npm - @openchambery/web - Versions diffs - 1.19.7-beta.13 → 1.19.7-beta.14 - Mend

@openchambery/web 1.19.7-beta.13 → 1.19.7-beta.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (118) hide show

package/dist/index.html CHANGED Viewed

@@ -552,7 +552,7 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-DYFky6Uj.js"></script>
+    <script type="module" crossorigin src="/assets/main-Dl-XWJxN.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
@@ -569,8 +569,8 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-CIIs9vFx.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-DNsnUkyp.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-BGao3JmJ.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-Dkt3p8CZ.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-KcdsQIuP.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html CHANGED Viewed

@@ -74,7 +74,7 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-DK-d_3-7.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-Cho-Pywx.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
@@ -91,8 +91,8 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-CIIs9vFx.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-DNsnUkyp.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-BGao3JmJ.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-Dkt3p8CZ.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-KcdsQIuP.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,7 +63,7 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-8QzXy5wz.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-1_JD1EGE.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
@@ -80,8 +80,8 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-CIIs9vFx.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-DNsnUkyp.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-BGao3JmJ.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-Dkt3p8CZ.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-KcdsQIuP.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "1.19.7-beta.13",
+  "version": "1.19.7-beta.14",
   "private": false,
   "type": "module",
   "main": "./server/index.js",
@@ -25,6 +25,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.1.0",
+    "@earendil-works/pi-agent-core": "0.84.4",
     "@octokit/rest": "^22.0.1",
     "@opencode-ai/sdk": "1.18.4",
     "@simplewebauthn/server": "13.3.1",

package/server/index.js CHANGED Viewed

@@ -1602,6 +1602,8 @@ async function main(options = {}) {
     messageQueueRuntime,
     globalMessageStreamHub,
     getServerId: () => relayService.getServerId(),
+    sessionIndexService,
+    notifyContactTurnComplete: (event) => notificationTriggerRuntime.sendContactTurnNotification(event),
   });
   const previewProxyRuntime = createPreviewProxyRuntime({

package/server/lib/assistant-delivery-parts.js CHANGED Viewed

@@ -20,5 +20,7 @@ export const validAssistantDeliveryParts = (parts, { allowAttachmentRefs = false
         && part.text.length <= MAX_TEXT_LENGTH
         && (part.synthetic === undefined || typeof part.synthetic === 'boolean');
     }
-    return part.type === 'file' && typeof part.mime === 'string' && part.mime.length > 0 && part.mime.length <= MAX_STRING_LENGTH && ((allowAttachmentRefs && Object.keys(part).every((key) => key === 'type' || key === 'mime' || key === 'attachmentID') && typeof part.attachmentID === 'string' && part.attachmentID.length > 0 && part.attachmentID.length <= MAX_STRING_LENGTH) || (Object.keys(part).every((key) => key === 'type' || key === 'mime' || key === 'url') && typeof part.url === 'string' && part.url.length > 0 && part.url.length <= MAX_FILE_URL_LENGTH));
+    const filenameOk = part.filename === undefined
+      || (typeof part.filename === 'string' && part.filename.length > 0 && part.filename.length <= MAX_STRING_LENGTH);
+    return part.type === 'file' && typeof part.mime === 'string' && part.mime.length > 0 && part.mime.length <= MAX_STRING_LENGTH && filenameOk && ((allowAttachmentRefs && Object.keys(part).every((key) => key === 'type' || key === 'mime' || key === 'attachmentID') && typeof part.attachmentID === 'string' && part.attachmentID.length > 0 && part.attachmentID.length <= MAX_STRING_LENGTH) || (Object.keys(part).every((key) => key === 'type' || key === 'mime' || key === 'url' || key === 'filename') && typeof part.url === 'string' && part.url.length > 0 && part.url.length <= MAX_FILE_URL_LENGTH));
   });

package/server/lib/assistant-delivery-parts.test.js CHANGED Viewed

@@ -13,4 +13,15 @@ describe('validAssistantDeliveryParts', () => {
     expect(validAssistantDeliveryParts([{ type: 'text', text: 'hello', id: 'part_1' }])).toBe(false);
     expect(validAssistantDeliveryParts([{ type: 'text', text: 'hello', synthetic: 'yes' }])).toBe(false);
   });
+  it('accepts file parts with mime+url and optional filename', () => {
+    expect(validAssistantDeliveryParts([
+      { type: 'text', text: 'look' },
+      { type: 'file', mime: 'image/png', url: 'data:image/png;base64,aa', filename: 'shot.png' },
+      { type: 'file', mime: 'text/plain', url: 'data:text/plain;base64,eA==' },
+    ])).toBe(true);
+    expect(validAssistantDeliveryParts([
+      { type: 'file', mime: 'image/png', url: 'data:image/png;base64,aa', id: 'part_1' },
+    ])).toBe(false);
+  });
 });

