@netnodeag/kraftwerk 0.62.0 → 0.63.0

package/dist/inspector/api/agents.js

@@ -0,0 +1,50 @@
+import { agentsRoot, deleteAgent, getAgent, listAgents, saveAgent, setAgentArchived } from "../agents.js";
+import { appendJournal, readJournal } from "../journal.js";
+import { UI_ACTOR } from "../knowledge.js";
+import { deleteRoutine, routineStatuses, runRoutineNow, saveRoutine } from "../routines.js";
+import { deleteAgentSkill, listAgentSkills, readSkill, saveAgentSkill } from "../skills.js";
+import { fail, route } from "./router.js";
+/** Agents (team members): definition, own skills, journal, routines. */
+export const agentRoutes = [
+    route({ name: "agents.list", method: "GET", path: "/api/agents", summary: "every member" }, async () => ({ root: await agentsRoot(), agents: await listAgents() })),
+    route({ name: "agents.create", method: "POST", path: "/api/agents", summary: "create a member", errors: 400 }, async (c) => saveAgent({ ...(await c.body()), slug: undefined })),
+    route({ name: "agents.get", method: "GET", path: "/api/agents/:slug", summary: "one member", errors: 400 }, async (c) => (await getAgent(c.params.slug)) ?? fail(404, "not found")),
+    route({ name: "agents.save", method: "PUT", path: "/api/agents/:slug", summary: "save a member", errors: 400 }, async (c) => saveAgent({ ...(await c.body()), slug: c.params.slug })),
+    route({ name: "agents.delete", method: "DELETE", path: "/api/agents/:slug", summary: "move a member to the trash", errors: 400 }, async (c) => {
+        await deleteAgent(c.params.slug);
+        return { ok: true };
+    }),
+    route({ name: "agents.archive", method: "POST", path: "/api/agents/:slug/archive", summary: "archive or unarchive {archived}", errors: 400 }, async (c) => setAgentArchived(c.params.slug, (await c.body()).archived === true)),
+    route({ name: "agents.skills", method: "GET", path: "/api/agents/:slug/skills", summary: "the agent's own skills", errors: 400 }, async (c) => ({
+        skills: await listAgentSkills(c.params.slug),
+    })),
+    route({ name: "agents.saveSkill", method: "POST", path: "/api/agents/:slug/skills", summary: "create or update one {name, content}", errors: 400 }, async (c) => {
+        const body = await c.body();
+        return saveAgentSkill(c.params.slug, String(body.name ?? ""), String(body.content ?? ""));
+    }),
+    route({ name: "agents.skill", method: "GET", path: "/api/agents/:slug/skills/:name", summary: "one agent skill with its content", errors: 400 }, async (c) => {
+        const name = c.params.name.toLowerCase();
+        const skill = (await listAgentSkills(c.params.slug)).find((s) => s.name.toLowerCase() === name);
+        if (!skill)
+            fail(404, "not found");
+        return { ...skill, content: await readSkill(skill) };
+    }),
+    route({ name: "agents.deleteSkill", method: "DELETE", path: "/api/agents/:slug/skills/:name", summary: "delete one agent skill", errors: 400 }, async (c) => {
+        await deleteAgentSkill(c.params.slug, c.params.name);
+        return { ok: true };
+    }),
+    route({ name: "agents.journal", method: "GET", path: "/api/agents/:slug/journal", summary: "the agent's journal", errors: 400 }, async (c) => ({ journal: await readJournal(c.params.slug) })),
+    route({ name: "agents.addJournal", method: "POST", path: "/api/agents/:slug/journal", summary: "a person adds a line {entry, kind?}", errors: 400 }, async (c) => {
+        const body = await c.body();
+        return { journal: await appendJournal(c.params.slug, String(body.entry ?? ""), { kind: body.kind, actor: UI_ACTOR }) };
+    }),
+    route({ name: "agents.routines", method: "GET", path: "/api/agents/:slug/routines", summary: "the agent's routines with run state", errors: 400 }, async (c) => ({
+        routines: await routineStatuses(c.params.slug),
+    })),
+    route({ name: "agents.saveRoutine", method: "POST", path: "/api/agents/:slug/routines", summary: "create or update a routine", errors: 400 }, async (c) => saveRoutine(c.params.slug, await c.body())),
+    route({ name: "agents.deleteRoutine", method: "DELETE", path: "/api/agents/:slug/routines/:id", summary: "delete a routine", errors: 400 }, async (c) => {
+        await deleteRoutine(c.params.slug, c.params.id);
+        return { ok: true };
+    }),
+    route({ name: "agents.runRoutine", method: "POST", path: "/api/agents/:slug/routines/:id/run", summary: "run a routine now", errors: 400 }, async (c) => runRoutineNow(c.params.slug, c.params.id)),
+];

