@pylonsync/create-pylon 0.21.0 → 0.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/create-pylon",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Scaffold a new Pylon app — realtime backend + web/mobile/expo frontends in one command. Run via `npm create @pylonsync/pylon@latest`.",
   "publishConfig": {
     "access": "public"

package/templates/chat/app/chat-client.tsx

@@ -254,7 +254,7 @@ function Chat({ selfId, initialChannel }: { selfId: string; initialChannel?: str
 
   function remove(id: string) {
     if (window.confirm("Delete this message? Everyone in the channel will stop seeing it.")) {
-      void db.delete("Message", id);
+      db.delete("Message", id).catch(console.warn);
     }
   }
 

package/templates/consumer/components/social/post-parts.tsx

@@ -86,7 +86,7 @@ export function PostMenu({ social, post }: { social: Social; post: Post }) {
               className={cn(row, "font-semibold text-red-600")}
               onClick={() => {
                 setOpen(false);
-                void db.delete("Post", post.id);
+                db.delete("Post", post.id).catch(console.warn);
                 if (window.location.pathname.startsWith("/p/")) router.push("/");
               }}
             >

package/templates/consumer/components/social/post-screen.tsx

@@ -158,7 +158,7 @@ function CommentRow({
           {mine ? (
             <button
               type="button"
-              onClick={() => void db.delete("Comment", comment.id)}
+              onClick={() => db.delete("Comment", comment.id).catch(console.warn)}
               className="hidden items-center gap-1 hover:text-zinc-900 group-hover:inline-flex"
               aria-label="Delete comment"
             >

package/templates/consumer/components/social/use-social.ts

@@ -66,21 +66,21 @@ export type Social = ReturnType<typeof useSocial>;
 export const actions = {
   toggleLike(social: Social, postId: string) {
     const mine = social.myLikes.get(postId);
-    if (mine) void db.delete("Like", mine.id);
-    else if (social.me) void db.insert("Like", { postId, userId: social.me });
+    if (mine) db.delete("Like", mine.id).catch(console.warn);
+    else if (social.me) db.insert("Like", { postId, userId: social.me }).catch(console.warn);
   },
   like(social: Social, postId: string) {
-    if (social.me && !social.myLikes.has(postId)) void db.insert("Like", { postId, userId: social.me });
+    if (social.me && !social.myLikes.has(postId)) db.insert("Like", { postId, userId: social.me }).catch(console.warn);
   },
   toggleSave(social: Social, postId: string) {
     const mine = social.mySaves.get(postId);
-    if (mine) void db.delete("Save", mine.id);
-    else if (social.me) void db.insert("Save", { postId, userId: social.me });
+    if (mine) db.delete("Save", mine.id).catch(console.warn);
+    else if (social.me) db.insert("Save", { postId, userId: social.me }).catch(console.warn);
   },
   toggleFollow(social: Social, userId: string) {
     if (!social.me || userId === social.me) return;
     const mine = social.myFollows.get(userId);
-    if (mine) void db.delete("Follow", mine.id);
-    else void db.insert("Follow", { followingId: userId, followerId: social.me });
+    if (mine) db.delete("Follow", mine.id).catch(console.warn);
+    else db.insert("Follow", { followingId: userId, followerId: social.me }).catch(console.warn);
   },
 };

package/templates/imessage/.env.example

@@ -42,8 +42,6 @@ IMESSAGE_TRANSPORT=sendblue
 # IMESSAGE_ALLOW_DEV_SENDS=1
 
 # ── Production only ──────────────────────────────────────────────────────────
-# The server runs the agent as the owner by calling its own API. It needs its
-# public origin and the admin token to open that session. `pylon dev` needs
-# neither (it falls back to http://127.0.0.1:$PYLON_PORT).
+# The public origin the Setup page uses for the webhook and relay URLs.
+# `pylon dev` falls back to http://127.0.0.1:$PYLON_PORT.
 # APP_URL=https://assistant.example.com
-# PYLON_ADMIN_TOKEN=

package/templates/imessage/AGENTS.md

@@ -14,9 +14,10 @@ transports, the owner model, and production setup.
   on the transport's message id, allowlist and rate limit (`lib/gate.ts`), then
   schedule `processTurn`. Do not add a second path that skips it.
 - **The agent is `functions/assistant.ts` (`agent()`, `auth: "admin"`).**
-  `processTurn` runs it as the owner through `lib/agent-call.ts`. Tools must
-  resolve their contact with `currentTurn(ctx)` and never accept a contact,
-  handle, or id from the model.
+  `processTurn` runs it as the owner with `ctx.agents.run`, passing the
+  conversation and turn as the run's `context`. Tools must resolve their
+  contact with `currentTurn(ctx, run)` and never accept a contact, handle, or
+  id from the model.
 - **The dashboard is owner-only.** Every entity policy is `auth.isAdmin`; the
   owner is the verified email in `PYLON_ADMIN_EMAILS`.
 - **AppleScript:** `relay/applescript.ts` passes text and handle as argv to a

package/templates/imessage/README.md

@@ -55,8 +55,8 @@ real texts arrive.
   history; after 80 turns a new run starts with the last few texts as context.
 - **Tools.** `remember_note`, `recall_notes`, `forget_note`, `set_reminder`,
   `list_reminders`, `cancel_reminder`. They act only on the person being
-  answered: the contact comes from the server (`functions/resolveTurn.ts`),
-  never from the model. Reminders run on Pylon's job scheduler
+  answered: the contact comes from the server (the run's context and
+  `functions/resolveTurn.ts`), never from the model. Reminders run on Pylon's job scheduler
   (`ctx.scheduler.runAt` → `functions/fireReminder.ts`).
 - **Replies** are converted from Markdown to plain text and split into up to
   four bubbles along paragraph breaks (`lib/chunk.ts`).
@@ -64,15 +64,15 @@ real texts arrive.
   owner is the account whose verified email is in `PYLON_ADMIN_EMAILS`.
   Anonymous visitors and other accounts read nothing.
 
