@schlenkr/ragents 0.1.4 → 0.1.6

package/README.md

@@ -15,18 +15,18 @@ npm install -g @schlenkr/ragents
 
 ## Commands
 
-- `connect <server-url>` - fetch the client profile of a RAgents server and start the local server
-  with it; the models come over the server's relay.
+- `connect <server-url>` - fetch the client profile of a RAgents server together with the plugin
+  bundles it names and start the local server with it; the models come over the server's relay.
+  The local host needs the same host API as the server; nothing is built or installed.
 
   ```sh
   RAGENTS_TOKEN=<token> ragents connect https://ragents.example.com
   ```
 
-- `start <profile|path>` - start a profile shipped with the package (`core`, `developer`), your
-  own `ragents.config.<name>.ts` anywhere on disk, or a stand that `connect` already fetched,
-  without asking the server. The web interface is built for that set of plugins when it is
-  missing or was last built for another profile or host version; the result goes to
-  `<data dir>/web/<profile>`, never into the package folder.
+- `start <profile|path>` - start a profile shipped with the package (`core`, `developer`,
+  `showcase`), your own `ragents.config.<name>.ts` anywhere on disk, or a stand that `connect`
+  already fetched, without asking the server. The web interface comes finished with the package,
+  the same for every profile; the web halves of the plugins load from their bundles.
 
   ```sh
   ragents start developer
@@ -47,6 +47,14 @@ npm install -g @schlenkr/ragents
   ragents workspace-client https://ragents.example.com ~/projects/demo
   ```
 
+- `plugin build <folder...>` - build your own plugin sources into bundles, with type checks
+  against the host API; the result goes to `./dist/plugins/<id>`, and a profile names that folder.
+  `--out <folder>` changes the target, `--watch` rebuilds on every change.
+
+  ```sh
+  ragents plugin build ./acme.tickets
+  ```
+
 - `run <folder> "<task>"` - start the host if none answers, bind a new run to the folder and wait
   until the turn is finished; the last line is always `run: <id>`. This host serves no web
   interface - an agent does not need one; use `start` for that.
@@ -76,8 +84,8 @@ npm install -g @schlenkr/ragents
 
 ## Requirements
 
-- Node 22 (>= 22.19.0). No git, no pnpm, no source checkout; the package builds its own web
-  interface per profile with the Vite it brings along.
+- Node 22 (>= 22.19.0). No git, no pnpm, no source checkout; the package carries its finished web
+  interface, the same for every profile, and loads the web halves of plugins from their bundles.
 - `dotnet` (.NET 10 SDK) for the C# diagnostics through Roslyn and the F# diagnostics through FSAC;
   without it TypeScript diagnostics still work.
 - Model access: either `OPENROUTER_API_KEY` in the environment, or `ragents connect <server-url>`
@@ -85,8 +93,8 @@ npm install -g @schlenkr/ragents
 
 ## Documentation
 
-The specification, the operations guide, the profile and plugin reference and the homepage live in
-the repository: https://github.com/SchlenkR/RAgents
+The specification, the usage and operations guides, the profile and plugin reference and the
+homepage live in the repository: https://github.com/SchlenkR/RAgents
 
 ## License
 

package/apps/server/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@aicontainer/server",
+  "name": "@ragents/host",
   "private": true,
   "type": "module",
   "exports": {
@@ -9,15 +9,17 @@
   "scripts": {
     "dev": "tsx watch src/main.ts",
     "start": "tsx src/main.ts",
-    "test": "PRODUCT_PROFILE=core node --import tsx --test tests/*.test.ts",
+    "test": "pnpm --dir ../.. build:plugins && PRODUCT_PROFILE=core node --import tsx --test tests/*.test.ts",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@aicontainer/agent": "workspace:*",
-    "@aicontainer/ai": "workspace:*",
-    "@aicontainer/ragents": "workspace:*",
-    "@aicontainer/workspace-executor": "workspace:*",
+    "@anthropic-ai/sandbox-runtime": "0.0.77",
+    "@ragents/agent": "workspace:*",
+    "@ragents/ai": "workspace:*",
+    "@ragents/engine": "workspace:*",
+    "@ragents/workspace-executor": "workspace:*",
     "handlebars": "^4.7.9",
+    "quassel": "^0.2.2",
     "tsx": "^4.20.0",
     "typebox": "^1.3.13",
     "vscode-jsonrpc": "^9.0.2"

package/apps/server/src/access-projection.ts

@@ -1,5 +1,5 @@
-import { emptyUsage, type AccessContext, type JsonValue, type PluginState, type RunView } from "@aicontainer/ragents";
-import type { ChatEvent, Message } from "./chat-events.js";
+import { emptyUsage, type AccessContext, type JsonValue, type PluginState, type RunView } from "@ragents/engine";
+import type { ChatEvent, Message } from "quassel/events";
 import type { ActorConversations } from "./ragents/actor-chat-history.js";
 