package/dist/inspector/api/attention.d.ts

@@ -0,0 +1,10 @@
+/** What needs a person: the bell, the attention list, the rail's per-agent status. */
+export declare const attentionRoutes: (import("./router.js").Route<"agents.status", Record<string, import("../agent-status.js").AgentStatus>, "/api/agent-status"> | import("./router.js").Route<"attention.list", import("../attention.js").AttentionView, "/api/attention"> | import("./router.js").Route<"notifications.clear", {
+    ok: boolean;
+}, "/api/notifications"> | import("./router.js").Route<"notifications.diagnose", import("./router.js").Reply<{
+    error: string;
+    status: number;
+}> | {
+    chatId: string;
+    href: string;
+}, "/api/notifications/:id/diagnose"> | import("./router.js").Route<"notifications.list", import("../notifications.js").NotificationsView, "/api/notifications"> | import("./router.js").Route<"notifications.read", import("../notifications.js").NotificationsView, "/api/notifications/read">)[];

package/dist/inspector/api/attention.js

@@ -0,0 +1,23 @@
+import { agentStatuses } from "../agent-status.js";
+import { listAttention } from "../attention.js";
+import { startDiagnosis } from "../diagnose.js";
+import { clearNotifications, listNotifications, markNotificationsRead } from "../notifications.js";
+import { reply, route } from "./router.js";
+/** What needs a person: the bell, the attention list, the rail's per-agent status. */
+export const attentionRoutes = [
+    route({ name: "notifications.list", method: "GET", path: "/api/notifications", summary: "the bell: attention items, newest first, plus the unread count" }, async () => listNotifications()),
+    route({ name: "notifications.clear", method: "DELETE", path: "/api/notifications", summary: "clear the list" }, async () => {
+        await clearNotifications();
+        return { ok: true };
+    }),
+    route({ name: "notifications.read", method: "POST", path: "/api/notifications/read", summary: "mark some {ids?} or all read" }, async (c) => {
+        const body = await c.body();
+        return markNotificationsRead(Array.isArray(body.ids) ? body.ids.map(String) : "all");
+    }),
+    route({ name: "notifications.diagnose", method: "POST", path: "/api/notifications/:id/diagnose", summary: "open a chat that investigates the failure behind an item" }, async (c) => {
+        const result = await startDiagnosis(c.params.id);
+        return "error" in result ? reply(result.status, result) : result;
+    }),
+    route({ name: "attention.list", method: "GET", path: "/api/attention", summary: "waiting approvals and questions, unread failures, with their owner" }, async () => listAttention()),
+    route({ name: "agents.status", method: "GET", path: "/api/agent-status", summary: "per agent: waiting, working, next routine, last active" }, async () => agentStatuses()),
+];

package/dist/inspector/api/channels.d.ts

@@ -0,0 +1,67 @@
+/** Channels: one shared transcript (channels/<slug>/channel.yml + one chat) with several agents. */
+export declare const channelRoutes: (import("./router.js").Route<"channels.create", {
+    slug: string;
+    name: string;
+    purpose?: string;
+    members: string[];
+    responder?: string;
+    maxHops: number;
+    project?: string;
+    chatId: string;
+    busy: boolean;
+    awaitingApproval: boolean;
+    updatedAt: string;
+}, "/api/channels"> | import("./router.js").Route<"channels.delete", {
+    ok: boolean;
+}, "/api/channels/:slug"> | import("./router.js").Route<"channels.fromChat", {
+    slug: string;
+    name: string;
+    purpose?: string;
+    members: string[];
+    responder?: string;
+    maxHops: number;
+    project?: string;
+    chatId: string;
+    busy: boolean;
+    awaitingApproval: boolean;
+    updatedAt: string;
+}, "/api/channels/from-chat"> | import("./router.js").Route<"channels.get", {
+    slug: string;
+    name: string;
+    purpose?: string;
+    members: string[];
+    responder?: string;
+    maxHops: number;
+    project?: string;
+    chatId: string;
+    busy: boolean;
+    awaitingApproval: boolean;
+    updatedAt: string;
+}, "/api/channels/:slug"> | import("./router.js").Route<"channels.list", {
+    root: string;
+    channels: {
+        slug: string;
+        name: string;
+        purpose?: string;
+        members: string[];
+        responder?: string;
+        maxHops: number;
+        project?: string;
+        chatId: string;
+        busy: boolean;
+        awaitingApproval: boolean;
+        updatedAt: string;
+    }[];
+}, "/api/channels"> | import("./router.js").Route<"channels.save", {
+    slug: string;
+    name: string;
+    purpose?: string;
+    members: string[];
+    responder?: string;
+    maxHops: number;
+    project?: string;
+    chatId: string;
+    busy: boolean;
+    awaitingApproval: boolean;
+    updatedAt: string;
+}, "/api/channels/:slug">)[];

