@openparachute/agent 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (501) hide show
  1. package/.claude/scheduled_tasks.lock +1 -0
  2. package/.claude/settings.json +5 -0
  3. package/.claude/skills/add-atomic-chat-tool/SKILL.md +243 -0
  4. package/.claude/skills/add-atomic-chat-tool/atomic-chat-mcp-stdio.ts +229 -0
  5. package/.claude/skills/add-codex/SKILL.md +161 -0
  6. package/.claude/skills/add-dashboard/SKILL.md +138 -0
  7. package/.claude/skills/add-dashboard/resources/dashboard-pusher.ts +495 -0
  8. package/.claude/skills/add-emacs/SKILL.md +296 -0
  9. package/.claude/skills/add-gcal-tool/SKILL.md +210 -0
  10. package/.claude/skills/add-gchat/REMOVE.md +6 -0
  11. package/.claude/skills/add-gchat/SKILL.md +92 -0
  12. package/.claude/skills/add-gchat/VERIFY.md +3 -0
  13. package/.claude/skills/add-github/REMOVE.md +6 -0
  14. package/.claude/skills/add-github/SKILL.md +148 -0
  15. package/.claude/skills/add-github/VERIFY.md +3 -0
  16. package/.claude/skills/add-gmail-tool/SKILL.md +229 -0
  17. package/.claude/skills/add-imessage/REMOVE.md +6 -0
  18. package/.claude/skills/add-imessage/SKILL.md +113 -0
  19. package/.claude/skills/add-imessage/VERIFY.md +3 -0
  20. package/.claude/skills/add-karpathy-llm-wiki/SKILL.md +110 -0
  21. package/.claude/skills/add-karpathy-llm-wiki/llm-wiki.md +75 -0
  22. package/.claude/skills/add-linear/REMOVE.md +6 -0
  23. package/.claude/skills/add-linear/SKILL.md +168 -0
  24. package/.claude/skills/add-linear/VERIFY.md +3 -0
  25. package/.claude/skills/add-macos-statusbar/SKILL.md +133 -0
  26. package/.claude/skills/add-macos-statusbar/add/src/statusbar.swift +147 -0
  27. package/.claude/skills/add-matrix/REMOVE.md +6 -0
  28. package/.claude/skills/add-matrix/SKILL.md +148 -0
  29. package/.claude/skills/add-matrix/VERIFY.md +3 -0
  30. package/.claude/skills/add-ollama-provider/SKILL.md +179 -0
  31. package/.claude/skills/add-ollama-tool/SKILL.md +193 -0
  32. package/.claude/skills/add-opencode/SKILL.md +229 -0
  33. package/.claude/skills/add-parallel/SKILL.md +290 -0
  34. package/.claude/skills/add-resend/REMOVE.md +6 -0
  35. package/.claude/skills/add-resend/SKILL.md +93 -0
  36. package/.claude/skills/add-resend/VERIFY.md +3 -0
  37. package/.claude/skills/add-signal/REMOVE.md +13 -0
  38. package/.claude/skills/add-signal/SKILL.md +318 -0
  39. package/.claude/skills/add-signal/VERIFY.md +5 -0
  40. package/.claude/skills/add-slack/REMOVE.md +6 -0
  41. package/.claude/skills/add-slack/SKILL.md +112 -0
  42. package/.claude/skills/add-slack/VERIFY.md +3 -0
  43. package/.claude/skills/add-teams/REMOVE.md +6 -0
  44. package/.claude/skills/add-teams/SKILL.md +207 -0
  45. package/.claude/skills/add-teams/VERIFY.md +3 -0
  46. package/.claude/skills/add-vercel/SKILL.md +147 -0
  47. package/.claude/skills/add-vercel/container-skills/vercel-cli/SKILL.md +103 -0
  48. package/.claude/skills/add-webex/REMOVE.md +6 -0
  49. package/.claude/skills/add-webex/SKILL.md +88 -0
  50. package/.claude/skills/add-webex/VERIFY.md +3 -0
  51. package/.claude/skills/add-wechat/REMOVE.md +49 -0
  52. package/.claude/skills/add-wechat/SKILL.md +170 -0
  53. package/.claude/skills/add-wechat/scripts/wire-dm.ts +172 -0
  54. package/.claude/skills/add-whatsapp/SKILL.md +264 -0
  55. package/.claude/skills/add-whatsapp-cloud/REMOVE.md +6 -0
  56. package/.claude/skills/add-whatsapp-cloud/SKILL.md +95 -0
  57. package/.claude/skills/add-whatsapp-cloud/VERIFY.md +3 -0
  58. package/.claude/skills/claw/SKILL.md +131 -0
  59. package/.claude/skills/claw/scripts/claw +374 -0
  60. package/.claude/skills/convert-to-apple-container/SKILL.md +212 -0
  61. package/.claude/skills/customize/SKILL.md +110 -0
  62. package/.claude/skills/debug/SKILL.md +349 -0
  63. package/.claude/skills/get-qodo-rules/SKILL.md +122 -0
  64. package/.claude/skills/get-qodo-rules/references/output-format.md +41 -0
  65. package/.claude/skills/get-qodo-rules/references/pagination.md +33 -0
  66. package/.claude/skills/get-qodo-rules/references/repository-scope.md +26 -0
  67. package/.claude/skills/init-first-agent/SKILL.md +120 -0
  68. package/.claude/skills/init-onecli/SKILL.md +270 -0
  69. package/.claude/skills/manage-channels/SKILL.md +87 -0
  70. package/.claude/skills/manage-mounts/SKILL.md +47 -0
  71. package/.claude/skills/migrate-from-openclaw/MIGRATE_CRONS.md +100 -0
  72. package/.claude/skills/migrate-from-openclaw/SKILL.md +447 -0
  73. package/.claude/skills/migrate-from-openclaw/scripts/discover-openclaw.ts +734 -0
  74. package/.claude/skills/migrate-from-openclaw/scripts/extract-channel-credentials.ts +476 -0
  75. package/.claude/skills/migrate-nanoclaw/SKILL.md +484 -0
  76. package/.claude/skills/migrate-nanoclaw/diagnostics.md +51 -0
  77. package/.claude/skills/qodo-pr-resolver/SKILL.md +326 -0
  78. package/.claude/skills/qodo-pr-resolver/resources/providers.md +329 -0
  79. package/.claude/skills/update-nanoclaw/SKILL.md +243 -0
  80. package/.claude/skills/update-nanoclaw/diagnostics.md +48 -0
  81. package/.claude/skills/update-skills/SKILL.md +130 -0
  82. package/.claude/skills/use-native-credential-proxy/SKILL.md +167 -0
  83. package/.claude/skills/x-integration/SKILL.md +417 -0
  84. package/.claude/skills/x-integration/agent.ts +243 -0
  85. package/.claude/skills/x-integration/host.ts +155 -0
  86. package/.claude/skills/x-integration/lib/browser.ts +148 -0
  87. package/.claude/skills/x-integration/lib/config.ts +62 -0
  88. package/.claude/skills/x-integration/scripts/like.ts +56 -0
  89. package/.claude/skills/x-integration/scripts/post.ts +66 -0
  90. package/.claude/skills/x-integration/scripts/quote.ts +80 -0
  91. package/.claude/skills/x-integration/scripts/reply.ts +74 -0
  92. package/.claude/skills/x-integration/scripts/retweet.ts +62 -0
  93. package/.claude/skills/x-integration/scripts/setup.ts +87 -0
  94. package/.github/CODEOWNERS +10 -0
  95. package/.github/PULL_REQUEST_TEMPLATE.md +18 -0
  96. package/.github/workflows/bump-version.yml +35 -0
  97. package/.github/workflows/ci.yml +39 -0
  98. package/.github/workflows/label-pr.yml +40 -0
  99. package/.github/workflows/update-tokens.yml +43 -0
  100. package/.husky/pre-commit +1 -0
  101. package/.mcp.json +3 -0
  102. package/.nvmrc +1 -0
  103. package/.parachute/module.json +14 -0
  104. package/.prettierrc +4 -0
  105. package/CHANGELOG.md +215 -0
  106. package/CLAUDE.md +307 -0
  107. package/CODE_OF_CONDUCT.md +128 -0
  108. package/CONTRIBUTING.md +159 -0