 const record = (value: JsonValue | undefined): Record<string, JsonValue | undefined> | undefined =>
@@ -69,7 +69,7 @@ export const accessibleChatEvent = (event: ChatEvent, access: AccessContext): Ch
   if (event.kind === "tool") return trace ? event : { kind: "tool", id: event.id, name: "", arguments: "", at: event.at };
   if (event.kind === "tool-result") return trace ? event : { kind: "tool-result", id: event.id, result: "", isError: event.isError };
   if (event.kind === "system") return { ...event, text: "Hinweis zur Verarbeitung. Bei Fragen wende Dich an den zuständigen Agenten." };
-  if (event.kind !== "extension") return event;
+  if (event.kind !== "plugin") return event;
   if (hiddenStates.has(event.pluginId)) return undefined;
   if (event.pluginId === "ragents.actor-programs" || event.pluginId === "ragents.actor-programs.invocations") return undefined;
   return event;

package/apps/server/src/access-service.ts

@@ -1,22 +1,33 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import type { IncomingMessage } from "node:http";
 
-const token = randomBytes(32).toString("hex");
+/** Je Koordinator ein Token für seine Werkzeuge; er handelt als dessen Benutzer, null ist der eine Zugang ohne Anmeldung. */
+const coordinatorTokens = new Map<string | null, string>();
 
-export const accessServiceToken = (): string => token;
+export const coordinatorAccessToken = (userId: string | null): string => {
+  const known = coordinatorTokens.get(userId);
+  if (known) return known;
+  const created = randomBytes(32).toString("hex");
+  coordinatorTokens.set(userId, created);
+  return created;
+};
 
 export const profileAccessCookieName = (productId: string | undefined, profile: string | undefined): string => {
   if (!productId || !profile) throw new Error("Die Benutzeranmeldung benötigt PRODUCT_ID und PRODUCT_PROFILE");
   return `${productId}-${profile}-user`;
 };
 
-export const isAccessServiceRequest = (request: IncomingMessage, url: URL): boolean => {
+/** Der Benutzer, für den ein Koordinator lokal die Nachrichtenschicht aufruft; sonst undefined. */
+export const coordinatorRequestUser = (request: IncomingMessage, url: URL): { userId: string | null } | undefined => {
   const address = request.socket.remoteAddress;
-  if (address !== "127.0.0.1" && address !== "::1" && address !== "::ffff:127.0.0.1") return false;
-  if (url.pathname !== "/rpc" && url.pathname !== "/rpc/stream" && !url.pathname.startsWith("/help/")) return false;
+  if (address !== "127.0.0.1" && address !== "::1" && address !== "::ffff:127.0.0.1") return undefined;
+  if (url.pathname !== "/rpc" && url.pathname !== "/rpc/stream" && !url.pathname.startsWith("/help/")) return undefined;
   const offered = request.headers.authorization;
-  if (!offered?.startsWith("Bearer ")) return false;
+  if (!offered?.startsWith("Bearer ")) return undefined;
   const value = Buffer.from(offered.slice(7));
-  const expected = Buffer.from(token);
-  return value.length === expected.length && timingSafeEqual(value, expected);
+  const matching = [...coordinatorTokens].filter(([, token]) => {
+    const expected = Buffer.from(token);
+    return value.length === expected.length && timingSafeEqual(value, expected);
+  });
+  return matching.length === 1 ? { userId: matching[0]![0] } : undefined;
 };

package/apps/server/src/access-session.ts

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, scrypt, scryptSync, timingSafeEqual } from "node:crypto";
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { ACCESS_TOKEN_QUERY, type AccessSnapshot, type AccessUser } from "@aicontainer/ragents";
+import { ACCESS_TOKEN_QUERY, type AccessSnapshot, type AccessUser } from "@ragents/engine";
 import type { ResolvedProfileUser } from "./config-file.js";
 import { PayloadTooLargeError, readJsonBody, writeJson } from "./plugin-support/http.js";
 
@@ -200,5 +200,9 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
     response.once("close", release);
     response.once("finish", release);
   };
-  return { enabled, snapshot, handle, track, close: () => { for (const token of sessions.keys()) invalidate(token); } };
+  /** Der Zugang, mit dem die Werkzeuge des Koordinators eines Benutzers handeln: dessen aktueller Stand, null ist der eine Zugang ohne Anmeldung. */
+  const coordinatorSnapshot = (userId: string | null): AccessSnapshot => userId === null
+    ? { enabled, user: enabled ? null : options.anonymousUser ?? null }
+    : { enabled: true, user: passwords.get(userId)?.user ?? null };
+  return { enabled, snapshot, coordinatorSnapshot, handle, track, close: () => { for (const token of sessions.keys()) invalidate(token); } };
 };