package/dist/inspector/api/channels.js

@@ -0,0 +1,58 @@
+import { channelsRoot, deleteChannel, getChannel, listChannels, saveChannel } from "../channels.js";
+import { convertChatToChannel, deleteChat, dropChannelSeats, ensureChannelChat, listChats } from "../chat/sessions.js";
+import { readMeta } from "../chat/store.js";
+import { fail, route } from "./router.js";
+/** A channel with its chat and that chat's live state. */
+async function view(c) {
+    const meta = await ensureChannelChat(c);
+    const live = (await listChats()).find((x) => x.id === meta.id);
+    return { ...c, chatId: meta.id, busy: live?.busy ?? false, awaitingApproval: live?.awaitingApproval ?? false, updatedAt: meta.updatedAt };
+}
+async function existing(slug) {
+    return (await getChannel(slug)) ?? fail(404, "channel not found");
+}
+/** Channels: one shared transcript (channels/<slug>/channel.yml + one chat) with several agents. */
+export const channelRoutes = [
+    route({ name: "channels.list", method: "GET", path: "/api/channels", summary: "every channel with its chat's state", errors: 400 }, async () => ({
+        root: await channelsRoot(),
+        channels: await Promise.all((await listChannels()).map(view)),
+    })),
+    route({ name: "channels.create", method: "POST", path: "/api/channels", summary: "create one {name, purpose?, members, responder?}", errors: 400 }, async (c) => {
+        const { chatId: _c, slug: _s, ...input } = await c.body();
+        return view(await saveChannel(input));
+    }),
+    // An agent session becomes a channel; a project chat's coworkers work in that project — the chat decides, not the body.
+    route({ name: "channels.fromChat", method: "POST", path: "/api/channels/from-chat", summary: "turn a chat into a channel {chatId, name, members, …}", errors: 400 }, async (c) => {
+        const { chatId, slug: _s, project: _p, ...input } = await c.body();
+        if (!chatId)
+            fail(400, "chatId is required");
+        const source = await readMeta(chatId).catch(() => null);
+        if (!source)
+            fail(404, "chat not found");
+        const channel = await saveChannel({ ...input, ...(source.scope.kind === "project" ? { project: source.scope.slug } : {}) });
+        const converted = await convertChatToChannel(chatId, channel);
+        if (converted.error) {
+            await deleteChannel(channel.slug).catch(() => { });
+            fail(409, converted.error);
+        }
+        return view(channel);
+    }),
+    route({ name: "channels.get", method: "GET", path: "/api/channels/:slug", summary: "one channel with its chat's state", errors: 400 }, async (c) => view(await existing(c.params.slug))),
+    route({ name: "channels.save", method: "PUT", path: "/api/channels/:slug", summary: "save a channel; members who left lose their seat", errors: 400 }, async (c) => {
+        const slug = c.params.slug;
+        await existing(slug);
+        const { chatId: _c, slug: _s, ...input } = await c.body();
+        const saved = await saveChannel({ ...input, slug });
+        await dropChannelSeats((await ensureChannelChat(saved)).id, saved.members);
+        return view(saved);
+    }),
+    route({ name: "channels.delete", method: "DELETE", path: "/api/channels/:slug", summary: "delete a channel and its chat", errors: 400 }, async (c) => {
+        const slug = c.params.slug;
+        await existing(slug);
+        const meta = (await listChats()).find((x) => x.scope.kind === "channel" && x.scope.slug === slug);
+        if (meta)
+            await deleteChat(meta.id);
+        await deleteChannel(slug);
+        return { ok: true };
+    }),
+];