-### Why the server calls itself
+### How a turn runs the agent
 
-`agent()` stores each run under the signed-in user who called it. A webhook
-has no user, so `processTurn` opens a session for the owner
-(`POST /api/auth/session`) and calls `/api/fn/assistant` over HTTP
-(`lib/agent-call.ts`). The session token stays in server memory. In
-`pylon dev` this needs nothing. In production set `PYLON_ADMIN_TOKEN` (only the
-server uses it, to open that session). The call goes to `127.0.0.1:$PYLON_PORT`
-when the port is known, otherwise to `APP_URL`, which must be https.
+`agent()` stores each run under a user. A webhook has no user, so
+`processTurn` (an internal action) calls `ctx.agents.run("assistant", ...)` with
+`as: { userId: <owner>, admin: true }`. The run belongs to the owner and shows
+up live in the dashboard. The call also passes `context: { conversationId,
+turnId }`; the tools read it from their `run` argument, and `resolveTurn`
+maps it to the contact only while that turn is running. Only server code can
+set a run's context.
 
 ## Transport 1: Sendblue
 
@@ -155,7 +155,7 @@ How the relay works (`relay/main.ts`):
 | `SENDBLUE_*` | The Sendblue transport. |
 | `RELAY_TOKEN` | The relay transport. At least 24 characters. |
 | `IMESSAGE_DRY_RUN=1` | Store replies without sending them (both transports). Always on in `pylon dev` unless `IMESSAGE_ALLOW_DEV_SENDS=1`. |
-| `PYLON_ADMIN_TOKEN`, `APP_URL` | Production: how the server reaches its own API to run the agent. `APP_URL` must be https and is used only when `PYLON_PORT` is not set. |
+| `APP_URL` | Production: the public origin the Setup page uses for the webhook and relay URLs. |
 
 The Setup page shows which of these are set (never their values), when the
 last text came in, and when the relay last checked in.
@@ -170,8 +170,8 @@ Covers webhook verification (valid, wrong, missing, unconfigured secret),
 idempotency, the allowlist and rate limit, STOP/START, relay token auth,
 AppleScript argument passing (including a real `osascript` echo run on macOS
 with quotes, backslashes, newlines, and unicode), the chat.db reader against a
-fixture database built in a temp directory, the agent call over SSE, and
-reply chunking. Nothing in the suite sends a message or calls Sendblue.
+fixture database built in a temp directory, the agent turn and its tool
+fence, and reply chunking. Nothing in the suite sends a message or calls Sendblue.
 
