optional: platforms/contexts without reaction support omit\n   * it, and callers must handle its absence.\n   */\n  react?(emoji: string): Promise<void>;\n  deleteResponse(): Promise<void>;\n}\n\nexport interface MessagingInfo {\n  name: string;\n  formattingGuide: string;\n  channels: { id: string; name: string }[];\n  users: { id: string; userName: string; displayName: string }[];\n  /**\n   * Trust boundary for ambient credentials. Defaults to `membership` when\n   * omitted (closed chat platforms). Open-trigger platforms must set this\n   * explicitly so vault policy does not key off platform name strings.\n   */\n  trustModel?: PlatformTrustModel;\n  diagnostics?: {\n    showUsageSummary?: boolean;\n  };\n}\n\nexport interface ChatAdapter {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n  getMessagingInfo(): MessagingInfo;\n}\n\nexport type AgentEventPayload =\n  | { kind: \"sessionStart\" }\n  | { kind: \"responseDelta\"; delta: string }\n  | { kind: \"responseFinal\"; text: string }\n  | { kind: \"diagnostic\"; text: string }\n  | { kind: \"toolStart\"; toolId: string; toolName: string; input?: unknown }\n  | { kind: \"toolEnd\"; toolId: string }\n  | { kind: \"turnEnd\"; awaitingInput?: boolean }\n  | { kind: \"sessionEnd\"; reason?: string };\n\nexport interface AgentEventEnvelope {\n  source: \"mikan\";\n  sessionId: string;\n  actorName: string;\n  event: AgentEventPayload;\n}\n\n/**\n * A platform-agnostic event (message/mention) that triggers the agent.\n */\nexport interface ConversationEvent {\n  type: string;\n  /** Canonical identity created by the platform adapter at intake. */\n  address: OfficeAddress;\n  /** @deprecated Raw platform identifier; valid only at adapter I/O seams. */\n  conversationId: string;\n  /** Optional alternate conversation identity used for vault routing. */\n  vaultConversationId?: string;\n  /** Cross-platform conversation shape: direct message vs shared space */\n  conversationKind: ConversationKind;\n  /** Message timestamp or ID as string */\n  ts: string;\n  /** Parent message ID for threaded replies (optional) */\n  thread_ts?: string;\n  /** User ID */\n  user: string;\n  /** Message text (already stripped of bot mentions) */\n  text: string;\n  /** Downloaded attachments */\n  attachments?: { name: string; localPath: string }[];\n  /** Platform-computed session key; overrides default conversationId:thread_ts computation */\n  sessionKey?: string;\n}\n\n/**\n * Minimum interface that every platform bot must implement,\n * used by the central handler in main.ts and by EventsWatcher.\n */\nexport interface MessagingBot {\n  start(): Promise<void>;\n  postMessage(channel: string, text: string): Promise<string>;\n  updateMessage(channel: string, ts: string, text: string): Promise<void>;\n  /**\n   * Add an emoji reaction to a message. `emoji` is a platform-agnostic short\n   * name without colons (e.g. \"eyes\", \"white_check_mark\"). Optional so\n   * adapters adopt it incrementally; callers must handle its absence.\n   */\n  addReaction?(channel: string, messageTs: string, emoji: string): Promise<void>;\n  /**\n   * Upload a host-side file into a conversation. Optional so adapters adopt\n   * it incrementally; callers must handle its absence. Existing adapter\n   * implementations (Slack/Discord/Telegram) already match this shape.\n   */\n  uploadFile?(channel: string, filePath: string, title?: string): Promise<void>;\n  enqueueEvent(event: ConversationEvent): boolean;\n  getMessagingInfo(): MessagingInfo;\n  postPrivate?(conversationId: string, userId: string, text: string): Promise<void>;\n  postPrivateDiagnostic?(\n    conversationId: string,\n    userId: string,\n    text: string,\n    options?: { style?: \"muted\" | \"error\" },\n  ): Promise<void>;\n}\n\n/**\n * Post a plain message to a conversation without triggering an agent run.\n * Backs extension `api.notify`; implemented in main.ts over the platform bots.\n * `platform` is required only when more than one platform is running.\n */\nexport type PlatformNotifier = (\n  conversationId: string,\n  text: string,\n  platform?: string,\n) => Promise<void>;\n\n/**\n * Add an emoji reaction to a message without triggering an agent run. Backs\n * extension `api.react`; implemented in main.ts over the platform bots.\n */\nexport type PlatformReactor = (\n  conversationId: string,\n  messageTs: string,\n  emoji: string,\n  platform?: string,\n) => Promise<void>;\n\n/**\n * Upload a host-side file into a conversation without triggering an agent\n * run. Backs extension `api.uploadFile`; implemented in main.ts over the\n * platform bots. `platform` is required only when more than one is running.\n */\nexport type PlatformUploader = (\n  conversationId: string,\n  filePath: string,\n  title?: string,\n  platform?: string,\n) => Promise<void>;\n\n/**\n * Post and update interactive Block Kit messages without triggering an agent\n * run. Backs extension `api.blockkit`; implemented in main.ts over the\n * platform bots (Slack-only today — other platforms throw).\n */\nexport interface PlatformBlockKit {\n  postBlocks(\n    conversationId: string,\n    message: { text: string; blocks: object[]; threadTs?: string },\n    platform?: string,\n  ): Promise<{ ts: string }>;\n  updateBlocks(\n    conversationId: string,\n    messageTs: string,\n    message: { text: string; blocks: object[] },\n    platform?: string,\n  ): Promise<void>;\n}\n\n/** Normalized platform data and reply hook for one event. */\nexport interface ConversationContext {\n  /** Canonical identity for the office handling this turn. */\n  address: OfficeAddress;\n  message: ConversationMessage;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n}\n\nexport interface RunningSession {\n  /** The office this run belongs to; two platforms may share a raw id. */\n  address: OfficeAddress;\n  sessionKey: string;\n  startedAt: number;\n  lastActivityAt?: number;\n  currentTool?: string;\n}\n\n/**\n * Runtime state is addressed by an office plus that office's platform session\n * reference. The session key alone is a platform value and is not unique\n * across platforms, so every session-scoped call carries its `OfficeAddress`.