package/apps/server/src/api/contracts.ts

@@ -1,8 +1,8 @@
 import { Type } from "typebox";
-import type { PublicPluginProfile } from "@aicontainer/ragents/src/plugin-types";
-import { defineChannel, defineOperation } from "@aicontainer/ragents/src/rpc/contract";
-import { openJson, runContracts } from "@aicontainer/ragents/src/http/contracts";
-import type { ChatAttachmentCapabilities, ChatEvent } from "../chat-events.js";
+import type { PublicPluginProfile } from "@ragents/engine/src/plugin-types";
+import { defineChannel, defineOperation } from "@ragents/engine/src/rpc/contract";
+import { openJson, runContracts } from "@ragents/engine/src/http/contracts";
+import type { ChatAttachmentCapabilities, ChatEvent } from "quassel/events";
 import type { ChatUserLocation } from "../chat-context.js";
 import type { SessionInfo } from "../chat-handler.js";
 import type { ActorConversations } from "../ragents/actor-chat-history.js";
@@ -26,16 +26,16 @@ const sessionInfo = openJson<SessionInfo>("SessionInfo");
 
 /** Rechte je Run prüft der Host dynamisch; Verträge ohne `rights` nennen ihre Regel in der Beschreibung. */
 export const coreContracts = {
-  sessions: {
+  runs: {
     list: defineOperation({
-      id: "ragents.sessions.list",
+      id: "ragents.runs.list",
       description: "Alle Runs des Profils mit Titel, Zeiten und Metadaten. Recht: runs.read.",
       rights: ["runs.read"],
       input: Type.Object({}, { additionalProperties: false }),
       result: Type.Array(sessionInfo),
     }),
     delete: defineOperation({
-      id: "ragents.sessions.delete",
+      id: "ragents.runs.delete",
       description: "Einen Run mit seinen Daten löschen. Rechte: runs.read und runs.delete.",
       rights: ["runs.read", "runs.delete"],
       input: Type.Object({ runId }, { additionalProperties: false }),
@@ -45,12 +45,13 @@ export const coreContracts = {
   chat: {
     send: defineOperation({
       id: "ragents.chat.send",
-      description: "Eine Nachricht an den Koordinator des Runs; startet einen neuen Run oder funkt in einen laufenden. Rechte: runs.read und runs.write, für einen neuen Run runs.create; beim globalen Chat dessen Rechte.",
+      description: "Eine Nachricht an den Koordinator des Runs; startet einen neuen Run oder funkt in einen laufenden. Mit entry startet sie den Run über diese Skill-Vorlage und deren festgelegte Startoptionen. Rechte: runs.read und runs.write, für einen neuen Run runs.create; beim globalen Chat dessen Rechte.",
       input: Type.Object({
         runId,
         text: Type.Optional(Type.String()),
         attachments: Type.Optional(Type.Array(attachment)),
         userLocation: Type.Optional(openJson<ChatUserLocation>("ChatUserLocation")),
+        entry: Type.Optional(Type.String({ minLength: 1, description: "Kennung der Skill-Vorlage, über die diese Nachricht den Run startet" })),
       }, { additionalProperties: false }),
       result: Type.Null(),
     }),
@@ -62,13 +63,13 @@ export const coreContracts = {
     }),
     start: defineOperation({
       id: "ragents.chat.start",
-      description: "Einen Run über einen Skill- oder Run-Script-Einstieg starten, ohne Nachricht. Rechte: runs.read, runs.write und die Freigabe des Einstiegs.",
+      description: "Einen Run über eine Script-Vorlage starten, ohne Nachricht; die Startoptionen, die die Vorlage festlegt, gelten. Rechte: runs.read, runs.write und die Freigabe der Vorlage.",
       input: Type.Object({ runId, entry: Type.String({ minLength: 1 }), input: Type.Optional(Type.Any()) }, { additionalProperties: false }),
       result: Type.Null(),
     }),
     stop: defineOperation({
       id: "ragents.chat.stop",
-      description: "Den laufenden Turn des Koordinators abbrechen. Rechte: runs.read und runs.write.",
+      description: "Not-Aus für den ganzen Run: bricht alle Turns und einen laufenden Start ab und stoppt alle Actors. Einen einzelnen Turn unterbricht ragents.runs.interruptTurn. Rechte: runs.read und runs.write.",
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: Type.Null(),
     }),
@@ -88,15 +89,15 @@ export const coreContracts = {
   startOptions: {
     list: defineOperation({
       id: "ragents.startOptions.list",
-      description: "Die Startoptionen eines noch nicht gestarteten Runs mit Wert und Darstellung. Rechte: runs.read, runs.create, runs.inspect.",
-      rights: ["runs.read", "runs.create", "runs.inspect"],
+      description: "Die Startoptionen eines Runs mit Wert und Darstellung, nur die, deren eigene Rechte der Aufrufer hat; die Modellwahl etwa verlangt runs.inspect. Nach dem Start ist jede außer den änderbaren gesperrt. Rechte: runs.read, runs.create.",
+      rights: ["runs.read", "runs.create"],
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: Type.Array(openJson<StartOptionState>("StartOptionState")),
     }),
     select: defineOperation({
       id: "ragents.startOptions.select",
-      description: "Eine Startoption vor dem Start wählen. Rechte: runs.read, runs.write, runs.create, runs.inspect.",
-      rights: ["runs.read", "runs.write", "runs.create", "runs.inspect"],
+      description: "Eine Startoption vor dem Start wählen, eine änderbare wie die Modellwahl auch danach mit Wirkung ab dem nächsten Turn; fehlt ein Recht der Option selbst, scheitert die Wahl mit access-denied. Rechte: runs.read, runs.write, runs.create.",
+      rights: ["runs.read", "runs.write", "runs.create"],
       input: Type.Object({ runId, optionId: Type.String({ minLength: 1, maxLength: 128 }), value: Type.Any() }, { additionalProperties: false }),
       result: openJson<StartOptionState>("StartOptionState"),
     }),
@@ -104,7 +105,7 @@ export const coreContracts = {
   transfer: {
     export: defineOperation({
       id: "ragents.runs.export",
-      description: "Einen gestoppten Run als Archiv holen: Journal, Payloads, Modellkontexte und die Plugin-Ablagen seiner Session. Rechte: runs.read und runs.inspect.",
+      description: "Einen gestoppten Run als Archiv holen: Journal, Payloads, Modellkontexte und seine Plugin-Ablagen. Rechte: runs.read und runs.inspect.",
       rights: ["runs.read", "runs.inspect"],
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: openJson<RunTransferExport>("RunTransferExport"),
@@ -160,7 +161,7 @@ export const coreContracts = {
   plugins: {
     bootstrap: defineOperation({
       id: "ragents.plugins.bootstrap",
-      description: "Produkt, aktive Plugins mit Web-Konfiguration und freigegebene Einstiege für die Oberfläche.",
+      description: "Produkt, aktive Plugins mit Web-Konfiguration und freigegebene Vorlagen für die Oberfläche.",
       input: Type.Object({}, { additionalProperties: false }),
       result: openJson<PublicPluginProfile>("PublicPluginProfile"),
     }),
@@ -175,8 +176,8 @@ export const coreContracts = {
     }),
   },
   channels: {
-    sessions: defineChannel({
-      id: "ragents.sessions",
+    runs: defineChannel({
+      id: "ragents.runs",
       description: "Meldet jede Änderung der Run-Liste. Recht: runs.read.",
       rights: ["runs.read"],
       params: Type.Object({}, { additionalProperties: false }),