 ## Deploy
 
@@ -180,7 +180,7 @@ pylon deploy
 pylon secrets set PYLON_ADMIN_EMAILS=you@example.com ANTHROPIC_API_KEY=... \
   IMESSAGE_TRANSPORT=sendblue SENDBLUE_API_KEY=... SENDBLUE_API_SECRET=... \
   SENDBLUE_FROM_NUMBER=+1... SENDBLUE_WEBHOOK_SECRET=... \
-  APP_URL=https://<your app> PYLON_ADMIN_TOKEN=<openssl rand -hex 32>
+  APP_URL=https://<your app>
 ```
 
 Sign-in codes in production need an email provider (`PYLON_EMAIL_PROVIDER`);

package/templates/imessage/app/console.tsx

@@ -55,7 +55,7 @@ interface AgentRunRow {
   steps?: number | null;
   error?: string | null;
   updatedAt: string;
-  title?: string | null;
+  context?: { conversationId?: string } | null;
 }
 interface AgentMessageRow {
   id: string;
@@ -242,10 +242,10 @@ export function Console({ view, initialConversationId }: { view: View; initialCo
     const contact = conversation ? contactById.get(conversation.contactId) : undefined;
     const threadMessages = conversation ? (messages ?? []).filter((m) => m.conversationId === conversation.id) : [];
     const unanswered = threadMessages.filter((m) => m.direction === "in" && UNANSWERED.has(m.status)).length;
-    const runRow = conversation ? (runs ?? []).find((r) => r.id === conversation.agentRunId || r.title === conversation.id) : undefined;
+    const runRow = conversation ? (runs ?? []).find((r) => r.id === conversation.agentRunId || r.context?.conversationId === conversation.id) : undefined;
     const activity: PanelActivity[] = [];
     if (conversation) {
-      const runIds = new Set((runs ?? []).filter((r) => r.title === conversation.id).map((r) => r.id));
+      const runIds = new Set((runs ?? []).filter((r) => r.id === conversation.agentRunId || r.context?.conversationId === conversation.id).map((r) => r.id));
       const refusals = new Map<string, string | null>();
       for (const m of agentMessages ?? []) {
         if (!runIds.has(m.runId) || m.role !== "user" || !Array.isArray(m.content)) continue;

package/templates/imessage/components/setup-view.tsx

@@ -9,7 +9,6 @@ export interface SetupStatus {
   checklist: { key: string; label: string; ok: boolean; hint: string }[];
   provider: { configured: boolean; provider: string | null };
   ownerConfigured: boolean;
-  adminTokenSet: boolean;
   appUrlSet: boolean;
   devMode: boolean;
   baseUrl: string;
@@ -139,7 +138,7 @@ export function SetupView({
 function StatusGrid({ status, transport }: { status: SetupStatus; transport: TransportStateView | null }) {
   const online = relayOnline(transport?.relayLastSeenAt ?? null);
   const transportOk = status.transport !== null && status.checklist.every((c) => c.ok);
-  const needsProdConfig = !status.devMode && (!status.appUrlSet || !status.adminTokenSet);
+  const needsProdConfig = !status.devMode && !status.appUrlSet;
   return (
     <div className="mt-8 grid gap-3 sm:grid-cols-2">
       <StatusCard
@@ -200,13 +199,10 @@ function StatusGrid({ status, transport }: { status: SetupStatus; transport: Tra
         ok={!needsProdConfig}
         title="Server"
         lines={[
-          `Calls itself at ${status.baseUrl}`,
-          status.devMode
-            ? "Development mode: no admin token needed."
-            : status.adminTokenSet
-              ? "PYLON_ADMIN_TOKEN set."
-              : "Set PYLON_ADMIN_TOKEN so the server can open the owner's session for replies.",
-          ...(!status.devMode && !status.appUrlSet ? ["Set APP_URL to this app's public https origin."] : []),
+          `Public URL ${status.baseUrl}`,
+          ...(!status.devMode && !status.appUrlSet
+            ? ["Set APP_URL to this app's public https origin so the webhook and relay URLs are right."]
+            : []),
         ]}
       />
     </div>

package/templates/imessage/functions/assistant.ts

@@ -1,30 +1,13 @@
-import { agent, v, type ActionCtx } from "@pylonsync/functions";
+import { agent, v } from "@pylonsync/functions";
 import { ASSISTANT_MODEL, SYSTEM_PROMPT } from "../lib/assistant";
-
-interface Turn {
-  conversationId: string;
-  contactId: string;
-}
-
-// Which contact is this generation about? Every tool starts here. The agent
-// loop records its stream id on the AgentRun row it is working on, and
-// processTurn created that run with the conversation id as its title, so
-// resolveTurn can map this call back to exactly one contact. Nothing the
-// model or the texter writes can change that mapping.
-async function currentTurn(ctx: ActionCtx): Promise<Turn> {
-  const streamId = ctx.stream?.id;
-  if (!streamId) throw new Error("This tool is only available while answering a text.");
-  const turn = await ctx.runQuery<Turn | null>("resolveTurn", { streamId });
-  if (!turn) throw new Error("This tool is only available while answering a text.");
-  return turn;
-}
+import { currentTurn } from "../lib/turn";
 
 // The assistant. Pylon's agent() runs the tool loop, persists every turn into
 // AgentRun/AgentMessage (live in the dashboard), and streams tokens.
 //
-// auth "admin": only the owner's session may run it. processTurn calls it as
-// the owner for each inbound text (lib/agent-call.ts); any other account gets
-// FORBIDDEN before the model is called.
+// auth "admin": only the owner may run it. processTurn runs it as the owner
+// for each inbound text (ctx.agents.run); any other account gets FORBIDDEN
+// before the model is called.
 //
 // The tools act only on the contact of the current turn and never take a
 // contact, phone number, or id from the model.
@@ -40,23 +23,23 @@ export default agent({
       description:
         "Save a short fact about the person you are texting (a preference, a name, a date). One fact per call.",
       args: { text: v.string() },
-      handler: async (ctx, input) => {
-        const turn = await currentTurn(ctx);
+      handler: async (ctx, input, run) => {
+        const turn = await currentTurn(ctx, run);
         return ctx.runMutation("toolSaveNote", { contactId: turn.contactId, text: String(input.text) });
       },
     },
     recall_notes: {
       description: "List the facts saved about the person you are texting, newest first.",
-      handler: async (ctx) => {
-        const turn = await currentTurn(ctx);
+      handler: async (ctx, _input, run) => {
+        const turn = await currentTurn(ctx, run);