\n */\nexport interface MessagingEventHandler {\n  isRunning(address: OfficeAddress, sessionKey: string): boolean;\n  getRunningSessions(): RunningSession[];\n  handleEvent(\n    event: ConversationEvent,\n    bot: MessagingBot,\n    context: ConversationContext,\n  ): Promise<void>;\n  handleStop(address: OfficeAddress, sessionKey: string, bot: MessagingBot): Promise<void>;\n  forceStop(address: OfficeAddress, sessionKey: string): void;\n  handleNewCommand(\n    sessionKey: string,\n    conversationId: string,\n    bot: MessagingBot,\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<void>;\n  /**\n   * Dispatch an extension-owned interactive block action (`ext:<slug>:`\n   * namespaced) to its onAction handler — deterministic, no agent run. The\n   * extension decides whether to involve the model (`triggerRun`). Returns\n   * true when an extension consumed the action; namespaced actions never\n   * fall through to the model, so the adapter drops unconsumed ones.\n   */\n  handleExtensionAction(params: {\n    address: OfficeAddress;\n    sessionKey: string;\n    conversationKind: ConversationKind;\n    slug: string;\n    action: ExtensionBlockAction;\n  }): Promise<boolean>;\n}\n\n// ── agent ─────────────────────────────────────────────────────────────────────\n\nexport interface PiAgentWrapper {\n  syncChatHistory(currentMessageId?: string): void;\n  run(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string }>;\n  /** Run a hidden Session Dream against the current session before resetting or rotating it. */\n  dreamSessionMemory(\n    message: ConversationMessage,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string }>;\n  abort(): void;\n  getCurrentStep(): { toolName?: string; label?: string } | undefined;\n  /**\n   * Dispatch a leading-slash message to an extension-registered command.\n   * Returns true when a command consumed the message (no agent run follows).\n   */\n  tryExtensionCommand(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n  ): Promise<boolean>;\n  /**\n   * Dispatch an extension-owned interactive block action to its onAction\n   * handler. Returns true when a handler consumed it (no agent run follows).\n   */\n  tryExtensionAction(slug: string, action: ExtensionBlockAction): Promise<boolean>;\n  /** Run extension disposers. Call once when this wrapper is discarded. */\n  dispose(): Promise<void>;\n}\n\n// ── config ────────────────────────────────────────────────────────────────────\n\nexport type WorkspaceDoorPolicy = \"isolated\" | \"trusted\";\nexport type WorkspaceLayout = \"conversation\" | \"shared-support\" | \"full\";\n\ninterface WorkspaceSettings {\n  doorPolicy?: WorkspaceDoorPolicy;\n  layout?: WorkspaceLayout;\n}\n\nexport interface SandboxSettings {\n  cpus?: string;\n  memory?: string;\n  boost?: { cpus?: string; memory?: string };\n  /** Legacy image-specific workspace setting; new installations use workspace. */\n  image?: { workspaceMount?: \"private\" | \"full\" };\n  /** Backend-neutral office data policy and layout. */\n  workspace?: WorkspaceSettings;\n  defaultSharedVault?: string;\n}\n\nexport interface AgentConfig {\n  provider: string;\n  model: string;\n  thinkingLevel: ThinkingLevel;\n  sentryDsn?: string;\n  sandbox?: SandboxSettings;\n  slack?: {\n    replyMode?: \"top-level\" | \"thread\";\n  };\n  /**\n   * Package sources (see `src/packages`) declared by ONE scope. Unlike every\n   * other key here, packages are additive across scopes rather than\n   * overriding: a conversation's list does not replace the global list, it\n   * extends it. `resolveConversationSettings` therefore reports only the\n   * conversation's own entries — combining the two scopes (and resolving\n   * same-package collisions in the conversation's favour) is\n   * `resolveConversationPackages`'s job.\n   */\n  packages?: string[];\n}\n\n/**\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport interface AutoReplyConfig {\n  enabled: boolean;\n  rules: string[];\n}\n\nexport interface JudgeModelConfig {\n  provider: string;\n  model: string;\n}\n\n// ── context ───────────────────────────────────────────────────────────────────\n\n/**\n * Platform conversation history entry from log.jsonl.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isMessagingBot?: boolean;\n}\n\n// ── events ────────────────────────────────────────────────────────────────────\n// The wire format (payload union, schema, parser, builder) is owned by\n// src/harness/event-format.ts. These are the *resolved* runtime shapes: the\n// EventsWatcher fills in the platform default and infers the conversation\n// kind before an event reaches a bot.\n\ninterface ResolvedEventFields {\n  platform: string;\n  conversationKind: ConversationKind;\n}\n\nexport type ImmediateEvent = ImmediateEventPayload & ResolvedEventFields;\n\nexport type OneShotEvent = OneShotEventPayload & ResolvedEventFields;\n\nexport type PeriodicEvent = PeriodicEventPayload & ResolvedEventFields;\n\nexport type MikanEvent = ImmediateEvent | OneShotEvent | PeriodicEvent;\n\nexport interface PeriodicEventInfo {\n  filename: string;\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  text: string;\n  schedule: string;\n  timezone: string;\n  nextRun: string | null;\n}\n\n// ── execution-resolver ────────────────────────────────────────────────────────\n\nexport interface ActorContext {\n  /** Canonical office identity; vault and package keys use its raw id. */\n  address: OfficeAddress;\n  userId: string;\n  /** From MessagingInfo.trustModel; vault policy uses this, not platform name. */\n  trustModel?: PlatformTrustModel;\n}\n\nexport type ImageWorkspaceMountMode = \"private\" | \"full\";\n\n// ── log ───────────────────────────────────────────────────────────────────────\n\nexport interface LogContext {\n  conversationId: string;\n  userName?: string;\n  conversationName?: string;\n  sessionId?: string;\n}\n\n// ── portal shell (src/web/portal-shell.ts) ────────────────────────────────────\n\ntype PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  extraStyles?: string;\n  inlineScript?: string;\n  extraHead?: string;\n  bodyAttributes?: Record<string, string>;\n}\n\n// ── provisioner ───────────────────────────────────────────────────────────────\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n  /**\n   * Mount without write access. Used for content the host owns and the agent\n   * must not edit — package-provided skills, whose host copy is a git checkout\n   * that a reinstall replaces wholesale. Absent means read-write, which is the\n   * right default for everything the agent is meant to author.