@oharness/server 0.11.0 → 0.14.0

package/dist/server.js

@@ -5,16 +5,21 @@ import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { homedir } from "node:os";
 import { Harness } from "@oharness/engine/harness.ts";
+import { BackgroundUsage } from "@oharness/engine/agent/background-usage.ts";
 import { updateUserMcpConfig } from "@oharness/engine/config-files.ts";
 import { connectorConfig, officialConnectors } from "@oharness/engine/mcp/registry.ts";
+import { findForeignServer, foreignMcpServers } from "@oharness/engine/foreign.ts";
+import { installMarketPlugin, marketPlugins, removeMarketPlugin } from "@oharness/engine/plugin-market.ts";
 import { missingSecrets } from "@oharness/engine/mcp/secrets.ts";
-import { connectorIcon, providerSites, siteIcon } from "./icons.js";
+import { connectorIcon, providerSites, sameSite, siteIcon, vendorSites } from "./icons.js";
+import { TOOL_ICONS } from "./tool-icons.js";
 import { checkAnswer } from "@oharness/engine/tools/questions.ts";
 import { isFree } from "@oharness/engine/providers/types.ts";
 import { PERMISSION_MODES } from "@oharness/engine/agent/permissions.ts";
 import { canDisableThinking, effectiveEffort, isEffortChoice, thinkingFor, } from "@oharness/engine/providers/types.ts";
 import { isReadable } from "@oharness/engine/agent/workspace.ts";
 import { BRANCH_TYPES, createWorktree, findWorktree, finishWorktree, listWorktrees, previewWorktree, worktreeStatus, } from "@oharness/engine/worktree/index.ts";
+import { restoredTaskView } from "@oharness/engine/agent/background.ts";
 import { within as insideAny } from "@oharness/engine/paths.ts";
 import { visibleText } from "@oharness/engine/core/types.ts";
 import { previewJson } from "@oharness/engine/util/json.ts";
@@ -302,6 +307,14 @@ export async function startWebServer(opts) {
     equipThemes(opts.agent.tools);
     const themeChanged = (state) => broadcast({ type: "theme", state });
     const runners = new Map();
+    /** Sidebar rows of sessions that are not loaded, keyed by tasks-file stamp. */
+    const storedTaskRows = new Map();
+    const sidebarTaskRows = (views) => views
+        .filter((task) => !task.dismissed)
+        .map((task) => ({
+        id: task.id, description: task.description, status: task.status,
+        queuedAt: task.queuedAt, endedAt: task.endedAt, activity: task.activity,
+    }));
     /** Agents whose background tasks are being watched; see watchTasks. */
     const watchedTasks = new WeakSet();
     // Written in the background; the page on that project swaps them in.
@@ -427,7 +440,6 @@ export async function startWebServer(opts) {
     // browser is still the same one bound by Harness.agent(session).
     initial.agent = opts.agent;
     runners.set(opts.session.id, initial);
-    adoptTasks(initial);
     let current = { session: opts.session, agent: opts.agent, harness: opts.harness };
     /**
      * Sign-ins waiting for their emailed code.
@@ -603,6 +615,8 @@ export async function startWebServer(opts) {
         for (const client of clients)
             client.write(payload);
     };
+    // Restored tasks may resolve immediately, so the broadcaster must exist.
+    adoptTasks(initial);
     const connectionSubscriptions = [];
     function watchConnections(harness) {
         connectionSubscriptions.push(harness.cloudConnectors.subscribe((card) => {
@@ -1713,13 +1727,19 @@ export async function startWebServer(opts) {
             case "GET /registry": {
                 const installed = new Set(contextOffer().connectors.map((one) => one.name));
                 const entries = await officialConnectors();
+                const found = await foreignMcpServers(current.session.cwd, current.harness.config.imports ?? {}, current.harness.plugins);
                 return send(res, 200, {
+                    // What Claude Code and Codex already have, offered rather than
+                    // started: each one is a process, and often a token, that the user
+                    // set up for another program. See `foreign.ts`.