package/apps/server/src/api/core-methods.ts

@@ -1,5 +1,5 @@
-import { canStartEntry, DomainError, implement, implementChannel, type AccessContext, type ChannelContribution, type MethodContribution, type PluginHost } from "@aicontainer/ragents";
-import { parseChatAttachments } from "../chat-attachments.js";
+import { canStartEntry, DomainError, implement, implementChannel, type AccessContext, type ChannelContribution, type MethodContribution, type PluginHost } from "@ragents/engine";
+import { parseChatAttachments } from "quassel/events";
 import type { ChatSessionLike, ChatSessionProvider, ChatUser } from "../chat-handler.js";
 import { accessibleActorConversations, accessibleChatEvent } from "../access-projection.js";
 import type { StartOptionState } from "../plugin-support/start-options-contract.js";
@@ -8,16 +8,15 @@ import type { RunTransferExport, RunTransferImport } from "../run-transfer.js";
 import type { SettingsResponse, SettingsSkillDetail } from "../settings.js";
 import type { TitleModelSettings } from "../title-settings-contract.js";
 import { coreContracts } from "./contracts.js";
-import { assertRunRights, type GlobalRunPolicy } from "./rights.js";
-import { assertRights } from "../rpc/dispatcher.js";
+import { assertRunReachable, assertRunRights, runListScope, type GlobalRunPolicy, type RunAccessPolicy } from "./rights.js";
 