package/dist/inspector/api/chats.d.ts

@@ -0,0 +1,55 @@
+/** Chats: ACP sessions with a coding agent, their event stream, and what a person does in them. */
+export declare const chatRoutes: (import("./router.js").Route<"agents.sessions", {
+    sessions: {
+        sessionId: string;
+        title?: string;
+        updatedAt?: string;
+        cwd: string;
+    }[];
+}, "/api/agent-sessions"> | import("./router.js").Route<"chats.attach", {
+    name: string;
+    mimeType: string;
+    size: number;
+}, "/api/chats/:id/attachments"> | import("./router.js").Route<"chats.attachment", undefined, "/api/chats/:id/attachments/:name"> | import("./router.js").Route<"chats.cancel", import("./router.js").Reply<{
+    error: string;
+}> | {
+    ok: true;
+}, "/api/chats/:id/cancel"> | import("./router.js").Route<"chats.config", import("./router.js").Reply<{
+    error: string;
+}> | {
+    ok: true;
+}, "/api/chats/:id/config"> | import("./router.js").Route<"chats.create", import("../chat/types.js").ChatMeta, "/api/chats"> | import("./router.js").Route<"chats.delete", import("./router.js").Reply<{
+    error?: string;
+}>, "/api/chats/:id"> | import("./router.js").Route<"chats.elicitation", import("./router.js").Reply<{
+    error: string;
+}> | {
+    ok: true;
+}, "/api/chats/:id/elicitation"> | import("./router.js").Route<"chats.events", undefined, "/api/chats/:id/events"> | import("./router.js").Route<"chats.fork", import("../chat/types.js").ChatMeta, "/api/chats/:id/fork"> | import("./router.js").Route<"chats.get", {
+    meta: import("../chat/types.js").ChatMeta;
+    events: import("../chat/types.js").StoredChatEvent[];
+    busy: boolean;
+}, "/api/chats/:id"> | import("./router.js").Route<"chats.list", {
+    chats: (import("../chat/types.js").ChatMeta & {
+        busy: boolean;
+        awaitingApproval: boolean;
+    })[];
+}, "/api/chats"> | import("./router.js").Route<"chats.message", import("./router.js").Reply<{
+    error: string;
+}> | {
+    ok: true;
+}, "/api/chats/:id/message"> | import("./router.js").Route<"chats.permission", import("./router.js").Reply<{
+    error: string;
+}> | {
+    ok: true;
+}, "/api/chats/:id/permission"> | import("./router.js").Route<"chats.rename", import("./router.js").Reply<{
+    meta?: import("../chat/types.js").ChatMeta;
+    error?: string;
+}>, "/api/chats/:id"> | import("./router.js").Route<"chats.resetSession", import("../chat/types.js").ChatMeta, "/api/chats/:id/reset-session"> | import("./router.js").Route<"chats.setVibeable", import("../chat/types.js").ChatMeta, "/api/chats/:id/vibeable"> | import("./router.js").Route<"chats.steer", import("./router.js").Reply<{
+    error: string;
+}> | {
+    ok: true;
+}, "/api/chats/:id/steer"> | import("./router.js").Route<"chats.stopTask", import("./router.js").Reply<{
+    error: string;
+}> | {
+    ok: true;
+}, "/api/chats/:id/task-stop">)[];

