@netnodeag/kraftwerk 0.39.1 → 0.41.0

package/dist/inspector/diagnose.d.ts

@@ -0,0 +1,32 @@
+import type { ChatAgentId, ChatScope } from "./chat/types.js";
+import { type DiagnoseRef } from "./notifications.js";
+/**
+ * "Diagnose" on a failure item in the bell: open a chat in the place that
+ * knows most about the failure and hand it a first message that asks for
+ * root cause and a fix.
+ *
+ *   workflow run failed  -> run chat (cwd = run folder, project root granted)
+ *   routine session died -> a fresh session of the same agent, pointed at the
+ *                           failed session's event log
+ *   routine could not start -> kraftwerk-aware chat (the agent/harness setup is the problem)
+ *
+ * The prompt is built here, at click time, so it reflects the run's final
+ * state, and the chat shows it as the user's own first message — nothing
+ * hidden.
+ */
+export interface DiagnosePlan {
+    agent: ChatAgentId;
+    scope: ChatScope;
+    title: string;
+    prompt: string;
+}
+/** Where and how the diagnosis chat starts, for a failure item's reference. */
+export declare function diagnosePlan(ref: DiagnoseRef, title: string): Promise<DiagnosePlan | null>;
+/** Create the chat, send the first message, mark the item read. */
+export declare function startDiagnosis(notificationId: string): Promise<{
+    chatId: string;
+    href: string;
+} | {
+    error: string;
+    status: number;
+}>;

package/dist/inspector/diagnose.js

@@ -0,0 +1,80 @@
+import path from "node:path";
+import { getOutputDir } from "./context.js";
+import { getAgent } from "./agents.js";
+import { getRun } from "./runs.js";
+import { listRoutines } from "./routines.js";
+import { createChat, getChat, postMessage } from "./chat/sessions.js";
+import { chatHref, getNotification, markNotificationsRead } from "./notifications.js";
+const FIX_INSTRUCTIONS = `Work in this order:\n` +
+    `1. Find the root cause. Read the evidence before guessing, and say in plain words what went wrong and where.\n` +
+    `2. Decide whether the fix belongs in the workflow definition (prompts, steps, gates, agent configs), in the project, ` +
+    `or outside (credentials, network, a missing tool). Say which.\n` +
+    `3. If the fix is in the workflow or project files, apply it and show the diff. If it is outside, say exactly what the user must do.\n` +
+    `4. End with how to verify: the command to re-run, and what a good result looks like.`;
+function runPrompt(run) {
+    const phases = run.phases
+        .map((p) => `- ${p.phase} [${p.status}]${p.summary ? `: ${p.summary}` : ""}`)
+        .join("\n");
+    const failedPhase = run.phases.find((p) => p.status === "failed" || p.status === "blocked");
+    return (`Workflow run ${run.id} of "${run.workflow ?? "?"}" ended with status ${run.status}` +
+        (failedPhase ? ` in phase "${failedPhase.phase}" (${failedPhase.status})` : "") +
+        `.\nRequest: ${run.request ?? "(none)"}\n\nPhases:\n${phases || "(none)"}\n\n` +
+        `Please diagnose this run. The evidence is in this folder: trace.jsonl (every event), trigger.log ` +
+        `(process output), and the phase outputs. The workflow definition lives in the project root, which you may edit.\n\n` +
+        FIX_INSTRUCTIONS +
+        `\nRe-run with: KRAFTWERK_YES=1 npx kraftwerk run ${run.workflow ?? "<workflow>"} "${(run.request ?? "").replace(/"/g, '\\"')}"`);
+}
+async function routinePrompt(ref, agentExists) {
+    const routine = (await listRoutines(ref.agent).catch(() => []))
+        .find((r) => r.id === ref.routine);
+    const head = routine
+        ? `The routine "${routine.name}" (schedule ${routine.schedule}) of agent "${ref.agent}" failed.\nIts prompt was:\n"""\n${routine.prompt}\n"""\n`
+        : `A routine (${ref.routine}) of agent "${ref.agent}" failed.\n`;
+    let evidence;
+    if (ref.chatId) {
+        const chat = await getChat(ref.chatId).catch(() => null);
+        const errors = chat?.events.filter((e) => e.type === "error").map((e) => e.message) ?? [];
+        evidence =
+            `The failed session's full event log is ${path.join(getOutputDir(), "chats", ref.chatId, "events.jsonl")} ` +
+                `(one JSON event per line: user_message, text, tool_call, error, turn_end).` +
+                (errors.length ? `\nErrors recorded:\n${errors.map((m) => `- ${m}`).join("\n")}` : "");
+    }
+    else {
+        evidence = agentExists
+            ? `The session could not even start. Check the agent's definition under agents/${ref.agent}/ (agent.yml, routines.yml) and whether its harness is installed and authenticated.`
+            : `The session could not start because agent "${ref.agent}" was not found — check agents/${ref.agent}/agent.yml and the routine in agents/${ref.agent}/routines.yml.`;
+    }
+    return `${head}\n${evidence}\n\nPlease diagnose this failure.\n\n${FIX_INSTRUCTIONS}\nRe-run from the agent page ("run" next to the routine) or wait for the next scheduled time.`;
+}
+/** Where and how the diagnosis chat starts, for a failure item's reference. */
+export async function diagnosePlan(ref, title) {
+    if (ref.kind === "run") {
+        const run = await getRun(ref.runId).catch(() => null);
+        if (!run)
+            return null;
+        return { agent: "claude", scope: { kind: "run", runId: run.id }, title: `🩺 ${title}`, prompt: runPrompt(run) };
+    }
+    const def = await getAgent(ref.agent).catch(() => null);
+    const prompt = await routinePrompt(ref, !!def);
+    // A session that died mid-run: the agent itself looks at its own log.
+    // No session at all (agent or harness broken): the kraftwerk-aware chat.
+    const scope = def && ref.chatId ? { kind: "agent", slug: def.slug } : { kind: "kraftwerk" };
+    return { agent: def && ref.chatId ? def.harness : "claude", scope, title: `🩺 ${title}`, prompt };
+}
+/** Create the chat, send the first message, mark the item read. */
+export async function startDiagnosis(notificationId) {
+    const item = await getNotification(notificationId);
+    if (!item)
+        return { error: "notification not found", status: 404 };
+    if (!item.diagnose)
+        return { error: "nothing to diagnose for this item", status: 409 };
+    const plan = await diagnosePlan(item.diagnose, item.title);
+    if (!plan)
+        return { error: "the run this item refers to is gone", status: 410 };
+    const meta = await createChat({ agent: plan.agent, scope: plan.scope, title: plan.title });
+    const { error } = await postMessage(meta.id, plan.prompt);
+    if (error)
+        return { error, status: 409 };
+    void markNotificationsRead([item.id]);
+    return { chatId: meta.id, href: chatHref(meta) };
+}