  109. package/CONTRIBUTORS.md +26 -0
  110. package/LICENSE +21 -0
  111. package/README.md +190 -0
  112. package/README_ja.md +194 -0
  113. package/README_zh.md +194 -0
  114. package/assets/nanoclaw-favicon.png +0 -0
  115. package/assets/nanoclaw-icon.png +0 -0
  116. package/assets/nanoclaw-logo-dark.png +0 -0
  117. package/assets/nanoclaw-logo.png +0 -0
  118. package/assets/nanoclaw-profile.jpeg +0 -0
  119. package/assets/nanoclaw-sales.png +0 -0
  120. package/assets/social-preview.jpg +0 -0
  121. package/config-examples/mount-allowlist.json +25 -0
  122. package/container/.dockerignore +2 -0
  123. package/container/CLAUDE.md +21 -0
  124. package/container/Dockerfile +121 -0
  125. package/container/agent-runner/bun.lock +243 -0
  126. package/container/agent-runner/package.json +22 -0
  127. package/container/agent-runner/scripts/sdk-signal-probe.ts +169 -0
  128. package/container/agent-runner/src/config.ts +55 -0
  129. package/container/agent-runner/src/db/connection.ts +267 -0
  130. package/container/agent-runner/src/db/index.ts +20 -0
  131. package/container/agent-runner/src/db/messages-in.ts +138 -0
  132. package/container/agent-runner/src/db/messages-out.ts +143 -0
  133. package/container/agent-runner/src/db/session-routing.ts +30 -0
  134. package/container/agent-runner/src/db/session-state.test.ts +100 -0
  135. package/container/agent-runner/src/db/session-state.ts +79 -0
  136. package/container/agent-runner/src/destinations.ts +135 -0
  137. package/container/agent-runner/src/formatter.test.ts +167 -0
  138. package/container/agent-runner/src/formatter.ts +260 -0
  139. package/container/agent-runner/src/index.ts +110 -0
  140. package/container/agent-runner/src/integration.test.ts +121 -0
  141. package/container/agent-runner/src/mcp-tools/agents.instructions.md +26 -0
  142. package/container/agent-runner/src/mcp-tools/agents.ts +66 -0
  143. package/container/agent-runner/src/mcp-tools/core.instructions.md +27 -0
  144. package/container/agent-runner/src/mcp-tools/core.ts +262 -0
  145. package/container/agent-runner/src/mcp-tools/index.ts +22 -0
  146. package/container/agent-runner/src/mcp-tools/interactive.instructions.md +22 -0
  147. package/container/agent-runner/src/mcp-tools/interactive.ts +169 -0
  148. package/container/agent-runner/src/mcp-tools/scheduling.instructions.md +40 -0
  149. package/container/agent-runner/src/mcp-tools/scheduling.ts +299 -0
  150. package/container/agent-runner/src/mcp-tools/self-mod.instructions.md +25 -0
  151. package/container/agent-runner/src/mcp-tools/self-mod.ts +120 -0
  152. package/container/agent-runner/src/mcp-tools/server.ts +54 -0
  153. package/container/agent-runner/src/mcp-tools/types.ts +6 -0
  154. package/container/agent-runner/src/poll-loop.test.ts +248 -0
  155. package/container/agent-runner/src/poll-loop.ts +437 -0
  156. package/container/agent-runner/src/providers/claude.ts +379 -0
  157. package/container/agent-runner/src/providers/factory.test.ts +19 -0
  158. package/container/agent-runner/src/providers/factory.ts +13 -0
  159. package/container/agent-runner/src/providers/index.ts +6 -0
  160. package/container/agent-runner/src/providers/mock.ts +77 -0
  161. package/container/agent-runner/src/providers/provider-registry.ts +33 -0
  162. package/container/agent-runner/src/providers/types.ts +82 -0
  163. package/container/agent-runner/src/scheduling/task-script.ts +121 -0
  164. package/container/agent-runner/src/timezone.test.ts +93 -0
  165. package/container/agent-runner/src/timezone.ts +107 -0
  166. package/container/agent-runner/tsconfig.json +14 -0
  167. package/container/build.sh +48 -0
  168. package/container/entrypoint.sh +16 -0
  169. package/container/skills/agent-browser/SKILL.md +159 -0
  170. package/container/skills/frontend-engineer/SKILL.md +157 -0
  171. package/container/skills/self-customize/SKILL.md +87 -0
  172. package/container/skills/slack-formatting/SKILL.md +94 -0
  173. package/container/skills/vercel-cli/SKILL.md +111 -0
  174. package/container/skills/welcome/SKILL.md +85 -0
  175. package/docs/APPLE-CONTAINER-NETWORKING.md +90 -0
  176. package/docs/BRANCH-FORK-MAINTENANCE.md +81 -0
  177. package/docs/README.md +25 -0
  178. package/docs/SDK_DEEP_DIVE.md +643 -0
  179. package/docs/SECURITY.md +162 -0
  180. package/docs/agent-runner-details.md +749 -0
  181. package/docs/api-details.md +365 -0
  182. package/docs/architecture-diagram.html +422 -0
  183. package/docs/architecture-diagram.md +215 -0
  184. package/docs/architecture.md +751 -0
  185. package/docs/audit/2026-04-30-channel-endpoint-audit.md +36 -0
  186. package/docs/build-and-runtime.md +80 -0
  187. package/docs/cross-mount-stress/README.md +112 -0
  188. package/docs/cross-mount-stress/container-writer-retry.mjs +55 -0
  189. package/docs/cross-mount-stress/container-writer-slow.mjs +42 -0
  190. package/docs/cross-mount-stress/container-writer.mjs +47 -0
  191. package/docs/cross-mount-stress/host-writer-retry.mjs +55 -0
  192. package/docs/cross-mount-stress/host-writer-slow.mjs +43 -0
  193. package/docs/cross-mount-stress/host-writer.mjs +47 -0
  194. package/docs/db-central.md +316 -0
  195. package/docs/db-session.md +183 -0
  196. package/docs/db.md +119 -0
  197. package/docs/design/2026-04-29-vault-management-ui.md +231 -0
  198. package/docs/design/2026-04-30-channel-wiring-rework.md +234 -0
  199. package/docs/design/2026-05-01-channel-wiring-approvals-deep-dive.md +272 -0
  200. package/docs/design/2026-05-02-channel-policy-and-approval-routing.md +250 -0
  201. package/docs/docker-sandboxes.md +359 -0
  202. package/docs/isolation-model.md +88 -0
  203. package/docs/ollama.md +79 -0
  204. package/docs/parachute-integration.md +109 -0
  205. package/docs/post-night-rebirth-reflections.md +151 -0
  206. package/eslint.config.js +32 -0
  207. package/package.json +54 -0
  208. package/pnpm-workspace.yaml +8 -0
  209. package/repo-tokens/README.md +113 -0
  210. package/repo-tokens/action.yml +186 -0
  211. package/repo-tokens/badge.svg +23 -0
  212. package/repo-tokens/examples/green.svg +14 -0
  213. package/repo-tokens/examples/red.svg +14 -0
  214. package/repo-tokens/examples/yellow-green.svg +14 -0
  215. package/repo-tokens/examples/yellow.svg +14 -0
  216. package/scripts/chat.ts +101 -0
  217. package/scripts/cleanup-sessions.sh +150 -0
  218. package/scripts/init-cli-agent.ts +171 -0
  219. package/scripts/init-first-agent.ts +377 -0