package/server/lib/assistants/DOCUMENTATION.md CHANGED Viewed

@@ -1,16 +1,89 @@
 # Assistants Module
+## Acceptance criteria
+The in-app Assistant is an OpenChamber-owned **contact**. OpenCode is only the LLM gateway (`POST /api/openchamber/llm/chat/completions`) using already-connected `{providerID, modelID}`. Composer send runs `@earendil-works/pi-agent-core` with `thinkingLevel: 'off'` and OpenChamber API tools only (`new_conversation`, `list_projects`, `list_sessions`, `create_assistant`, `schedule_task`, `message_assistant`, `assign_session`). It does not use `SessionPrompt` / `promptAsync` as the conversation engine, and it never attaches bash/edit/read/write or other OpenCode coding tools.
+**Session cards (this PR)**
+- First-class contact parts reuse one slot: `cardType` `session` | `assistant` | `schedule`.
+- Persist in `assistant_contact_message` / `assistant_contact_part`. Survive reload.
+- Cards are **assistant-emitted UI**, not user slash commands. The user never types `/card`. Insert: tool auto-cards (`assign_session`, `create_assistant`, `schedule_task`), and API `POST /:id/contact/cards` for harness/tests. Later project/worktree/watch/PR, inbound pushes, and summon **must** reuse this card slot.
+**Assign work (this PR)**
+- `assign_session` is an OpenChamber AgentTool on the contact harness. It creates or reuses a visible OpenCode/OpenChamber session on a **registered project path** (Settings projects / `getAllowedRoots()`), optionally an **existing** Chat worktree/branch via `getWorktrees`, then kicks the coding prompt into that session with `session.create` + `session.promptAsync` (same worker path as `POST /api/openchamber/conversations`).
+- That worker session is the coder. The contact does not code. Assign sessions are **not** archived Assistant bindings and must not use `assistant-workspaces`.
+- After a successful assign, the service persists the existing session card into the contact transcript (user bubbles first, then the card) and watches that worker session in `assistant_contact_watch`.
+- Existing OpenCode SSE on the same `globalEventHub` as notifications (`session.idle`, `session.error`, `session.status`, `question.asked`, `permission.asked`) updates **the same card** (`busy` → `complete` / `error` / `question`) and appends one idempotent settle bubble (`oc.settle.*`). Session-goal settle (`emitGoalNotification`) is wired into that same reporter — not a second scheduler. Idle after `session.error` must not rewrite 失败 as 完成.
+- Restart or a missed `session.idle` cannot leave the watch stuck: boot and the existing 60s reconcile timer `listInFlightWatches` and poll OpenCode `session.get` / `session.messages`. Idle, `time.completed`, or a missing session settles the same card (`busy` → 完成) and appends the existing `oc.settle.complete` bubble. `session.error` or last-assistant `info.error` settles 失败. Transport / non-404 get errors leave the watch in flight (failure is not empty success). One failed watch does not block unrelated watches. Reconcile reuses `reportAssignedSession`, so an error watch is never rewritten as complete.
+- Worker sessions stamp `metadata.openchamber.assigned` (`from: 'contact'`, `assistantID`, `name`). They must **not** use `openchamber.assistant.assistantID` — that marker hides archived Assistant bindings from Chat.
+- `AssistantDTO.assignedSessionIDs` lists in-flight (`busy`/`question`) watches. `AssistantDTO.working` is true only while a watch is `busy` (the Grok-Bot green avatar dot). Question/complete/error settle the running indicator.
+- No registered project → clear `project_required` (ask the user to configure a project). Never fall back to managed assistant-workspaces.
+- Assign must not go through the peer DM channel.
+- Share/queue may still use `promptAsync` on Assistant bindings.
+**Registered projects + sessions (this PR)**
+- Every contact turn injects a **Registered projects** block (`id`, `path`, `label`) from `listProjects()` into the system prompt via `formatRegisteredProjectsPrompt`. The model can fuzzy-match names like "openchamber yee" without a tool call first. It must never claim it cannot see the list; empty catalog → tell the user to add a project in Settings.
+- `list_projects` refreshes/filters that catalog (`query` optional). `list_sessions` searches the existing session-index (`sessionIndexService.snapshot()`) for sessions in a project (`projectPath` / `projectID`, optional title query). Results are bounded (`sessionID`, `title`, `directory`, `updatedAt`). Index/catalog failure is an error, never an empty success.
+- After matching a project, open work with `assign_session` (`projectPath` and/or existing `sessionID`).
+**Create assistant / schedule task (this PR)**
+- `create_assistant` calls the same in-process `createAssistant` (`name`, connected OpenCode `providerID`/`modelID`, `mode: 'continuous'`). It emits an `assistant` card that opens that contact.
+- `schedule_task` calls in-process `projectConfigRuntime.upsertScheduledTask` with the same payload as `PUT /api/projects/:id/scheduled-tasks` (`name`, `schedule.kind/time/timezone`, `execution.prompt` + provider/model) on a registered project, then best-effort `scheduledTasksRuntime.syncProject`. It emits a `schedule` card.
+- Successful `schedule_task` also writes an assistants-owned mapping row in `assistants.sqlite` (`assistant_scheduled_task`: assistantID + projectID + taskID). Project-config execution strips unknown fields, so ownership stays out of the task payload. `GET /api/openchamber/assistants/:id/scheduled-tasks` returns those mappings joined with live `listScheduledTasks` records when possible; failed project lookups keep the mapping with `task: null`.
+- `CONTACT_SYSTEM_PROMPT` + `formatContactToolsPrompt` tell the model to call these from natural language (开新对话 / 找项目 / 现有对话 / 建助理 / 建会话 / 排定时任务 / 给 X 说一声). A reply without the tool call does nothing; never say 已创建 / 已发送 unless the tool returned. Completions are messages-only (no native tools), so `parseContactToolCalls` accepts a fence, a whole-message JSON object, or a bare `{name, arguments}` object anywhere in the reply.
+- If the user asked for `new_conversation` / `list_projects` / `list_sessions` / `create_assistant` / `schedule_task` / `message_assistant` / `assign_session` and the first completion has no tool call, the harness runs **one** follow-up completion whose user content is only `emit the fence now, do not claim success.` If still no tool, the turn replies that it could not complete and does not fake a card. No slash commands. No second store.