\n   */\n  readOnly?: boolean;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface SandboxResourceController {\n  boost(key: string): Promise<SandboxLimitStatus>;\n  setLimits(key: string, limits: ResourceLimits): Promise<SandboxLimitStatus>;\n  getLimitStatus(key: string): SandboxLimitStatus;\n  getDefaultLimits(): ResourceLimits | undefined;\n  getBoostLimits(): ResourceLimits | undefined;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: ExecFileAsync;\n}\n\nexport interface ExecutionPlan {\n  credentialKey: string;\n  resourceKey: string;\n  sandboxConfig: import(\"./sandbox/types.js\").SandboxConfig;\n  env?: Record<string, string>;\n  mounts: ContainerMount[];\n}\n\n// ── store ─────────────────────────────────────────────────────────────────────\n\nexport interface Attachment {\n  original: string;\n  localPath: string;\n}\n\nexport interface LoggedMessage {\n  date: string;\n  ts: string;\n  user: string;\n  userName?: string;\n  displayName?: string;\n  text: string;\n  attachments: Attachment[];\n  isMessagingBot: boolean;\n  threadTs?: string;\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string;\n}\n\n// ── trigger ───────────────────────────────────────────────────────────────────\n\nexport type TriggerIntent = \"mention\" | \"direct\" | \"thread-continuation\" | \"auto-reply-candidate\";\n\nexport type TriggerResult = { trigger: true; reason: string } | { trigger: false; reason: string };\n\n/**\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport type AutoReplyJudge = (input: {\n  event: ConversationEvent;\n  rules: string[];\n  conversationDir: string;\n}) => Promise<boolean>;\n\n// ── shared implementation contracts ─────────────────────────────────────────\n\ninterface EnvVarSpec {\n  name: string;\n  required?: boolean;\n  secret?: boolean;\n  deploy?: boolean;\n  doc: string;\n}\n\nexport interface EnvGroup {\n  key: string;\n  title: string;\n  kind: \"platform\" | \"feature\";\n  vars: EnvVarSpec[];\n  anyOf?: readonly string[];\n  doc?: string;\n}\n\nexport interface RunnerCacheControl {\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n}\n\nexport interface GlobalRunnerCacheControl {\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport type SettingsApplyResult =\n  | { ok: true; runtimeSwitched: boolean | null }\n  | { ok: false; reason: \"busy\" };\n\nexport interface CreateRunnerOptions {\n  sandboxConfig: import(\"./sandbox/types.js\").SandboxConfig;\n  sessionKey: string;\n  /** Canonical office identity for workspace paths and execution scoping. */\n  address: OfficeAddress;\n  /** Raw platform id; settings/vault/package keys keep it until ADR 0005. */\n  conversationId: string;\n  conversationDir: string;\n  workspaceDir: string;\n  sessionScope: import(\"./sessions/types.js\").ResolvedSessionScope;\n  vaultManager?: import(\"./vault/types.js\").VaultManager;\n  provisioner?: import(\"./provisioner.js\").DockerContainerManager;\n  resourceController?: SandboxResourceController;\n  sessionView?: {\n    tokenStore: import(\"./commands/types.js\").SessionViewTokenStoreLike;\n    portalBaseUrl?: string;\n  };\n  platformNotifier?: PlatformNotifier;\n  platformReactor?: PlatformReactor;\n  platformUploader?: PlatformUploader;\n  platformBlockKit?: PlatformBlockKit;\n  platformToolPackFactories?: readonly import(\"./tools/types.js\").PlatformToolPackFactory[];\n  models?: import(\"./harness/models.js\").MikanModels;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AASjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { execFile } from \"child_process\";\nimport { promisify } from \"util\";\nimport type {\n  ImmediateEventPayload,\n  OneShotEventPayload,\n  PeriodicEventPayload,\n} from \"./harness/event-format.js\";\nimport type { ExtensionBlockAction } from \"./harness/extensions/types.js\";\nimport type { SubagentRunStatus } from \"./harness/types.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\n// ── adapter ───────────────────────────────────────────────────────────────────\n\nexport type ConversationKind = \"direct\" | \"shared\";\n\nexport type PlatformName = \"slack\" | \"discord\" | \"telegram\" | \"github\";\n\n/** Canonical platform-plus-raw identifier for one conversation office. */\nexport interface OfficeAddress {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n}\n\n/** Stable, filesystem-safe identity derived from an OfficeAddress. */\nexport type OfficeKey = string & { readonly __brand: \"OfficeKey\" };\n\nexport type OfficeMigrationStatus = \"needs-owner\" | \"prepared\" | \"moving\" | \"committed\" | \"failed\";\n\nexport interface OfficeMigrationRecord {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n  readonly targetDir?: string;\n  readonly status: OfficeMigrationStatus;\n  readonly error?: string;\n  readonly updatedAt: string;\n}\n\n/**\n * Directory entry for one conversation office. The workspace dir name stops\n * carrying the raw platform id once the ADR 0005 layout migration lands, so\n * the registry is the durable raw-id ↔ office mapping used for enumeration.\n */\nexport interface OfficeRecord {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n  readonly recordedAt: string;\n}\n\nexport interface OfficeRegistryState {\n  readonly version: 1;\n  readonly enabledPlatforms: readonly PlatformName[];\n  readonly offices: readonly OfficeRecord[];\n  readonly migrations: readonly OfficeMigrationRecord[];\n}\n\nexport interface OfficeMigrationPreparation {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n}\n\n/**\n * Who can drive conversations on a platform — gates ambient credential policy.\n *\n * - `membership`: only invited workspace/server members (Slack/Discord/Telegram).\n *   Safe to copy `sandbox.defaultSharedVault` into new conversation vaults.\n * - `open-trigger`: broader trigger surface (e.g. GitHub repo writers on public\n *   issues/PRs). Ambient shared vault must not apply; use host-side platform\n *   identity or an explicitly provisioned vault.