  220. package/scripts/parachute.ts +158 -0
  221. package/scripts/run-migrations.ts +105 -0
  222. package/scripts/sanity-live-poll.ts +95 -0
  223. package/scripts/seed-discord.ts +79 -0
  224. package/scripts/test-v2-agent.ts +106 -0
  225. package/scripts/test-v2-channel-e2e.ts +265 -0
  226. package/scripts/test-v2-host.ts +184 -0
  227. package/src/channels/adapter.ts +214 -0
  228. package/src/channels/ask-question.ts +46 -0
  229. package/src/channels/channel-registry.test.ts +421 -0
  230. package/src/channels/channel-registry.ts +313 -0
  231. package/src/channels/chat-sdk-bridge.test.ts +84 -0
  232. package/src/channels/chat-sdk-bridge.ts +652 -0
  233. package/src/channels/cli.ts +276 -0
  234. package/src/channels/discord.ts +90 -0
  235. package/src/channels/index.ts +17 -0
  236. package/src/channels/telegram-markdown-sanitize.test.ts +78 -0
  237. package/src/channels/telegram-markdown-sanitize.ts +55 -0
  238. package/src/channels/telegram-pairing.test.ts +254 -0
  239. package/src/channels/telegram-pairing.ts +339 -0
  240. package/src/channels/telegram.ts +279 -0
  241. package/src/channels/trust-hint.test.ts +48 -0
  242. package/src/channels/trust-hint.ts +75 -0
  243. package/src/claude-md-compose.migrate.test.ts +64 -0
  244. package/src/claude-md-compose.ts +205 -0
  245. package/src/command-gate.ts +63 -0
  246. package/src/config.test.ts +93 -0
  247. package/src/config.ts +108 -0
  248. package/src/container-config.ts +167 -0
  249. package/src/container-runner.test.ts +32 -0
  250. package/src/container-runner.ts +576 -0
  251. package/src/container-runtime.test.ts +169 -0
  252. package/src/container-runtime.ts +92 -0
  253. package/src/db/_bun-sqlite-shim.ts +88 -0
  254. package/src/db/agent-activity.test.ts +155 -0
  255. package/src/db/agent-activity.ts +121 -0
  256. package/src/db/agent-groups.ts +77 -0
  257. package/src/db/connection.migrate.test.ts +143 -0
  258. package/src/db/connection.ts +224 -0
  259. package/src/db/db-v2.test.ts +440 -0
  260. package/src/db/dropped-messages.ts +44 -0
  261. package/src/db/index.ts +40 -0
  262. package/src/db/messaging-groups.ts +252 -0
  263. package/src/db/migrations/001-initial.ts +112 -0
  264. package/src/db/migrations/002-chat-sdk-state.ts +36 -0
  265. package/src/db/migrations/008-dropped-messages.ts +27 -0
  266. package/src/db/migrations/009-drop-pending-credentials.ts +13 -0
  267. package/src/db/migrations/010-engage-modes.ts +103 -0
  268. package/src/db/migrations/011-pending-sender-approvals.ts +40 -0
  269. package/src/db/migrations/012-channel-registration.ts +48 -0
  270. package/src/db/migrations/013-approval-render-metadata.ts +27 -0
  271. package/src/db/migrations/014-secrets.ts +44 -0
  272. package/src/db/migrations/015-secrets-drop-host-pattern.ts +18 -0
  273. package/src/db/migrations/016-secret-assignments.ts +30 -0
  274. package/src/db/migrations/017-agent-activity.ts +40 -0
  275. package/src/db/migrations/018-oauth-app-configs.ts +34 -0
  276. package/src/db/migrations/019-oauth-app-connections.ts +48 -0
  277. package/src/db/migrations/020-agent-app-connections.ts +28 -0
  278. package/src/db/migrations/021-pending-oauth-states.ts +35 -0
  279. package/src/db/migrations/022-app-connections-provider.ts +25 -0
  280. package/src/db/migrations/023-agent-group-secret-mode.test.ts +124 -0
  281. package/src/db/migrations/023-agent-group-secret-mode.ts +65 -0
  282. package/src/db/migrations/024-collapse-approvals.test.ts +249 -0
  283. package/src/db/migrations/024-collapse-approvals.ts +182 -0
  284. package/src/db/migrations/025-secret-mode-check.test.ts +155 -0
  285. package/src/db/migrations/025-secret-mode-check.ts +49 -0
  286. package/src/db/migrations/026-user-dms-bot-id.test.ts +116 -0
  287. package/src/db/migrations/026-user-dms-bot-id.ts +54 -0
  288. package/src/db/migrations/027-provider-credentials.ts +41 -0
  289. package/src/db/migrations/_test-helpers.ts +41 -0
  290. package/src/db/migrations/index.ts +127 -0
  291. package/src/db/migrations/module-agent-to-agent-destinations.ts +84 -0
  292. package/src/db/migrations/module-approvals-pending-approvals.ts +42 -0
  293. package/src/db/migrations/module-approvals-title-options.ts +40 -0
  294. package/src/db/schema.ts +258 -0
  295. package/src/db/session-db.test.ts +93 -0
  296. package/src/db/session-db.ts +325 -0
  297. package/src/db/sessions.ts +241 -0
  298. package/src/delivery.test.ts +148 -0
  299. package/src/delivery.ts +445 -0
  300. package/src/env.ts +74 -0
  301. package/src/group-folder.test.ts +35 -0
  302. package/src/group-folder.ts +44 -0
  303. package/src/group-init.ts +92 -0
  304. package/src/host-core.test.ts +456 -0
  305. package/src/host-sweep.test.ts +146 -0
  306. package/src/host-sweep.ts +287 -0
  307. package/src/index.ts +227 -0
  308. package/src/install-slug.ts +33 -0
  309. package/src/log.test.ts +81 -0
  310. package/src/log.ts +117 -0
  311. package/src/mcp/http.ts +72 -0
  312. package/src/mcp/server.ts +92 -0
  313. package/src/mcp/stdio.ts +51 -0
  314. package/src/mcp/tools/activity.ts +88 -0
  315. package/src/mcp/tools/agent-groups.ts +183 -0
  316. package/src/mcp/tools/approvals.ts +122 -0
  317. package/src/mcp/tools/channels.ts +199 -0
  318. package/src/mcp/tools/index.ts +27 -0
  319. package/src/mcp/tools/oauth.ts +48 -0
  320. package/src/mcp/tools/secrets.ts +169 -0
  321. package/src/mcp/tools/sessions.ts +135 -0
  322. package/src/mcp/types.ts +51 -0
  323. package/src/modules/agent-to-agent/agent-route.test.ts +46 -0
  324. package/src/modules/agent-to-agent/agent-route.ts +223 -0
  325. package/src/modules/agent-to-agent/create-agent.ts +127 -0
  326. package/src/modules/agent-to-agent/db/agent-destinations.ts +135 -0
  327. package/src/modules/agent-to-agent/index.ts +22 -0
  328. package/src/modules/agent-to-agent/write-destinations.ts +59 -0
  329. package/src/modules/approvals/agent.md +45 -0
  330. package/src/modules/approvals/index.ts +21 -0
  331. package/src/modules/approvals/picks.test.ts +291 -0
  332. package/src/modules/approvals/primitive.ts +279 -0
  333. package/src/modules/approvals/project.md +27 -0
  334. package/src/modules/approvals/response-handler.ts +87 -0
  335. package/src/modules/index.ts +24 -0
  336. package/src/modules/interactive/agent.md +21 -0
  337. package/src/modules/interactive/index.ts +69 -0
  338. package/src/modules/interactive/project.md +12 -0
  339. package/src/modules/mount-security/index.ts +448 -0
