@iloveagents/foundry-agent 0.3.0 → 0.4.0

package/dist/tools/registry.js

@@ -0,0 +1,50 @@
+import { createStore } from "zustand/vanilla";
+export const clientToolRegistry = createStore((set, get) => ({
+    globalTools: new Map(),
+    pageTools: new Map(),
+    registerGlobal: (tool) => {
+        const { globalTools } = get();
+        const next = new Map(globalTools);
+        next.set(tool.name, tool);
+        set({ globalTools: next });
+    },
+    registerPageTools: (tools) => {
+        const next = new Map();
+        for (const tool of tools) {
+            next.set(tool.name, tool);
+        }
+        set({ pageTools: next });
+    },
+    clearPageTools: () => {
+        set({ pageTools: new Map() });
+    },
+    getActiveSchemas: () => {
+        const { globalTools, pageTools } = get();
+        // Merge: page tools override global tools with the same name
+        const merged = new Map();
+        for (const tool of globalTools.values()) {
+            merged.set(tool.name, tool);
+        }
+        for (const tool of pageTools.values()) {
+            merged.set(tool.name, tool); // page overrides global
+        }
+        return Array.from(merged.values()).map((tool) => ({
+            name: tool.name,
+            description: tool.description,
+            parameters: tool.parameters,
+        }));
+    },
+    isRegistered: (name) => {
+        const { globalTools, pageTools } = get();
+        return pageTools.has(name) || globalTools.has(name);
+    },
+    executeTool: async (name, argsJson) => {
+        const { globalTools, pageTools } = get();
+        // Page tools take precedence
+        const tool = pageTools.get(name) ?? globalTools.get(name);
+        if (!tool) {
+            return JSON.stringify({ error: `Unknown client tool: ${name}` });
+        }
+        return tool.execute(argsJson);
+    },
+}));

package/package.json

@@ -1,13 +1,25 @@
 {
   "name": "@iloveagents/foundry-agent",
-  "version": "0.3.0",
-  "license": "SEE LICENSE IN LICENSE",
+  "version": "0.4.0",
+  "license": "MIT",
   "type": "module",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts",
-    "./msal": "./src/msal/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./msal": {
+      "types": "./dist/msal/index.d.ts",
+      "import": "./dist/msal/index.js"
+    }
   },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
   "publishConfig": {
     "access": "public"
   },
@@ -23,14 +35,16 @@
     }
   },
   "devDependencies": {
+    "@ag-ui/client": "^0.0.52",
+    "@ag-ui/core": "^0.0.52",
+    "@azure/msal-browser": "^5.0.0",
+    "jsdom": "^28.1.0",
     "typescript": "~5.9.3",
     "vitest": "^4.1.4",
-    "jsdom": "^28.1.0",
-    "zustand": "^5.0.0",
-    "@ag-ui/client": "^0.0.52",
-    "@ag-ui/core": "^0.0.52"
+    "zustand": "^5.0.0"
   },
   "scripts": {
+    "build": "tsc -p tsconfig.build.json && node ../../scripts/fix-dts-extensions.mjs dist",
     "test:unit": "vitest run",
     "typecheck": "tsc --noEmit"
   }