+                    imports: found.map((one) => foreignRow(one, installed)),
                     connectors: entries.map((entry) => ({
                         id: entry.id,
                         label: entry.label,
                         ...(entry.description ? { description: entry.description } : {}),
                         ...(entry.publisher ? { publisher: entry.publisher } : {}),
                         ...(entry.docsUrl ? { docsUrl: entry.docsUrl } : {}),
+                        ...(entry.category ? { category: entry.category } : {}),
                         installed: installed.has(entry.id),
                         // Said before the click, not after it. An entry that needs a key
                         // fails at connect with a perfectly clear message, but a menu that
@@ -1737,10 +1757,35 @@ export async function startWebServer(opts) {
              * otherwise be twelve third-party requests, each one telling a vendor
              * that this user opened the menu before connecting anything.
              */
+            // Claude Code's and Codex's own marks; see tool-icons.ts.
+            case "GET /tool-icon": {
+                const data = TOOL_ICONS[url.searchParams.get("id") ?? ""];
+                if (!data)
+                    return send(res, 404, { error: "no icon" });
+                const bytes = Buffer.from(data, "base64");
+                res.writeHead(200, {
+                    "content-type": "image/png",
+                    "content-length": bytes.length,
+                    "cache-control": "private, max-age=604800",
+                });
+                res.end(bytes);
+                return;
+            }
             case "GET /connector-icon": {
                 const id = url.searchParams.get("id") ?? "";
                 const entry = (await officialConnectors()).find((one) => one.id === id);
-                const icon = entry?.siteUrl ? await connectorIcon(entry.id, entry.siteUrl) : undefined;
+                let icon = entry?.siteUrl ? await connectorIcon(entry.id, entry.siteUrl) : undefined;
+                // One brought over from Claude Code or Codex, or added from them: its
+                // vendor's site, from the host it talks to — mcp.zernio.com is
+                // zernio.com. Looked up by name here, never taken from the request.
+                if (!icon && !entry) {
+                    const site = foreignSite((current.harness.mcpStatus?.() ?? []).some((one) => one.name === id)
+                        ? current.harness.mcp.configFor(id)
+                        : (await foreignMcpServers(current.session.cwd, current.harness.config.imports ?? {}, current.harness.plugins))
+                            .find((one) => one.name === id && one.config?.type === "http")?.config);
+                    if (site)
+                        icon = await siteIcon(`site-${new URL(site).hostname}`, vendorSites(site));
+                }
                 // A row without a picture draws a monogram, so this is a normal answer
                 // rather than something worth reporting.
                 if (!icon)
@@ -1794,6 +1839,42 @@ export async function startWebServer(opts) {
              */
             case "POST /connector": {
                 const body = await readJson(req);
+                /**
+                 * One found in Claude Code's or Codex's config, named by where it was
+                 * found rather than sent whole. The declaration is read again here,
+                 * so what starts is what is in that file — not whatever a page that
+                 * can reach this port chose to put in a request body.
