@geminixiang/mikan 1.0.0-beta.62 → 1.0.0-beta.63

package/dist/adapters/web/admin/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/admin/portal.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,qBAAa,uBAAwB,SAAQ,kBAAkB,CAAC,UAAU,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,UAAU,CAUb;CACF;AAsCD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,OAAO,CAAC,CA6BlB;AA0GD,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,UAAU,GAChB,sBAAsB,CAexB;AA8gCD,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAwBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,EAAE,CAuB/F;AAqRD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAmBjF"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/admin/portal.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,qBAAa,uBAAwB,SAAQ,kBAAkB,CAAC,UAAU,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,UAAU,CAUb;CACF;AAoCD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,OAAO,CAAC,CA6BlB;AAwGD,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,UAAU,GAChB,sBAAsB,CAexB;AA28BD,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAwBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,EAAE,CAuB/F;AAqRD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAmBjF"}

package/dist/adapters/web/admin/portal.js

@@ -16,11 +16,11 @@ export class InMemoryAdminTokenStore extends InMemoryTokenStore {
         });
     }
 }
-import { loadConversationWorkspaceOverride, loadGlobalSettings, loadScopeMcpServers, resolveConversationSettings, } from "../../../config.js";
+import { loadOfficeVisibilityOverride, loadGlobalSettings, loadScopeMcpServers, resolveConversationSettings, } from "../../../config.js";
 import { findMcpPreset, listMcpPresets, materializeMcpPreset } from "../../../harness/mcp.js";
 import { loadMcpTools } from "../../../harness/mcp.js";
 import { isValidMcpServerName, parseStandardMcpServers, redactMcpUrl, } from "../../../harness/mcp.js";
-import { applyConversationSettings, applyConversationWorkspacePolicy, applyGlobalSettings, applyGlobalWorkspacePolicy, } from "../../../settings-mutation.js";
+import { applyConversationSettings, applyOfficeVisibility, applyGlobalSettings, } from "../../../settings-mutation.js";
 import { escapeHtml, jsonResponse as jsonRes, readJsonBody, renderPortalShell, } from "../portal-shell.js";
 import { resolveExistingSessionFile } from "../session-view/portal.js";
 import { PRODUCT_NAME } from "../../../platform-messages.js";
@@ -115,8 +115,8 @@ async function routePostApiRequest(req, res, url, services) {
     switch (url.pathname) {
         case "/admin/api/conversations/model":
             return serveConversationModelUpdate(res, body, services, token);
-        case "/admin/api/conversations/sandbox":
-            return serveConversationSandboxUpdate(res, body, services, token);
+        case "/admin/api/conversations/visibility":
+            return serveConversationVisibilityUpdate(res, body, services, token);
         case "/admin/api/conversations/slack":
             return serveConversationSlackUpdate(res, body, services, token);
         case "/admin/api/conversations/session-link":
@@ -129,8 +129,6 @@ async function routePostApiRequest(req, res, url, services) {
             return serveMcpServerMutation(res, body, services, token);
         case "/admin/api/settings/model":
             return serveGlobalModelUpdate(res, body, services);
-        case "/admin/api/settings/workspace":
-            return serveGlobalWorkspaceUpdate(res, body, services);
         case "/admin/api/settings/sandbox":
             return serveGlobalSandboxUpdate(res, body, services);
         case "/admin/api/settings/slack":
@@ -443,7 +441,6 @@ function serveConversationState(res, url, services, token) {
     const globalConfig = loadGlobalSettings();
     const conversationConfig = resolveConversationSettings(office);
     const conversationWorkspace = resolveWorkspaceProjection(office);
-    const globalWorkspaceSettings = globalConfig.sandbox?.workspace;
     jsonRes(res, 200, {
         conversationId,
         provider: conversationConfig.provider,
@@ -452,13 +449,10 @@ function serveConversationState(res, url, services, token) {
         globalProvider: globalConfig.provider,
         globalModel: globalConfig.model,
         globalThinkingLevel: globalConfig.thinkingLevel,
-        workspaceDoorPolicy: conversationWorkspace.doorPolicy,
-        workspaceLayout: conversationWorkspace.layout,
-        workspaceVisibility: conversationWorkspace.visibility,
-        workspaceOverride: doorPolicyChoiceKey(loadConversationWorkspaceOverride(office)),
-        globalWorkspaceDoorPolicy: globalWorkspaceSettings?.doorPolicy ?? "isolated",
-        globalWorkspaceLayout: globalWorkspaceSettings?.layout ?? "conversation",
-        globalWorkspaceVisibility: globalWorkspaceSettings?.visibility ?? "public",
+        officeVisibility: conversationWorkspace.visibility,
+        officeVisibilitySource: conversationWorkspace.source,
+        officeVisibilityOverride: loadOfficeVisibilityOverride(office),
+        officeLegacyFull: conversationWorkspace.legacyFull,
         slack: {
             replyMode: conversationConfig.slack?.replyMode ?? globalConfig.slack?.replyMode ?? "top-level",
             globalReplyMode: globalConfig.slack?.replyMode ?? "top-level",
@@ -476,9 +470,6 @@ function serveGlobalSettings(res) {
             sandboxMemory: config.sandbox?.memory ?? null,
             sandboxBoostCpus: config.sandbox?.boost?.cpus ?? null,
             sandboxBoostMemory: config.sandbox?.boost?.memory ?? null,
-            workspaceDoorPolicy: config.sandbox?.workspace?.doorPolicy ?? null,
-            workspaceLayout: config.sandbox?.workspace?.layout ?? null,