\n */\nexport type PlatformTrustModel = \"membership\" | \"open-trigger\";\n\nexport interface ConversationMessage {\n  id: string;\n  /** Canonical identity of the conversation office. */\n  address: OfficeAddress;\n  /** @deprecated Use address.conversationId except at platform I/O seams. */\n  conversationId?: string;\n  sessionKey: string;\n  conversationKind: ConversationKind;\n  userId: string;\n  userName?: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  threadTs?: string;\n}\n\nexport interface ChatToolResult {\n  toolName: string;\n  label?: string;\n  args?: Record<string, unknown>;\n  result: string;\n  isError: boolean;\n  durationMs: number;\n}\n\n/**\n * Derived from the run status rather than restated, so a new terminal status\n * in the harness reaches the dashboard instead of silently rendering as a\n * status the marker tables never learned about.\n */\nexport type SubagentProgressStatus = SubagentRunStatus | \"pending\" | \"running\" | \"skipped\";\n\nexport interface SubagentProgressNode {\n  id: string;\n  label: string;\n  status: SubagentProgressStatus;\n  /** Profile the node ran under; the first thing to check when a run is ungrounded. */\n  profile?: string;\n  turns?: number;\n  toolCalls?: number;\n  toolCallCounts?: Record<string, number>;\n  tokens?: number;\n  costUsd?: number;\n  durationMs?: number;\n  reason?: string;\n  cleanupPending?: boolean;\n}\n\nexport interface SubagentProgressSnapshot {\n  mode: \"single\" | \"parallel\" | \"dag\";\n  nodes: SubagentProgressNode[];\n}\n\nexport interface ConversationResponder {\n  respond(text: string): Promise<void>;\n  appendResponseDelta?(delta: string): Promise<void>;\n  finishResponse?(finalText?: string): Promise<void>;\n  replaceResponse(text: string, options?: { createOverflowLink?: () => string }): Promise<void>;\n  /**\n   * Override only to convert the subagent dashboard for a pipeline that is\n   * not response-source Markdown (Telegram HTML). Absent, the harness composes\n   * the Markdown dashboard — optionally followed by the final answer — through\n   * `replaceResponse`.\n   */\n  replaceSubagentProgress?(progress: SubagentProgressSnapshot, finalText?: string): Promise<void>;\n  respondDiagnostic(text: string, options?: { style?: \"muted\" | \"error\" }): Promise<void>;\n  respondToolResult(result: ChatToolResult): Promise<void>;\n  setTyping(isTyping: boolean): Promise<void>;\n  setWorking(working: boolean): Promise<void>;\n  uploadFile(filePath: string, title?: string): Promise<void>;\n  /**\n   * React to the message that triggered this run with an emoji short name\n   * (no colons). Optional: platforms/contexts without reaction support omit\n   * it, and callers must handle its absence.\n   */\n  react?(emoji: string): Promise<void>;\n  deleteResponse(): Promise<void>;\n}\n\nexport interface MessagingInfo {\n  name: string;\n  formattingGuide: string;\n  channels: { id: string; name: string }[];\n  users: { id: string; userName: string; displayName: string }[];\n  /**\n   * Trust boundary for ambient credentials. Defaults to `membership` when\n   * omitted (closed chat platforms). Open-trigger platforms must set this\n   * explicitly so vault policy does not key off platform name strings.\n   */\n  trustModel?: PlatformTrustModel;\n  diagnostics?: {\n    showUsageSummary?: boolean;\n  };\n}\n\nexport interface ChatAdapter {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n  getMessagingInfo(): MessagingInfo;\n}\n\nexport type AgentEventPayload =\n  | { kind: \"sessionStart\" }\n  | { kind: \"responseDelta\"; delta: string }\n  | { kind: \"responseFinal\"; text: string }\n  | { kind: \"diagnostic\"; text: string }\n  | { kind: \"toolStart\"; toolId: string; toolName: string; input?: unknown }\n  | { kind: \"toolEnd\"; toolId: string }\n  | { kind: \"turnEnd\"; awaitingInput?: boolean }\n  | { kind: \"sessionEnd\"; reason?: string };\n\nexport interface AgentEventEnvelope {\n  source: \"mikan\";\n  sessionId: string;\n  actorName: string;\n  event: AgentEventPayload;\n}\n\n/**\n * A platform-agnostic event (message/mention) that triggers the agent.\n */\nexport interface ConversationEvent {\n  type: string;\n  /** Canonical identity created by the platform adapter at intake. */\n  address: OfficeAddress;\n  /** @deprecated Raw platform identifier; valid only at adapter I/O seams. */\n  conversationId: string;\n  /** Optional alternate conversation identity used for vault routing. */\n  vaultConversationId?: string;\n  /** Cross-platform conversation shape: direct message vs shared space */\n  conversationKind: ConversationKind;\n  /** Message timestamp or ID as string */\n  ts: string;\n  /** Parent message ID for threaded replies (optional) */\n  thread_ts?: string;\n  /** User ID */\n  user: string;\n  /** Message text (already stripped of bot mentions) */\n  text: string;\n  /** Downloaded attachments */\n  attachments?: { name: string; localPath: string }[];\n  /** Platform-computed session key; overrides default conversationId:thread_ts computation */\n  sessionKey?: string;\n}\n\n/**\n * Minimum interface that every platform bot must implement,\n * used by the central handler in main.ts and by EventsWatcher.\n */\nexport interface MessagingBot {\n  start(): Promise<void>;\n  postMessage(channel: string, text: string): Promise<string>;\n  updateMessage(channel: string, ts: string, text: string): Promise<void>;\n  /**\n   * Add an emoji reaction to a message. `emoji` is a platform-agnostic short\n   * name without colons (e.g. \"eyes\", \"white_check_mark\"). Optional so\n   * adapters adopt it incrementally; callers must handle its absence.\n   */\n  addReaction?(channel: string, messageTs: string, emoji: string): Promise<void>;\n  /**\n   * Upload a host-side file into a conversation. Optional so adapters adopt\n   * it incrementally; callers must handle its absence. Existing adapter\n   * implementations (Slack/Discord/Telegram) already match this shape.\n   */\n  uploadFile?(channel: string, filePath: string, title?: string): Promise<void>;\n  enqueueEvent(event: ConversationEvent): boolean;\n  getMessagingInfo(): MessagingInfo;\n  postPrivate?(conversationId: string, userId: string, text: string): Promise<void>;\n  postPrivateDiagnostic?(\n    conversationId: string,\n    userId: string,\n    text: string,\n    options?: { style?: \"muted\" | \"error\" },\n  ): Promise<void>;\n}\n\n/**\n * Post a plain message to a conversation without triggering an agent run.\n * Backs extension `api.notify`; implemented in main.ts over the platform bots.\n * `platform` is required only when more than one platform is running.