+                 */
+                if (body.import && typeof body.import === "object") {
+                    const key = body.import;
+                    const found = await findForeignServer(current.session.cwd, {
+                        source: String(key.source ?? ""),
+                        scope: String(key.scope ?? ""),
+                        name: String(key.name ?? ""),
+                        ...(typeof key.plugin === "string" ? { plugin: key.plugin } : {}),
+                    }, current.harness.config.imports ?? {}, current.harness.plugins);
+                    if (!found)
+                        return send(res, 404, { error: "that server is no longer in its config file" });
+                    if (!found.config)
+                        return send(res, 400, { error: `${found.name} cannot be used here` });
+                    const name = found.name;
+                    if (current.harness.mcpStatus().some((one) => one.name === name)) {
+                        return send(res, 409, { error: `a connector named "${name}" is already here` });
+                    }
+                    try {
+                        const status = await current.harness.addMcpServer(name, found.config);
+                        if (!status.connected && !status.needsAuth) {
+                            await current.harness.removeMcpServer(name);
+                            return send(res, 400, { error: status.error ?? `${name} did not start` });
+                        }
+                        await updateUserMcpConfig((existing) => ({ ...existing, [name]: found.config }));
+                        return send(res, 200, { status, ...contextOffer() });
+                    }
+                    catch (err) {
+                        await current.harness.removeMcpServer(name).catch(() => { });
+                        return send(res, 400, { error: errorMessage(err) });
+                    }
+                }
                 const id = typeof body.id === "string" ? body.id.trim() : "";
                 if (!id)
                     return send(res, 400, { error: "id is required" });
@@ -1834,6 +1915,103 @@ export async function startWebServer(opts) {
                     return send(res, 400, { error: errorMessage(err) });
                 }
             }
+            /**
+             * The plugins on offer, as the connectors are: a file, plus what is here.
+             *
+             * A plugin counts as here when one of that name is loaded from anywhere —
+             * Claude Code's cache included. Offering a second copy of something the
+             * Installed list already shows is how a menu ends up with two PostHogs.
+             */
+            case "GET /plugin-market": {
+                const loaded = current.harness.plugins ?? [];
+                const entries = await marketPlugins();
+                return send(res, 200, {
+                    plugins: entries.map((entry) => ({
+                        id: entry.id,
+                        label: entry.label,
+                        publisher: entry.publisher,
+                        category: entry.category,
+                        description: entry.description,
+                        ...(entry.homepage ? { homepage: entry.homepage } : {}),
+                        provides: entry.provides,
+                        installed: loaded.some((one) => one.market?.id === entry.id || one.name === entry.id),
+                    })),
+                });
+            }
+            /**
+             * Install a plugin from the list, or remove one it installed.
+             *
+             * Every open project's harness takes the change, not just the focused
+             * one: the plugin directory is the user's, so it is in every project,
+             * and a tab in another tree that kept the old set would disagree with
+             * the menu about what is installed.
+             */
+            case "POST /plugin-market": {
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id.trim() : "";
+                if (!id)
+                    return send(res, 400, { error: "id is required" });
+                const open = new Set([current.harness, ...harnesses.values()]);
+                if (body.remove === true) {
+                    const installed = (current.harness.plugins ?? []).find((one) => one.market?.id === id);
+                    if (!installed)
+                        return send(res, 404, { error: `${id} was not installed from the plugin list` });
+                    for (const harness of open)
+                        await harness.dropPlugin(installed.directory);
+                    await removeMarketPlugin(id);
+                    return send(res, 200, { removed: id, ...contextOffer() });
+                }
+                const entry = (await marketPlugins()).find((one) => one.id === id);
+                if (!entry)
+                    return send(res, 404, { error: `no plugin named "${id}"` });
+                try {
+                    const directory = await installMarketPlugin(entry);
+                    for (const harness of open)
+                        await harness.adoptPlugin(directory);
+                    return send(res, 200, { installed: id, ...contextOffer() });
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            /**
+             * A plugin's vendor icon, on the same terms as a connector's.
+             *
+             * The marketplace's site for the plugin first, because a manifest's
+             * homepage is as often a GitHub repository as the vendor's own page, and
+             * every one of those would come back wearing GitHub's mark.
+             */
+            case "GET /plugin-icon": {
+                const id = url.searchParams.get("id") ?? "";
+                const loaded = (current.harness.plugins ?? []).find((one) => one.name === id || one.market?.id === id);
+                // A Codex plugin ships its own mark, which beats any guess from its site.