package/dist/inspector/api/chats.js

@@ -0,0 +1,154 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { getAgent } from "../agents.js";
+import { answerElicitation, cancelChat, createChat, deleteChat, forkChat, getChat, listAgentSessionsFor, listChats, postMessage, renameChat, resetSession, resolvePermission, setChatConfig, setChatVibeable, steerChat, stopChatTask, subscribeChat, } from "../chat/sessions.js";
+import { attachmentPath, saveAttachment } from "../chat/store.js";
+import { getProject } from "../projects.js";
+import { MIME } from "./mime.js";
+import { projectErrors } from "./projects.js";
+import { ApiError, fail, readRawBody, reply, route } from "./router.js";
+const AGENTS = ["claude", "codex", "pi"];
+/** A chat id that names no chat folder (or a malformed one) is a 400. */
+const validChat = (p, message = "invalid chat id") => p.catch((err) => {
+    throw err instanceof ApiError ? err : new ApiError(400, message);
+});
+/** Sessions report refusals as `{error, status?}`; the success value is the chat's meta. */
+const metaOf = (result) => (result.error ? fail(result.status ?? 400, result.error) : result.meta);
+/** The attachments a message or steer carries: references to files already uploaded. */
+const attachmentsOf = (body) => Array.isArray(body.attachments)
+    ? body.attachments
+        .filter((a) => a && typeof a.name === "string" && typeof a.mimeType === "string")
+        .map((a) => ({ name: String(a.name), mimeType: String(a.mimeType), size: Number(a.size) || 0 }))
+    : [];
+/** An action on a running chat: `{ok}` when it went through, 409 with the reason when the chat refused. */
+const act = (name, path, summary, run) => route({ name, method: "POST", path, summary, errors: 400 }, async (c) => {
+    const result = await run(c, await c.body());
+    return result.error ? reply(409, result) : { ok: true };
+});
+const textOf = (body) => {
+    const text = String(body.text ?? "").trim();
+    if (!text && attachmentsOf(body).length === 0)
+        fail(400, "text is required");
+    return text || "(see attached)";
+};
+/** The scope a new chat runs in; agent and project chats take their harness from the definition, not the caller. */
+async function scopeOf(body) {
+    const s = body.scope;
+    if (s?.kind === "agent" && s.slug) {
+        const def = await getAgent(s.slug).catch(() => null);
+        if (!def)
+            fail(404, "agent not found");
+        return { agent: def.harness, scope: { kind: "agent", slug: def.slug } };
+    }
+    if (s?.kind === "project" && s.slug) {
+        // A project chat needs its folder; a missing one is a 404 here, not a chat that apologizes.
+        const found = await getProject(s.slug).catch((err) => {
+            throw new ApiError(projectErrors(err.message), err.message);
+        });
+        if (!found)
+            fail(404, "project not found");
+        return { agent: found.harness, scope: { kind: "project", slug: found.slug } };
+    }
+    const agent = body.agent ?? "";
+    if (s?.kind === "run" && s.runId)
+        return { agent, scope: { kind: "run", runId: s.runId } };
+    if (s?.kind === "kraftwerk")
+        return { agent, scope: { kind: "kraftwerk" } };
+    if (s?.kind === "knowledge")
+        return { agent, scope: { kind: "knowledge", ...(s.bundle ? { bundle: s.bundle } : {}) } };
+    return { agent, scope: { kind: "general" } };
+}
+/** Chats: ACP sessions with a coding agent, their event stream, and what a person does in them. */
+export const chatRoutes = [
+    route({ name: "chats.list", method: "GET", path: "/api/chats", summary: "every chat with its live state" }, async () => ({ chats: await listChats() })),
+    route({ name: "chats.create", method: "POST", path: "/api/chats", summary: "start a chat {agent, scope, resume?}" }, async (c) => {
+        // `resume` continues one of the agent's own sessions (see agents.sessions).
+        const body = await c.body();
+        const { agent, scope } = await scopeOf(body);
+        if (!AGENTS.includes(agent))
+            fail(400, "agent must be claude, codex, or pi");
+        try {
+            return await createChat({ agent: agent, scope, ...(typeof body.resume === "string" && body.resume ? { resume: body.resume } : {}) });
+        }
+        catch (err) {
+            throw new ApiError(400, err.message);
+        }
+    }),
+    route({ name: "agents.sessions", method: "GET", path: "/api/agent-sessions", summary: "the agent's own sessions in the workspace ?agent=claude|codex|pi", errors: 502 }, async (c) => {
+        const agent = c.query.get("agent") ?? "claude";
+        if (!AGENTS.includes(agent))
+            fail(400, "agent must be claude, codex, or pi");
+        return { sessions: await listAgentSessionsFor(agent) };
+    }),
+    route({ name: "chats.get", method: "GET", path: "/api/chats/:id", summary: "the chat's meta and events" }, async (c) => (await validChat(getChat(c.params.id))) ?? fail(404, "not found")),
+    route({ name: "chats.delete", method: "DELETE", path: "/api/chats/:id", summary: "delete the chat" }, async (c) => {
+        const result = await validChat(deleteChat(c.params.id));
+        return reply(result.error ? 404 : 200, result);
+    }),
+    route({ name: "chats.rename", method: "PATCH", path: "/api/chats/:id", summary: "rename the chat {title}" }, async (c) => {