package/dist/inspector/git.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { realpathSync } from "node:fs";
 import path from "node:path";
-import { reposRootFor, resolveProject, vibeablesRootFor } from "../config.js";
+import { reposRootFor, resolveProject, vibeablesRootFor, isSafeGitName } from "../config.js";
 import { ENV_FILE } from "../runner/docker.js";
 import { getOutputDir, getProjectRoot } from "./context.js";
 /**
@@ -130,6 +130,19 @@ export async function sshCommandFor(repoRoot) {
 export async function gitNet(args, repoRoot) {
     return git(args, repoRoot, NET_TIMEOUT, { GIT_SSH_COMMAND: await sshCommandFor(repoRoot) });
 }
+/**
+ * Remote/branch names from kraftwerk.yml become git positionals. Config
+ * load and the settings API already refuse dash-led names, but the file is
+ * shared through the workspace repo itself, so the call site checks again
+ * and separates options from positionals.
+ */
+function netArgs(cmd, ...names) {
+    for (const n of names) {
+        if (!isSafeGitName(n))
+            throw new Error(`refusing git name "${n}" (looks like an option)`);
+    }
+    return [...cmd, "--end-of-options", ...names];
+}
 /**
  * Pathspecs are globs by default, so a file called `note[1].md` would not
  * match itself. `:(literal)` turns the pattern off.
@@ -522,7 +535,7 @@ async function fetchNow() {
     const { repo, error } = await openRepo();
     if (!repo)
         return { ok: false, error };
-    const r = await gitNet(["fetch", repo.cfg.remote], repo.repoRoot);
+    const r = await gitNet(netArgs(["fetch"], repo.cfg.remote), repo.repoRoot);
     touched();
     // Only a fetch that worked counts. Stamping the time on a failure would
     // put "fetched 5s ago" next to ahead/behind counts that stopped moving
@@ -550,7 +563,7 @@ async function pullNow() {
     const upstream = (await git(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"], repoRoot)).ok;
     const r = upstream
         ? await gitNet(["pull", "--ff-only"], repoRoot)
-        : await gitNet(["pull", "--ff-only", cfg.remote, head.branch], repoRoot);
+        : await gitNet(netArgs(["pull", "--ff-only"], cfg.remote, head.branch), repoRoot);
     touched();
     if (!r.ok) {
         // git's own non-fast-forward output is a wall of hints. Say the one
@@ -579,7 +592,7 @@ async function pushNow() {
     const upstream = (await git(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"], repoRoot)).ok;
     const r = upstream
         ? await gitNet(["push"], repoRoot)
-        : await gitNet(["push", "--set-upstream", cfg.remote, `HEAD:${head.branch}`], repoRoot);
+        : await gitNet(netArgs(["push", "--set-upstream"], cfg.remote, `HEAD:${head.branch}`), repoRoot);
     touched();
     if (!r.ok) {
         lastError = r.stderr || "push failed";