+                if (loaded?.logo) {
+                    const type = { ".png": "image/png", ".svg": "image/svg+xml", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".webp": "image/webp" }[path.extname(loaded.logo).toLowerCase()];
+                    const bytes = type ? await readFile(loaded.logo).catch(() => undefined) : undefined;
+                    if (bytes && type) {
+                        res.writeHead(200, { "content-type": type, "content-length": bytes.length, "cache-control": "private, max-age=86400" });
+                        res.end(bytes);
+                        return;
+                    }
+                }
+                const listed = (await marketPlugins()).find((one) => one.id === id || one.id === loaded?.market?.id);
+                const site = listed?.siteUrl ?? loaded?.siteUrl;
+                // A vendor with a connector too wears the connector's mark: the two
+                // dialogs then show one vendor one way, and a mark the connector list
+                // already fetched is not lost to this one's failed attempt.
+                const sibling = site ? (await officialConnectors()).find((one) => sameSite(one.siteUrl, site)) : undefined;
+                const icon = (sibling?.siteUrl ? await connectorIcon(sibling.id, sibling.siteUrl) : undefined) ??
+                    (site ? await siteIcon(`plugin-${listed?.id ?? id}`, vendorSites(site)) : undefined);
+                if (!icon)
+                    return send(res, 404, { error: "no icon" });
+                res.writeHead(200, {
+                    "content-type": icon.type,
+                    "content-length": icon.bytes.length,
+                    "cache-control": "private, max-age=86400",
+                });
+                res.end(icon.bytes);
+                return;
+            }
             /**
              * Log in to a connector that asked for it.
              *
@@ -2391,6 +2569,23 @@ export async function startWebServer(opts) {
                 broadcast({ type: "connectors_changed", ...contextOffer() });
                 return send(res, 200, await current.harness.claudeAgentStatus());
             }
+            /**
+             * Switch one skill off or on. Every open project's harness, as with
+             * Claude Agent: it is a setting of this machine, not of one project.
+             */
+            case "POST /skill": {
+                const body = await readJson(req);
+                const name = typeof body.name === "string" ? body.name.trim() : "";
+                if (!name)
+                    return send(res, 400, { error: "name is required" });
+                if (typeof body.enabled !== "boolean")
+                    return send(res, 400, { error: "enabled must be a boolean" });
+                for (const harness of new Set([current.harness, ...harnesses.values()])) {
+                    await harness.setSkillEnabled(name, body.enabled);
+                }
+                broadcast({ type: "connectors_changed", ...contextOffer() });
+                return send(res, 200, contextOffer());
+            }
             case "POST /settings/browser-mode": {
                 const body = await readJson(req);
                 if (body.mode !== "auto" && body.mode !== "builtin" && body.mode !== "extension") {
@@ -2827,13 +3022,39 @@ export async function startWebServer(opts) {
             case "GET /sessions": {
                 const prefs = await readPrefs();
                 const pinned = new Set(prefs.pinnedSessions ?? []);
+                const metas = await current.harness.listSessions(50);
+                const taskRows = new Map();
+                // Bound disk concurrency. Read stored views only: listing history must
+                // never create agents, switch projects or deliver pending results.
+                for (let offset = 0; offset < metas.length; offset += 5) {
+                    await Promise.all(metas.slice(offset, offset + 5).map(async (meta) => {
+                        const runner = runners.get(meta.id);
+                        if (runner) {
+                            taskRows.set(meta.id, sidebarTaskRows(runner.agent.backgroundTasks?.list() ?? []));
+                            return;
+                        }
+                        // The stored document carries every task's conversation; parse it
+                        // again only when it has been rewritten since the last listing.