+        const body = await c.body();
+        const result = await validChat(renameChat(c.params.id, body.title), "invalid chat id or body");
+        return reply(result.error ? (result.error === "not found" ? 404 : 400) : 200, result);
+    }),
+    // Replays from ?after=N, then streams new events as they happen.
+    route({ name: "chats.events", method: "GET", path: "/api/chats/:id/events", summary: "SSE: the chat's events from ?after=N", raw: true }, async ({ req, res, params, query }) => {
+        const afterSeq = Number(query.get("after") ?? "0") || 0;
+        res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-store", connection: "keep-alive" });
+        const unsubscribe = await subscribeChat(params.id, afterSeq, (ev) => res.write(`id: ${ev.seq}\ndata: ${JSON.stringify(ev)}\n\n`)).catch(() => null);
+        if (!unsubscribe)
+            return void res.end();
+        const heartbeat = setInterval(() => res.write(":hb\n\n"), 25_000);
+        req.on("close", () => {
+            clearInterval(heartbeat);
+            unsubscribe();
+        });
+    }),
+    route({ name: "chats.setVibeable", method: "POST", path: "/api/chats/:id/vibeable", summary: "open an app {slug} in the chat's preview pane (cwd follows), or close it {slug: null}", errors: 400 }, async (c) => {
+        const { slug } = await c.body();
+        return metaOf(await setChatVibeable(c.params.id, slug == null || slug === "" ? null : String(slug)));
+    }),
+    route({ name: "chats.fork", method: "POST", path: "/api/chats/:id/fork", summary: "a new chat continuing a copy of this one's session", errors: 400 }, async (c) => metaOf(await forkChat(c.params.id))),
+    route({ name: "chats.resetSession", method: "POST", path: "/api/chats/:id/reset-session", summary: "forget the agent's session; the next message starts fresh", errors: 400 }, async (c) => metaOf(await resetSession(c.params.id))),
+    // The body is the file itself; x-file-name names it, content-type types it.
+    route({ name: "chats.attach", method: "POST", path: "/api/chats/:id/attachments", summary: "upload an attachment for the next message", errors: 400, upload: true }, async (c) => {
+        if (!(await getChat(c.params.id)))
+            fail(404, "not found");
+        const data = await readRawBody(c.req, 25_000_000);
+        if (data.length === 0)
+            fail(400, "empty file");
+        const mimeType = (c.req.headers["content-type"] ?? "application/octet-stream").split(";")[0].trim();
+        const name = await saveAttachment(c.params.id, decodeURIComponent(String(c.req.headers["x-file-name"] ?? "file")), data);
+        return { name, mimeType, size: data.length };
+    }),
+    route({ name: "chats.attachment", method: "GET", path: "/api/chats/:id/attachments/:name", summary: "a stored attachment", raw: true }, async ({ res, params }) => {
+        let data;
+        let file;
+        try {
+            file = attachmentPath(params.id, params.name);
+            data = await fs.readFile(file);
+        }
+        catch {
+            return fail(404, "not found");
+        }
+        res.writeHead(200, {
+            "content-type": MIME[path.extname(file).toLowerCase()] ?? "application/octet-stream",
+            "content-length": data.length,
+            "cache-control": "private, max-age=86400",
+            "x-content-type-options": "nosniff",
+        });
+        res.end(data);
+    }),
+    // Channels: `from` is the poster's display name, which signs the message.
+    act("chats.message", "/api/chats/:id/message", "send a message {text, attachments?, from?}", (c, body) => postMessage(c.params.id, textOf(body), { from: typeof body.from === "string" ? body.from : undefined, attachments: attachmentsOf(body) })),
+    act("chats.steer", "/api/chats/:id/steer", "add to the running turn {text, attachments?}", (c, body) => steerChat(c.params.id, textOf(body), attachmentsOf(body))),
+    act("chats.permission", "/api/chats/:id/permission", "answer a permission request {requestId, optionId | null}", (c, body) => resolvePermission(c.params.id, String(body.requestId ?? ""), body.optionId == null ? null : String(body.optionId))),
+    // Channels: `agent` stops one member; without it every agent in the chat.
+    act("chats.cancel", "/api/chats/:id/cancel", "stop the running turn {agent?}", (c, body) => cancelChat(c.params.id, typeof body.agent === "string" && body.agent ? body.agent : undefined)),
+    act("chats.elicitation", "/api/chats/:id/elicitation", "answer the agent's question {requestId, action, content?}", (c, body) => {
+        const action = body.action === "accept" || body.action === "decline" || body.action === "cancel" ? body.action : fail(400, "action must be accept, decline, or cancel");
+        const content = body.content && typeof body.content === "object" ? body.content : {};
+        return answerElicitation(c.params.id, String(body.requestId ?? ""), action === "accept" ? { action, content } : { action });
+    }),
+    act("chats.stopTask", "/api/chats/:id/task-stop", "stop one background task {taskId}", (c, body) => stopChatTask(c.params.id, String(body.taskId ?? ""))),
+    act("chats.config", "/api/chats/:id/config", "set a session option {configId, value}", (c, body) => setChatConfig(c.params.id, String(body.configId ?? ""), typeof body.value === "boolean" ? body.value : String(body.value ?? ""))),
+];