  340. package/src/modules/mount-security/migrate.test.ts +91 -0
  341. package/src/modules/permissions/access.ts +28 -0
  342. package/src/modules/permissions/channel-approval.test.ts +389 -0
  343. package/src/modules/permissions/channel-approval.ts +188 -0
  344. package/src/modules/permissions/db/agent-group-members.ts +44 -0
  345. package/src/modules/permissions/db/pending-channel-approvals.test.ts +86 -0
  346. package/src/modules/permissions/db/pending-channel-approvals.ts +66 -0
  347. package/src/modules/permissions/db/pending-sender-approvals.ts +60 -0
  348. package/src/modules/permissions/db/user-dms.ts +58 -0
  349. package/src/modules/permissions/db/user-roles.ts +85 -0
  350. package/src/modules/permissions/db/users.ts +38 -0
  351. package/src/modules/permissions/index.ts +421 -0
  352. package/src/modules/permissions/permissions.test.ts +358 -0
  353. package/src/modules/permissions/sender-approval.test.ts +470 -0
  354. package/src/modules/permissions/sender-approval.ts +165 -0
  355. package/src/modules/permissions/user-dm.ts +200 -0
  356. package/src/modules/provider-credentials/db.ts +121 -0
  357. package/src/modules/provider-credentials/index.ts +12 -0
  358. package/src/modules/provider-credentials/spawn.test.ts +206 -0
  359. package/src/modules/provider-credentials/spawn.ts +114 -0
  360. package/src/modules/scheduling/actions.ts +113 -0
  361. package/src/modules/scheduling/db.test.ts +282 -0
  362. package/src/modules/scheduling/db.ts +148 -0
  363. package/src/modules/scheduling/index.ts +34 -0
  364. package/src/modules/scheduling/recurrence.test.ts +98 -0
  365. package/src/modules/scheduling/recurrence.ts +54 -0
  366. package/src/modules/self-mod/agent.md +30 -0
  367. package/src/modules/self-mod/apply.ts +85 -0
  368. package/src/modules/self-mod/index.ts +30 -0
  369. package/src/modules/self-mod/project.md +39 -0
  370. package/src/modules/self-mod/request.ts +91 -0
  371. package/src/modules/typing/index.ts +165 -0
  372. package/src/oauth/agent-app-connections.ts +103 -0
  373. package/src/oauth/app-configs.test.ts +64 -0
  374. package/src/oauth/app-configs.ts +114 -0
  375. package/src/oauth/app-connections.test.ts +109 -0
  376. package/src/oauth/app-connections.ts +178 -0
  377. package/src/oauth/crypto.ts +56 -0
  378. package/src/oauth/flow.ts +104 -0
  379. package/src/oauth/providers/google.test.ts +38 -0
  380. package/src/oauth/providers/google.ts +46 -0
  381. package/src/oauth/providers/index.ts +48 -0
  382. package/src/oauth/state-store.test.ts +54 -0
  383. package/src/oauth/state-store.ts +93 -0
  384. package/src/parachute/README.md +27 -0
  385. package/src/parachute/create-agent.test.ts +83 -0
  386. package/src/parachute/create-agent.ts +122 -0
  387. package/src/parachute/group-status.test.ts +165 -0
  388. package/src/parachute/group-status.ts +136 -0
  389. package/src/parachute/types.ts +41 -0
  390. package/src/parachute/vault-mcp.test.ts +251 -0
  391. package/src/parachute/vault-mcp.ts +232 -0
  392. package/src/platform-id.test.ts +104 -0
  393. package/src/platform-id.ts +109 -0
  394. package/src/providers/index.ts +6 -0
  395. package/src/providers/provider-container-registry.ts +58 -0
  396. package/src/response-registry.ts +45 -0
  397. package/src/router.ts +530 -0
  398. package/src/secrets/crypto.test.ts +45 -0
  399. package/src/secrets/crypto.ts +55 -0
  400. package/src/secrets/index.ts +355 -0
  401. package/src/secrets/master-key.ts +70 -0
  402. package/src/secrets/secrets.test.ts +354 -0
  403. package/src/session-manager.migrate.test.ts +59 -0
  404. package/src/session-manager.ts +433 -0
  405. package/src/startup-bootstrap.test.ts +226 -0
  406. package/src/startup-bootstrap.ts +207 -0
  407. package/src/state-sqlite.ts +182 -0
  408. package/src/timezone.test.ts +64 -0
  409. package/src/timezone.ts +37 -0
  410. package/src/types.ts +230 -0
  411. package/src/web/auth.test.ts +335 -0
  412. package/src/web/auth.ts +214 -0
  413. package/src/web/discord-validate.test.ts +77 -0
  414. package/src/web/discord-validate.ts +88 -0
  415. package/src/web/hub-discovery.test.ts +98 -0
  416. package/src/web/hub-discovery.ts +69 -0
  417. package/src/web/routes/activity.ts +106 -0
  418. package/src/web/routes/agent-provider.test.ts +282 -0
  419. package/src/web/routes/agent-provider.ts +309 -0
  420. package/src/web/routes/approvals.ts +185 -0
  421. package/src/web/routes/apps.ts +434 -0
  422. package/src/web/routes/channels-mg-detail.test.ts +324 -0
  423. package/src/web/routes/channels-mga-detail.test.ts +425 -0
  424. package/src/web/routes/channels.ts +489 -0
  425. package/src/web/routes/oauth-providers.ts +42 -0
  426. package/src/web/routes/secrets.test.ts +175 -0
  427. package/src/web/routes/secrets.ts +282 -0
  428. package/src/web/routes/sessions.ts +123 -0
  429. package/src/web/routes/settings.test.ts +106 -0
  430. package/src/web/routes/settings.ts +247 -0
  431. package/src/web/routes/setup-status.ts +205 -0
  432. package/src/web/routes/vaults.test.ts +389 -0
  433. package/src/web/routes/vaults.ts +225 -0
  434. package/src/web/server-version.test.ts +16 -0
  435. package/src/web/server.ts +1003 -0
  436. package/src/web/services-manifest.test.ts +120 -0
  437. package/src/web/services-manifest.ts +61 -0
  438. package/src/web/static-serve.test.ts +255 -0
  439. package/src/web/static-serve.ts +104 -0
  440. package/src/web/telegram-validate.test.ts +116 -0
  441. package/src/web/telegram-validate.ts +107 -0
  442. package/src/web/vault-proxy.test.ts +214 -0
  443. package/src/web/vault-proxy.ts +120 -0
  444. package/src/web/wire-channel.ts +181 -0
  445. package/src/webhook-server.ts +134 -0
  446. package/tsconfig.json +21 -0
  447. package/vitest.config.ts +18 -0
  448. package/web/README.md +63 -0
  449. package/web/ui/index.html +13 -0
  450. package/web/ui/package.json +35 -0
  451. package/web/ui/pnpm-lock.yaml +2164 -0
  452. package/web/ui/scripts/verify-base.mjs +31 -0
  453. package/web/ui/src/App.tsx +88 -0
  454. package/web/ui/src/components/ActivityFeed.tsx +444 -0
  455. package/web/ui/src/components/AgentGroupPicker.tsx +263 -0
  456. package/web/ui/src/components/AgentProviderCards.tsx +220 -0
  457. package/web/ui/src/components/CredentialForm.tsx +214 -0
  458. package/web/ui/src/components/ScopeGrants.tsx +74 -0
  459. package/web/ui/src/components/StatusDot.tsx +43 -0
  460. package/web/ui/src/components/VaultPicker.tsx +127 -0
  461. package/web/ui/src/components/setup/AdapterInstallStep.tsx +178 -0