\n */\nexport type PlatformNotifier = (\n  conversationId: string,\n  text: string,\n  platform?: string,\n) => Promise<void>;\n\n/**\n * Add an emoji reaction to a message without triggering an agent run. Backs\n * extension `api.react`; implemented in main.ts over the platform bots.\n */\nexport type PlatformReactor = (\n  conversationId: string,\n  messageTs: string,\n  emoji: string,\n  platform?: string,\n) => Promise<void>;\n\n/**\n * Upload a host-side file into a conversation without triggering an agent\n * run. Backs extension `api.uploadFile`; implemented in main.ts over the\n * platform bots. `platform` is required only when more than one is running.\n */\nexport type PlatformUploader = (\n  conversationId: string,\n  filePath: string,\n  title?: string,\n  platform?: string,\n) => Promise<void>;\n\n/**\n * Post and update interactive Block Kit messages without triggering an agent\n * run. Backs extension `api.blockkit`; implemented in main.ts over the\n * platform bots (Slack-only today — other platforms throw).\n */\nexport interface PlatformBlockKit {\n  postBlocks(\n    conversationId: string,\n    message: { text: string; blocks: object[]; threadTs?: string },\n    platform?: string,\n  ): Promise<{ ts: string }>;\n  updateBlocks(\n    conversationId: string,\n    messageTs: string,\n    message: { text: string; blocks: object[] },\n    platform?: string,\n  ): Promise<void>;\n}\n\n/** Normalized platform data and reply hook for one event. */\nexport interface ConversationContext {\n  /** Canonical identity for the office handling this turn. */\n  address: OfficeAddress;\n  message: ConversationMessage;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n}\n\nexport interface RunningSession {\n  /** The office this run belongs to; two platforms may share a raw id. */\n  address: OfficeAddress;\n  sessionKey: string;\n  startedAt: number;\n  lastActivityAt?: number;\n  currentTool?: string;\n}\n\n/**\n * Runtime state is addressed by an office plus that office's platform session\n * reference. The session key alone is a platform value and is not unique\n * across platforms, so every session-scoped call carries its `OfficeAddress`.\n */\nexport interface MessagingEventHandler {\n  isRunning(address: OfficeAddress, sessionKey: string): boolean;\n  getRunningSessions(): RunningSession[];\n  handleEvent(\n    event: ConversationEvent,\n    bot: MessagingBot,\n    context: ConversationContext,\n  ): Promise<void>;\n  handleStop(address: OfficeAddress, sessionKey: string, bot: MessagingBot): Promise<void>;\n  forceStop(address: OfficeAddress, sessionKey: string): void;\n  handleNewCommand(\n    sessionKey: string,\n    conversationId: string,\n    bot: MessagingBot,\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<void>;\n  /**\n   * Dispatch an extension-owned interactive block action (`ext:<slug>:`\n   * namespaced) to its onAction handler — deterministic, no agent run. The\n   * extension decides whether to involve the model (`triggerRun`). Returns\n   * true when an extension consumed the action; namespaced actions never\n   * fall through to the model, so the adapter drops unconsumed ones.\n   */\n  handleExtensionAction(params: {\n    address: OfficeAddress;\n    sessionKey: string;\n    conversationKind: ConversationKind;\n    slug: string;\n    action: ExtensionBlockAction;\n  }): Promise<boolean>;\n}\n\n// ── agent ─────────────────────────────────────────────────────────────────────\n\nexport interface PiAgentWrapper {\n  syncChatHistory(currentMessageId?: string): void;\n  run(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string }>;\n  /** Run a hidden Session Dream against the current session before resetting or rotating it. */\n  dreamSessionMemory(\n    message: ConversationMessage,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string }>;\n  abort(): void;\n  getCurrentStep(): { toolName?: string; label?: string } | undefined;\n  /**\n   * Dispatch a leading-slash message to an extension-registered command.\n   * Returns true when a command consumed the message (no agent run follows).\n   */\n  tryExtensionCommand(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n  ): Promise<boolean>;\n  /**\n   * Dispatch an extension-owned interactive block action to its onAction\n   * handler. Returns true when a handler consumed it (no agent run follows).\n   */\n  tryExtensionAction(slug: string, action: ExtensionBlockAction): Promise<boolean>;\n  /** Run extension disposers. Call once when this wrapper is discarded. */\n  dispose(): Promise<void>;\n}\n\n// ── config ────────────────────────────────────────────────────────────────────\n\nexport type WorkspaceDoorPolicy = \"isolated\" | \"trusted\";\nexport type WorkspaceLayout = \"conversation\" | \"shared-support\" | \"full\";\n\ninterface WorkspaceSettings {\n  doorPolicy?: WorkspaceDoorPolicy;\n  layout?: WorkspaceLayout;\n}\n\nexport interface SandboxSettings {\n  cpus?: string;\n  memory?: string;\n  boost?: { cpus?: string; memory?: string };\n  /** Legacy image-specific workspace setting; new installations use workspace. */\n  image?: { workspaceMount?: \"private\" | \"full\" };\n  /** Backend-neutral office data policy and layout. */\n  workspace?: WorkspaceSettings;\n  defaultSharedVault?: string;\n}\n\nexport interface AgentConfig {\n  provider: string;\n  model: string;\n  thinkingLevel: ThinkingLevel;\n  sentryDsn?: string;\n  sandbox?: SandboxSettings;\n  slack?: {\n    replyMode?: \"top-level\" | \"thread\";\n  };\n  /**\n   * Package sources (see `src/packages`) declared by ONE scope. Unlike every\n   * other key here, packages are additive across scopes rather than\n   * overriding: a conversation's list does not replace the global list, it\n   * extends it. `resolveConversationSettings` therefore reports only the\n   * conversation's own entries — combining the two scopes (and resolving\n   * same-package collisions in the conversation's favour) is\n   * `resolveConversationPackages`'s job.\n   */\n  packages?: string[];\n}\n\n/**\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport interface AutoReplyConfig {\n  enabled: boolean;\n  rules: string[];\n}\n\nexport interface JudgeModelConfig {\n  provider: string;\n  model: string;\n}\n\n// ── context ───────────────────────────────────────────────────────────────────\n\n/**\n * Platform conversation history entry from log.jsonl.