 export interface CoreMethodSources {
   sessions: ChatSessionProvider & {
     subscribeList: (listener: () => void) => () => void;
     subscribeRun: (runId: string, listener: () => void) => () => void;
-    startOptions: (runId: string) => readonly StartOptionState[];
-    selectStartOption: (runId: string, optionId: string, value: unknown) => StartOptionState;
-    prepareRunMessage: (runId: string, request: unknown, signal: AbortSignal) => Promise<RunPreparationResponse>;
+    startOptions: (runId: string, userId: string | null) => readonly StartOptionState[];
+    selectStartOption: (runId: string, optionId: string, value: unknown, userId: string | null) => Promise<StartOptionState>;
+    prepareRunMessage: (runId: string, request: unknown, signal: AbortSignal, userId: string | null) => Promise<RunPreparationResponse>;
     exportRun: (runId: string) => Promise<RunTransferExport>;
     importRun: (archive: Buffer, workspacePath: string | undefined) => Promise<RunTransferImport>;
     settings: () => Promise<SettingsResponse>;
@@ -27,6 +26,10 @@ export interface CoreMethodSources {
   };
   plugins: PluginHost;
   global: GlobalRunPolicy | undefined;
+  /** Der Benutzer eines Runs: null ohne Eigentümer, undefined für eine Kennung ohne Run. */
+  runOwner: (runId: string) => string | null | undefined;
+  /** Ob nur der Eigentümer den Run bedient. */
+  runOwnerOnly: (runId: string) => boolean;
   /** Einstellungen sind ohne Anmeldung und Zugangstoken nur vom eigenen Rechner lesbar. */
   settingsGuarded: () => boolean;
   external: { open: () => boolean; set: (value: boolean) => Promise<void> };
@@ -34,6 +37,15 @@ export interface CoreMethodSources {
 
 const userOf = (access: AccessContext): ChatUser | undefined => access.user ? { id: access.user.id, label: access.user.label } : undefined;
 
+const userIdOf = (access: AccessContext): string | null => access.user?.id ?? null;
+
+/** Der Oberflächenkontext nennt den beim Absenden geöffneten Run; auch er ist ein Zugriff auf diesen Run. */
+const locatedRun = (userLocation: unknown): string | undefined => {
+  const named = typeof userLocation === "object" && userLocation !== null && "runId" in userLocation
+    ? (userLocation as { runId: unknown }).runId : undefined;
+  return typeof named === "string" ? named : undefined;
+};
+
 const messageOf = (text: string | undefined, attachments: unknown) => {
   try {
     const trimmed = text?.trim() ?? "";
@@ -62,24 +74,27 @@ const guardedForUser = async <T>(access: AccessContext, work: () => Promise<T>):
 
 export const coreMethods = (sources: CoreMethodSources): MethodContribution[] => {
   const { sessions, global } = sources;
-  const session = async (access: AccessContext, runId: string, kind: "read" | "write"): Promise<ChatSessionLike> => {
-    assertRunRights(access, runId, kind, global);
+  const policy: RunAccessPolicy = { global, ownerOf: sources.runOwner, ownerOnly: sources.runOwnerOnly };
+  const session = async (access: AccessContext, runId: string, kind: "read" | "write" | "stop"): Promise<ChatSessionLike> => {
+    assertRunRights(access, runId, kind, policy);
     return sessions.get(runId);
   };
   const assertMaySend = (access: AccessContext, runId: string) => {
-    if (!access.can("runs.create") && !sessions.hasRun?.(runId)) throw new DomainError("access-denied", "Freie Runs sind für diesen Zugang nicht freigegeben.", 403);
+    if (!access.can("runs.create") && !sessions.hasRun?.(runId) && !global?.isCoordinator(runId)) throw new DomainError("access-denied", "Freie Runs sind für diesen Zugang nicht freigegeben.", 403);
   };
   const assertSettingsReachable = (local: boolean) => {
     if (!local && sources.settingsGuarded()) throw new DomainError("settings-local-only", "Einstellungen sind nur lokal oder mit Zugangstoken verfügbar", 403);
   };
   return [
-    implement(coreContracts.sessions.list, () => sessions.list()),
-    implement(coreContracts.sessions.delete, async ({ runId }) => { await sessions.delete(runId); return null; }),
-    implement(coreContracts.chat.send, async ({ runId, text, attachments, userLocation }, { access }) => {
+    implement(coreContracts.runs.list, (_input, { access }) => sessions.list(runListScope(access, policy))),
+    implement(coreContracts.runs.delete, async ({ runId }) => { await sessions.delete(runId); return null; }),
+    implement(coreContracts.chat.send, async ({ runId, text, attachments, userLocation, entry }, { access }) => {
       assertMaySend(access, runId);
+      const located = locatedRun(userLocation);
+      if (located !== undefined) assertRunReachable(access, located, policy);
       const current = await session(access, runId, "write");
       const message = messageOf(text, attachments);
-      await guardedForUser(access, async () => current.send(message.text, message.attachments, userLocation, userOf(access)));
+      await guardedForUser(access, async () => current.send(message.text, message.attachments, userLocation, userOf(access), entry));
       return null;
     }),
     implement(coreContracts.chat.sendToActor, async ({ runId, actorId, text, attachments }, { access }) => {
@@ -87,7 +102,7 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
       const current = await session(access, runId, "write");
       if (!current.sendToActor) throw new DomainError("actor-send-unavailable", "Actor-Nachrichten sind nicht verfügbar", 404);
       const message = messageOf(text, attachments);
-      await guardedForUser(access, () => current.sendToActor!(actorId, message.text, message.attachments));
+      await guardedForUser(access, () => current.sendToActor!(actorId, message.text, message.attachments, userOf(access)));
       return null;
     }),
     implement(coreContracts.chat.start, async ({ runId, entry, input }, { access }) => {
@@ -98,14 +113,14 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
       return null;
     }),
     implement(coreContracts.chat.stop, async ({ runId }, { access }) => {
-      const current = await session(access, runId, "write");
+      const current = await session(access, runId, "stop");
       await current.stop();
       return null;
     }),
     implement(coreContracts.chat.capabilities, async ({ runId, actor }, { access }) => {
       const current = await session(access, runId, "read");
       if (!current.capabilities) throw new DomainError("capabilities-unavailable", "Modellfähigkeiten sind nicht verfügbar", 404);
-      const capabilities = await current.capabilities(actor ?? "primary");
+      const capabilities = await current.capabilities(actor ?? "primary", userIdOf(access));
       return access.can("runs.inspect") ? capabilities : { ...capabilities, model: "" };
     }),
     implement(coreContracts.chat.actorHistory, async ({ runId }, { access }) => {
@@ -113,9 +128,14 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
       if (!current.actorConversations) throw new DomainError("actor-history-unavailable", "Actor-Verläufe sind nicht verfügbar", 404);
       return accessibleActorConversations(current.actorConversations(), access);
     }),
-    implement(coreContracts.startOptions.list, ({ runId }) => [...sessions.startOptions(runId)]),
-    implement(coreContracts.startOptions.select, ({ runId, optionId, value }) => sessions.selectStartOption(runId, optionId, value)),
-    implement(coreContracts.prepare, ({ runId, ...request }, { signal }) => sessions.prepareRunMessage(runId, request, signal)),
+    implement(coreContracts.startOptions.list, ({ runId }, { access }) =>
+      sessions.startOptions(runId, userIdOf(access)).filter((option) => sources.plugins.startOptions.missingRight(option.id, access) === undefined)),
+    implement(coreContracts.startOptions.select, ({ runId, optionId, value }, { access }) => {
+      sources.plugins.startOptions.assertRights(optionId, access);
+      return sessions.selectStartOption(runId, optionId, value, userIdOf(access));
+    }),
+    implement(coreContracts.prepare, ({ runId, ...request }, { signal, access }) =>
+      sessions.prepareRunMessage(runId, request, signal, userIdOf(access))),
     implement(coreContracts.transfer.export, ({ runId }) => sessions.exportRun(runId)),
     implement(coreContracts.transfer.import, ({ archive, workspacePath }) => {
       const decoded = Buffer.from(archive, "base64");
@@ -135,22 +155,23 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
   ];
 };
 