package/dist/inspector/notifications.d.ts

@@ -0,0 +1,69 @@
+import type { ChatMeta } from "./chat/types.js";
+/**
+ * Attention items: things that happened while nobody was looking and that
+ * the user should see — a session waiting for a permission answer, a routine
+ * that finished or failed, a workflow run that ended. The inspector shows
+ * them behind the bell in the top bar (count, list, browser notification);
+ * this module is the one writer. Items are run-state, not config, so they
+ * live in <output>/notifications.json (capped, newest first).
+ *
+ * Approval items carry a `key` so the same request is never listed twice
+ * and disappears again the moment someone answers (dismissKey).
+ */
+export type NotificationKind = "approval" | "routine_done" | "routine_failed" | "run_done" | "run_failed";
+/**
+ * What a "diagnose" on a failure item should look at: a workflow run (chat
+ * in the run folder) or a routine (its agent, and the session that failed
+ * when there was one). The prompt is built when the chat starts, from the
+ * current state of the run/session.
+ */
+export type DiagnoseRef = {
+    kind: "run";
+    runId: string;
+} | {
+    kind: "routine";
+    agent: string;
+    routine: string;
+    chatId?: string;
+};
+export interface Notification {
+    id: string;
+    kind: NotificationKind;
+    /** One line: who/what — "⏰ Morning digest needs approval". */
+    title: string;
+    /** Optional detail: the tool title, the summary's first lines, the error. */
+    body?: string;
+    /** Inspector route without the leading "#" — "/agents/<slug>/chat/<id>". */
+    href: string;
+    at: string;
+    readAt?: string;
+    /** Dedupe/dismiss handle for items that represent a live state. */
+    key?: string;
+    /** Present on failure items that a chat can investigate ("diagnose" in the bell). */
+    diagnose?: DiagnoseRef;
+}
+export interface NotificationsView {
+    items: Notification[];
+    unread: number;
+}
+/** Trim a summary/error to a short body; first paragraph, no markdown noise. */
+export declare function clipBody(text: string | undefined): string | undefined;
+/** Inspector route for a chat — mirrors chatHref in the UI. */
+export declare function chatHref(meta: ChatMeta): string;
+export declare function pushNotification(input: {
+    kind: NotificationKind;
+    title: string;
+    body?: string;
+    href: string;
+    key?: string;
+    diagnose?: DiagnoseRef;
+}): Promise<Notification>;
+/** Drop the item(s) for a live state that no longer exists (a permission got answered). */
+export declare function dismissKey(key: string): Promise<void>;
+export declare function getNotification(id: string): Promise<Notification | null>;
+export declare function listNotifications(): Promise<NotificationsView>;
+/** Mark the given ids (or everything) read. */
+export declare function markNotificationsRead(ids: string[] | "all"): Promise<NotificationsView>;
+export declare function clearNotifications(): Promise<void>;
+/** Tests / project switches: forget the in-memory copy so the next read hits disk. */
+export declare function resetNotificationsCache(): void;