package/dist/inspector/api/files.d.ts

@@ -0,0 +1,15 @@
+/** Files: the workspace's folder and one per project, browsed by scope and path. */
+export declare const fileRoutes: (import("./router.js").Route<"files.delete", {
+    ok: boolean;
+}, "/api/files"> | import("./router.js").Route<"files.list", import("../files.js").FilesListing, "/api/files/list"> | import("./router.js").Route<"files.mkdir", import("./router.js").Reply<import("../files.js").FileEntry>, "/api/files/folder"> | import("./router.js").Route<"files.move", {
+    ok: boolean;
+}, "/api/files/move"> | import("./router.js").Route<"files.raw", void, "/api/files/raw"> | import("./router.js").Route<"files.recent", {
+    root: string;
+    count: number;
+    recent: {
+        path: string;
+        at: string;
+    }[];
+}, "/api/files/recent"> | import("./router.js").Route<"files.scopes", {
+    scopes: import("../files.js").FilesScopeInfo[];
+}, "/api/files"> | import("./router.js").Route<"files.upload", import("./router.js").Reply<import("../files.js").FileEntry>, "/api/files/upload">)[];

package/dist/inspector/api/files.js

@@ -0,0 +1,43 @@
+import { deleteFile, filesSummary, listFiles, listScopes, makeFolder, moveFile, openFile, saveUpload } from "../files.js";
+import { reply, route } from "./router.js";
+const errors = (message) => (/^no (file|folder|project)/.test(message) ? 404 : 400);
+/** The scope (workspace, or a project's folder) and the path inside it, from the query. */
+const where = (c) => [c.query.get("scope") ?? "workspace", c.query.get("path") ?? ""];
+/** Files: the workspace's folder and one per project, browsed by scope and path. */
+export const fileRoutes = [
+    route({ name: "files.scopes", method: "GET", path: "/api/files", summary: "the roots: the workspace and one per project", errors }, async () => ({ scopes: await listScopes() })),
+    route({ name: "files.list", method: "GET", path: "/api/files/list", summary: "a folder's entries ?scope&path", errors }, async (c) => listFiles(...where(c))),
+    route({ name: "files.recent", method: "GET", path: "/api/files/recent", summary: "the scope's file count and latest files ?scope", errors }, async (c) => (await filesSummary(where(c)[0], 5)) ?? { root: "", count: 0, recent: [] }),
+    route({ name: "files.raw", method: "GET", path: "/api/files/raw", summary: "the file itself ?scope&path[&download=1]", errors, raw: true }, async (c) => {
+        const f = await openFile(...where(c));
+        c.res.writeHead(200, {
+            "content-type": f.mime,
+            "content-length": f.size,
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff",
+            // Anything in here may come from outside: a page, an SVG or XML renders without scripts, in an origin of its own.
+            // (Not on PDFs and media: a sandboxed document cannot show the browser's PDF viewer.)
+            ...(/^(text\/html|image\/svg|text\/xml|application\/xml)/.test(f.mime) ? { "content-security-policy": "sandbox" } : {}),
+            "content-disposition": `${c.query.get("download") ? "attachment" : "inline"}; filename*=UTF-8''${encodeURIComponent(f.name)}`,
+        });
+        f.stream.pipe(c.res);
+    }),
+    // The body is the file itself; x-file-name names it.
+    route({ name: "files.upload", method: "POST", path: "/api/files/upload", summary: "upload one file ?scope&path", errors, upload: true }, async (c) => {
+        const name = decodeURIComponent(String(c.req.headers["x-file-name"] ?? "file"));
+        return reply(201, await saveUpload(...where(c), name, c.req));
+    }),
+    route({ name: "files.mkdir", method: "POST", path: "/api/files/folder", summary: "create a folder {scope, path}", errors }, async (c) => {
+        const body = await c.body();
+        return reply(201, await makeFolder(body.scope ?? where(c)[0], String(body.path ?? "")));
+    }),
+    route({ name: "files.move", method: "POST", path: "/api/files/move", summary: "move or rename {scope, from, to}", errors }, async (c) => {
+        const body = await c.body();
+        await moveFile(body.scope ?? where(c)[0], String(body.from ?? ""), String(body.to ?? ""));
+        return { ok: true };
+    }),
+    route({ name: "files.delete", method: "DELETE", path: "/api/files", summary: "move a file or folder ?scope&path to the trash", errors }, async (c) => {
+        await deleteFile(...where(c));
+        return { ok: true };
+    }),
+];

package/dist/inspector/api/git.d.ts

@@ -0,0 +1,25 @@
+/** The workspace's own git, and the repositories cloned under its repos root. */
+export declare const gitRoutes: (import("./router.js").Route<"git.commit", import("./router.js").Reply<{
+    ok: boolean;
+    error?: string;
+    committed?: number;
+}>, "/api/git/commit"> | import("./router.js").Route<"git.diff", import("../git.js").GitDiff, "/api/git/diff"> | import("./router.js").Route<"git.fetch", import("./router.js").Reply<{
+    ok: boolean;
+    error?: string;
+}>, "/api/git/fetch"> | import("./router.js").Route<"git.pull", import("./router.js").Reply<{
+    ok: boolean;
+    error?: string;
+}>, "/api/git/pull"> | import("./router.js").Route<"git.push", import("./router.js").Reply<{
+    ok: boolean;
+    error?: string;
+}>, "/api/git/push"> | import("./router.js").Route<"git.status", import("../git.js").GitStatus, "/api/git"> | import("./router.js").Route<"repos.add", import("./router.js").Reply<import("../repos.js").RepoInfo>, "/api/repos"> | import("./router.js").Route<"repos.commit", import("./router.js").Reply<import("../git.js").GitDiff>, "/api/repos/:slug/commits/:hash"> | import("./router.js").Route<"repos.diff", import("./router.js").Reply<import("../git.js").GitDiff>, "/api/repos/:slug/diff"> | import("./router.js").Route<"repos.get", import("../repos.js").RepoDetail, "/api/repos/:slug"> | import("./router.js").Route<"repos.list", import("../repos.js").ReposView, "/api/repos"> | import("./router.js").Route<"repos.remove", import("./router.js").Reply<{
+    ok: boolean;
+    error?: string;
+    off?: boolean;
+    conflict?: boolean;
+}>, "/api/repos/:slug"> | import("./router.js").Route<"repos.update", import("./router.js").Reply<{
+    ok: boolean;
+    error?: string;
+    off?: boolean;
+    repo?: import("../repos.js").RepoInfo;
+}>, "/api/repos/:slug/update">)[];