-            workspaceVisibility: config.sandbox?.workspace?.visibility ?? null,
             defaultSharedVault: config.sandbox?.defaultSharedVault ?? null,
             slack: {
                 replyMode: config.slack?.replyMode ?? "top-level",
@@ -543,48 +534,9 @@ function serveConversationModelUpdate(res, body, services, token) {
         jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
     }
 }
-/**
- * Wire values for a door-policy selection; "default" clears the office's
- * override. `trusted-shared-support` keeps the historical read-write shared
- * MEMORY.md; `trusted-shared-support-private` is the same layout with the
- * shared MEMORY.md mounted read-only (modeled on Claude Tag's private-
- * channel memory: read the shared pool, never write into it).
- */
-function parseDoorPolicyChoice(value) {
-    switch (value) {
-        case "default":
-            return { choice: null };
-        case "isolated":
-            return { choice: { doorPolicy: "isolated" } };
-        case "trusted-shared-support":
-            return { choice: { doorPolicy: "trusted", layout: "shared-support", visibility: "public" } };
-        case "trusted-shared-support-private":
-            return {
-                choice: { doorPolicy: "trusted", layout: "shared-support", visibility: "private" },
-            };
-        case "trusted-full":
-            return { choice: { doorPolicy: "trusted", layout: "full" } };
-        default:
-            return undefined;
-    }
-}
-function doorPolicyChoiceKey(choice) {
-    if (!choice)
-        return "default";
-    if (choice.doorPolicy === "isolated")
-        return "isolated";
-    if (choice.layout === "full")
-        return "trusted-full";
-    return choice.visibility === "private"
-        ? "trusted-shared-support-private"
-        : "trusted-shared-support";
-}
-function serveConversationSandboxUpdate(res, body, services, token) {
-    const parsed = parseDoorPolicyChoice(body.doorPolicy);
-    if (!parsed) {
-        jsonRes(res, 400, {
-            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', 'trusted-shared-support-private', or 'trusted-full'",
-        });
+function serveConversationVisibilityUpdate(res, body, services, token) {
+    if (body.visibility !== "private" && body.visibility !== "default") {
+        jsonRes(res, 400, { error: "visibility must be 'private' or 'default'" });
         return;
     }
     const target = requireConversationWorkspace(res, body, services, token);
@@ -592,7 +544,7 @@ function serveConversationSandboxUpdate(res, body, services, token) {
         return;
     const { scope, workspace } = target;
     try {
-        const result = applyConversationWorkspacePolicy(services.runtime, workspace.office(scope.address), parsed.choice);
+        const result = applyOfficeVisibility(services.runtime, workspace.office(scope.address), body.visibility === "private" ? "private" : null);
         if (!result.ok) {
             jsonRes(res, 409, { error: "Conversation is busy; retry when the current run finishes" });
             return;
@@ -603,19 +555,6 @@ function serveConversationSandboxUpdate(res, body, services, token) {
         jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
     }
 }
-function serveGlobalWorkspaceUpdate(res, body, services) {
-    const parsed = parseDoorPolicyChoice(body.doorPolicy);
-    if (!parsed) {
-        jsonRes(res, 400, {
-            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', 'trusted-shared-support-private', or 'trusted-full'",
-        });
-        return;
-    }
-    respondWithSettingsUpdate(res, () => {
-        const result = applyGlobalWorkspacePolicy(services.runtime, parsed.choice);
-        return { ok: true, staleConversations: result.staleConversations.length };
-    });
-}
 function serveConversationSlackUpdate(res, body, services, token) {
     const replyMode = body.replyMode;
     if (replyMode !== "top-level" && replyMode !== "thread") {
@@ -1848,23 +1787,12 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
     function renderReplyOptions(slack) {
       return renderOptions(['top-level','thread'].map((m) => [m, m]), (slack && slack.replyMode) || 'top-level');
     }
-    function renderDoorOptions(value, channel) {
-      return renderOptions([
-        ['default', 'Automatic — follows ' + channel + ' platform channel (public shares, private reads only, DMs isolated)'],
-        ['isolated', 'isolated — own office only'],
-        ['trusted-shared-support', 'trusted / shared-support (public) — office + shared memory, skills, events — read-write'],
-        ['trusted-shared-support-private', 'trusted / shared-support (private) — same, but shared MEMORY.md is read-only'],
-        ['trusted-full', 'trusted / full — entire workspace'],
-      ], value);
-    }
-
     function renderSettings(data) {
       const thinkingOpts = renderThinkingOptions(data.thinkingLevel);
       const replyModeOpts = renderReplyOptions(data.slack);
       const globalReplyMode = (data.slack && data.slack.globalReplyMode) || 'top-level';
       const globalModel = [data.globalProvider, data.globalModel].filter(Boolean).join('/');
       const globalModelLabel = globalModel + (data.globalThinkingLevel ? ':' + data.globalThinkingLevel : '');
-      const doorPolicyOpts = renderDoorOptions(data.workspaceOverride || 'default', 'the');
       return [
         '<div class="config-grid">',
           renderConfigCard('Model', [
@@ -1873,11 +1801,19 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
             '<p class="muted-note">Global default: ' + escHtml(globalModelLabel) + '</p>',
           ].join(''), 'saveModel', 'Save model', 'model-save-result'),
 