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isMessagingBot?: boolean;\n}\n\n// ── events ────────────────────────────────────────────────────────────────────\n// The wire format (payload union, schema, parser, builder) is owned by\n// src/harness/event-format.ts. These are the *resolved* runtime shapes: the\n// EventsWatcher fills in the platform default and infers the conversation\n// kind before an event reaches a bot.\n\ninterface ResolvedEventFields {\n  platform: string;\n  conversationKind: ConversationKind;\n}\n\nexport type ImmediateEvent = ImmediateEventPayload & ResolvedEventFields;\n\nexport type OneShotEvent = OneShotEventPayload & ResolvedEventFields;\n\nexport type PeriodicEvent = PeriodicEventPayload & ResolvedEventFields;\n\nexport type MikanEvent = ImmediateEvent | OneShotEvent | PeriodicEvent;\n\nexport interface PeriodicEventInfo {\n  filename: string;\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  text: string;\n  schedule: string;\n  timezone: string;\n  nextRun: string | null;\n}\n\n// ── execution-resolver ────────────────────────────────────────────────────────\n\nexport interface ActorContext {\n  /** Canonical office identity; vault and package keys use its raw id. */\n  address: OfficeAddress;\n  userId: string;\n  /** From MessagingInfo.trustModel; vault policy uses this, not platform name. */\n  trustModel?: PlatformTrustModel;\n}\n\nexport type ImageWorkspaceMountMode = \"private\" | \"full\";\n\n// ── log ───────────────────────────────────────────────────────────────────────\n\nexport interface LogContext {\n  conversationId: string;\n  userName?: string;\n  conversationName?: string;\n  sessionId?: string;\n}\n\n// ── portal shell (src/web/portal-shell.ts) ────────────────────────────────────\n\ntype PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  extraStyles?: string;\n  inlineScript?: string;\n  extraHead?: string;\n  bodyAttributes?: Record<string, string>;\n}\n\n// ── provisioner ───────────────────────────────────────────────────────────────\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n  /**\n   * Mount without write access. Used for content the host owns and the agent\n   * must not edit — package-provided skills, whose host copy is a git checkout\n   * that a reinstall replaces wholesale. Absent means read-write, which is the\n   * right default for everything the agent is meant to author.\n   */\n  readOnly?: boolean;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface SandboxResourceController {\n  boost(key: string): Promise<SandboxLimitStatus>;\n  setLimits(key: string, limits: ResourceLimits): Promise<SandboxLimitStatus>;\n  getLimitStatus(key: string): SandboxLimitStatus;\n  getDefaultLimits(): ResourceLimits | undefined;\n  getBoostLimits(): ResourceLimits | undefined;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: ExecFileAsync;\n}\n\nexport interface ExecutionPlan {\n  credentialKey: string;\n  resourceKey: string;\n  sandboxConfig: import(\"./sandbox/types.js\").SandboxConfig;\n  env?: Record<string, string>;\n  mounts: ContainerMount[];\n}\n\n// ── store ─────────────────────────────────────────────────────────────────────\n\nexport interface Attachment {\n  original: string;\n  localPath: string;\n}\n\nexport interface LoggedMessage {\n  date: string;\n  ts: string;\n  user: string;\n  userName?: string;\n  displayName?: string;\n  text: string;\n  attachments: Attachment[];\n  isMessagingBot: boolean;\n  threadTs?: string;\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string;\n}\n\n// ── trigger ───────────────────────────────────────────────────────────────────\n\nexport type TriggerIntent = \"mention\" | \"direct\" | \"thread-continuation\" | \"auto-reply-candidate\";\n\nexport type TriggerResult = { trigger: true; reason: string } | { trigger: false; reason: string };\n\n/**\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport type AutoReplyJudge = (input: {\n  event: ConversationEvent;\n  rules: string[];\n  conversationDir: string;\n}) => Promise<boolean>;\n\n// ── shared implementation contracts ─────────────────────────────────────────\n\ninterface EnvVarSpec {\n  name: string;\n  required?: boolean;\n  secret?: boolean;\n  deploy?: boolean;\n  doc: string;\n}\n\nexport interface EnvGroup {\n  key: string;\n  title: string;\n  kind: \"platform\" | \"feature\";\n  vars: EnvVarSpec[];\n  anyOf?: readonly string[];\n  doc?: string;\n}\n\nexport interface RunnerCacheControl {\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  /** Clear the office's cached runner for a non-model settings change; false while busy. */\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n}\n\nexport interface GlobalRunnerCacheControl {\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport type SettingsApplyResult =\n  | { ok: true; runtimeSwitched: boolean | null }\n  | { ok: false; reason: \"busy\" };\n\nexport interface CreateRunnerOptions {\n  sandboxConfig: import(\"./sandbox/types.js\").SandboxConfig;\n  sessionKey: string;\n  /** Canonical office identity for workspace paths and execution scoping. */\n  address: OfficeAddress;\n  /** Raw platform id; settings/vault/package keys keep it until ADR 0005. */\n  conversationId: string;\n  conversationDir: string;\n  workspaceDir: string;\n  sessionScope: import(\"./sessions/types.js\").ResolvedSessionScope;\n  vaultManager?: import(\"./vault/types.js\").VaultManager;\n  provisioner?: import(\"./provisioner.js\").DockerContainerManager;\n  resourceController?: SandboxResourceController;\n  sessionView?: {\n    tokenStore: import(\"./commands/types.js\").SessionViewTokenStoreLike;\n    portalBaseUrl?: string;\n  };\n  platformNotifier?: PlatformNotifier;\n  platformReactor?: PlatformReactor;\n  platformUploader?: PlatformUploader;\n  platformBlockKit?: PlatformBlockKit;\n  platformToolPackFactories?: readonly import(\"./tools/types.js\").PlatformToolPackFactory[];\n  models?: import(\"./harness/models.js\").MikanModels;\n}\n"]}