-export const coreChannels = (sources: Pick<CoreMethodSources, "sessions" | "global">): ChannelContribution[] => {
+export const coreChannels = (sources: Pick<CoreMethodSources, "sessions" | "global" | "runOwner" | "runOwnerOnly">): ChannelContribution[] => {
   const { sessions, global } = sources;
+  const policy: RunAccessPolicy = { global, ownerOf: sources.runOwner, ownerOnly: sources.runOwnerOnly };
   return [
-    implementChannel(coreContracts.channels.sessions, (_params, emit) => {
+    implementChannel(coreContracts.channels.runs, (_params, emit) => {
       const notify = () => emit({ type: "changed" });
       const unsubscribe = sessions.subscribeList(notify);
       notify();
       return unsubscribe;
     }),
     implementChannel(coreContracts.channels.run, ({ runId }, emit, { access }) => {
-      assertRunRights(access, runId, "read", global);
+      assertRunRights(access, runId, "read", policy);
       emit({ kind: "ready" });
       return sessions.subscribeRun(runId, () => emit({ kind: "run" }));
     }),
     implementChannel(coreContracts.channels.chat, async ({ runId }, emit, { access }) => {
-      assertRunRights(access, runId, "read", global);
+      assertRunRights(access, runId, "read", policy);
       const current = await sessions.get(runId);
       return current.subscribe((event) => {
         const visible = accessibleChatEvent(event, access);
@@ -159,5 +180,3 @@ export const coreChannels = (sources: Pick<CoreMethodSources, "sessions" | "glob
     }),
   ];
 };
-
-export { assertRights };

package/apps/server/src/api/delivery.ts

@@ -1,11 +1,11 @@
-import { DomainError, type HttpRouteContribution } from "@aicontainer/ragents";
+import { DomainError, type HttpRouteContribution } from "@ragents/engine";
 import type { ChatSessionProvider } from "../chat-handler.js";
 import { writeJson } from "../plugin-support/http.js";
 import { ATTACHMENT_CONTENT_PATH } from "./contracts.js";
-import { assertRunRights, type GlobalRunPolicy } from "./rights.js";
+import { assertRunRights, type RunAccessPolicy } from "./rights.js";
 