+                        const stamp = await current.harness.store.tasksStamp(meta.id);
+                        const cached = storedTaskRows.get(meta.id);
+                        if (cached && cached.stamp === stamp)
+                            return void taskRows.set(meta.id, cached.rows);
+                        const rows = stamp === undefined ? [] : sidebarTaskRows((await current.harness.store.readTasks(meta.id)).flatMap((raw) => {
+                            const view = raw?.view;
+                            return view?.id ? [restoredTaskView(view)] : [];
+                        }));
+                        storedTaskRows.set(meta.id, { stamp, rows });
+                        taskRows.set(meta.id, rows);
+                    }));
+                }
                 return send(res, 200, {
                     // What somebody arranged by hand travels beside the list rather than
                     // being applied to it here: the sidebar groups by project and hides
                     // the tail of each group, so it is the only side that knows which
                     // rows an order has to survive.
                     order: prefs.sessionOrder ?? {},
-                    sessions: (await current.harness.listSessions(50)).map((meta) => ({
+                    sessions: metas.map((meta) => ({
+                        tasks: taskRows.get(meta.id) ?? [],
                         id: meta.id,
                         pinned: pinned.has(meta.id),
                         title: meta.title,
@@ -2901,7 +3122,8 @@ export async function startWebServer(opts) {
                         ...row,
                         current: row.id === current.session.id,
                     })),
-                    total: list.length,
+                    // Sessions, not rows: a day of background calls is listed but is not one.
+                    total: list.filter((row) => !row.background).length,
                     offset,
                     more: offset + limit < list.length,
                     truncated: stored.length >= USAGE_SESSIONS_SCAN,
@@ -2934,6 +3156,9 @@ export async function startWebServer(opts) {
                     return into;
                 };
                 const totals = list.reduce(add, { ...zero });
+                // A background row is spending, not a session: it counts toward the
+                // money and tokens, not toward how many sessions they came from.
+                const sessionCount = list.filter((row) => !row.background).length;
                 // Per model, because that is the axis a bill is read along: the same
                 // work costs an order of magnitude more on one model than another, and
                 // the only way to see that is to have them side by side.
@@ -2941,7 +3166,8 @@ export async function startWebServer(opts) {
                 for (const row of list) {
                     const bucket = byModel.get(row.model)
                         ?? { model: row.model, sessions: 0, lastUsedAt: 0, ...zero };
-                    bucket.sessions += 1;
+                    if (!row.background)
+                        bucket.sessions += 1;
                     bucket.lastUsedAt = Math.max(bucket.lastUsedAt, row.updatedAt);
                     byModel.set(row.model, add(bucket, row));
                 }
@@ -2954,7 +3180,7 @@ export async function startWebServer(opts) {
                     from: window.from,
                     to: window.to,
                     series: usageSeries(list, since || (list.length ? list[list.length - 1].updatedAt : Date.now()), until),
-                    totals: { ...totals, sessions: list.length },
+                    totals: { ...totals, sessions: sessionCount },
                     // Sorted by what was spent, not by name: the row worth seeing first
                     // is the expensive one.
                     models: [...byModel.values()].sort((a, b) => b.costUsd - a.costUsd),
@@ -3686,6 +3912,7 @@ export async function startWebServer(opts) {
                     await runners.get(id)?.agent.discardBackgroundTasks();
                     const forks = (await current.harness.store.children(id)).length;
                     const deleted = await current.harness.deleteSession(id);
+                    storedTaskRows.delete(id);
                     await removeTurnShots(id);
                     // A session nobody has spoken to has nothing on disk yet — the store
                     // writes on the first message — but it is still a session someone
@@ -4139,6 +4366,56 @@ export async function startWebServer(opts) {
      * is declared but failed to start is worth showing as exactly that, and a
      * menu built from the config file would claim it was there.
      */
+    /**
+     * One server found in Claude Code's or Codex's config, as the connector
+     * list shows it. What it runs is summarised — a host, a command's name —
+     * rather than echoed: an argument or a URL can carry a key, and the row
+     * only needs to say which server this is.
+     */
+    /** The vendor's site for an HTTP server, from its host; none for a local one. */
+    function foreignSite(config) {
+        if (config?.type !== "http")
+            return undefined;
+        let host;
+        try {
+            host = new URL(config.url).hostname.toLowerCase();
+        }
+        catch {
+            return undefined;
+        }
+        if (host === "localhost" || /^[\d.]+$/.test(host) || host.endsWith(".local") || !host.includes("."))