         return ctx.runQuery("toolListNotes", { contactId: turn.contactId });
       },
     },
     forget_note: {
       description: "Delete one saved fact about the person you are texting, by the id recall_notes returned.",
       args: { noteId: v.string() },
-      handler: async (ctx, input) => {
-        const turn = await currentTurn(ctx);
+      handler: async (ctx, input, run) => {
+        const turn = await currentTurn(ctx, run);
         return ctx.runMutation("toolForgetNote", { contactId: turn.contactId, noteId: String(input.noteId) });
       },
     },
@@ -64,8 +47,8 @@ export default agent({
       description:
         "Schedule a text to the person you are texting at a specific time. `when` is ISO 8601 with a UTC offset, e.g. 2026-10-03T09:00:00-05:00. `text` is the exact message they will receive.",
       args: { when: v.string(), text: v.string() },
-      handler: async (ctx, input) => {
-        const turn = await currentTurn(ctx);
+      handler: async (ctx, input, run) => {
+        const turn = await currentTurn(ctx, run);
         return ctx.runMutation("toolSetReminder", {
           contactId: turn.contactId,
           conversationId: turn.conversationId,
@@ -76,16 +59,16 @@ export default agent({
     },
     list_reminders: {
       description: "List the upcoming reminders for the person you are texting.",
-      handler: async (ctx) => {
-        const turn = await currentTurn(ctx);
+      handler: async (ctx, _input, run) => {
+        const turn = await currentTurn(ctx, run);
         return ctx.runQuery("toolListReminders", { contactId: turn.contactId });
       },
     },
     cancel_reminder: {
       description: "Cancel one upcoming reminder for the person you are texting, by the id list_reminders returned.",
       args: { reminderId: v.string() },
-      handler: async (ctx, input) => {
-        const turn = await currentTurn(ctx);
+      handler: async (ctx, input, run) => {
+        const turn = await currentTurn(ctx, run);
         return ctx.runMutation("toolCancelReminder", {
           contactId: turn.contactId,
           reminderId: String(input.reminderId),

package/templates/imessage/functions/processTurn.ts

@@ -1,5 +1,5 @@
 import { action, v } from "@pylonsync/functions";
-import { runAgentAsOwner } from "../lib/agent-call";
+import { AGENT_NAME } from "../lib/assistant";
 import { chunkReply } from "../lib/chunk";
 import { providerStatus } from "../lib/provider";
 
@@ -47,27 +47,28 @@ export default action({
         return { state: "awaiting_setup" };
       }
 
-      const outcome = await runAgentAsOwner(ctx.env, owner.userId, {
+      // The run belongs to the owner, so it shows up live in the dashboard.
+      // `admin: true` because the assistant is declared auth: "admin".
+      // The context tells the tools which conversation and turn they act on
+      // (functions/assistant.ts); only server code can set it.
+      const result = await ctx.agents.run(AGENT_NAME, {
         input: begin.input,
         ...(begin.runId ? { runId: begin.runId } : {}),
-        // The run's title carries the conversation id. The agent's tools read
-        // it back (functions/resolveTurn.ts) to know which contact they act on.
-        title: begin.conversationId,
+        as: { userId: owner.userId, admin: true },
+        context: { conversationId: begin.conversationId, turnId: begin.turnId },
       });
-      if (!outcome.ok) {
-        await finish({ outcome: "failed", detail: `${outcome.code}: ${outcome.message}`.slice(0, 500) });
-        return { state: "failed" };
-      }
-      const chunks = chunkReply(outcome.result.text);
+      const chunks = chunkReply(result.text);
       if (chunks.length === 0) {
-        await finish({ outcome: "failed", detail: "The model returned an empty reply", runId: outcome.result.runId });
+        await finish({ outcome: "failed", detail: "The model returned an empty reply", runId: result.runId });
         return { state: "failed" };
       }
-      await finish({ outcome: "answered", runId: outcome.result.runId, chunks });
+      await finish({ outcome: "answered", runId: result.runId, chunks });
       return { state: "answered", bubbles: chunks.length };
     } catch (err) {
+      const code = (err as { code?: unknown })?.code;
       const message = err instanceof Error ? err.message : String(err);
-      await finish({ outcome: "failed", detail: message.slice(0, 500) });
+      const detail = typeof code === "string" ? `${code}: ${message}` : message;
+      await finish({ outcome: "failed", detail: detail.slice(0, 500) });
       return { state: "failed" };
     }
   },

package/templates/imessage/functions/resolveTurn.ts

@@ -1,25 +1,20 @@
 import { query, v } from "@pylonsync/functions";
-import { AGENT_NAME } from "../lib/assistant";
 
-// Map the agent's current stream id to the conversation it is answering.
-// Internal: called by the assistant's tools only (functions/assistant.ts).
+// The contact a tool call acts on. Internal: called by the assistant's tools
+// only (functions/assistant.ts), with the conversation and turn that
+// processTurn put in the agent run's context.
 //
-// Returns null unless all of these hold:
-//   - an AgentRun of the assistant carries this stream id and belongs to the caller
-//   - its title is a conversation id (processTurn sets it)
-//   - that conversation has a turn running right now
+// Returns null unless that conversation exists and that exact turn is still
+// running, so a tool cannot act for a finished turn (for example when the
+// owner continues the run from the dashboard later).
 export default query({
   internal: true,
   auth: "admin",
-  args: { streamId: v.string() },
+  args: { conversationId: v.string(), turnId: v.string() },
   async handler(ctx, args) {
-    if (args.streamId === "") return null;
-    const runs = await ctx.db.query("AgentRun", { streamId: args.streamId, $limit: 2 });
-    if (runs.length !== 1) return null;
-    const run = runs[0];
-    if (run.agent !== AGENT_NAME || run.userId !== ctx.auth.userId || run.status !== "running") return null;
-    const conversation = await ctx.db.get("Conversation", String(run.title ?? ""));
-    if (!conversation || conversation.turnState !== "running") return null;
+    if (args.conversationId === "" || args.turnId === "") return null;