package/AGENTS.md

@@ -1,91 +0,0 @@
-Pure-TS agent transport for the LastSpace open-core stack. Published as `@iloveagents/foundry-agent`. Zero DOM, zero React, zero `@assistant-ui/*`. Cross-runtime — consumed by `@iloveagents/foundry-web-ui` today, future Outlook / Teams / native shells tomorrow.
-
-# Architecture
-
-```
-src/
-  client/
-    agui-runner.ts    ← AG-UI protocol engine (SSE + multi-turn loop). Yields RunnerEvent.
-    runner-events.ts  ← RunnerEvent discriminated union.
-    service-fetch.ts  ← createServiceFetch({ acquireToken, baseUrl }) factory.
-  store/
-    streaming-status-store.ts  ← vanilla zustand store
-    citation-store.ts          ← vanilla zustand store
-  tools/
-    registry.ts       ← clientToolRegistry (vanilla zustand store).
-  msal/               ← subpath export: @iloveagents/foundry-agent/msal
-    auth-store.ts     ← authStore (vanilla zustand store)
-    auth-config.ts    ← MsalAuthConfig + initializeMsal singleton.
-    token-fetch.ts    ← Bearer-token-attaching fetch.
-    index.ts          ← barrel for the /msal subpath
-  index.ts            ← barrel for the root export.
-  __tests__/          ← vitest suite (runner, service-fetch, no-react smoke).
-```
-
-# Import boundary (enforced by guard test)
-
-Files under `packages/agent/src/` (excluding `msal/`) MUST NOT import:
-
-- `react`, `react-dom`
-- `@assistant-ui/*` (anywhere — including under `msal/`)
-- `@azure/msal-*` (anywhere — including under `msal/` for `msal-react`; only `@azure/msal-browser` is allowed under `msal/`)
-- bare `"zustand"` — use `"zustand/vanilla"` (`zustand/middleware` is allowed)
-
-Files under `packages/agent/src/msal/` MAY import `@azure/msal-browser` (dynamic import only — keeps the dep optional). They MUST NOT import `@azure/msal-react` (which is React-bound and lives in `@iloveagents/foundry-web-ui`).
-
-`packages/agent/` MUST NOT import from any other `@lastspace/*` package — agent is the leaf of the open-core graph.
-
-# Why `zustand/vanilla`
-
-`import { create } from "zustand"` resolves to the React build (`useSyncExternalStore`). Importing it in a "zero React" package would silently take a React dependency and defeat the cross-runtime goal. Every store in this package uses `import { createStore } from "zustand/vanilla"`. React consumers (in `@iloveagents/foundry-web-ui` / `apps/web/`) bind via `useStore(store, selector)` from the React entry of zustand.
-
-# What goes here
-
-- AG-UI protocol client (SSE, message conversion, multi-turn re-issue, tool dispatch).
-- Vanilla state stores that the protocol engine needs at runtime — streaming status, citation cache, client-tool registry.
-- MSAL bits under the `/msal` subpath only.
-- Generic per-service fetch factory (`createServiceFetch`).
-
-# What does NOT go here
-
-- Anything implementing `@assistant-ui/*` interfaces (`ChatModelAdapter`, `AttachmentAdapter`, etc.) — those are React UI surface and live in `@iloveagents/foundry-web-ui`.
-- React components, hooks, contexts, providers.
-- UI-layout state (panel widths, modal modes, theme).
-- The `MsalProvider` React component — that lives in `@iloveagents/foundry-web-ui`.
-
-# Public surface
-
-Root `@iloveagents/foundry-agent`:
-
-```ts
-import {
-  AGUIRunner,
-  type RunnerEvent,
-  createServiceFetch,
-  clientToolRegistry,
-  type ClientToolEntry,
-  streamingStatusStore,
-  type StreamingStatus,
-  citationStore,
-  type CitationResult,
-  type CitationHandler,
-} from "@iloveagents/foundry-agent";
-```
-
-Subpath `@iloveagents/foundry-agent/msal`:
-
-```ts
-import {
-  authStore,
-  type AuthUser,
-  type MsalAuthConfig,
-  initializeMsal,
-  getMsalInstance,
-  getMsalConfig,
-  tokenFetch,
-} from "@iloveagents/foundry-agent/msal";
-```
-
-# Bundle-size budget
-
-Target ≤25 KB gz on the root entry (`@iloveagents/foundry-agent`, excluding the `/msal` subpath). Measured manually pre-1.0 via `gzip -c dist/index.js | wc -c`; `size-limit` enforcement scaffolds in #92's follow-up.