-          renderConfigCard('Office data policy', [
-            '<div class="config-row"><label>Door policy</label><select id="m-door-policy">' + doorPolicyOpts + '</select></div>',
-            '<p class="muted-note">Effective: ' + escHtml(data.workspaceDoorPolicy + ' / ' + data.workspaceLayout + ' / ' + (data.workspaceVisibility || 'public')) + '</p>',
-            '<p class="muted-note">Changing the policy rebuilds the office sandbox container with the new mounts on its next message; the container contents are preserved.</p>',
-          ].join(''), 'saveDoorPolicy', 'Save door policy', 'mount-save-result'),
+          renderConfigCard('Office visibility', [
+            '<div class="config-row"><label>Visibility</label><select id="m-visibility">' +
+              renderOptions([
+                ['default', 'Follow the Slack conversation type (default)'],
+                ['private', 'Private — treat this public channel as private'],
+              ], data.officeVisibilityOverride === 'private' ? 'private' : 'default') + '</select></div>',
+            '<p class="muted-note">Effective: <strong>' + escHtml(data.officeVisibility) + '</strong> · ' + escHtml(
+              data.officeVisibilitySource === 'override' ? 'set here'
+              : data.officeVisibilitySource === 'platform' ? 'from the Slack conversation type'
+              : 'conversation type unknown; private until observed') + '</p>',
+            '<p class="muted-note">Public offices can be read by every other office and may write shared MEMORY.md and skills. Private offices (private channels, DMs) are visible only to themselves and read shared knowledge without writing it. Nothing can be made more visible than Slack allows.</p>',
+            (data.officeLegacyFull ? '<p class="muted-note">This office still declares the retired <code>full</code> door policy; it no longer widens access.</p>' : ''),
+          ].join(''), 'saveVisibility', 'Save visibility', 'mount-save-result'),
           renderConfigCard('Slack', [
             '<div class="config-row"><label>Reply mode</label><select id="m-slack-reply-mode">' + replyModeOpts + '</select></div>',
             '<p class="muted-note">Global default: ' + escHtml(globalReplyMode) + '</p>',
@@ -1906,10 +1842,10 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
       await saveConversationSetting(btn, result, 'slack', { replyMode }, 'Save Slack');
     }
 