+    const conversation = await ctx.db.get("Conversation", args.conversationId);
+    if (!conversation || conversation.turnState !== "running" || conversation.turnId !== args.turnId) return null;
     return { conversationId: String(conversation.id), contactId: String(conversation.contactId) };
   },
 });

package/templates/imessage/functions/setupStatus.ts

@@ -1,8 +1,8 @@
 import { query } from "@pylonsync/functions";
-import { selfBaseUrl } from "../lib/agent-call";
 import { providerStatus } from "../lib/provider";
 import { findOwner } from "../lib/store";
 import { isDevMode, isDryRun, selectedTransport, transportChecklist } from "../lib/transport";
+import { appBaseUrl } from "../lib/urls";
 
 // What the server is configured with, for the dashboard's setup panel.
 // Reports which variables are present, never their values. Owner only.
@@ -13,7 +13,7 @@ export default query({
     const transport = selectedTransport(ctx.env);
     const provider = providerStatus(ctx.env);
     const owner = await findOwner(ctx);
-    const base = selfBaseUrl(ctx.env);
+    const base = appBaseUrl(ctx.env);
     const devMode = isDevMode(ctx.env);
     return {
       transport,
@@ -22,7 +22,6 @@ export default query({
       provider,
       ownerConfigured: owner !== null,
       adminEmailsSet: (ctx.env.PYLON_ADMIN_EMAILS ?? "").trim() !== "",
-      adminTokenSet: (ctx.env.PYLON_ADMIN_TOKEN ?? "").trim() !== "",
       appUrlSet: (ctx.env.APP_URL ?? ctx.env.PYLON_PUBLIC_URL ?? "").trim() !== "",
       devMode,
       baseUrl: base,

package/templates/imessage/lib/turn.ts

@@ -0,0 +1,25 @@
+import type { ActionCtx, AgentToolRun } from "@pylonsync/functions";
+
+export interface Turn {
+  conversationId: string;
+  contactId: string;
+}
+
+const NOT_ANSWERING = "This tool is only available while answering a text.";
+
+/**
+ * Which contact a tool call is about. Every assistant tool starts here.
+ *
+ * processTurn runs the agent with ctx.agents.run and puts the conversation
+ * and turn in the run's context; only server code can set it. resolveTurn
+ * maps that to exactly one contact, and only while that turn is running.
+ * Nothing the model or the texter writes can change the mapping.
+ */
+export async function currentTurn(ctx: Pick<ActionCtx, "runQuery">, run: AgentToolRun): Promise<Turn> {
+  const conversationId = run.context?.conversationId;
+  const turnId = run.context?.turnId;
+  if (typeof conversationId !== "string" || typeof turnId !== "string") throw new Error(NOT_ANSWERING);
+  const turn = await ctx.runQuery<Turn | null>("resolveTurn", { conversationId, turnId });
+  if (!turn) throw new Error(NOT_ANSWERING);
+  return turn;
+}

package/templates/imessage/lib/urls.ts

@@ -0,0 +1,20 @@
+type Env = Record<string, string | undefined>;
+
+/**
+ * This app's origin, for the URLs the Setup page shows (the Sendblue webhook
+ * and the relay endpoint): APP_URL or PYLON_PUBLIC_URL when set to an http(s)
+ * URL, otherwise the local dev server.
+ */
+export function appBaseUrl(env: Env): string {
+  const raw = (env.APP_URL || env.PYLON_PUBLIC_URL || "").trim();
+  if (raw !== "") {
+    try {
+      const u = new URL(raw);
+      if (u.protocol === "https:" || u.protocol === "http:") return u.origin;
+    } catch {
+      // Fall through to the local default.
+    }
+  }
+  const port = Number.parseInt(env.PYLON_PORT ?? "", 10);
+  return `http://127.0.0.1:${Number.isFinite(port) && port > 0 && port < 65536 ? port : 4321}`;
+}

package/templates/imessage/tests/turn.test.ts

@@ -0,0 +1,141 @@
+// The agent turn: processTurn runs the assistant as the owner through
+// ctx.agents.run, and the tools find their contact from the run's context.
+import { describe, expect, test } from "bun:test";
+import processTurn from "../functions/processTurn";
+import resolveTurn from "../functions/resolveTurn";
+import { chunkReply } from "../lib/chunk";
+import { currentTurn } from "../lib/turn";
+import { appBaseUrl } from "../lib/urls";
+import { fakeCtx } from "./fake-ctx";
+
+type Handler = (ctx: unknown, args: Record<string, unknown>) => Promise<any>;
+const run = (def: unknown, ctx: unknown, args: Record<string, unknown>) =>
+  (def as { handler: Handler }).handler(ctx, args);
+
+const STARTED = {
+  state: "started",
+  turnId: "turn_1",
+  conversationId: "conv_1",
+  runId: null,
+  input: "[iMessage from Ana] hi",
+};
+
+/** An action ctx for processTurn with the agent call stubbed. */
+function turnCtx(agentsRun: (name: string, options: Record<string, unknown>) => Promise<unknown>) {
+  const finished: Record<string, unknown>[] = [];
+  const agentCalls: { name: string; options: Record<string, unknown> }[] = [];
+  const ctx = {
+    env: { ANTHROPIC_API_KEY: "sk-test" },
+    async runMutation(name: string, args: Record<string, unknown>) {
+      if (name === "beginTurn") return STARTED;
+      if (name === "finishTurn") {
+        finished.push(args);
+        return {};
+      }
+      throw new Error(`unexpected mutation ${name}`);
+    },
+    async runQuery(name: string) {
+      if (name === "ownerAccount") return { userId: "owner_1" };
+      throw new Error(`unexpected query ${name}`);
+    },
+    agents: {
+      run(name: string, options: Record<string, unknown>) {
+        agentCalls.push({ name, options });
+        return agentsRun(name, options);
+      },
+    },
+  };
+  return { ctx, finished, agentCalls };
+}
+
+describe("processTurn", () => {
+  test("runs the assistant as the owner with the turn as context", async () => {
+    const reply = "Hello Ana.\n\nSee you soon.";
+    const t = turnCtx(async () => ({ runId: "run_1", text: reply, steps: 1 }));
+    const out = await run(processTurn, t.ctx, { conversationId: "conv_1" });
+    expect(out).toEqual({ state: "answered", bubbles: chunkReply(reply).length });
+    expect(t.agentCalls).toEqual([
+      {
+        name: "assistant",
+        options: {
+          input: STARTED.input,
+          as: { userId: "owner_1", admin: true },
+          context: { conversationId: "conv_1", turnId: "turn_1" },
+        },
+      },
+    ]);
+    expect(t.finished).toEqual([
+      {
+        conversationId: "conv_1",
+        turnId: "turn_1",
+        outcome: "answered",
+        runId: "run_1",
+        chunks: chunkReply(reply),
+      },
+    ]);
+  });
+