+**New conversation (this PR)**
+- `new_conversation` clears this assistant's OpenChamber contact transcript via `deleteContactMessages` (messages, parts, watches), bumps revision / `assistants-changed`, and confirms with a short bubble. Shared API: `POST /api/openchamber/assistants/:id/contact/reset`.
+- The tool terminates the contact turn. Persist only `NEW_CONVERSATION_CONFIRM_BUBBLE`. Discard leftover assistant text and cards from the same pre-reset generation — do not re-feed that history after reset.
+- It must **not** call OpenCode `session/new` / `createNew`. That path is worker binding, not contact context reset.
+- Natural language: 开新对话 / new conversation / clear chat.
+**Contact LLM window (this PR)**
+- `contactHistoryForLlm` is a short algorithmic window documented in `contact-store.js`: `CONTACT_LLM_MAX_TURNS` (8), `CONTACT_LLM_MAX_CHARS` (6000), `CONTACT_LLM_FETCH_LIMIT` (40), `CONTACT_LLM_FILE_CHAR_WEIGHT` (80). Newest user+assistant text pairs are kept; peer / error / pure-card rows are dropped. There is no summarizer and no user-facing compress or continuous/stateless memory control. SQLite and the transcript UI may still scroll older bubbles.
+**Contact attachments (this PR)**
+- Attach is required on the contact composer: images and non-image files via picker, paste, and drag-drop. Same OpenCode file-part convention (`mime` + data `url`, optional `filename`) stored in `assistant_contact_part`. Do not invent a second store or route uploads through SessionPrompt / ChatInput / the message-queue attachment store.
+- User bubbles persist file parts. Images render inline; other files render as a named chip. Refresh hydrates the same parts.
+- The contact harness turn receives those file parts so the OpenChamber Chat Completions / OpenCode provider gateway can show images to the model.
+**Inter-assistant DM (this PR, read-only)**
+- `message_assistant` is the contact tool for natural language (给 PeerQA 说一声 / tell PeerQA). It calls in-process `deliverPeerMessage` and confirms with a short bubble. No card required. The user never types `/dm`.
+- `POST /:fromAssistantID/contact/dm` `{ toAssistantID, text, parts? }` delivers into B’s contact transcript as `role: 'peer'` with `fromAssistantID` / `fromAssistantName`. The harness/API sends peer messages.
+- Read-only: no `session.promptAsync`, no session/file/worktree mutation, no tools on the recipient. Assign is not delivered here.
+- Peer rows are excluded from `contactHistoryForLlm` so they cannot become harness turns.
+- This is the inbox primitive for later summon. Do not invent a second inbox.
+`GET /api/openchamber/assistants/capability` remains the navigation gate.
 ## History coverage
 Snapshots expose the latest 50 `historySessionIDs` in chronological order and `historySessionCount` for the full count. The messages pagination endpoint owns complete history, including the current binding. A successful direct, shared, or queued OpenCode admission writes its user message and provisional parts to the Assistant SQLite mirror before the HTTP operation settles; this covered admission row survives binding replacement, restart, and an unavailable OpenCode history endpoint. Matching live parts replace provisional parts by message ID. Other event mirrors retain raw JSON as uncovered (`covered=0`) provisional fallback rows: they remain visible in archived history until an explicit shrink signal. Authoritative OpenCode backfill upserts covered rows and reconciles authoritative parts, rejects entries whose embedded session ID belongs to another session, and never deletes provisional mirrors merely because a successful page omitted them. Pagination `complete` only records that the OpenCode cursor was exhausted; it does not authorize deleting uncovered event mirrors. The only shrink whitelist is explicit `message.removed`, an authoritative `session.messages` 404 (`session-missing`), or assistant deletion. Late archived `message.updated` / `message.part.updated` and session lifecycle events (`session.idle`, `session.error`, `session.status` busy/retry/idle) call `invalidateBackfill` to reopen that session's cursor/complete without clearing covered flags. `history-state.js` owns the pure backfill reducer (`invalidate` → preserve; `page` → complete iff next cursor empty, always preserve; `session-missing` → discard provisional). Backfill persists the OpenCode `x-next-cursor` header verbatim and derives completion from its presence. A demand request commits up to three upstream pages and returns committed archived mirror rows (covered and provisional) with a stable scan-boundary cursor when more work remains. Startup begins one non-blocking current-binding backfill page. Archived rows preserve their stored directory; a legacy null directory triggers an authoritative session lookup of `data.directory` and `data.project.worktree`, with containment validation before persistence. Unresolved legacy directories remain `null` in persisted and historical response data. Ordinary mirror upserts preserve covered rows and never blanket-invalidate a session; explicit authoritative upserts elevate coverage; session-wide `invalidateCoverage` preserves every already-covered user row, including admitted rows whose local marker was replaced by live OpenCode info, while resetting other coverage on archive/re-archive; message-scoped coverage invalidation runs only after structural part deletes that require re-backfill. Removing an assistant tombstones the row and deletes its session history, message/part mirrors, and backfill state in one transaction. Schema v11 adds the mirror coverage marker.
 `assistants` owns Assistant configuration, session bindings, and a durable assistant-owned OpenCode message/part mirror in `assistants.sqlite`. Routes register before the generic OpenCode proxy.
-`GET /api/openchamber/assistants/capability` returns `supported`, the persisted `enabled` switch, domain revision, and relay-derived stable `serverInstanceID`. Fresh databases default `enabled` to off; Settings flips the switch, and product navigation entries stay hidden until it is on. `PUT /api/openchamber/assistants/settings` changes the global switch with `expectedRevision`. CRUD and snapshots live under `/api/openchamber/assistants`. Session routes are `POST /:id/session/ensure`, `/:id/session/new`, and `/:id/session/compact`; composer sends use `POST /:id/messages`; shares use `POST /:id/share` and `GET /share-operations/:operationID`.