package/CHANGELOG.md

@@ -1,180 +0,0 @@
-# @iloveagents/foundry-agent
-
-## 0.3.0
-
-## 0.2.2
-
-### Patch Changes
-
-- 8184a8c: shell: URL is authoritative for the runtime threadId — fixes
-  resume-creates-new-conversation race
-
-  `ChatConversationAwareRuntime` previously computed
-  `effectiveThreadId = sticky ?? urlMatch ?? freshIdRef.current`.
-  When the user navigated from one chat to another via a Recents
-  click, the synchronous render that followed the URL change had:
-  - `urlMatch = B` (read from the now-updated `useLocation`)
-  - `sticky = A` (the active-chat-store hadn't been updated by
-    `useTrackActiveChatFromUrl`'s `useEffect` yet — effects run
-    AFTER the commit phase)
-
-  `sticky ?? urlMatch` picked `A` (the previous chat). The AG-UI
-  adapter was constructed with `threadId = A`. The first message the
-  user sent went to `/api/agent` with `thread_id = A`, the middleware
-  created a new row keyed by `A`... wait actually no, here's what
-  happens — the runtime mints a fresh runner UUID when given a
-  mismatched threadId; that fresh UUID became a new conversation row,
-  appearing as "Untitled chat" at the top of the sidebar while the
-  URL still said `/chat/B`. Two active-looking dots: one for `B`
-  (NavLink URL match), one for the new row (statusDot from the
-  updated active-chat-store after the lazy ensure ran).
-
-  Swap the priority: `urlMatch ?? sticky ?? freshIdRef.current`. The
-  URL is authoritative whenever it's set (i.e. on `/chat/<id>`
-  routes), eliminating the stale-sticky race entirely. `sticky` is
-  still consulted as the second-priority fallback for non-chat
-  routes (`/spaces`, `/tasks`) so the popout chat stays "live" while
-  the user browses workspaces — that's the original purpose of
-  `useStickyConversationId` and it's preserved.
-
-## 0.2.1
-
-### Patch Changes
-
-- No source changes. The 0.2.0 publish for `@iloveagents/foundry-agent` and
-  `@iloveagents/foundry-web-primitives` failed because npm had `0.2.0`
-  reserved for those two packages from an older publish-then-unpublish
-  cycle (the version was reserved before the recent v1 incident — see
-  git tag history). `@iloveagents/foundry-web-shell@0.2.0` and
-  `@iloveagents/foundry-web-ui@0.2.0` published cleanly. Bumping the
-  whole fixed group to 0.2.1 so all four publish together at a version
-  number that's free across all four packages.
-
-## 0.2.0
-
-### Minor Changes
-
-- shell: ChatConversationConfig API + sticky-runtime threadId
-
-  Lets a downstream module (e.g. `@ltwlf/spaces-web-ui`) attach a
-  `ChatConversationConfig` to its `ChatModule`. The shell then:
-  - Pre-mints a fresh thread UUID via `useRef` so the AG-UI runtime's
-    `threadId` is defined from first render — no `undefined → defined`
-    remount mid-conversation when the user sends the first message.
-  - Calls `config.useStickyConversationId()` (when declared) and
-    feeds the resulting id into the runtime so the chat stays "live"
-    while the user browses non-chat routes (Workspaces, Jobs, etc.).
-  - Per-config keyed child components (`StickyAwareRuntime` vs
-    `UrlOnlyRuntime`) so optional hooks satisfy Rules-of-Hooks across
-    multi-module config swaps.
-
-  UI: collapsible nav groups in `sidebar.tsx` with persisted state via
-  `useSyncExternalStore` + localStorage, plus stable group ordering via
-  new `priority` field in `nav-config.ts`.
-
-  `ag-ui-runtime-provider.tsx` accepts an external `threadId` and
-  `historyAdapterFactory` so the consuming app can wire its own
-  persistence (e.g. `ThreadHistoryAdapter` → REST `/api/conversations`).
-
-### Patch Changes
-
-- Fix `citationStore.clear()` so the registered handler survives per-conversation resets.
-