  462. package/web/ui/src/components/setup/AgentGroupStep.tsx +43 -0
  463. package/web/ui/src/components/setup/ChannelPickStep.tsx +74 -0
  464. package/web/ui/src/components/setup/DoneStep.tsx +49 -0
  465. package/web/ui/src/components/setup/PrereqStep.tsx +129 -0
  466. package/web/ui/src/components/setup/TestConnectionStep.tsx +108 -0
  467. package/web/ui/src/components/setup/TestMessageStep.tsx +104 -0
  468. package/web/ui/src/components/setup/WireChannelStep.tsx +166 -0
  469. package/web/ui/src/components/setup/types.ts +105 -0
  470. package/web/ui/src/lib/api.test.ts +410 -0
  471. package/web/ui/src/lib/api.ts +1210 -0
  472. package/web/ui/src/lib/auth.test.ts +139 -0
  473. package/web/ui/src/lib/auth.ts +348 -0
  474. package/web/ui/src/lib/channel-adapters.ts +136 -0
  475. package/web/ui/src/main.tsx +19 -0
  476. package/web/ui/src/routes/ApprovalsList.tsx +294 -0
  477. package/web/ui/src/routes/Apps.tsx +613 -0
  478. package/web/ui/src/routes/ChannelWireDetail.test.tsx +233 -0
  479. package/web/ui/src/routes/ChannelWireDetail.tsx +403 -0
  480. package/web/ui/src/routes/ChannelsList.tsx +158 -0
  481. package/web/ui/src/routes/GroupDetail.tsx +755 -0
  482. package/web/ui/src/routes/GroupList.tsx +187 -0
  483. package/web/ui/src/routes/MessagingGroupDetail.test.tsx +233 -0
  484. package/web/ui/src/routes/MessagingGroupDetail.tsx +306 -0
  485. package/web/ui/src/routes/NewGroupWizard.tsx +390 -0
  486. package/web/ui/src/routes/OAuthCallback.tsx +56 -0
  487. package/web/ui/src/routes/SecretsList.tsx +921 -0
  488. package/web/ui/src/routes/SessionsList.tsx +220 -0
  489. package/web/ui/src/routes/SettingsAgentProvider.tsx +109 -0
  490. package/web/ui/src/routes/SettingsApprovals.tsx +234 -0
  491. package/web/ui/src/routes/SetupWizard.tsx +219 -0
  492. package/web/ui/src/routes/VaultDetail.test.tsx +361 -0
  493. package/web/ui/src/routes/VaultDetail.tsx +960 -0
  494. package/web/ui/src/routes/VaultsList.tsx +295 -0
  495. package/web/ui/src/routes/WireChannelPage.tsx +413 -0
  496. package/web/ui/src/styles.css +608 -0
  497. package/web/ui/src/test/setup.ts +23 -0
  498. package/web/ui/src/vite-env.d.ts +10 -0
  499. package/web/ui/tsconfig.json +20 -0
  500. package/web/ui/vite.config.ts +34 -0
  501. package/web/ui/vitest.config.ts +25 -0
package/docs/architecture-diagram.html ADDED
@@ -0,0 +1,422 @@
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8" />
5
+ <meta name="viewport" content="width=device-width,initial-scale=1" />
6
+ <title>Paraclaw Architecture</title>
7
+ <script src="https://cdn.jsdelivr.net/npm/mermaid@10/dist/mermaid.min.js"></script>
8
+ <style>
9
+ :root {
10
+ --bg: #0b0d12;
11
+ --panel: #141821;
12
+ --ink: #e7ecf3;
13
+ --muted: #8a94a6;
14
+ --accent: #7aa2ff;
15
+ --border: #232a38;
16
+ }
17
+ * { box-sizing: border-box; }
18
+ html, body {
19
+ margin: 0;
20
+ padding: 0;
21
+ background: var(--bg);
22
+ color: var(--ink);
23
+ font-family: -apple-system, BlinkMacSystemFont, "SF Pro Text", "Segoe UI", Helvetica, Arial, sans-serif;
24
+ font-size: 15px;
25
+ line-height: 1.55;
26
+ }
27
+ header {
28
+ padding: 32px 40px 16px;
29
+ border-bottom: 1px solid var(--border);
30
+ position: sticky;
31
+ top: 0;
32
+ background: rgba(11, 13, 18, 0.92);
33
+ backdrop-filter: saturate(180%) blur(10px);
34
+ z-index: 10;
35
+ }
36
+ header h1 {
37
+ margin: 0 0 4px;
38
+ font-size: 22px;
39
+ font-weight: 600;
40
+ letter-spacing: -0.01em;
41
+ }
42
+ header .sub {
43
+ color: var(--muted);
44
+ font-size: 13px;
45
+ }
46
+ nav {
47
+ display: flex;
48
+ flex-wrap: wrap;
49
+ gap: 8px;
50
+ margin-top: 14px;
51
+ }
52
+ nav a {
53
+ color: var(--accent);
54
+ text-decoration: none;
55
+ font-size: 12px;
56
+ padding: 4px 10px;
57
+ border: 1px solid var(--border);
58
+ border-radius: 999px;
59
+ background: var(--panel);
60
+ }
61
+ nav a:hover { border-color: var(--accent); }
62
+ main {
63
+ max-width: 1280px;
64
+ margin: 0 auto;
65
+ padding: 28px 40px 80px;
66
+ }
67
+ section {
68
+ margin-bottom: 48px;
69
+ }
70
+ section h2 {
71
+ font-size: 18px;
72
+ font-weight: 600;
73
+ margin: 0 0 6px;
74
+ letter-spacing: -0.005em;
75
+ }
76
+ section h2 .num {
77
+ color: var(--muted);
78
+ font-weight: 500;
79
+ margin-right: 8px;
80
+ }
81
+ section p.desc {
82
+ color: var(--muted);
83
+ margin: 0 0 16px;
84
+ max-width: 900px;
85
+ }
86
+ .diagram {
87
+ background: var(--panel);
88
+ border: 1px solid var(--border);
89
+ border-radius: 14px;
90
+ padding: 24px;
91
+ overflow-x: auto;
92
+ }
93
+ .diagram svg { max-width: 100%; height: auto; display: block; margin: 0 auto; }
94
+ table {
95
+ width: 100%;
96
+ border-collapse: collapse;
97
+ margin-top: 14px;
98
+ font-size: 13px;
99
+ }
100
+ th, td {
101
+ text-align: left;
102
+ padding: 10px 12px;
103
+ border-bottom: 1px solid var(--border);
104
+ }
105
+ th {
106
+ color: var(--muted);
107
+ font-weight: 500;
108
+ text-transform: uppercase;
109
+ font-size: 11px;
110
+ letter-spacing: 0.04em;
111
+ }
112
+ code {
113
+ font-family: "SF Mono", Menlo, Consolas, monospace;
114
+ font-size: 12px;
115
+ background: #1c2230;
116
+ padding: 1px 6px;
117
+ border-radius: 4px;
118
+ color: #c8d4ee;
119
+ }
120
+ footer {
121
+ color: var(--muted);
122
+ font-size: 12px;
123
+ text-align: center;
124
+ padding: 20px 0 0;
125
+ border-top: 1px solid var(--border);
126
+ }
127
+ </style>
128
+ </head>
129
+ <body>
130
+ <header>
131
+ <h1>Paraclaw Architecture</h1>
132
+ <div class="sub">Session-DB messaging model · Chat SDK bridge · local AES-GCM secret store · per-session containers</div>
133
+ <nav>
134
+ <a href="#overview">1 · Overview</a>
135
+ <a href="#flow">2 · Message Flow</a>
136
+ <a href="#destinations">3 · Destinations &amp; A2A</a>
137
+ <a href="#entities">4 · Entity Model</a>
138
+ <a href="#twodb">5 · Two-DB Split</a>
139
+ </nav>
140
+ </header>
141
+
142
+ <main>
143
+ <section id="overview">
144
+ <h2><span class="num">1</span>System Overview</h2>
145
+ <p class="desc">
146
+ Inbound messages land at the Chat SDK bridge, which hands off to the
147
+ router. The router resolves the messaging group → agent group → session
148
+ and writes to the session's <code>inbound.db</code>. The container runner
149
+ spawns a per-session container (with secrets injected as env vars from
150
+ paraclaw's local AES-GCM secret store), and the agent-runner
151
+ polls its DB, calls Claude, and writes responses to <code>outbound.db</code>.