 /** Anhänge sind Auslieferung: ein GET mit dem Medientyp, inline für Bilder und Videos. */
-export const attachmentContentRoute = (sessions: ChatSessionProvider, global: GlobalRunPolicy | undefined): HttpRouteContribution => ({
+export const attachmentContentRoute = (sessions: ChatSessionProvider, policy: RunAccessPolicy): HttpRouteContribution => ({
   id: "ragents.chat.attachment-content",
   requiredRights: [],
   isApiPath: (pathname) => ATTACHMENT_CONTENT_PATH.test(pathname),
@@ -15,7 +15,7 @@ export const attachmentContentRoute = (sessions: ChatSessionProvider, global: Gl
     const runId = decodeURIComponent(match[1]!);
     const artifactId = decodeURIComponent(match[2]!);
     try {
-      assertRunRights(access, runId, "read", global);
+      assertRunRights(access, runId, "read", policy);
       const session = await sessions.get(runId);
       if (!session.attachment) throw new DomainError("attachments-unavailable", "Anhänge sind nicht verfügbar", 404);
       const { attachment, content } = session.attachment(artifactId);

package/apps/server/src/api/reference.ts

@@ -1,5 +1,5 @@
 import type { TSchema } from "typebox";
-import { RPC_METHODS, type ChannelDescriptor, type MethodDescriptor, type PluginHost } from "@aicontainer/ragents";
+import { RPC_METHODS, type ChannelDescriptor, type MethodDescriptor, type PluginHost } from "@ragents/engine";
 
 export type ApiAuthentication = { kind: "open" } | { kind: "token" } | { kind: "users"; cookieName: string };
 

package/apps/server/src/api/rights.ts

@@ -1,16 +1,35 @@
-import type { AccessContext } from "@aicontainer/ragents";
+import { DomainError, type AccessContext } from "@ragents/engine";
 import { assertRights } from "../rpc/dispatcher.js";
-import type { RunRightsKind } from "@aicontainer/ragents/src/http/methods";
+import type { RunRightsKind } from "@ragents/engine/src/http/methods";
+import type { RunListScope } from "../chat-handler.js";
 
 export interface GlobalRunPolicy {
-  runId: string;
+  /** Jede Kennung, die einem globalen Koordinator vorbehalten ist. */
+  isCoordinator: (runId: string) => boolean;
+  /** Der Koordinator eines Benutzers; ohne Anmeldung (null) gibt es genau einen. */
+  runIdFor: (userId: string | null) => string;
   read: string;
   write: string;
 }
 
-/** Rechte je Run: gewöhnliche Runs über runs.*, der globale Chat über die Rechte seines Plugins. */
+/** Der Koordinator eines Zugangs: ohne Anmeldung der eine, angemeldet der des Benutzers, ohne Benutzer keiner. */
+export const coordinatorRunIdOf = (access: AccessContext, global: GlobalRunPolicy): string | undefined =>
+  !access.enabled ? global.runIdFor(null) : access.user ? global.runIdFor(access.user.id) : undefined;
+
+/** Das Recht, die Runs aller Benutzer zu sehen; ohne es bleibt ein Zugang bei seinen eigenen. */
+export const RUNS_READ_ALL = "runs.read.all";
+
+export interface RunAccessPolicy {
+  global: GlobalRunPolicy | undefined;
+  /** Der Benutzer des Runs: null für einen Run ohne Eigentümer, undefined für einen Run, den es noch nicht gibt. */
+  ownerOf: (runId: string) => string | null | undefined;
+  /** Ob nur der Eigentümer den Run bedient, weil ein Plugin ihn so erklärt hat. */
+  ownerOnly: (runId: string) => boolean;
+}
+
+/** Rechte je Run: gewöhnliche Runs über runs.*, die Koordinatoren über die Rechte ihres Plugins. */
 export const runRights = (runId: string, kind: RunRightsKind, global: GlobalRunPolicy | undefined): readonly string[] => {
-  if (global && runId === global.runId) {
+  if (global?.isCoordinator(runId)) {
     const technical = kind === "inspect" || kind === "write-inspect" ? ["runs.inspect"] : [];
     return kind === "read" || kind === "inspect" ? [global.read, ...technical] : [global.read, global.write, ...technical];
   }
@@ -18,9 +37,69 @@ export const runRights = (runId: string, kind: RunRightsKind, global: GlobalRunP
     case "read": return ["runs.read"];
     case "inspect": return ["runs.read", "runs.inspect"];
     case "write": return ["runs.read", "runs.write"];
+    case "stop": return ["runs.read", "runs.write"];
     case "write-inspect": return ["runs.read", "runs.write", "runs.inspect"];
   }
 };
 