+`GET /api/openchamber/assistants/capability` returns `supported`, the persisted `enabled` switch, domain revision, and relay-derived stable `serverInstanceID`. Fresh databases default `enabled` to off; Settings flips the switch, and product navigation entries stay hidden until it is on. `PUT /api/openchamber/assistants/settings` changes the global switch with `expectedRevision`. CRUD and snapshots live under `/api/openchamber/assistants`. Session routes are `POST /:id/session/ensure`, `/:id/session/new`, and `/:id/session/compact`; composer sends use `POST /:id/messages` (contact harness, not `promptAsync`); contact history is `GET /:id/contact/messages`; contact reset is `POST /:id/contact/reset`; session cards are `POST /:id/contact/cards`; read-only inter-assistant DMs are `POST /:fromID/contact/dm`; assistant-owned scheduled tasks are `GET /:id/scheduled-tasks`. Shares still use `POST /:id/share` and `GET /share-operations/:operationID`.
+`AssistantDTO.mode` remains `continuous` or `stateless` (default `continuous`) for share/queue OpenCode session binding. It is **not** a user-facing memory setting: Settings no longer exposes the continuous/stateless toggle, and new assistants stay continuous contact history with server-side LLM trim. `historySessionIDs` lists prior OpenCode session bindings in chronological order (oldest first, capped). Continuous Assistants keep one long-lived current session across composer turns. Stateless Assistants create and bind a fresh OpenCode session for every composer send, share admission, and queued delivery so the model executes without prior transcript context; prior sessions remain available in OpenCode history. The Assistant surface follows the current binding, so each stateless turn rematerializes onto that fresh session. `AssistantDTO.workspacePath` retains the configuration value: `null` selects the managed workspace and a string selects a registered project path. `AssistantDTO.managedWorkspacePath` always carries the canonical managed target at `dataDir/assistant-workspaces/<assistantID>`, including for project-configured Assistants. `AssistantDTO.effectiveWorkspacePath` carries the resolved OpenCode session directory. `AssistantDTO.variant` is nullable and reaches OpenCode `promptAsync` with provider, model, agent, and system prompt. `SessionBinding` is `{ sessionID, directory, sessionGeneration }` with the effective directory. `ensure` and `new` return `SessionBinding`; `compact` returns `{ binding, summarized: true }`; messages return `{ binding, messageID, admitted: true }`; shares return top-level `{ operationID, assistantID, sessionID, messageID, state, phase, attempt, leaseExpiresAt, errorCode }`. `contracts.js` exports serialization fixtures for these DTOs. Binding replacement uses generation CAS, so concurrent creation retains one winner while orphan sessions stay available in OpenCode history. Workspace changes create and bind a session in the new directory. Session metadata carries `openchamber.assistant.assistantID` and `name` as the authoritative ownership marker. New OpenCode sessions use the fixed human title `[Assistant] ${name}` and are archived via `session.update({ time: { archived } })` immediately after create and before binding is returned, so ordinary active lists never flash them; metadata isolation still applies if archive fails after create. The session index and global session lists hide system sessions by this metadata (never by title prefix). Assistant history and direct source open remain the entry points.
+**Contact send admission + SSE (this PR)**
-`AssistantDTO.mode` is `continuous` or `stateless` (default `continuous`). `historySessionIDs` lists prior OpenCode session bindings in chronological order (oldest first, capped) so the UI can stitch a read-only transcript with “new conversation” dividers while the live binding stays the only writable session. Continuous Assistants keep one long-lived current session across composer turns. Stateless Assistants create and bind a fresh OpenCode session for every composer send, share admission, and queued delivery so the model executes without prior transcript context; prior sessions remain available in OpenCode history. The Assistant surface follows the current binding, so each stateless turn rematerializes onto that fresh session. `AssistantDTO.workspacePath` retains the configuration value: `null` selects the managed workspace and a string selects a registered project path. `AssistantDTO.managedWorkspacePath` always carries the canonical managed target at `dataDir/assistant-workspaces/<assistantID>`, including for project-configured Assistants. `AssistantDTO.effectiveWorkspacePath` carries the resolved OpenCode session directory. `AssistantDTO.variant` is nullable and reaches OpenCode `promptAsync` with provider, model, agent, and system prompt. `SessionBinding` is `{ sessionID, directory, sessionGeneration }` with the effective directory. `ensure` and `new` return `SessionBinding`; `compact` returns `{ binding, summarized: true }`; messages return `{ binding, messageID, admitted: true }`; shares return top-level `{ operationID, assistantID, sessionID, messageID, state, phase, attempt, leaseExpiresAt, errorCode }`. `contracts.js` exports serialization fixtures for these DTOs. Binding replacement uses generation CAS, so concurrent creation retains one winner while orphan sessions stay available in OpenCode history. Workspace changes create and bind a session in the new directory. Session metadata carries `openchamber.assistant.assistantID` and `name` as the authoritative ownership marker. New OpenCode sessions use the fixed human title `[Assistant] ${name}` and are archived via `session.update({ time: { archived } })` immediately after create and before binding is returned, so ordinary active lists never flash them; metadata isolation still applies if archive fails after create. The session index and global session lists hide system sessions by this metadata (never by title prefix). Assistant history and direct source open remain the entry points.
+- `POST /api/openchamber/assistants/:id/messages` returns **202** `{ messageID, admitted: true, binding }` as soon as the **user row** is persisted (`status: complete`). It does **not** wait for the LLM turn. Validation errors still fail synchronously with 4xx before admit.
+- After admit: bump revision + `openchamber:assistants-changed`, broadcast `openchamber:contact-turn-start` `{ assistantID, turnID, messageID, occurredAt }` (`turnID` = client `messageID`), then kick `runContactTurn` asynchronously (serialized per assistant).