-  The previous implementation wiped both `results` AND `handler`. `useNewConversation` calls `clear()` on every "New Thread" click. Combined with the `registerOnce`-style handler registration in feature modules (e.g. SPACES' `registerSpacesCitationHandler`), the result was that all `[n]` citation markers in chat became inert non-clickable spans for the rest of the session after the first new-thread click. `clear()` now resets `results` only — the handler is module-level state and must persist.
-
-- Move sibling `@iloveagents/foundry-*` declarations from `peerDependencies`
-  to `dependencies` in `foundry-web-shell` and `foundry-web-ui`. These four
-  packages always ship together as a coordinated fixed group from the same
-  monorepo — they were never independently-versioned peers, so declaring
-  them as peerDeps caused changesets' `shouldBumpMajor` cascade to promote
-  the entire group to a major version on every minor changeset (a single
-  minor on any of the four would exit the sibling's `^0.x.y` peerDep range
-  → all dependents promoted to major → fixed group synced all four to
-  major → 0.1.5 unexpectedly jumped to 1.0.0). Moving to `dependencies`
-  eliminates the cascade entirely; `dependencies` never trigger
-  `shouldBumpMajor`. Consumers that already install each foundry-\* package
-  directly are unaffected — pnpm hoists by name, so a single instance
-  resolves across the dep graph regardless of declaration site.
-
-### NOTE: 1.0.0 / 1.0.1 were accidental
-
-These version numbers were published briefly on 2026-05-27 due to the
-peerDep cascade bug described above, then unpublished. The version
-numbers themselves are now permanently reserved on npm and CANNOT be
-re-published. This 0.2.0 release captures all the work that was in
-the accidental 1.0.x releases. Do not depend on 1.0.x.
-
-## 0.1.5
-
-## 0.1.4
-
-### Patch Changes
-
-- 07ace7e: fix(agent): canonical MSAL.js recovery — acquireTokenRedirect-first, orphaned-state cleanup, dedup
-
-  Closes the production "stuck on 401 forever" bug observed on andritz-dev after the 0.1.2 / 0.1.3 fixes. Diagnostic on the live tab showed `getAllAccounts() === []` despite localStorage holding 3 access tokens + 1 refresh token — the orphaned-state signature.
-
-  **Root cause:** The previous recovery code did `setActiveAccount(null) + clearCache({account}) + loginRedirect()`. When `loginRedirect()` silently failed to navigate (caught by our try/catch — popup blocker, browser policy, async race), the account record was already gone but the tokens lingered. Every subsequent API call hit `getAllAccounts() === []` and silently returned `null` — no Bearer header, endless 401s, only manual `localStorage.clear()` recovered.
-
-  **Canonical 2026 fix per Microsoft Learn `entra/msal/javascript/browser/errors`** + linked GitHub issues + msal-react samples:
-  1. **`acquireTokenRedirect` first, not `loginRedirect`.** It's the documented primitive for refreshing a known account's tokens — preserves the account record across the navigation. `loginRedirect` is only the fallback when `acquireTokenRedirect` itself fails to navigate.
-  2. **Never `clearCache` before redirect.** The redirect navigation IS the recovery signal; if it succeeds, MSAL handles state cleanup; if it fails, leave state intact for the next attempt rather than orphaning the cache.
-  3. **Detect + repair orphaned state.** When `getAllAccounts() === []` but localStorage has MSAL token entries, nuke ALL `msal.*` keys (localStorage + sessionStorage) and force a fresh `loginRedirect`. Without this, the SPA renders authenticated UI but every API call goes anonymous.
-  4. **Module-level recovery deduplication.** Multiple parallel API calls all hitting the recovery path simultaneously now share a single in-flight redirect promise instead of each issuing their own (which would cascade `interaction_in_progress` errors).
-
-  The previous `recoverFromHardAuthFailure` callback now uses the same primitive — single recovery path for both "MSAL silent failed" and "API rejected refreshed token".
-