+            return undefined;
+        const bare = host.replace(/^(mcp|api|connect|server)\./, "");
+        return "https://" + bare + "/";
+    }
+    function foreignRow(one, installed) {
+        const config = one.config;
+        let target = "";
+        if (config?.type === "http") {
+            try {
+                target = new URL(config.url).host;
+            }
+            catch {
+                target = "";
+            }
+        }
+        else if (config) {
+            target = path.basename(config.command);
+        }
+        return {
+            source: one.source,
+            scope: one.scope,
+            name: one.name,
+            ...(one.plugin ? { plugin: one.plugin } : {}),
+            ...(one.pluginTitle ? { pluginTitle: one.pluginTitle } : {}),
+            file: one.file.startsWith(homedir()) ? "~" + one.file.slice(homedir().length) : one.file,
+            ...(config ? { transport: config.type, target } : {}),
+            ...(one.reason ? { reason: one.reason } : {}),
+            ...(one.inlineSecret ? { inlineSecret: true } : {}),
+            ...(config && missingSecrets(config).length ? { missingEnv: missingSecrets(config) } : {}),
+            installed: installed.has(one.name),
+        };
+    }
     function contextOffer() {
         const harness = current.harness;
         const connectors = (harness.mcpStatus?.() ?? []).map((status) => ({
@@ -4151,10 +4428,14 @@ export async function startWebServer(opts) {
         }));
         const plugins = (harness.plugins ?? []).map((plugin) => ({
             name: plugin.name,
+            ...(plugin.title ? { title: plugin.title } : {}),
             ...(plugin.description ? { description: plugin.description } : {}),
             source: plugin.source,
             servers: Object.keys(plugin.mcpServers ?? {}),
             subagents: plugin.subagents?.length ?? 0,
+            // The marketplace id, for the row's remove button. Only a directory the
+            // marketplace put there carries one; nothing else is removed from here.
+            ...(plugin.market ? { market: plugin.market.id } : {}),
         }));
         const runtime = (harness.runtimePluginStatus?.() ?? []).map((plugin) => ({
             name: plugin.id,
@@ -4175,13 +4456,17 @@ export async function startWebServer(opts) {
          * in the model's own system prompt. Nobody driving the composer could see
          * what was there, let alone point at one.
          */
-        const skills = (harness.skills?.list?.() ?? []).map((skill) => ({
+        // Switched-off ones included, so the list that switched one off still
+        // has the row to switch it back on. Everything that only wants what the
+        // model can load filters on `disabled`.
+        const skills = (harness.skills?.listAll?.() ?? harness.skills?.list?.() ?? []).map((skill) => ({
             name: skill.name,
             description: skill.description,
             source: skill.source,
             // "builtin" is the registry's own word for one that ships with the
             // harness; the rest name where on disk they were found.
             builtin: skill.source === "builtin",
+            ...(harness.skills?.isDisabled?.(skill.name) ? { disabled: true } : {}),
         }));
         /**
          * What shipped here first, then what this machine added.
@@ -5076,6 +5361,16 @@ export async function startWebServer(opts) {
                 ...tokensOf(sess.usage),
             });
         }
+        // Calls made outside any conversation (dreaming) have no transcript to sum;
+        // they are recorded per day, purpose and model, and join the totals here.
+        for (const record of await BackgroundUsage.shared.records().catch(() => [])) {
+            const id = `background:${record.purpose}:${record.day}:${record.model}`;
+            rows.set(id, {
+                id, title: record.purpose, model: record.model, updatedAt: record.updatedAt, turns: 0,
+                costUsd: record.costUsd, input: record.input, output: record.output, cacheRead: record.cacheRead, cacheWrite: record.cacheWrite,
+                background: record.purpose,
+            });
+        }
         return { stored, rows };
     }
     async function artifactCatalogue() {