+  test("records an agent failure on the turn instead of throwing", async () => {
+    const t = turnCtx(async () => {
+      throw Object.assign(new Error("Upstream LLM provider returned an error."), { code: "PROVIDER_HTTP_529" });
+    });
+    const out = await run(processTurn, t.ctx, { conversationId: "conv_1" });
+    expect(out).toEqual({ state: "failed" });
+    expect(t.finished[0]).toMatchObject({
+      outcome: "failed",
+      detail: "PROVIDER_HTTP_529: Upstream LLM provider returned an error.",
+    });
+  });
+});
+
+describe("the tool fence", () => {
+  test("resolveTurn maps a running turn to its contact and nothing else", async () => {
+    const f = fakeCtx();
+    const contactId = await f.ctx.db.insert("Contact", { handle: "+15125550148" });
+    const conversationId = await f.ctx.db.insert("Conversation", {
+      contactId,
+      turnState: "running",
+      turnId: "turn_1",
+    });
+    expect(await run(resolveTurn, f.ctx, { conversationId, turnId: "turn_1" })).toEqual({ conversationId, contactId });
+    // An older turn of the same conversation.
+    expect(await run(resolveTurn, f.ctx, { conversationId, turnId: "turn_0" })).toBeNull();
+    // The turn finished.
+    await f.ctx.db.update("Conversation", conversationId, { turnState: "idle" });
+    expect(await run(resolveTurn, f.ctx, { conversationId, turnId: "turn_1" })).toBeNull();
+    expect(await run(resolveTurn, f.ctx, { conversationId: "missing", turnId: "turn_1" })).toBeNull();
+  });
+
+  test("currentTurn needs the server-set context", async () => {
+    const queries: unknown[] = [];
+    const ctx = {
+      async runQuery(name: string, args: unknown) {
+        queries.push([name, args]);
+        return { conversationId: "conv_1", contactId: "contact_1" };
+      },
+    } as never;
+    const base = { runId: "run_1", agent: "assistant", userId: "owner_1" };
+
+    expect(
+      await currentTurn(ctx, { ...base, context: { conversationId: "conv_1", turnId: "turn_1" } }),
+    ).toEqual({ conversationId: "conv_1", contactId: "contact_1" });
+    expect(queries).toEqual([["resolveTurn", { conversationId: "conv_1", turnId: "turn_1" }]]);
+
+    // A run a client started (no context), or a partial one, gets nothing.
+    await expect(currentTurn(ctx, { ...base, context: null })).rejects.toThrow("only available while answering");
+    await expect(currentTurn(ctx, { ...base, context: { conversationId: "conv_1" } })).rejects.toThrow(
+      "only available while answering",
+    );
+    expect(queries.length).toBe(1);
+  });
+});
+
+describe("appBaseUrl", () => {
+  test("prefers the configured public origin, then the local dev server", () => {
+    expect(appBaseUrl({ APP_URL: "https://a.example.com/path", PYLON_PORT: "4541" })).toBe("https://a.example.com");
+    expect(appBaseUrl({ PYLON_PUBLIC_URL: "https://b.example.com" })).toBe("https://b.example.com");
+    expect(appBaseUrl({ PYLON_PORT: "4541" })).toBe("http://127.0.0.1:4541");
+    expect(appBaseUrl({ APP_URL: "javascript:alert(1)" })).toBe("http://127.0.0.1:4321");
+    expect(appBaseUrl({})).toBe("http://127.0.0.1:4321");
+  });
+});

package/templates/invoices/app/invoices/[id]/invoice-view.tsx

@@ -156,9 +156,9 @@ export function InvoiceView({
                       value={invoice.clientId ?? ""}
                       className="h-8 bg-background md:h-7.5"
                       onChange={(event) =>
-                        void db.update("Invoice", invoice.id, {
+                        db.update("Invoice", invoice.id, {
                           clientId: event.target.value || null,
-                        })
+                        }).catch(console.warn)
                       }
                     >
                       <option value="">—</option>

package/templates/marketplace/client/WatchButton.tsx

@@ -66,9 +66,9 @@ function Inner({
       return;
     }
     if (mine) {
-      void db.delete("Watch", mine.id);
+      db.delete("Watch", mine.id).catch(console.warn);
     } else {
-      void db.insert("Watch", { userId: identity.userId, listingId, listingTitle });
+      db.insert("Watch", { userId: identity.userId, listingId, listingTitle }).catch(console.warn);
     }
   }
 

package/templates/projects/app/projects/[id]/project-view.tsx

@@ -93,9 +93,9 @@ export function ProjectView({
                   value={project.status}
                   className="h-8 md:h-7.5"
                   onChange={(event) =>
-                    void db.update("Project", project.id, {
+                    db.update("Project", project.id, {
                       status: event.target.value,
-                    })
+                    }).catch(console.warn)
                   }
                 >
                   {PROJECT_STATUSES.map((s) => (

package/templates/imessage/lib/agent-call.ts

@@ -1,251 +0,0 @@
-// Run the `assistant` agent for an inbound text.
-//
-// `agent()` persists every turn into AgentRun/AgentMessage rows owned by the
-// caller, so it needs a signed-in user. Inbound texts arrive on a webhook or a
-// relay sync, where there is no user. The server therefore calls the agent
-// over HTTP as the owner: it mints a session for the owner's user id with
-// POST /api/auth/session (open in `pylon dev`; requires PYLON_ADMIN_TOKEN in
-// production), then POSTs /api/fn/assistant with that session. The owner's
-// session resolves to an admin (PYLON_ADMIN_EMAILS), which is the only caller
-// the agent accepts. The runs then show up live in the owner's dashboard
-// through the framework's owner-scoped AgentRun/AgentMessage sync.
-//
-// The session token lives only in this process's memory and is reused until
-// the server rejects it.
-
-import { AGENT_NAME } from "./assistant";
-
-type Env = Record<string, string | undefined>;
-
-export interface AgentResult {
-  runId: string;
-  text: string;
-  steps: number;
-  queued?: boolean;
-  cancelled?: boolean;
-}
-
-export type AgentCallOutcome =
-  | { ok: true; result: AgentResult }
-  | { ok: false; code: string; message: string };
-
-export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
-
-/**
- * Origin the server calls itself on. The request carries PYLON_ADMIN_TOKEN, so
- * it stays on this machine whenever the port is known (PYLON_PORT). Otherwise
- * it goes to APP_URL / PYLON_PUBLIC_URL, and only over https: a plain-http