-  68/68 agent tests pass (was 65) — the new tests assert the no-clearCache invariant, the acquireTokenRedirect-first ordering, the loginRedirect fallback path, and the orphaned-state nuke + redirect. Pair: lastspace bump to ^0.1.4.
-
-## 0.1.3
-
-### Patch Changes
-
-- d9b0460: fix(agent): escalate to loginRedirect after second 401
-
-  Follow-up to the auth-stale-token-401-retry fix in 0.1.2. The first version retried with `forceRefresh: true` and bounced to `loginRedirect` only when MSAL itself reported `InteractionRequiredAuthError`. But there's a more common production failure mode the silent path can't recover: the resource server rejects the **freshly-refreshed** token too — server-side policy drift, audience mismatch, conditional-access re-evaluation, claims challenge, tenant-policy change. MSAL has no way to know about any of this; it produces a clean refreshed token and calls it a day. The user is left in an endless silent 401 loop because nothing kicks them to `loginRedirect`.
-
-  Adds `recoverFromHardAuthFailure(reason)` on `authStore`. The fetch interceptor calls it when a SECOND consecutive 401 fires (i.e. even the force-refresh retry didn't help). It clears the MSAL cache and starts `loginRedirect` so a brand-new session mints a token bound to current server policy.
-
-  `createServiceFetch` now accepts an optional `recoverFromHardAuthFailure` callback. The default consumer (`@iloveagents/foundry-web-shell`) wires it to the new method on `authStore`. Same pattern in `tokenFetch`.
-
-  Pair: `lastspace#TBD` (forwards the new option through `spacesFetch`).
-
-## 0.1.2
-
-### Patch Changes
-
-- 30a4346: fix(agent): retry protected fetch with `forceRefresh` on 401
-
-  Closes the long-lived-tab 401 loop where the only recovery the user had was logging out or clearing localStorage.
-
-  The token-fetch wrapper used to ask MSAL for a cached token and never retry. If the resource server rejected that token (claims challenge, conditional-access re-eval, audience drift, or staleness MSAL's clock-offset check missed), every subsequent request kept re-sending the same token.
-
-  Fix: on 401 from a protected API, retry once with `acquireTokenSilent({ forceRefresh: true })`. If that also fails, the existing `InteractionRequiredAuthError` path bounces the user through Entra ID. Single-retry cap so we never loop. Request bodies are cloned per-attempt (ReadableStream is single-consume) so POST/PUT payloads survive the retry intact.
-
-  The `acquireToken` callback type now accepts an optional `{ forceRefresh? }` argument — non-breaking; existing callbacks continue to work, but they should forward the option to their token source so the retry path actually reaches the auth backend.
-
-  Pair: `lastspace#205` (forwards the option through `spacesFetch.acquireToken`).
-
-## 0.1.1
-
-### Patch Changes
-
-- 689d3e9: feat(sidebar): distinct file-drop affordance for nav containers
-
-  `useNavItemDnd` now exposes `isFileDragOver` separately from `isDragOver`
-  so consuming nav items can render a prominent file-drop visual (dashed
-  primary outline + soft primary background + Upload icon) when the user
-  is dragging native files over the container. Previously file drags
-  shared the same subtle ring as entity-move drags, so users couldn't
-  tell that a folder accepted external files. Applies to all five nav-
-  item shapes (action-row leaf, button leaf, `NestedFolderItem`,
-  `CollapsibleNavItem` with children/actions, `NavLink` fallthrough) and
-  updates `ContainerDropZone` for visual parity.
-
-  Also fixes a related regression: the capture-phase
-  `onDragEnterCapture` / `onDragOverCapture` handlers were calling
-  `e.stopPropagation()`, which short-circuits React's synthetic dispatch
-  and prevented the bubble-phase `onDragEnter` (where state actually
-  mutates) from running. Removed — `preventDefault()` alone is enough to
-  mark the element as droppable.

package/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md