+- Contact SSE reuses `/api/openchamber/events` (no new endpoint): `openchamber:contact-bubble-delta` `{ assistantID, turnID, bubbleIndex, delta, done, occurredAt }`. Raw completion tokens are **not** painted live — they are often chain-of-thought and would appear then vanish. A short spoken preamble (e.g. 我去找一下) may appear before a tool and is kept. Planning/CoT is stripped. No-tool replies emit each stripped bubble as `{ done:true }` after parse, with a short gap between bubbles so they arrive one beat at a time.
+- Turn end: strip/parse/tools (existing), persist **assistant** bubbles + cards only (never re-insert the user row), bump + assistants-changed, broadcast `openchamber:contact-turn-end` `{ assistantID, turnID, status: 'complete'|'error', error?, occurredAt }`. On failure the admitted user row stays; clients must not spin forever. Completing a contact turn also sends the same completion notification path as a normal contact: SMS-style title (assistant name) + body (spoken bubbles), via desktop / UI SSE / push, gated by `notifyOnCompletion`.
+- In-process tests use `whenContactTurnSettled(messageID)` (not part of the HTTP JSON body).
+- Completions: public `POST /llm/chat/completions` still rejects `stream:true`. In-process contact harness passes `onTextDelta` + `globalEventHub` through `boundCompletion` → `createChatCompletion` → throwaway generate for real tokens only.
-Composer messages carry the expected binding and client message ID. The service confirms the binding, sends through OpenCode `promptAsync`, persists the admitted user row in Assistant SQLite, and returns the binding, client message ID, and admission. OpenCode `204` is an admitted empty response. A 404 restores one generation-scoped binding before retrying. Ambiguous network errors preserve the client message ID without another send. Every committed Assistant revision publishes `openchamber:assistants-changed` only after its SQLite transaction completes; clients use the tip to reload the authoritative snapshot after worker-driven stateless binding changes. `POST /:id/session/abort` requires the same `{ sessionID, sessionGeneration }`, returns the binding and `aborted: true`, reports a changed binding as `revision_conflict`, and preserves upstream missing-session `not_found` semantics.
+Composer messages carry a client message ID. The service accepts the existing OpenCode delivery parts (`{ type: 'text' }` and `{ type: 'file', mime, url, filename? }` data URLs — not a second attachment store), extracts text (`[attachment]` when the send is file-only), admits the user at 202, then runs the contact harness asynchronously (`runContactTurn` / pi-agent-core, thinking off, OpenChamber tools `new_conversation` / `list_projects` / `list_sessions` / `create_assistant` / `schedule_task` / `message_assistant` / `assign_session` only, plus the registered-projects catalog each turn) through the OpenChamber completions gateway (public HTTP non-streaming; in-process `onTextDelta` for contact SSE). Assistant bubbles and tool cards persist at turn end. File parts survive `GET /:id/contact/messages`. The harness forwards those file parts to the completions gateway. Image data URLs reach `promptAsync` only when the connected catalog marks the model as vision-capable; otherwise generate keeps the `[image: …]` description and text-file bytes so a non-vision model cannot stall the contact turn. Gateway 502 responses include `{ error, message }` so the composer can show the OpenCode error string. OpenCode `promptAsync` is not the contact conversation engine; assign uses it only on the **worker** session. Share and queued delivery still use it on Assistant bindings. OpenCode `204` is an admitted empty response. A 404 restores one generation-scoped binding before retrying. Ambiguous network errors preserve the client message ID without another send. Every committed Assistant revision publishes `openchamber:assistants-changed` only after its SQLite transaction completes; clients use the tip to reload the authoritative snapshot after worker-driven stateless binding changes. `POST /:id/session/abort` requires the same `{ sessionID, sessionGeneration }`, returns the binding and `aborted: true`, reports a changed binding as `revision_conflict`, and preserves upstream missing-session `not_found` semantics.
 `GET /api/openchamber/assistants/:assistantID/messages?before=&limit=` returns archived and current bindings as `{ entries: [{ sessionID, directory, info, parts }], nextCursor, complete }`. It reads assistant-owned mirror rows in chronological session and message order, pages toward older rows with an opaque stable cursor, and preserves the raw OpenCode `info` and `part` JSON. `directory` is the effective workspace for that source session and is nullable for legacy archived rows with an unknown workspace. `complete === (nextCursor === null)` marks arrival at the oldest available history. The service reads the latest persisted `limit + 1` rows first, then demand-backfills one page at a time from the newest incomplete archived session covered by the cursor; a request performs at most three upstream pages and reuses persisted pages without upstream access. Backfill page commits are independent. Each `session.messages` page attempt retries only transient 5xx/network-class SDK failures up to three times with short backoff; persistent failures still throw `upstream_error`. An authoritative OpenCode 404 for an archived or old binding marks that session's backfill complete via the `session-missing` reducer path, deletes only its uncovered event mirrors, preserves covered/admitted rows, and continues scanning other incomplete sessions so one deleted session cannot permanently block Assistant history. Successful backfill pages upsert authoritative rows without clearing provisional mirrors missing from that snapshot. Concurrent ensure that replaces a missing current binding archives the old ID and creates a new one; 404 completion never deletes covered history under either identity. A required-page failure surfaces as an upstream error only when the current request's `pageRows()` is empty; when the current range already has covered or provisional rows, the service returns that partial result and keeps the incomplete cursor retryable. Provisional event mirrors stay readable as `covered=0` fallbacks until a shrink-whitelist signal or a later authoritative upsert elevates them. Current-session live sync overrides the matching SQLite message identity in the UI.