- * public origin would put the admin token on the wire. Falls back to the
- * default local port.
- */
-export function selfBaseUrl(env: Env): string {
-  const port = Number.parseInt(env.PYLON_PORT ?? "", 10);
-  if (Number.isFinite(port) && port > 0 && port < 65536) return `http://127.0.0.1:${port}`;
-  const raw = (env.APP_URL || env.PYLON_PUBLIC_URL || "").trim();
-  if (raw !== "") {
-    try {
-      const u = new URL(raw);
-      if (u.protocol === "https:") return u.origin;
-    } catch {
-      // Fall through to the local default.
-    }
-  }
-  return "http://127.0.0.1:4321";
-}
-
-export interface SseEvent {
-  event: string;
-  data: string;
-}
-
-/** Parse a complete text/event-stream body into events. Comment and id lines are dropped. */
-export function parseSse(body: string): SseEvent[] {
-  const events: SseEvent[] = [];
-  for (const block of body.replace(/\r\n?/g, "\n").split("\n\n")) {
-    let event = "message";
-    const data: string[] = [];
-    for (const line of block.split("\n")) {
-      if (line.startsWith("event:")) event = line.slice(6).trim();
-      else if (line.startsWith("data:")) data.push(line.slice(5).replace(/^ /, ""));
-    }
-    if (data.length > 0) events.push({ event, data: data.join("\n") });
-  }
-  return events;
-}
-
-/** True once `body` holds a complete `result` or `error` event. */
-export function hasTerminalEvent(body: string): boolean {
-  const complete = body.replace(/\r\n?/g, "\n");
-  const end = complete.lastIndexOf("\n\n");
-  if (end === -1) return false;
-  return parseSse(complete.slice(0, end)).some((e) => e.event === "result" || e.event === "error");
-}
-
-/**
- * Read an SSE response until its `result` or `error` event, then stop. The
- * server can hold a finished stream open (it stays resumable for a while), so
- * waiting for the connection to close would hang.
- */
-async function readUntilTerminalEvent(res: Response): Promise<string> {
-  if (!res.body) return "";
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder();
-  let body = "";
-  try {
-    for (;;) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      body += decoder.decode(value, { stream: true });
-      if (hasTerminalEvent(body)) break;
-    }
-  } finally {
-    await reader.cancel().catch(() => {});
-  }
-  return body;
-}
-
-function asResult(value: unknown): AgentResult | null {
-  if (typeof value !== "object" || value === null) return null;
-  const v = value as Record<string, unknown>;
-  if (typeof v.runId !== "string") return null;
-  return {
-    runId: v.runId,
-    text: typeof v.text === "string" ? v.text : "",
-    steps: typeof v.steps === "number" ? v.steps : 0,
-    queued: v.queued === true,
-    cancelled: v.cancelled === true,
-  };
-}
-
-function asError(value: unknown, fallback: string): { code: string; message: string } {
-  const v = (value ?? {}) as Record<string, unknown>;
-  const e = (typeof v.error === "object" && v.error !== null ? v.error : v) as Record<string, unknown>;
-  return {
-    code: typeof e.code === "string" ? e.code : "AGENT_FAILED",
-    message: typeof e.message === "string" ? e.message : fallback,
-  };
-}
-
-/** Interpret the agent endpoint's response: SSE when it streamed, JSON otherwise. */
-export function readAgentResponse(status: number, contentType: string, body: string): AgentCallOutcome {
-  if (contentType.includes("text/event-stream")) {
-    const events = parseSse(body);
-    const result = events.find((e) => e.event === "result");
-    if (result) {
-      try {
-        const parsed = asResult(JSON.parse(result.data));
-        if (parsed) return { ok: true, result: parsed };
-      } catch {
-        // Reported below.
-      }
-    }
-    const error = events.find((e) => e.event === "error");
-    if (error) {
-      try {
-        return { ok: false, ...asError(JSON.parse(error.data), error.data) };
-      } catch {
-        return { ok: false, code: "AGENT_FAILED", message: error.data.slice(0, 300) };
-      }
-    }
-    return { ok: false, code: "AGENT_NO_RESULT", message: "The agent stream ended without a result" };
-  }
-  let json: unknown = null;
-  try {
-    json = JSON.parse(body);
-  } catch {
-    return { ok: false, code: `HTTP_${status}`, message: body.slice(0, 300) || `HTTP ${status}` };
-  }
-  if (status >= 200 && status < 300) {
-    const parsed = asResult(json);
-    if (parsed) return { ok: true, result: parsed };
-  }
-  return { ok: false, ...asError(json, `HTTP ${status}`) };
-}
-
-interface CachedSession {
-  userId: string;
-  token: string;
-}
-
-let cached: CachedSession | null = null;
-
-async function mintSession(
-  base: string,
-  userId: string,
-  adminToken: string,
-  fetchImpl: FetchLike,
-): Promise<string> {
-  const headers: Record<string, string> = { "content-type": "application/json" };
-  if (adminToken) headers.authorization = `Bearer ${adminToken}`;
-  const res = await fetchImpl(`${base}/api/auth/session`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({ user_id: userId }),
-    signal: AbortSignal.timeout(15_000),
-  });
-  const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-  if (!res.ok || typeof body.token !== "string") {
-    const err = asError(body, `HTTP ${res.status}`);
-    throw Object.assign(new Error(err.message), {
-      code: res.status === 403 ? "OWNER_SESSION_FORBIDDEN" : err.code,
-    });
-  }
-  return body.token;
-}
-
-export interface AgentCallArgs {
-  input: string;
-  runId?: string;
-  title?: string;
-}
-
-export async function runAgentAsOwner(
-  env: Env,
-  ownerUserId: string,
-  args: AgentCallArgs,
-  fetchImpl: FetchLike = fetch,
-): Promise<AgentCallOutcome> {
-  const base = selfBaseUrl(env);
-  const adminToken = (env.PYLON_ADMIN_TOKEN ?? "").trim();
-
-  for (let attempt = 0; attempt < 2; attempt++) {
-    if (!cached || cached.userId !== ownerUserId) {
-      try {
-        cached = { userId: ownerUserId, token: await mintSession(base, ownerUserId, adminToken, fetchImpl) };
-      } catch (err) {
-        const e = err as { code?: string; message?: string };
-        return { ok: false, code: e.code ?? "OWNER_SESSION_FAILED", message: e.message ?? String(err) };
-      }
-    }
-    let res: Response;
-    try {
-      res = await fetchImpl(`${base}/api/fn/${AGENT_NAME}`, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          accept: "text/event-stream",