152
+ Delivery polls the outbound DB, re-validates destinations, and ships
153
+ messages back through the same bridge.
154
+ </p>
155
+ <div class="diagram">
156
+ <pre class="mermaid">
157
+ flowchart TB
158
+ subgraph Platforms["Messaging Platforms"]
159
+ P1[Discord]
160
+ P2[Telegram]
161
+ P3[Slack]
162
+ P4[GitHub / Linear]
163
+ P5[WhatsApp / iMessage / Teams / GChat / Matrix / Webex / Email]
164
+ end
165
+
166
+ subgraph Host["Host Process (Node)"]
167
+ direction TB
168
+ Bridge["Chat SDK Bridge<br/>src/channels/chat-sdk-bridge.ts"]
169
+ Router["Router<br/>src/router.ts<br/>platformId + threadId → session"]
170
+ SessMgr["Session Manager<br/>src/session-manager.ts"]
171
+ Runner["Container Runner<br/>src/container-runner.ts<br/>spawn + secret env injection"]
172
+ Delivery["Delivery Poller<br/>src/delivery.ts<br/>1s active / 60s sweep"]
173
+ Sweep["Host Sweep<br/>src/host-sweep.ts"]
174
+ Central[("Central DB · data/v2.db<br/>agent_groups · messaging_groups<br/>messaging_group_agents · sessions<br/>pending_approvals")]
175
+ end
176
+
177
+ subgraph Secrets["Local Secret Store"]
178
+ Vault["AES-GCM ciphertext<br/>(central DB)<br/>master key on host"]
179
+ Approvals["pending_approvals (self-mod)"]
180
+ end
181
+
182
+ subgraph Session["Per-Session Container"]
183
+ direction TB
184
+ PollLoop["Poll Loop<br/>container/agent-runner"]
185
+ Provider["Claude Agent SDK<br/>(codex / opencode planned)"]
186
+ MCP["MCP Tools<br/>send_message · send_file · edit_message<br/>send_card · ask_user_question · schedule_task<br/>create_agent · install_packages · add_mcp_server<br/>request_rebuild"]
187
+ InDB[("inbound.db<br/>host writes · even seq")]
188
+ OutDB[("outbound.db<br/>container writes · odd seq")]
189
+ end
190
+
191
+ Folder["Agent Group FS<br/>groups/*<br/>CLAUDE.md · memory · skills"]
192
+
193
+ P1 & P2 & P3 & P4 & P5 --> Bridge
194
+ Bridge --> Router
195
+ Router --> Central
196
+ Router --> SessMgr
197
+ SessMgr --> InDB
198
+ SessMgr --> Runner
199
+ Runner --> Vault
200
+ Runner --> PollLoop
201
+ PollLoop --> InDB
202
+ PollLoop --> Provider
203
+ Provider --> MCP
204
+ MCP --> OutDB
205
+ OutDB --> Delivery
206
+ Delivery --> Central
207
+ Delivery --> Bridge
208
+ Bridge --> P1 & P2 & P3 & P4 & P5
209
+ Sweep --> InDB
210
+ Sweep --> OutDB
211
+ Sweep --> Central
212
+ Runner -.mounts.-> Folder
213
+ MCP -.approval.-> Approvals
214
+ Approvals --> Central
215
+ Vault -.env vars.-> Provider
216
+ </pre>
217
+ </div>
218
+ </section>
219
+
220
+ <section id="flow">
221
+ <h2><span class="num">2</span>Message Flow</h2>
222
+ <p class="desc">
223
+ End-to-end path of a single message. The host and container never write
224
+ to the same SQLite file — the split between inbound and outbound DBs is
225
+ what makes this lock-free under concurrent activity.
226
+ </p>
227
+ <div class="diagram">
228
+ <pre class="mermaid">
229
+ sequenceDiagram
230
+ participant P as Platform (Telegram)
231
+ participant B as Chat SDK Bridge
232
+ participant R as Router
233
+ participant SM as Session Manager
234
+ participant IDB as inbound.db
235
+ participant C as Container (agent-runner)
236
+ participant ODB as outbound.db
237
+ participant D as Delivery Poller
238
+
239
+ P->>B: new message
240
+ B->>R: routeInbound(platformId, threadId, msg)
241
+ R->>R: resolve messaging_group → agent_group → session<br/>(agent-shared · shared · per-thread)
242
+ R->>SM: ensure session + DBs exist
243
+ R->>IDB: INSERT messages_in (even seq)
244
+ R->>C: wake container (spawn or signal)
245
+ C->>IDB: poll messages_in
246
+ C->>C: format xml → Claude SDK stream
247
+ C->>ODB: INSERT messages_out (odd seq)<br/>parse &lt;message to='name'&gt; blocks
248
+ D->>ODB: 1s active poll / 60s sweep
249
+ D->>D: hasDestination() re-validate
250
+ D->>B: deliver via adapter
251
+ B->>P: send · edit · react · file · card
252
+ </pre>
253
+ </div>
254
+ </section>
255
+
256
+ <section id="destinations">
257
+ <h2><span class="num">3</span>Named Destinations &amp; Agent-to-Agent</h2>
258
+ <p class="desc">
259
+ Agents address outputs by local name. The host looks up each name against
260
+ the agent's destinations table at delivery time — dropping anything
261
+ unauthorized. The same table routes agent-to-agent messages to a sibling
262
+ agent's <code>inbound.db</code> with bidirectional permission rows.