package/dist/inspector/notifications.js

@@ -0,0 +1,91 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { getOutputDir } from "./context.js";
+const MAX_ITEMS = 200;
+const BODY_MAX = 280;
+let cache = null;
+let writeChain = Promise.resolve();
+const file = () => path.join(getOutputDir(), "notifications.json");
+async function load() {
+    if (cache)
+        return cache;
+    try {
+        const parsed = JSON.parse(await fs.readFile(file(), "utf8"));
+        cache = Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        cache = [];
+    }
+    return cache;
+}
+function persist(items) {
+    cache = items;
+    writeChain = writeChain
+        .then(async () => {
+        await fs.mkdir(getOutputDir(), { recursive: true });
+        await fs.writeFile(file(), JSON.stringify(items, null, 2));
+    })
+        .catch(() => { });
+}
+/** Trim a summary/error to a short body; first paragraph, no markdown noise. */
+export function clipBody(text) {
+    const t = (text ?? "").replace(/\r/g, "").trim();
+    if (!t)
+        return undefined;
+    const para = t.split(/\n{2,}/)[0].replace(/\s+/g, " ").replace(/^#+\s*/, "").trim();
+    return para.length > BODY_MAX ? para.slice(0, BODY_MAX - 1).trimEnd() + "…" : para;
+}
+/** Inspector route for a chat — mirrors chatHref in the UI. */
+export function chatHref(meta) {
+    if (meta.scope.kind === "channel")
+        return `/channels/${meta.scope.slug}`;
+    return meta.scope.kind === "agent" ? `/agents/${meta.scope.slug}/chat/${meta.id}` : `/agents/chats/${meta.id}`;
+}
+export async function pushNotification(input) {
+    const items = await load();
+    const item = {
+        id: randomUUID(),
+        kind: input.kind,
+        title: input.title,
+        ...(input.body ? { body: clipBody(input.body) } : {}),
+        href: input.href,
+        at: new Date().toISOString(),
+        ...(input.key ? { key: input.key } : {}),
+        ...(input.diagnose ? { diagnose: input.diagnose } : {}),
+    };
+    // Same live state again (e.g. the request re-emitted): replace, don't stack.
+    const rest = input.key ? items.filter((n) => n.key !== input.key) : items;
+    persist([item, ...rest].slice(0, MAX_ITEMS));
+    return item;
+}
+/** Drop the item(s) for a live state that no longer exists (a permission got answered). */
+export async function dismissKey(key) {
+    const items = await load();
+    const next = items.filter((n) => n.key !== key);
+    if (next.length !== items.length)
+        persist(next);
+}
+export async function getNotification(id) {
+    return (await load()).find((n) => n.id === id) ?? null;
+}
+export async function listNotifications() {
+    const items = await load();
+    return { items, unread: items.filter((n) => !n.readAt).length };
+}
+/** Mark the given ids (or everything) read. */
+export async function markNotificationsRead(ids) {
+    const items = await load();
+    const now = new Date().toISOString();
+    const pick = ids === "all" ? null : new Set(ids);
+    persist(items.map((n) => (!n.readAt && (!pick || pick.has(n.id)) ? { ...n, readAt: now } : n)));
+    return listNotifications();
+}
+export async function clearNotifications() {
+    await load();
+    persist([]);
+}
+/** Tests / project switches: forget the in-memory copy so the next read hits disk. */
+export function resetNotificationsCache() {
+    cache = null;
+}

package/dist/inspector/routines.d.ts

@@ -24,6 +24,8 @@ export interface RoutineStatus extends Routine {
     lastRunAt?: string;
     lastChatId?: string;
     lastError?: string;
+    /** The last run's session holds a permission request waiting for a human. */
+    awaitingApproval?: boolean;
 }
 interface CronSpec {
     minute: Set<number>;