package/dist/inspector/api/git.js

@@ -0,0 +1,56 @@
+import { gitCommit, gitDiff, gitFetch, gitPull, gitPush, gitStatus } from "../git.js";
+import { addRepo, listRepos, openRepos, removeRepo, repoCommitDiff, repoDetail, repoDiff, updateRepo } from "../repos.js";
+import { fail, reply, route, statusByMessage } from "./router.js";
+const repoErrors = statusByMessage(/^no repository/);
+const conflictUnlessOk = (result) => reply(result.ok ? 200 : 409, result);
+/** The workspace's own git, and the repositories cloned under its repos root. */
+export const gitRoutes = [
+    // The git screen polls this, so it is cached for a beat; ?fresh=1 bypasses the cache.
+    route({ name: "git.status", method: "GET", path: "/api/git", summary: "branch, ahead/behind, changed files" }, async (c) => gitStatus(c.query.has("fresh"))),
+    route({ name: "git.diff", method: "GET", path: "/api/git/diff", summary: "unified diff for one file ?path=" }, async (c) => {
+        const file = c.query.get("path");
+        if (!file)
+            fail(400, "path required");
+        return gitDiff(file);
+    }),
+    // Commit and push stay manual; the background timer never writes history.
+    route({ name: "git.commit", method: "POST", path: "/api/git/commit", summary: "stage and commit {paths, message}", errors: 400 }, async (c) => {
+        const body = await c.body();
+        const paths = Array.isArray(body.paths) ? body.paths.filter((p) => typeof p === "string") : [];
+        const result = await gitCommit(paths, typeof body.message === "string" ? body.message : "");
+        return reply(result.ok ? 200 : 409, result);
+    }),
+    route({ name: "git.fetch", method: "POST", path: "/api/git/fetch", summary: "git fetch" }, async () => conflictUnlessOk(await gitFetch())),
+    route({ name: "git.pull", method: "POST", path: "/api/git/pull", summary: "git pull --ff-only" }, async () => conflictUnlessOk(await gitPull())),
+    route({ name: "git.push", method: "POST", path: "/api/git/push", summary: "git push" }, async () => conflictUnlessOk(await gitPush())),
+    route({ name: "repos.list", method: "GET", path: "/api/repos", summary: "every clone under the repos root, read live from git" }, async () => listRepos()),
+    route({ name: "repos.add", method: "POST", path: "/api/repos", summary: "clone {url, name?, branch?, depth?} into the root", errors: 400 }, async (c) => {
+        if ((await openRepos()).off)
+            fail(409, "repositories are off");
+        const body = await c.body();
+        const str = (v) => (typeof v === "string" ? v : undefined);
+        const depth = body.depth === undefined ? undefined : typeof body.depth === "number" ? body.depth : Number.NaN;
+        return reply(201, await addRepo({ url: str(body.url) ?? "", name: str(body.name), branch: str(body.branch), depth }));
+    }),
+    route({ name: "repos.get", method: "GET", path: "/api/repos/:slug", summary: "changed files, line counts, recent commits (unpushed marked)", errors: repoErrors }, async (c) => {
+        const detail = await repoDetail(c.params.slug);
+        return detail ?? fail(404, `no repository "${c.params.slug}"`);
+    }),
+    route({ name: "repos.diff", method: "GET", path: "/api/repos/:slug/diff", summary: "unified diff of one changed file ?path= against HEAD", errors: repoErrors }, async (c) => {
+        const d = await repoDiff(c.params.slug, c.query.get("path") ?? "");
+        return reply(d.error ? (/^not shown/.test(d.error) ? 404 : 400) : 200, d);
+    }),
+    route({ name: "repos.commit", method: "GET", path: "/api/repos/:slug/commits/:hash", summary: "one commit as a patch", errors: repoErrors }, async (c) => {
+        const d = await repoCommitDiff(c.params.slug, c.params.hash);
+        return reply(d.error ? (/^no such commit/.test(d.error) ? 404 : 400) : 200, d);
+    }),
+    route({ name: "repos.update", method: "POST", path: "/api/repos/:slug/update", summary: "fetch, fast-forward when clean", errors: 400 }, async (c) => {
+        const result = await updateRepo(c.params.slug);
+        return reply(result.ok ? 200 : result.repo || result.off ? 409 : 404, result);
+    }),
+    // 409 while the clone holds unpushed or uncommitted work, unless ?force=1.
+    route({ name: "repos.remove", method: "DELETE", path: "/api/repos/:slug", summary: "remove the clone", errors: 400 }, async (c) => {
+        const result = await removeRepo(c.params.slug, ["1", "true"].includes(c.query.get("force") ?? ""));
+        return reply(result.ok ? 200 : result.conflict || result.off ? 409 : 404, result);
+    }),
+];