package/dist/web/admin/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/web/admin/portal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AA2BvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAWtD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,OAAO,CAAC,CA6BlB;AA+ID,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,UAAU,GAChB,sBAAsB,CAexB;AAk+BD,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAwBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,EAAE,CAuB/F;AA6JD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAiB9E"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/web/admin/portal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAkCvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAWtD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,OAAO,CAAC,CA6BlB;AAmJD,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,UAAU,GAChB,sBAAsB,CAexB;AA6iCD,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAwBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,EAAE,CAuB/F;AA6JD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAiB9E"}

package/dist/web/admin/portal.js

@@ -1,8 +1,8 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { basename, join, resolve as pathResolve, sep as pathSep } from "path";
 import { MikanModels, parseFrontmatter, SessionStore } from "../../harness/index.js";
-import { loadConversationAutoReplyConfig, loadGlobalSettings, resolveConversationSettings, saveConversationAutoReplyConfig, } from "../../config.js";
-import { applyConversationSettings, applyGlobalSettings } from "../../settings-mutation.js";
+import { loadConversationAutoReplyConfig, loadConversationWorkspaceOverride, loadGlobalSettings, resolveConversationSettings, saveConversationAutoReplyConfig, } from "../../config.js";
+import { applyConversationSettings, applyConversationWorkspacePolicy, applyGlobalSettings, applyGlobalWorkspacePolicy, } from "../../settings-mutation.js";
 import { effectiveStateDir } from "../../cli/arg-grammar.js";
 import { addPackage, inspectConversationPackages, refreshPackage, removePackage, } from "../../packages/index.js";
 import { escapeHtml } from "../../utils/html.js";
@@ -162,6 +162,10 @@ async function routeApiRequest(req, res, url, services) {
         serveGlobalModelUpdate(res, body, services);
         return;
     }
+    if (url.pathname === "/admin/api/settings/workspace") {
+        serveGlobalWorkspaceUpdate(res, body, services);
+        return;
+    }
     if (url.pathname === "/admin/api/settings/sandbox") {
         serveGlobalSandboxUpdate(res, body, services);
         return;
@@ -485,6 +489,7 @@ function serveConversationState(res, url, services, token) {
         globalThinkingLevel: globalConfig.thinkingLevel,
         workspaceDoorPolicy: conversationWorkspace.doorPolicy,
         workspaceLayout: conversationWorkspace.layout,
+        workspaceOverride: doorPolicyChoiceKey(loadConversationWorkspaceOverride({ address: scope.address, conversationDir: dir })),
         globalWorkspaceDoorPolicy: globalWorkspaceSettings?.doorPolicy ?? "isolated",
         globalWorkspaceLayout: globalWorkspaceSettings?.layout ?? "conversation",
         autoReplyEnabled: autoReply.enabled,
@@ -576,10 +581,71 @@ function serveConversationModelUpdate(res, body, services, token) {
         jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
     }
 }
-function serveConversationSandboxUpdate(res, _body, _services, _token) {
-    jsonRes(res, 403, {
-        error: "Office door policy is host-controlled until administrator authorization is configured",
-    });
+/** Wire values for a door-policy selection; "default" clears the office's override. */
+function parseDoorPolicyChoice(value) {
+    switch (value) {
+        case "default":
+            return { choice: null };
+        case "isolated":
+            return { choice: { doorPolicy: "isolated" } };
+        case "trusted-shared-support":
+            return { choice: { doorPolicy: "trusted", layout: "shared-support" } };
+        case "trusted-full":
+            return { choice: { doorPolicy: "trusted", layout: "full" } };
+        default:
+            return undefined;
+    }
+}
+function doorPolicyChoiceKey(choice) {
+    if (!choice)
+        return "default";
+    if (choice.doorPolicy === "isolated")
+        return "isolated";
+    return choice.layout === "full" ? "trusted-full" : "trusted-shared-support";
+}
+function serveConversationSandboxUpdate(res, body, services, token) {
+    const parsed = parseDoorPolicyChoice(body.doorPolicy);
+    if (!parsed) {
+        jsonRes(res, 400, {
+            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', or 'trusted-full'",
+        });
+        return;
+    }
+    const scope = resolveTargetConversation(body, token);
+    if (scope.error) {
+        jsonRes(res, 403, { error: scope.error });
+        return;
+    }
+    const workingDir = requireAdminWorkingDir(res, services);
+    if (!workingDir)
+        return;
+    try {
+        const result = applyConversationWorkspacePolicy(services.runtime, workingDir, scope.address, parsed.choice);
+        if (!result.ok) {
+            jsonRes(res, 409, { error: "Conversation is busy; retry when the current run finishes" });
+            return;
+        }
+        jsonRes(res, 200, { ok: true });
+    }
+    catch (err) {
+        jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
+    }
+}
+function serveGlobalWorkspaceUpdate(res, body, services) {
+    const parsed = parseDoorPolicyChoice(body.doorPolicy);
+    if (!parsed) {
+        jsonRes(res, 400, {
+            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', or 'trusted-full'",
+        });
+        return;
+    }
+    try {
+        const result = applyGlobalWorkspacePolicy(services.runtime, parsed.choice);
+        jsonRes(res, 200, { ok: true, staleConversations: result.staleConversations.length });
+    }
+    catch (err) {
+        jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
+    }
 }
 function serveConversationSlackUpdate(res, body, services, token) {
     const replyMode = body.replyMode;
@@ -1686,6 +1752,15 @@ function renderAdminPage(token) {
       const globalReplyMode = (data.slack && data.slack.globalReplyMode) || 'top-level';
       const globalModel = [data.globalProvider, data.globalModel].filter(Boolean).join('/');
       const globalModelLabel = globalModel + (data.globalThinkingLevel ? ':' + data.globalThinkingLevel : '');
+      const doorPolicyChoices = [
+        ['default', 'Global default (' + data.globalWorkspaceDoorPolicy + ' / ' + data.globalWorkspaceLayout + ')'],
+        ['isolated', 'isolated — own office only'],
+        ['trusted-shared-support', 'trusted / shared-support — office + shared memory, skills, events'],
+        ['trusted-full', 'trusted / full — entire workspace'],
+      ];
+      const doorPolicyOpts = doorPolicyChoices.map(([value, label]) =>