package/dist/inspector/routines.js

@@ -3,7 +3,8 @@ import path from "node:path";
 import { parse, stringify } from "yaml";
 import { getOutputDir } from "./context.js";
 import { getAgent, listAgents, safeAgentSlug, agentsRoot } from "./agents.js";
-import { createChat, postMessage } from "./chat/sessions.js";
+import { chatAwaitingApproval, createChat, postMessage } from "./chat/sessions.js";
+import { pushNotification } from "./notifications.js";
 /* ---------- cron ---------- */
 const ALIASES = {
     "@hourly": "0 * * * *",
@@ -174,6 +175,7 @@ export async function routineStatuses(slug) {
             ...(r.enabled ? { nextRunAt: nextRun(r.schedule) } : {}),
             ...(s.lastRunAt ? { lastRunAt: s.lastRunAt } : {}),
             ...(s.lastChatId ? { lastChatId: s.lastChatId } : {}),
+            ...(s.lastChatId && chatAwaitingApproval(s.lastChatId) ? { awaitingApproval: true } : {}),
             ...(s.lastError ? { lastError: s.lastError } : {}),
         };
     });
@@ -194,6 +196,16 @@ async function fireRoutine(slug, routine) {
         throw new Error(error);
     return meta.id;
 }
+/** A routine could not even start (agent gone, harness missing): the bell says so. */
+function notifyRoutineFailed(slug, routine, message) {
+    return pushNotification({
+        kind: "routine_failed",
+        title: `⏰ ${routine.name} could not start`,
+        body: message,
+        href: `/agents/${slug}`,
+        diagnose: { kind: "routine", agent: slug, routine: routine.id },
+    }).catch(() => { });
+}
 export async function runRoutineNow(slug, id) {
     const routine = (await listRoutines(slug)).find((r) => r.id === id);
     if (!routine)
@@ -210,6 +222,7 @@ export async function runRoutineNow(slug, id) {
     catch (err) {
         state[key] = { ...state[key], lastError: err.message };
         await writeState(state);
+        void notifyRoutineFailed(slug, routine, err.message);
         throw err;
     }
 }
@@ -251,6 +264,7 @@ async function tick() {
             }
             catch (err) {
                 state[key] = { ...state[key], lastError: err.message };
+                void notifyRoutineFailed(m.slug, r, err.message);
             }
         }
     }

package/dist/inspector/runner.js

@@ -2,7 +2,8 @@ import { spawn, spawnSync } from "node:child_process";
 import { mkdirSync, openSync, closeSync } from "node:fs";
 import path from "node:path";
 import { getProjectRoot } from "./context.js";
-import { RUN_ID_RE, safeRunDir } from "./runs.js";
+import { RUN_ID_RE, getRun, safeRunDir } from "./runs.js";
+import { pushNotification } from "./notifications.js";
 import { newRunId } from "../workflow.js";
 /**
  * Workflow trigger for the web UI. The inspector stays decoupled from the
@@ -54,6 +55,24 @@ export function triggerRun(opts) {
     });
     child.unref();
     closeSync(log);
+    // Detached, but as long as the inspector lives it still hears the exit:
+    // that is when the run's outcome goes to the bell (read from the trace,
+    // the exit code alone does not say whether a gate blocked).
+    child.on("exit", () => {
+        void getRun(runId)
+            .then((run) => {
+            const ok = run?.status === "ok";
+            const lastSummary = run?.phases.filter((p) => p.summary).at(-1)?.summary;
+            return pushNotification({
+                kind: ok ? "run_done" : "run_failed",
+                title: `${opts.workflowName} run ${ok ? "finished" : (run?.status ?? "failed")}`,
+                body: lastSummary ?? opts.request,
+                href: `/runs/${runId}`,
+                ...(ok ? {} : { diagnose: { kind: "run", runId } }),
+            });
+        })
+            .catch(() => { });
+    });
     return { runId };
 }
 export function stopRun(runId) {