263
+ </p>
264
+ <div class="diagram">
265
+ <pre class="mermaid">
266
+ flowchart LR
267
+ subgraph AgentA["Agent Group A (main)"]
268
+ A_out["&lt;message to='slack'&gt;...&lt;/message&gt;<br/>&lt;message to='browser-agent'&gt;...&lt;/message&gt;<br/>&lt;internal&gt;scratchpad&lt;/internal&gt;"]
269
+ end
270
+
271
+ subgraph Dests["inbound.db.destinations (per agent)"]
272
+ D1["slack → messaging_group 42"]
273
+ D2["browser-agent → agent_group 7<br/>(bidirectional)"]
274
+ D3["github → messaging_group 13"]
275
+ end
276
+
277
+ subgraph AgentB["Agent Group B (browser sub-agent)"]
278
+ B_session["own inbound.db / outbound.db<br/>inherited destination back to A"]
279
+ end
280
+
281
+ Slack[Slack]
282
+ GitHub[GitHub PR]
283
+
284
+ A_out -->|parse + lookup| Dests
285
+ D1 -->|deliver| Slack
286
+ D2 -->|write to B's inbound.db| B_session
287
+ D3 -->|deliver| GitHub
288
+ B_session -.reply via 'parent'.-> Dests
289
+ </pre>
290
+ </div>
291
+ </section>
292
+
293
+ <section id="entities">
294
+ <h2><span class="num">4</span>Entity Model</h2>
295
+ <p class="desc">
296
+ Messaging groups and agent groups are many-to-many, joined via
297
+ <code>messaging_group_agents</code>. The <code>session_mode</code>
298
+ column selects one of three isolation levels.
299
+ </p>
300
+ <div class="diagram">
301
+ <pre class="mermaid">
302
+ erDiagram
303
+ agent_groups ||--o{ messaging_group_agents : wired
304
+ messaging_groups ||--o{ messaging_group_agents : wired
305
+ agent_groups ||--o{ sessions : runs
306
+ messaging_groups ||--o{ sessions : context
307
+ agent_groups ||--o{ agent_destinations : owns
308
+ agent_groups ||--o{ pending_approvals : requests
309
+
310
+ agent_groups {
311
+ int id
312
+ string name
313
+ string folder
314
+ string agent_provider
315
+ json container_config
316
+ }
317
+ messaging_groups {
318
+ int id
319
+ string channel_type
320
+ string platform_id
321
+ string name
322
+ bool is_group
323
+ string unknown_sender_policy "strict | request_approval | public"
324
+ }
325
+ users {
326
+ string id PK "namespaced &lt;channel&gt;:&lt;handle&gt;"
327
+ string kind
328
+ string display_name
329
+ }
330
+ user_roles {
331
+ string user_id FK
332
+ string role "owner | admin"
333
+ string agent_group_id FK "null = global"
334
+ }
335
+ agent_group_members {
336
+ string user_id FK
337
+ string agent_group_id FK
338
+ }
339
+ user_dms {
340
+ string user_id FK
341
+ string channel_type
342
+ string messaging_group_id FK
343
+ }
344
+ messaging_group_agents {
345
+ int messaging_group_id
346
+ int agent_group_id
347
+ string session_mode
348
+ json trigger_rules
349
+ int priority
350
+ }
351
+ sessions {
352
+ int id
353
+ int agent_group_id
354
+ int messaging_group_id
355
+ string sdk_session_id
356
+ string status
357
+ }
358
+ </pre>
359
+ </div>
360
+ <table>
361
+ <thead>
362
+ <tr><th>Level</th><th>session_mode</th><th>Shared</th><th>Example</th></tr>
363
+ </thead>
364
+ <tbody>
365
+ <tr><td>1 · Shared session</td><td><code>agent-shared</code></td><td>Workspace + memory + conversation</td><td>Slack + GitHub webhooks in one thread</td></tr>
366
+ <tr><td>2 · Same agent, separate sessions</td><td><code>shared</code> / <code>per-thread</code></td><td>Workspace + memory only</td><td>One agent across 3 Telegram chats</td></tr>
367
+ <tr><td>3 · Separate agent groups</td><td>— (different agent_group_id)</td><td>Nothing</td><td>Personal vs work channels</td></tr>
368
+ </tbody>
369
+ </table>
370
+ </section>
371
+
372
+ <section id="twodb">
373
+ <h2><span class="num">5</span>Two-DB Split</h2>
374
+ <p class="desc">
375
+ Each SQLite file has exactly one writer. The container touches a
376
+ heartbeat file instead of <code>UPDATE</code>-ing a liveness row, so host
377
+ sweep can detect staleness via <code>stat(mtime)</code> without opening the
378
+ DB. Host uses even seq numbers, container uses odd — collision-free.
379
+ </p>
380
+ <div class="diagram">
381
+ <pre class="mermaid">
382
+ flowchart LR
383
+ subgraph Mount["/workspace (volume mount)"]
384
+ In[("inbound.db")]
385
+ Out[("outbound.db")]
386
+ HB["/.heartbeat (file touch)"]
387
+ end
388
+
389
+ Host[Host process] -->|writes · even seq| In
390
+ Host -->|reads| Out
391
+ Container[agent-runner] -->|reads| In
392
+ Container -->|writes · odd seq| Out
393
+ Container -->|touch every poll| HB
394
+ HostSweep[Host sweep] -->|stat mtime| HB
395
+ HostSweep -->|reads processing_ack| In
396
+ </pre>
397
+ </div>
398
+ </section>
399
+
400
+ <footer>Paraclaw · generated from docs/architecture.md, isolation-model.md</footer>
401
+ </main>
402
+
403
+ <script>
404
+ mermaid.initialize({
405
+ startOnLoad: true,
406
+ theme: "dark",
407
+ securityLevel: "loose",
408
+ flowchart: { curve: "basis", padding: 18 },
409
+ themeVariables: {
410
+ background: "#141821",
411
+ primaryColor: "#1c2230",
412
+ primaryTextColor: "#e7ecf3",
413
+ primaryBorderColor: "#3a465e",
414
+ lineColor: "#6b7893",
415
+ secondaryColor: "#222a3a",
416
+ tertiaryColor: "#1a2030",
417
+ fontSize: "14px",
418
+ },
419
+ });
420
+ </script>
421
+ </body>
422
+ </html>
package/docs/architecture-diagram.md ADDED
@@ -0,0 +1,215 @@
1
+ # Paraclaw Architecture Diagram
2
+
3
+ ## System Overview
4
+
5
+ ```mermaid
6
+ flowchart TB
7
+ subgraph Platforms["Messaging Platforms"]
8
+ P1[Discord]
9
+ P2[Telegram]
10
+ P3[Slack]
11
+ P4[GitHub / Linear]
12
+ P5[WhatsApp / iMessage / Teams / GChat / Matrix / Webex / Email]
13
+ end
14
+
15
+ subgraph Host["Host Process (Node)"]
16
+ direction TB
17
+ Bridge["Chat SDK Bridge<br/>(src/channels/chat-sdk-bridge.ts)"]
18
+ Router["Router<br/>(src/router.ts)<br/>platformId + threadId -> messaging_group -> agent_group -> session"]
19
+ SessMgr["Session Manager<br/>(src/session-manager.ts)<br/>creates inbound.db + outbound.db"]
20
+ Runner["Container Runner<br/>(src/container-runner.ts)<br/>spawn + secret env injection"]
21
+ Delivery["Delivery Poller<br/>(src/delivery.ts)<br/>1s active / 60s sweep"]
22
+ Sweep["Host Sweep<br/>(src/host-sweep.ts)<br/>heartbeat, retry, recurrence"]
23
+ Central[("Central DB<br/>data/v2.db<br/>agent_groups<br/>messaging_groups<br/>messaging_group_agents<br/>sessions<br/>pending_approvals")]
24
+ end
25
+
26
+ subgraph Secrets["Local Secret Store"]
27
+ Vault["AES-GCM ciphertext<br/>(central DB)<br/>master key on host"]