-export const assertRunRights = (access: AccessContext, runId: string, kind: RunRightsKind, global: GlobalRunPolicy | undefined): void =>
-  assertRights(access, runRights(runId, kind, global));
+/** Ein Run gehört dem Zugang: ohne Anmeldung gibt es nur einen, runs.read.all sieht alle; ein Koordinator gehört nur seinem Benutzer. */
+export const runOwned = (access: AccessContext, runId: string, policy: RunAccessPolicy): boolean =>
+  policy.global?.isCoordinator(runId)
+    ? runId === coordinatorRunIdOf(access, policy.global)
+    : !access.enabled || access.can(RUNS_READ_ALL) || policy.ownerOf(runId) === access.user?.id;
+
+/** Erreichbar ist zusätzlich eine Kennung ohne Run: sie gehört erst dem, der den Run unter ihr anlegt; eine Koordinatorkennung nie einem anderen. */
+export const runReachable = (access: AccessContext, runId: string, policy: RunAccessPolicy): boolean =>
+  runOwned(access, runId, policy) || (!policy.global?.isCoordinator(runId) && policy.ownerOf(runId) === undefined);
+
+/** Bedienen heißt schreiben, starten und antworten; einen Run, den nur sein Eigentümer bedient, bedient auch runs.read.all nicht. */
+export const runOperable = (access: AccessContext, runId: string, policy: RunAccessPolicy): boolean =>
+  !access.enabled || !policy.ownerOnly(runId) || policy.ownerOf(runId) === access.user?.id;
+
+/** Der Arbeitsbereich eines Runs, den nur sein Eigentümer bedient, liegt bei ihm; auch lesend erreicht ihn nur er, das Journal lesen weiter alle, die den Run sehen. */
+export const runWorkspaceAccessible = (access: AccessContext, runId: string, policy: RunAccessPolicy): boolean =>
+  runOperable(access, runId, policy);
+
+/** Die Run-Liste eines Zugangs: sichtbar, was ihm gehört, erreichbar nur der Arbeitsbereich, den er auch lesen darf. */
+export const runListScope = (access: AccessContext, policy: RunAccessPolicy): RunListScope => ({
+  visible: (runId) => runOwned(access, runId, policy),
+  workspaceAccessible: (runId) => runWorkspaceAccessible(access, runId, policy),
+});
+
+export const assertRunWorkspaceAccess = (access: AccessContext, runId: string, policy: RunAccessPolicy): void => {
+  if (!runWorkspaceAccessible(access, runId, policy)) {
+    throw new DomainError(
+      "run-workspace-owner-only",
+      `Den Arbeitsbereich des Runs ${runId} sieht nur sein Eigentümer; Journal lesen und den Run stoppen darfst du.`,
+      403,
+    );
+  }
+};
+
+/** Auslieferungsadressen nennen ihren Run als eigenen Pfadabschnitt: /files/runs/<id>/..., /api/plugins/<plugin>/runs/<id>/... */
+export const runIdInPath = (pathname: string): string | undefined =>
+  /(?:^|\/)runs\/([A-Za-z0-9_-]{1,64})(?:\/|$)/.exec(pathname)?.[1];
+
+/** Ein fremder Run verhält sich wie ein nicht vorhandener: gleicher Code, gleiche Meldung, gleicher Status. */
+export const assertRunReachable = (access: AccessContext, runId: string, policy: RunAccessPolicy): void => {
+  if (!runReachable(access, runId, policy)) throw new DomainError("run-not-found", `Run ${runId} does not exist.`, 404);
+};
+
+/** Wer den Run sehen darf, erfährt auch, warum er ihn nicht bedienen darf. */
+export const assertRunOperable = (access: AccessContext, runId: string, policy: RunAccessPolicy): void => {
+  if (!runOperable(access, runId, policy)) {
+    throw new DomainError("run-owner-only", `Den Run ${runId} bedient nur sein Eigentümer; lesen und stoppen darfst du ihn.`, 403);
+  }
+};
+
+/** Die Prüfung der Nachrichtenschicht: jeder Beitrag mit runId muss den Run erreichen, einer mit runs.write ihn auch bedienen. */
+export const assertRunAccess = (access: AccessContext, runId: string, operates: boolean, policy: RunAccessPolicy): void => {
+  assertRunReachable(access, runId, policy);
+  if (operates) assertRunOperable(access, runId, policy);
+};
+
+export const assertRunRights = (access: AccessContext, runId: string, kind: RunRightsKind, policy: RunAccessPolicy): void => {
+  assertRights(access, runRights(runId, kind, policy.global));
+  assertRunReachable(access, runId, policy);
+  if (kind === "write" || kind === "write-inspect") assertRunOperable(access, runId, policy);
+};

package/apps/server/src/chat-context.ts

@@ -1,5 +1,5 @@
 export interface ChatUserLocation {
-  surface: "home" | "overview" | "run";
+  page: "home" | "overview" | "run";
   runId: string | null;
   tab: string | null;
   selection: { type: string; id: string } | null;