package/dist/inspector/server.js

@@ -6,7 +6,10 @@ import { resolveProject } from "../config.js";
 import { listRuns, getRun, readRunFile } from "./runs.js";
 import { listWorkflows, getWorkflow } from "./workflows.js";
 import { dockerStatus, triggerRun, stopRun } from "./runner.js";
-import { cancelChat, createChat, deleteChat, disposeAllBackends, getChat, listChats, postMessage, resolvePermission, setChatVibeable, subscribeChat, } from "./chat/sessions.js";
+import { clearNotifications, listNotifications, markNotificationsRead } from "./notifications.js";
+import { startDiagnosis } from "./diagnose.js";
+import { deleteChannel, getChannel, listChannels, saveChannel, channelsRoot } from "./channels.js";
+import { cancelChat, createChat, deleteChat, disposeAllBackends, getChat, listChats, postMessage, resolvePermission, setChatVibeable, subscribeChat, convertChatToChannel, dropChannelSeats, ensureChannelChat } from "./chat/sessions.js";
 import { bundleDetail, conceptDetail, createBundle, knowledgeIndex, putConcept, verifyFromUi, } from "./knowledge.js";
 import { deleteAgent, getAgent, listAgents, saveAgent, setAgentArchived, agentsRoot, } from "./agents.js";
 import { deleteAgentSkill, getSkill, listAgentSkills, listSkills, readSkill, saveAgentSkill, skillsRoot, } from "./skills.js";
@@ -23,6 +26,8 @@ import { deleteRoutine, routineStatuses, runRoutineNow, saveRoutine, startRoutin
  * frontend polls. Realtime is polling — no daemon, no socket, works on a
  * plain filesystem.
  */
+/** CSP for raw run files: same shape as the vibeable preview — scripts allowed, origin opaque. */
+const RUN_FILE_CSP = "sandbox allow-scripts allow-forms allow-popups allow-modals allow-downloads";
 const MIME = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
@@ -186,6 +191,108 @@ async function handleApi(req, res, url) {
     if (method !== "GET" && method !== "HEAD" && !sameOrigin(req)) {
         return json(res, { error: "cross-origin request refused" }, 403);
     }
+    // Channels — shared transcripts with several agents (channels/<slug>/channel.yml + one chat).
+    // GET /api/channels | POST /api/channels {name, purpose?, members, responder?}
+    // POST /api/channels/from-chat {chatId, name, members, ...} — an agent session becomes a channel
+    // GET/PUT/DELETE /api/channels/:slug
+    if (seg.length >= 2 && seg[1] === "channels") {
+        const view = async (c) => {
+            const meta = await ensureChannelChat(c);
+            const live = (await listChats()).find((x) => x.id === meta.id);
+            return { ...c, chatId: meta.id, busy: live?.busy ?? false, awaitingApproval: live?.awaitingApproval ?? false, updatedAt: meta.updatedAt };
+        };
+        let body = {};
+        if (method === "POST" || method === "PUT") {
+            try {
+                const raw = await readBody(req);
+                if (raw)
+                    body = JSON.parse(raw);
+            }
+            catch {
+                return json(res, { error: "invalid JSON body" }, 400);
+            }
+        }
+        try {
+            if (seg.length === 2 && method === "GET") {
+                const channels = await listChannels();
+                return json(res, { root: await channelsRoot(), channels: await Promise.all(channels.map(view)) });
+            }
+            if (seg.length === 2 && method === "POST") {
+                const { chatId: _c, slug: _s, ...input } = body;
+                return json(res, await view(await saveChannel(input)));
+            }
+            if (seg.length === 3 && seg[2] === "from-chat" && method === "POST") {
+                const { chatId, slug: _s, ...input } = body;
+                if (!chatId)
+                    return json(res, { error: "chatId is required" }, 400);
+                const channel = await saveChannel(input);
+                const converted = await convertChatToChannel(chatId, channel);
+                if (converted.error) {
+                    await deleteChannel(channel.slug).catch(() => { });
+                    return json(res, { error: converted.error }, 409);
+                }
+                return json(res, await view(channel));
+            }
+            if (seg.length === 3) {
+                const slug = decodeURIComponent(seg[2]);
+                const channel = await getChannel(slug);
+                if (!channel)
+                    return json(res, { error: "channel not found" }, 404);
+                if (method === "GET")
+                    return json(res, await view(channel));
+                if (method === "PUT") {
+                    const { chatId: _c, slug: _s, ...input } = body;
+                    const saved = await saveChannel({ ...input, slug });
+                    const meta = await ensureChannelChat(saved);
+                    await dropChannelSeats(meta.id, saved.members);
+                    return json(res, await view(saved));
+                }
+                if (method === "DELETE") {
+                    const meta = (await listChats()).find((c) => c.scope.kind === "channel" && c.scope.slug === slug);
+                    if (meta)
+                        await deleteChat(meta.id);
+                    await deleteChannel(slug);
+                    return json(res, { ok: true });
+                }
+            }
+        }
+        catch (err) {
+            return json(res, { error: err.message }, 400);
+        }
+        return json(res, { error: "not found" }, 404);
+    }
+    // GET /api/notifications — the bell: attention items, newest first, plus unread count.
+    // POST /api/notifications/read {ids?: string[]} — mark some (or all) read.
+    // DELETE /api/notifications — clear the list.
+    if (seg.length >= 2 && seg[1] === "notifications") {
+        if (seg.length === 2 && method === "GET")
+            return json(res, await listNotifications());
+        if (seg.length === 2 && method === "DELETE") {
+            await clearNotifications();
+            return json(res, { ok: true });
+        }
+        // POST /api/notifications/:id/diagnose — open a chat that investigates the failure behind an item.
+        if (seg.length === 4 && seg[3] === "diagnose" && method === "POST") {
+            const result = await startDiagnosis(seg[2]);
+            if ("error" in result)
+                return json(res, result, result.status);
+            return json(res, result);
+        }
+        if (seg.length === 3 && seg[2] === "read" && method === "POST") {
+            let body = {};
+            try {
+                const raw = await readBody(req);
+                if (raw)
+                    body = JSON.parse(raw);
+            }
+            catch {
+                return json(res, { error: "invalid JSON body" }, 400);
+            }
+            const ids = Array.isArray(body.ids) ? body.ids.map(String) : "all";
+            return json(res, await markNotificationsRead(ids));
+        }
+        return json(res, { error: "not found" }, 404);
+    }
     // GET /api/meta — package version + project name ("environment") for the UI.
     // ?probe=1 marks a discovery probe from another instance: answer identity
     // only, skip our own discovery (two instances must not probe each other
@@ -486,9 +593,16 @@ async function handleApi(req, res, url) {
         const ext = name.slice(name.lastIndexOf(".")).toLowerCase();
         const buf = await fs.readFile(file.absPath);
         if (raw) {
+            // Agent-written files must not run as the inspector's origin: the
+            // sandbox keeps scripts working (interactive reports) but makes the
+            // origin opaque, so no fetch() into /api and no cookies. PDFs are
+            // exempt — Chrome's viewer refuses sandboxed documents, and PDF
+            // scripting has no DOM or origin access.
             res.writeHead(200, {
                 "content-type": MIME[ext] ?? "text/plain; charset=utf-8",
                 "cache-control": "no-store",
+                "x-content-type-options": "nosniff",
+                ...(ext === ".pdf" ? {} : { "content-security-policy": RUN_FILE_CSP }),
             });
             return void res.end(buf);
         }
@@ -871,7 +985,8 @@ async function handleApi(req, res, url) {
                 const text = String(body.text ?? "").trim();
                 if (!text)
                     return json(res, { error: "text is required" }, 400);
-                result = await postMessage(seg[2], text);
+                // Channels: the poster's display name signs the message.
+                result = await postMessage(seg[2], text, { from: typeof body.from === "string" ? body.from : undefined });
             }
             else if (seg[3] === "permission") {
                 result = await resolvePermission(seg[2], String(body.requestId ?? ""), body.optionId == null ? null : String(body.optionId));