package/server/lib/assistants/assign.js ADDED Viewed

@@ -0,0 +1,225 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export class AssignError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = 'AssignError';
+    this.code = code;
+  }
+}
+export const ASSIGN_CODES = Object.freeze({
+  PROJECT_REQUIRED: 'project_required',
+  WORKSPACE_FORBIDDEN: 'workspace_forbidden',
+  WORKTREE_NOT_FOUND: 'worktree_not_found',
+  VALIDATION: 'validation_error',
+  UPSTREAM: 'upstream_error',
+});
+export const PROJECT_REQUIRED_MESSAGE = 'No registered project is configured. Add a project in Settings before assigning work. Do not use assistant-workspaces.';
+const contained = (candidate, root) => candidate === root || candidate.startsWith(`${root}${path.sep}`);
+const trim = (value, max = 10_000) => {
+  if (typeof value !== 'string') return null;
+  const next = value.trim();
+  if (!next || next.length > max) return null;
+  return next;
+};
+const promptAdmitted = (result) => (
+  !result?.error
+  && (result?.response?.status === 204 || result?.status === 204 || result?.data !== undefined || result?.response?.ok === true)
+);
+function normalizeProjectRoots(allowedRoots = []) {
+  const seen = new Set();
+  const roots = [];
+  for (const root of allowedRoots) {
+    if (typeof root !== 'string' || !root.trim()) continue;
+    const resolved = path.resolve(root.trim());
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    roots.push(resolved);
+  }
+  return roots;
+}
+export function isManagedAssistantWorkspace(candidate, managedWorkspaceRoot) {
+  if (!candidate || !managedWorkspaceRoot) return false;
+  return contained(path.resolve(candidate), path.resolve(managedWorkspaceRoot));
+}
+export function resolveAssignDirectory({
+  projectPath,
+  directory,
+  branch,
+  allowedRoots,
+  managedWorkspaceRoot,
+  defaultProjectPath = null,
+  worktrees = [],
+}) {
+  const roots = normalizeProjectRoots(allowedRoots);
+  if (roots.length === 0) {
+    throw new AssignError(ASSIGN_CODES.PROJECT_REQUIRED, PROJECT_REQUIRED_MESSAGE);
+  }
+  const rejectManaged = (resolved) => {
+    if (isManagedAssistantWorkspace(resolved, managedWorkspaceRoot)) {
+      throw new AssignError(
+        ASSIGN_CODES.WORKSPACE_FORBIDDEN,
+        'Assign cannot use assistant-workspaces. Choose a registered project path.',
+      );
+    }
+  };
+  const underRoots = (resolved) => roots.some((root) => contained(resolved, root));
+  const resolveExisting = (candidate) => {
+    const raw = trim(candidate, 4096);
+    if (!raw) return null;
+    const resolved = path.resolve(raw);
+    rejectManaged(resolved);
+    if (!underRoots(resolved)) {
+      throw new AssignError(
+        ASSIGN_CODES.WORKSPACE_FORBIDDEN,
+        'That path is not a registered project. Add it in Settings, then assign again.',
+      );
+    }
+    if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {
+      throw new AssignError(ASSIGN_CODES.VALIDATION, 'The project directory does not exist.');
+    }
+    try {
+      return fs.realpathSync(resolved);
+    } catch {
+      throw new AssignError(ASSIGN_CODES.VALIDATION, 'The project directory does not exist.');
+    }
+  };
+  let target = resolveExisting(directory) || resolveExisting(projectPath) || resolveExisting(defaultProjectPath);
+  if (!target && roots.length === 1) {
+    rejectManaged(roots[0]);
+    if (fs.existsSync(roots[0]) && fs.statSync(roots[0]).isDirectory()) {
+      target = fs.realpathSync(roots[0]);
+    }
+  }
+  if (!target) {
+    throw new AssignError(
+      ASSIGN_CODES.PROJECT_REQUIRED,
+      'Choose a registered project path. Several projects are configured; assign cannot guess.',
+    );
+  }
+  const branchName = trim(branch, 256);
+  if (!branchName) return target;
+  const match = (Array.isArray(worktrees) ? worktrees : []).find((entry) => {
+    const entryBranch = trim(entry?.branch, 256);
+    if (!entryBranch) return false;
+    return entryBranch === branchName || entryBranch === `refs/heads/${branchName}`;