+        '<option value="' + value + '"' + ((data.workspaceOverride || 'default') === value ? ' selected' : '') + '>' + escHtml(label) + '</option>'
+      ).join('');
       return [
         '<div class="config-grid">',
           '<div class="config-block">',
@@ -1705,7 +1780,10 @@ function renderAdminPage(token) {
           '</div>',
           '<div class="config-block">',
             '<h3 class="card-subtitle">Office data policy</h3>',
-            '<p class="muted-note">Door policy is host-controlled until administrator authorization is configured. Effective: ' + escHtml(data.workspaceDoorPolicy + ' / ' + data.workspaceLayout) + '</p>',
+            '<div class="config-row"><label>Door policy</label><select id="m-door-policy">' + doorPolicyOpts + '</select></div>',
+            '<p class="muted-note">Effective: ' + escHtml(data.workspaceDoorPolicy + ' / ' + data.workspaceLayout) + '</p>',
+            '<p class="muted-note">Changing the policy rebuilds the office sandbox container with the new mounts on its next message; the container contents are preserved.</p>',
+            '<button class="primary-action-btn" onclick="saveDoorPolicy(this)">Save door policy</button>',
             '<div id="mount-save-result" class="inline-result" style="display:none"></div>',
           '</div>',
           '<div class="config-block">',
@@ -1778,6 +1856,23 @@ function renderAdminPage(token) {
       }
     }
 
+    async function saveDoorPolicy(btn) {
+      const doorPolicy = document.getElementById('m-door-policy').value;
+      const result = document.getElementById('mount-save-result');
+      btn.disabled = true; btn.textContent = 'Saving…'; result.style.display = 'none';
+      try {
+        await apiPost('/admin/api/conversations/sandbox', {
+          ...scopeBody(), doorPolicy,
+        });
+        result.style.display = 'block'; result.className = 'inline-result ok'; result.textContent = 'Saved ✓';
+        loadSettings();
+      } catch (err) {
+        result.style.display = 'block'; result.className = 'inline-result err'; result.textContent = err.message;
+      } finally {
+        btn.disabled = false; btn.textContent = 'Save door policy';
+      }
+    }
+
     // ── Workspace ────────────────────────────────────────────────────────────────
 
     async function loadWorkspace() {
@@ -2307,6 +2402,17 @@ function renderAdminPage(token) {
       const replyModeOpts = replyModes.map((m) =>
         '<option value="' + m + '"' + (((data.slack && data.slack.replyMode) || 'top-level') === m ? ' selected' : '') + '>' + m + '</option>'
       ).join('');
+      const gDoorKey = data.workspaceDoorPolicy === 'isolated'
+        ? 'isolated'
+        : (data.workspaceLayout === 'full' ? 'trusted-full' : 'trusted-shared-support');
+      const gDoorPolicyChoices = [
+        ['isolated', 'isolated — own office only (built-in default)'],
+        ['trusted-shared-support', 'trusted / shared-support — office + shared memory, skills, events'],
+        ['trusted-full', 'trusted / full — entire workspace'],
+      ];
+      const gDoorPolicyOpts = gDoorPolicyChoices.map(([value, label]) =>
+        '<option value="' + value + '"' + (gDoorKey === value ? ' selected' : '') + '>' + escHtml(label) + '</option>'
+      ).join('');
       return [
         '<div class="config-grid">',
           '<div class="config-block">',
@@ -2322,10 +2428,16 @@ function renderAdminPage(token) {
             '<div class="config-row"><label>Memory</label><input id="g-mem" placeholder="1g" value="' + escAttr(data.sandboxMemory || '') + '"></div>',
             '<div class="config-row"><label>Boost CPUs</label><input id="g-bcpus" placeholder="2" value="' + escAttr(data.sandboxBoostCpus || '') + '"></div>',
             '<div class="config-row"><label>Boost Mem</label><input id="g-bmem" placeholder="4g" value="' + escAttr(data.sandboxBoostMemory || '') + '"></div>',
-            '<p class="muted-note">Office door policy is configured in host settings. Effective default: ' + escHtml(data.workspaceDoorPolicy + ' / ' + data.workspaceLayout) + '</p>',
             '<button class="primary-action-btn" onclick="saveGlobalSandbox(this)">Save sandbox</button>',
             '<div id="g-sandbox-result" class="inline-result" style="display:none"></div>',
           '</div>',
+          '<div class="config-block">',
+            '<h3 class="card-subtitle">Office door policy</h3>',
+            '<div class="config-row"><label>Default</label><select id="g-door-policy">' + gDoorPolicyOpts + '</select></div>',
+            '<p class="muted-note">Applies to offices without their own policy. Affected offices rebuild their sandbox container with the new mounts on the next message; container contents are preserved.</p>',
+            '<button class="primary-action-btn" onclick="saveGlobalWorkspace(this)">Save door policy</button>',
+            '<div id="g-workspace-result" class="inline-result" style="display:none"></div>',
+          '</div>',
           '<div class="config-block">',
             '<h3 class="card-subtitle">Slack</h3>',
             '<div class="config-row"><label>Reply mode</label><select id="g-slack-reply-mode">' + replyModeOpts + '</select></div>',
@@ -2374,6 +2486,23 @@ function renderAdminPage(token) {
       }
     }
 
+    async function saveGlobalWorkspace(btn) {
+      const doorPolicy = document.getElementById('g-door-policy').value;
+      const result = document.getElementById('g-workspace-result');
+      btn.disabled = true; btn.textContent = 'Saving…'; result.style.display = 'none';
+      try {
+        const data = await apiPost('/admin/api/settings/workspace', { doorPolicy });
+        result.style.display = 'block'; result.className = 'inline-result ok';
+        result.textContent = data.staleConversations > 0
+          ? 'Saved ✓ (' + data.staleConversations + ' busy conversation(s) refresh after their current run)'
+          : 'Saved ✓';
+      } catch (err) {
+        result.style.display = 'block'; result.className = 'inline-result err'; result.textContent = err.message;
+      } finally {
+        btn.disabled = false; btn.textContent = 'Save door policy';
+      }
+    }
+
     async function saveGlobalSlack(btn) {
       const replyMode = document.getElementById('g-slack-reply-mode').value;
       const result = document.getElementById('g-slack-result');