-          authorization: `Bearer ${cached.token}`,
-        },
-        body: JSON.stringify(args),
-        signal: AbortSignal.timeout(280_000),
-      });
-    } catch (err) {
-      return { ok: false, code: "AGENT_UNREACHABLE", message: err instanceof Error ? err.message : String(err) };
-    }
-    const contentType = res.headers.get("content-type") ?? "";
-    const body = contentType.includes("text/event-stream") ? await readUntilTerminalEvent(res) : await res.text();
-    const outcome = readAgentResponse(res.status, contentType, body);
-    // A session the server no longer accepts: mint a new one and retry once.
-    if (!outcome.ok && (res.status === 401 || res.status === 403) && attempt === 0) {
-      cached = null;
-      continue;
-    }
-    return outcome;
-  }
-  return { ok: false, code: "AGENT_AUTH_FAILED", message: "Could not authenticate as the owner" };
-}
-
-/** Test seam: forget the cached owner session. */
-export function resetOwnerSessionCache(): void {
-  cached = null;
-}

package/templates/imessage/tests/agent-call.test.ts

@@ -1,112 +0,0 @@
-import { beforeEach, describe, expect, test } from "bun:test";
-import {
-  hasTerminalEvent,
-  parseSse,
-  readAgentResponse,
-  resetOwnerSessionCache,
-  runAgentAsOwner,
-  selfBaseUrl,
-} from "../lib/agent-call";
-
-const RESULT = { runId: "run_1", text: "Hi there", steps: 1, usage: { input_tokens: 1, output_tokens: 1 } };
-const SSE_BODY = `retry: 1000\n\nid: 1\ndata: Hi \n\nid: 2\ndata: there\n\nid: 3\nevent: result\ndata: ${JSON.stringify(RESULT)}\n\n`;
-
-beforeEach(() => resetOwnerSessionCache());
-
-describe("SSE parsing", () => {
-  test("parses events and multi-line data", () => {
-    expect(parseSse("event: tool\ndata: a\ndata: b\n\ndata: plain\n\n")).toEqual([
-      { event: "tool", data: "a\nb" },
-      { event: "message", data: "plain" },
-    ]);
-  });
-
-  test("detects a complete terminal event only", () => {
-    expect(hasTerminalEvent(SSE_BODY)).toBe(true);
-    expect(hasTerminalEvent(SSE_BODY.slice(0, -2))).toBe(false);
-    expect(hasTerminalEvent("data: x\n\n")).toBe(false);
-  });
-
-  test("reads a streamed result, a streamed error, and a JSON error", () => {
-    expect(readAgentResponse(200, "text/event-stream", SSE_BODY)).toEqual({
-      ok: true,
-      result: { runId: "run_1", text: "Hi there", steps: 1, queued: false, cancelled: false },
-    });
-    expect(
-      readAgentResponse(200, "text/event-stream", `event: error\ndata: {"code":"LLM_NOT_CONFIGURED","message":"no key"}\n\n`),
-    ).toEqual({ ok: false, code: "LLM_NOT_CONFIGURED", message: "no key" });
-    expect(readAgentResponse(403, "application/json", `{"error":{"code":"FORBIDDEN","message":"admin only"}}`)).toEqual({
-      ok: false,
-      code: "FORBIDDEN",
-      message: "admin only",
-    });
-  });
-});
-
-describe("selfBaseUrl", () => {
-  test("prefers loopback, then an https public origin, never plain-http public", () => {
-    expect(selfBaseUrl({ PYLON_PORT: "4541", APP_URL: "https://a.example.com" })).toBe("http://127.0.0.1:4541");
-    expect(selfBaseUrl({ APP_URL: "https://a.example.com/path" })).toBe("https://a.example.com");
-    expect(selfBaseUrl({ PYLON_PUBLIC_URL: "https://b.example.com" })).toBe("https://b.example.com");
-    expect(selfBaseUrl({ APP_URL: "http://a.example.com" })).toBe("http://127.0.0.1:4321");
-    expect(selfBaseUrl({ APP_URL: "javascript:alert(1)" })).toBe("http://127.0.0.1:4321");
-  });
-});
-
-/** A streaming response that sends `body` and then never closes. */
-function openStream(body: string): Response {
-  const stream = new ReadableStream({
-    start(controller) {
-      controller.enqueue(new TextEncoder().encode(body));
-    },
-  });
-  return new Response(stream, { headers: { "content-type": "text/event-stream" } });
-}
-
-describe("runAgentAsOwner", () => {
-  test("mints an owner session, calls the agent, and returns once the result arrives", async () => {
-    const calls: { url: string; auth: string | null; body: unknown }[] = [];
-    const fetchImpl = async (url: string, init: RequestInit) => {
-      const headers = init.headers as Record<string, string>;
-      calls.push({ url, auth: headers.authorization ?? null, body: JSON.parse(String(init.body)) });
-      if (url.endsWith("/api/auth/session")) return Response.json({ token: "owner-session", user_id: "u1" }, { status: 201 });
-      return openStream(SSE_BODY);
-    };
-    const env = { APP_URL: "https://app.example.com", PYLON_ADMIN_TOKEN: "admin-token" };
-    const out = await runAgentAsOwner(env, "u1", { input: "hi", title: "conv_1" }, fetchImpl);
-    expect(out.ok && out.result.text).toBe("Hi there");
-    expect(calls.map((c) => c.url)).toEqual([
-      "https://app.example.com/api/auth/session",
-      "https://app.example.com/api/fn/assistant",
-    ]);
-    expect(calls[0].auth).toBe("Bearer admin-token");
-    expect(calls[0].body).toEqual({ user_id: "u1" });
-    expect(calls[1].auth).toBe("Bearer owner-session");
-    expect(calls[1].body).toEqual({ input: "hi", title: "conv_1" });
-
-    // The session is reused on the next call.
-    await runAgentAsOwner(env, "u1", { input: "again" }, fetchImpl);
-    expect(calls.filter((c) => c.url.endsWith("/api/auth/session")).length).toBe(1);
-  });
-
-  test("re-mints once when the cached session is rejected", async () => {
-    let mints = 0;
-    let agentCalls = 0;
-    const fetchImpl = async (url: string) => {
-      if (url.endsWith("/api/auth/session")) return Response.json({ token: `s${++mints}` });
-      agentCalls += 1;
-      if (agentCalls === 1) return Response.json({ error: { code: "AUTH_REQUIRED", message: "expired" } }, { status: 401 });
-      return openStream(SSE_BODY);
-    };
-    const out = await runAgentAsOwner({}, "u1", { input: "hi" }, fetchImpl);
-    expect(out.ok).toBe(true);
-    expect(mints).toBe(2);
-  });
-
-  test("reports a refused session mint", async () => {
-    const fetchImpl = async () =>
-      Response.json({ error: { code: "FORBIDDEN", message: "/api/auth/session requires admin auth" } }, { status: 403 });
-    const out = await runAgentAsOwner({}, "u1", { input: "hi" }, fetchImpl);
-    expect(out).toEqual({ ok: false, code: "OWNER_SESSION_FORBIDDEN", message: "/api/auth/session requires admin auth" });
-  });
-});