28
+ Approvals["pending_approvals<br/>(self-mod)"]
29
+ end
30
+
31
+ subgraph Session["Per-Session Container (Docker / Apple Container)"]
32
+ direction TB
33
+ PollLoop["Poll Loop<br/>(container/agent-runner)"]
34
+ Provider["Agent providers<br/>(claude, opencode, mock; todo: codex)"]
35
+ MCP["MCP Tools<br/>send_message, send_file, edit_message,<br/>add_reaction, send_card, ask_user_question,<br/>schedule_task, create_agent,<br/>install_packages, add_mcp_server"]
36
+ Skills["Container Skills<br/>(container/skills/)"]
37
+ InDB[("inbound.db<br/>host writes<br/>even seq<br/>messages_in<br/>destinations<br/>processing_ack")]
38
+ OutDB[("outbound.db<br/>container writes<br/>odd seq<br/>messages_out<br/>heartbeat file")]
39
+ end
40
+
41
+ subgraph Groups["Agent Group Filesystem (groups/*)"]
42
+ Folder["CLAUDE.md<br/>memory<br/>per-group skills<br/>container_config"]
43
+ end
44
+
45
+ P1 & P2 & P3 & P4 & P5 --> Bridge
46
+ Bridge --> Router
47
+ Router --> Central
48
+ Router --> SessMgr
49
+ SessMgr --> InDB
50
+ SessMgr --> Runner
51
+ Runner --> Vault
52
+ Runner --> PollLoop
53
+ PollLoop --> InDB
54
+ PollLoop --> Provider
55
+ Provider --> MCP
56
+ Provider --> Skills
57
+ MCP --> OutDB
58
+ OutDB --> Delivery
59
+ Delivery --> Central
60
+ Delivery --> Bridge
61
+ Bridge --> P1 & P2 & P3 & P4 & P5
62
+ Sweep --> InDB
63
+ Sweep --> OutDB
64
+ Sweep --> Central
65
+ Runner -.mounts.-> Folder
66
+ MCP -.approval.-> Approvals
67
+ Approvals --> Central
68
+ Vault -.env vars.-> Provider
69
+ ```
70
+
71
+ ## Message Flow (inbound -> agent -> outbound)
72
+
73
+ ```mermaid
74
+ sequenceDiagram
75
+ participant P as Platform (e.g. Telegram)
76
+ participant B as Chat SDK Bridge
77
+ participant R as Router
78
+ participant SM as Session Manager
79
+ participant IDB as inbound.db
80
+ participant C as Container (agent-runner)
81
+ participant ODB as outbound.db
82
+ participant D as Delivery Poller
83
+
84
+ P->>B: new message
85
+ B->>R: routeInbound(platformId, threadId, msg)
86
+ R->>R: resolve messaging_group -> agent_group -> session<br/>(agent-shared | shared | per-thread)
87
+ R->>SM: ensure session + DBs exist
88
+ R->>IDB: INSERT messages_in (even seq)
89
+ R->>C: wake container (docker run / already running)
90
+ C->>IDB: poll messages_in
91
+ C->>C: format xml, stream to selected provider
92
+ C->>ODB: INSERT messages_out (odd seq)<br/>parse <message to="name"> blocks
93
+ D->>ODB: 1s poll (active) / 60s (sweep)
94
+ D->>D: hasDestination() re-validate
95
+ D->>B: deliver via adapter
96
+ B->>P: send message / edit / react / file / card
97
+ ```
98
+
99
+ ## Named Destinations + Agent-to-Agent
100
+
101
+ ```mermaid
102
+ flowchart LR
103
+ subgraph AgentA["Agent Group A (main)"]
104
+ A_out["output:<br/>&lt;message to='slack'&gt;...&lt;/message&gt;<br/>&lt;message to='browser-agent'&gt;...&lt;/message&gt;<br/>&lt;internal&gt;scratchpad&lt;/internal&gt;"]
105
+ end
106
+
107
+ subgraph Dests["inbound.db.destinations (per agent)"]
108
+ D1["slack -> messaging_group 42"]
109
+ D2["browser-agent -> agent_group 7<br/>(bidirectional row)"]
110
+ D3["github -> messaging_group 13"]
111
+ end
112
+
113
+ subgraph AgentB["Agent Group B (browser sub-agent)"]
114
+ B_session["own inbound.db / outbound.db<br/>inherited destination back to A"]
115
+ end
116
+
117
+ Slack[Slack channel]
118
+ GitHub[GitHub PR thread]
119
+
120
+ A_out -->|parse + lookup| Dests
121
+ D1 -->|deliver| Slack
122
+ D2 -->|write to B's inbound.db| B_session
123
+ D3 -->|deliver| GitHub
124
+ B_session -.reply via 'parent'.-> Dests
125
+ ```
126
+
127
+ ## Entity Model + Isolation Levels
128
+
129
+ ```mermaid
130
+ erDiagram
131
+ agent_groups ||--o{ messaging_group_agents : wired
132
+ messaging_groups ||--o{ messaging_group_agents : wired
133
+ agent_groups ||--o{ sessions : runs
134
+ messaging_groups ||--o{ sessions : context
135
+ agent_groups ||--o{ agent_destinations : owns
136
+ agent_groups ||--o{ pending_approvals : requests
137
+
138
+ agent_groups {
139
+ int id
140
+ string name
141
+ string folder
142
+ string agent_provider
143
+ json container_config
144
+ }
145
+ messaging_groups {
146
+ int id
147
+ string channel_type
148
+ string platform_id
149
+ string name
150
+ bool is_group
151
+ string unknown_sender_policy "strict | request_approval | public"
152
+ }
153
+ users {
154
+ string id PK "namespaced <channel>:<handle>"
155
+ string kind
156
+ string display_name
157
+ }
158
+ user_roles {
159
+ string user_id FK
160
+ string role "owner | admin"
161
+ string agent_group_id FK "null = global"
162
+ }
163
+ agent_group_members {
164
+ string user_id FK
165
+ string agent_group_id FK
166
+ }
167
+ user_dms {
168
+ string user_id FK
169
+ string channel_type
170
+ string messaging_group_id FK
171
+ }
172
+ messaging_group_agents {
173
+ int messaging_group_id
174
+ int agent_group_id
175
+ string session_mode "agent-shared | shared | per-thread"
176
+ json trigger_rules
177
+ int priority
178
+ }
179
+ sessions {
180
+ int id
181
+ int agent_group_id
182
+ int messaging_group_id
183
+ string sdk_session_id
184
+ string status
185
+ }
186
+ ```
187
+
188
+ ### Isolation Level Cheatsheet
189
+
190
+ | Level | `session_mode` | What's shared | Example |
191
+ |---|---|---|---|
192
+ | 1. Shared session | `agent-shared` | Workspace + memory + conversation | Slack + GitHub webhooks in one thread |
193
+ | 2. Same agent, separate sessions | `shared` / `per-thread` | Workspace + memory only | One agent across 3 Telegram chats |
194
+ | 3. Separate agent groups | (different `agent_group_id`) | Nothing | Personal vs work channels |
195
+
196
+ ## Two-DB Split (why)
197
+
198
+ ```mermaid
199
+ flowchart LR
200
+ subgraph Mount["/workspace (volume mounted into container)"]
201
+ In[("inbound.db")]
202
+ Out[("outbound.db")]
203
+ HB["/.heartbeat (file touch)"]
204
+ end
205
+
206
+ Host[Host process] -->|"writes only<br/>(even seq)"| In
207
+ Host -->|reads| Out
208
+ Container[agent-runner] -->|reads| In
209
+ Container -->|"writes only<br/>(odd seq)"| Out
210
+ Container -->|touch every poll| HB
211
+ HostSweep[Host sweep] -->|stat mtime| HB
212
+ HostSweep -->|reads processing_ack| In
213
+
214
+ note1["Each file has exactly ONE writer.<br/>Eliminates SQLite cross-process write contention.<br/>Collision-free seq numbering."]
215
+ ```