package/dist/inspector/settings.js

@@ -1,7 +1,7 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { parseDocument } from "yaml";
-import { ignoreEntryFor, REPOS_DEFAULT_ROOT, resolveProject, VIBEABLES_DEFAULT_ROOT } from "../config.js";
+import { ignoreEntryFor, REPOS_DEFAULT_ROOT, resolveProject, VIBEABLES_DEFAULT_ROOT, isSafeGitName } from "../config.js";
 import { disposeAllDevs, ensureVibeablesRoot } from "./vibeables.js";
 import { getProjectRoot } from "./context.js";
 import { ensureReposRoot } from "./repos.js";
@@ -47,9 +47,13 @@ function cleanGit(value) {
         throw new Error("git.enabled must be true or false");
     const out = {};
     const remote = typeof value.remote === "string" ? value.remote.trim() : "";
+    if (remote && !isSafeGitName(remote))
+        throw new Error('git.remote must be a plain name (no leading "-", no whitespace)');
     if (remote && remote !== GIT_DEFAULTS.remote)
         out.remote = remote;
     const branch = typeof value.branch === "string" ? value.branch.trim() : "";
+    if (branch && !isSafeGitName(branch))
+        throw new Error('git.branch must be a plain name (no leading "-", no whitespace)');
     if (branch)
         out.branch = branch;
     if (value.interval !== undefined && value.interval !== "") {