+  });
+  if (!match?.path) {
+    throw new AssignError(
+      ASSIGN_CODES.WORKTREE_NOT_FOUND,
+      `No existing worktree is checked out on ${branchName}. Create that worktree in Chat first, then assign again.`,
+    );
+  }
+  return resolveExisting(match.path);
+}
+export async function assignSession(input = {}) {
+  const prompt = trim(input.prompt, 200_000);
+  if (!prompt) {
+    throw new AssignError(ASSIGN_CODES.VALIDATION, 'assign_session requires a coding prompt for the worker session.');
+  }
+  const projectDirectory = resolveAssignDirectory({
+    projectPath: input.projectPath,
+    directory: input.directory,
+    branch: null,
+    allowedRoots: input.allowedRoots,
+    managedWorkspaceRoot: input.managedWorkspaceRoot,
+    defaultProjectPath: input.defaultProjectPath,
+    worktrees: [],
+  });
+  let directory = projectDirectory;
+  const branchName = trim(input.branch, 256);
+  if (branchName && !trim(input.directory, 4096)) {
+    const worktrees = typeof input.listWorktrees === 'function'
+      ? await input.listWorktrees(projectDirectory)
+      : (input.worktrees || []);
+    directory = resolveAssignDirectory({
+      projectPath: projectDirectory,
+      directory: projectDirectory,
+      branch: branchName,
+      allowedRoots: input.allowedRoots,
+      managedWorkspaceRoot: input.managedWorkspaceRoot,
+      worktrees,
+    });
+  }
+  const assistant = input.assistant && typeof input.assistant === 'object' ? input.assistant : {};
+  const providerID = trim(assistant.providerID, 256);
+  const modelID = trim(assistant.modelID, 256);
+  if (!providerID || !modelID) {
+    throw new AssignError(ASSIGN_CODES.VALIDATION, 'Assistant is missing a connected provider/model.');
+  }
+  const sessionID = trim(input.sessionID, 256);
+  const title = trim(input.title, 256) || prompt.slice(0, 80);
+  const messageID = trim(input.messageID, 256) || `msg_assign_${crypto.randomUUID()}`;
+  const model = { providerID, modelID };
+  const parts = [{ type: 'text', text: prompt }];
+  // Subscriber identity lives on `assigned`, not `assistant`.
+  // `openchamber.assistant.assistantID` marks a hidden system binding.
+  const metadata = {
+    openchamber: {
+      assigned: {
+        from: 'contact',
+        assistantID: assistant.id || assistant.assistantID || null,
+        name: assistant.name || null,
+      },
+    },
+  };
+  const promptInput = {
+    directory,
+    messageID,
+    model,
+    parts,
+    ...(trim(assistant.agent, 256) ? { agent: trim(assistant.agent, 256) } : {}),
+    ...(trim(assistant.variant, 256) ? { variant: trim(assistant.variant, 256) } : {}),
+  };
+  if (sessionID) {
+    if (typeof input.promptExisting !== 'function') {
+      throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Worker prompt is unavailable.');
+    }
+    const prompted = await input.promptExisting({ ...promptInput, sessionID });
+    if (!promptAdmitted(prompted)) {
+      throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Failed to submit the prompt to the existing session.');
+    }
+    return { sessionID, directory, title, status: 'busy', reused: true, messageID, branch: branchName };
+  }
+  if (typeof input.createSession !== 'function' || typeof input.promptExisting !== 'function') {
+    throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Worker session APIs are unavailable.');
+  }
+  const created = await input.createSession({ directory, title, metadata });
+  const createdID = created?.data?.id || created?.id;
+  if (created?.error || !createdID) {
+    throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Failed to create a coding session.');
+  }
+  const prompted = await input.promptExisting({ ...promptInput, sessionID: createdID });
+  if (!promptAdmitted(prompted)) {
+    throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Failed to submit the prompt to the new session.');
+  }
+  return { sessionID: createdID, directory, title, status: 'busy', reused: false, messageID, branch: branchName };
+}