-    async function saveDoorPolicy(btn) {
-      const doorPolicy = document.getElementById('m-door-policy').value;
+    async function saveVisibility(btn) {
+      const visibility = document.getElementById('m-visibility').value;
       const result = document.getElementById('mount-save-result');
-      await saveConversationSetting(btn, result, 'sandbox', { doorPolicy }, 'Save door policy', loadSettings);
+      await saveConversationSetting(btn, result, 'visibility', { visibility }, 'Save visibility', loadSettings);
     }
 
     function saveConversationSetting(btn, result, setting, values, label, onSaved) {
@@ -2674,14 +2610,6 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
     function renderGlobalSettings(data) {
       const thinkingOpts = renderThinkingOptions(data.thinkingLevel);
       const replyModeOpts = renderReplyOptions(data.slack);
-      const gDoorKey = !data.workspaceDoorPolicy
-        ? 'default'
-        : (data.workspaceDoorPolicy === 'isolated'
-          ? 'isolated'
-          : (data.workspaceLayout === 'full'
-            ? 'trusted-full'
-            : ((data.workspaceVisibility || 'public') === 'private' ? 'trusted-shared-support-private' : 'trusted-shared-support')));
-      const gDoorPolicyOpts = renderDoorOptions(gDoorKey, 'each');
       return [
         '<div class="config-grid">',
           renderConfigCard('Default model', [
@@ -2694,10 +2622,6 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
             '<div class="config-row"><label>Boost CPUs</label><input id="g-bcpus" placeholder="2" value="' + escAttr(data.sandboxBoostCpus || '') + '"></div>',
             '<div class="config-row"><label>Boost Mem</label><input id="g-bmem" placeholder="4g" value="' + escAttr(data.sandboxBoostMemory || '') + '"></div>',
           ].join(''), 'saveGlobalSandbox', 'Save sandbox', 'g-sandbox-result'),
-          renderConfigCard('Office door policy', [
-            '<div class="config-row"><label>Default</label><select id="g-door-policy">' + gDoorPolicyOpts + '</select></div>',
-            '<p class="muted-note">Applies to offices without their own policy. Affected offices rebuild their sandbox container with the new mounts on the next message; container contents are preserved.</p>',
-          ].join(''), 'saveGlobalWorkspace', 'Save door policy', 'g-workspace-result'),
           renderConfigCard('Slack', [
             '<div class="config-row"><label>Reply mode</label><select id="g-slack-reply-mode">' + replyModeOpts + '</select></div>',
           ].join(''), 'saveGlobalSlack', 'Save Slack', 'g-slack-result'),
@@ -2735,23 +2659,6 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
       await saveSetting(btn, result, 'settings/sandbox', { cpus, memory, boostCpus, boostMemory }, 'Save sandbox');
     }
 
-    async function saveGlobalWorkspace(btn) {
-      const doorPolicy = document.getElementById('g-door-policy').value;
-      const result = document.getElementById('g-workspace-result');
-      btn.disabled = true; btn.textContent = 'Saving…'; result.style.display = 'none';
-      try {
-        const data = await apiPost('/admin/api/settings/workspace', { doorPolicy });
-        result.style.display = 'block'; result.className = 'inline-result ok';
-        result.textContent = data.staleConversations > 0
-          ? 'Saved ✓ (' + data.staleConversations + ' busy conversation(s) refresh after their current run)'
-          : 'Saved ✓';
-      } catch (err) {
-        result.style.display = 'block'; result.className = 'inline-result err'; result.textContent = err.message;
-      } finally {
-        btn.disabled = false; btn.textContent = 'Save door policy';
-      }
-    }
-
     async function saveGlobalSlack(btn) {
       const replyMode = document.getElementById('g-slack-reply-mode').value;
       const result = document.getElementById('g-slack-result');