package/server/lib/assistants/assign.test.js ADDED Viewed

@@ -0,0 +1,118 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { describe, expect, it, vi } from 'vitest';
+import {
+  ASSIGN_CODES,
+  PROJECT_REQUIRED_MESSAGE,
+  assignSession,
+  isManagedAssistantWorkspace,
+  resolveAssignDirectory,
+} from './assign.js';
+const root = () => fs.mkdtempSync(path.join(os.tmpdir(), 'assign-'));
+describe('resolveAssignDirectory', () => {
+  it('requires a registered project root', () => {
+    expect(() => resolveAssignDirectory({ allowedRoots: [] })).toThrowError(
+      expect.objectContaining({ code: ASSIGN_CODES.PROJECT_REQUIRED, message: PROJECT_REQUIRED_MESSAGE }),
+    );
+  });
+  it('rejects managed assistant-workspaces even when they sit under an allowed root', () => {
+    const directory = root();
+    const managed = path.join(directory, 'assistant-workspaces', 'asst_1');
+    fs.mkdirSync(managed, { recursive: true });
+    expect(isManagedAssistantWorkspace(managed, path.join(directory, 'assistant-workspaces'))).toBe(true);
+    expect(() => resolveAssignDirectory({
+      directory: managed,
+      allowedRoots: [directory],
+      managedWorkspaceRoot: path.join(directory, 'assistant-workspaces'),
+    })).toThrowError(expect.objectContaining({ code: ASSIGN_CODES.WORKSPACE_FORBIDDEN }));
+  });
+  it('resolves an existing worktree for a branch and refuses a missing one', () => {
+    const directory = root();
+    const project = path.join(directory, 'project');
+    const worktree = path.join(directory, 'worktrees', 'login');
+    fs.mkdirSync(project, { recursive: true });
+    fs.mkdirSync(worktree, { recursive: true });
+    expect(resolveAssignDirectory({
+      projectPath: project,
+      branch: 'feat-login',
+      allowedRoots: [directory],
+      managedWorkspaceRoot: path.join(directory, 'assistant-workspaces'),
+      worktrees: [{ branch: 'feat-login', path: worktree }],
+    })).toBe(fs.realpathSync(worktree));
+    expect(() => resolveAssignDirectory({
+      projectPath: project,
+      branch: 'missing',
+      allowedRoots: [directory],
+      managedWorkspaceRoot: path.join(directory, 'assistant-workspaces'),
+      worktrees: [{ branch: 'feat-login', path: worktree }],
+    })).toThrowError(expect.objectContaining({ code: ASSIGN_CODES.WORKTREE_NOT_FOUND }));
+  });
+});
+describe('assignSession', () => {
+  it('creates a visible worker session and prompts it', async () => {
+    const directory = root();
+    const project = path.join(directory, 'app');
+    fs.mkdirSync(project, { recursive: true });
+    const createSession = vi.fn(async (input) => ({ data: { id: 'ses_worker' }, input }));
+    const promptExisting = vi.fn(async () => ({ response: { status: 204 } }));
+    const assigned = await assignSession({
+      prompt: 'Fix login',
+      projectPath: project,
+      title: 'Login',
+      assistant: { id: 'asst_1', name: 'Ada', providerID: 'openai', modelID: 'gpt-5.2' },
+      allowedRoots: [directory],
+      managedWorkspaceRoot: path.join(directory, 'assistant-workspaces'),
+      createSession,
+      promptExisting,
+    });
+    expect(assigned).toMatchObject({
+      sessionID: 'ses_worker',
+      directory: fs.realpathSync(project),
+      title: 'Login',
+      status: 'busy',
+      reused: false,
+    });
+    expect(createSession).toHaveBeenCalledWith(expect.objectContaining({
+      directory: fs.realpathSync(project),
+      title: 'Login',
+      metadata: {
+        openchamber: {
+          assigned: { from: 'contact', assistantID: 'asst_1', name: 'Ada' },
+        },
+      },
+    }));
+    expect(createSession.mock.calls[0][0].metadata.openchamber.assistant).toBeUndefined();
+    expect(promptExisting).toHaveBeenCalledWith(expect.objectContaining({
+      sessionID: 'ses_worker',
+      directory: fs.realpathSync(project),
+      parts: [{ type: 'text', text: 'Fix login' }],
+      model: { providerID: 'openai', modelID: 'gpt-5.2' },
+    }));
+  });
+  it('reuses an existing session without creating another', async () => {
+    const directory = root();
+    fs.mkdirSync(directory, { recursive: true });
+    const createSession = vi.fn();
+    const promptExisting = vi.fn(async () => ({ response: { status: 204 } }));
+    const assigned = await assignSession({
+      prompt: 'Continue login',
+      sessionID: 'ses_existing',
+      directory,
+      assistant: { providerID: 'p', modelID: 'm' },
+      allowedRoots: [directory],
+      managedWorkspaceRoot: path.join(directory, 'assistant-workspaces'),
+      createSession,
+      promptExisting,
+    });
+    expect(assigned).toMatchObject({ sessionID: 'ses_existing', reused: true, status: 'busy' });
+    expect(createSession).not.toHaveBeenCalled();
+    expect(promptExisting).toHaveBeenCalledWith(expect.objectContaining({ sessionID: 'ses_existing' }));
+  });
+});

package/server/lib/assistants/bubbles.js ADDED Viewed

@@ -0,0 +1,45 @@
+const SENTENCE = /(?<=[.!?])\s+(?=[A-Z“"‘])/u;
+const CONTACT_PLANNING = /\b(let me think|i should|i need to|i'll call|i will call|the user (said|wants|asked)|actually,?|hmm\.?|assign_session|list_projects|list_sessions|create_assistant|schedule_task|tool call|projectPath)\b/i;
+/**
+ * A short spoken contact line (not chain-of-thought). Shown before a tool and kept.
+ */
+export function isContactSpokenPreamble(text, { maxChars = 80 } = {}) {
+  if (typeof text !== 'string') return false;
+  const next = text.replace(/\r\n/g, '\n').trim();
+  if (!next || next.length > maxChars) return false;
+  if (/\n{2,}/u.test(next)) return false;
+  if (/```/.test(next)) return false;
+  if (CONTACT_PLANNING.test(next)) return false;
+  return true;
+}
+/**
+ * Split model output into short contact bubbles.
+ * Blank-line paragraphs first; long paragraphs split on sentence boundaries.
+ */
+export function splitContactBubbles(text, { maxChars = 280 } = {}) {
+  const raw = typeof text === 'string' ? text.replace(/\r\n/g, '\n').trim() : '';
+  if (!raw) return [];
+  const paragraphs = raw.split(/\n{2,}/u).map((part) => part.trim()).filter(Boolean);
+  const bubbles = [];
+  for (const paragraph of paragraphs) {
+    if (paragraph.length <= maxChars) {
+      bubbles.push(paragraph);
+      continue;
+    }
+    const sentences = paragraph.split(SENTENCE).map((part) => part.trim()).filter(Boolean);
+    let current = '';
+    for (const sentence of sentences) {
+      const next = current ? `${current} ${sentence}` : sentence;
+      if (next.length > maxChars && current) {
+        bubbles.push(current);
+        current = sentence;
+      } else {
+        current = next;
+      }
+    }
+    if (current) bubbles.push(current);
+  }
+  return bubbles.length > 0 ? bubbles : [raw];
+}