@schlenkr/ragents 0.1.5 → 0.1.6

package/apps/server/src/server.ts

@@ -1,28 +1,36 @@
-import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { timingSafeEqual } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { ACCESS_TOKEN_QUERY, createAccessContext } from "@aicontainer/ragents";
+import { ACCESS_TOKEN_QUERY, createAccessContext } from "@ragents/engine";
 import { coreChannels, coreMethods } from "./api/core-methods.js";
 import { attachmentContentRoute } from "./api/delivery.js";
+import { assertRunAccess } from "./api/rights.js";
 import { RpcDispatcher } from "./rpc/dispatcher.js";
-import { isRpcPath, RpcHttpTransport } from "./rpc/http-transport.js";
+import { RpcHttpTransport } from "./rpc/http-transport.js";
 import { startStdioTransport } from "./rpc/stdio-transport.js";
 import { config, HOST_SECRET_ENV_NAMES, hostConfigKeys } from "./config.js";
-import { configuredAnonymousUser, configuredUsers, validateConfigFileSections } from "./config-file.js";
+import { configuredAnonymousUser, configuredDefaultStartEntry, configuredUsers, validateConfigFileSections } from "./config-file.js";
 import { createAccessSessionManager, isSameOriginRequest } from "./access-session.js";
-import { isAccessServiceRequest, profileAccessCookieName } from "./access-service.js";
-import { globalChatToken } from "./ragents/global-chat.js";
+import { coordinatorRequestUser, profileAccessCookieName } from "./access-service.js";
+import { globalChatToken, globalRunPolicyOf } from "./ragents/global-chat.js";
 import { PayloadTooLargeError, readBody } from "./plugin-support/http.js";
 import { workspaceRuntimeToken } from "./ragents/workspace-runtime.js";
 import { externalAccessOpen, externalGate, isLocalRequest, loadExternalAccess, setExternalAccess } from "./external-access.js";
-import { loadPlugins } from "./profile/plugin-discovery.js";
+import { loadPlugins, resolvePluginEntries, staleBuiltInBundles } from "./profile/plugin-discovery.js";
 import { composeProfile, type ProfileComposition } from "./profile/compose.js";
 import { Protocol, teeConsole } from "./protocol.js";
 import { RunSessionProvider } from "./provider.js";
 import { readHelpResponse } from "./help-files.js";
+import { watchParentProcess } from "./parent-watch.js";
+import { hostRoot } from "./host-version.js";
+import { hostWebProblem, isCheckout } from "./host-web.js";
+import { createStylesheet, STYLESHEET_PATH } from "./web-stylesheet.js";
+import { isBundleSourceMap, isPublicBundleFile, isWebBundlePath, webBundleFile } from "./web-bundles.js";
 
 const stdioMode = process.env.RAGENTS_STDIO === "1";
+// scripts/start.sh --dev: das Web kommt vom Vite-Dev-Server, die Bundles hält ein Watch aktuell.
+const devMode = process.env.RAGENTS_DEV === "1";
 const announce = process.env.RAGENTS_ANNOUNCE === "1";
 const withoutHttp = process.env.RAGENTS_NO_HTTP === "1";
 // Im stdio-Modus gehört stdout dem Protokoll; alles andere geht nach stderr.
@@ -82,13 +90,14 @@ const accessGate = async (
   res: ServerResponse,
   url: URL,
   isPluginApiPath: (pathname: string) => boolean,
+  isPublicFile: (pathname: string) => boolean,
   productTitle: string,
   cookieName: string,
 ): Promise<boolean> => {
   const token = process.env.ACCESS_TOKEN;
   if (!token) return false;
-  // Das gebaute Web ist frei, jede Datenroute verlangt den Token; so laden iframes ohne Cookie ihre Skripte.
-  if (url.pathname === "/health" || url.pathname.startsWith("/assets/")) return false;
+  // Das gebaute Web, die ausgelieferten Dateien der Web-Hälften und das Stylesheet sind frei, jede Datenroute verlangt den Token; so laden iframes ohne Cookie ihre Skripte.
+  if (url.pathname === "/health" || url.pathname.startsWith("/assets/") || isPublicFile(url.pathname) || url.pathname === STYLESHEET_PATH) return false;
 
   const auth = req.headers.authorization;
   if (auth?.startsWith("Bearer ") && tokenGleich(auth.slice(7), token)) return false;
@@ -143,14 +152,43 @@ const contentTypes: Record<string, string> = {
 
 if (config.plugins.length === 0)
   throw new Error(`Das Profil ${config.productProfile} nennt keine Plugins: PLUGINS fehlt in ragents.config.${config.productProfile}.ts`);
+const root = hostRoot();
+const checkout = isCheckout(root);
+const rebuild = (command: string): string => checkout ? `im Checkout mit ${command} neu bauen` : "das Paket ist unvollständig; neu installieren";
+if (!devMode) {
+  const problem = hostWebProblem(config.webDistDir, root, checkout);
+  if (problem) throw new Error(`${problem}; ${rebuild("pnpm build:web")}`);
+  const stale = checkout ? staleBuiltInBundles(resolvePluginEntries(config.plugins)) : [];
+  if (stale.length > 0) throw new Error(`Eingebaute Bundles passen nicht mehr zu ihren Quellen unter plugins/: ${stale.join(", ")}; ${rebuild("pnpm build:plugins")}`);
+}
 const loaded = await loadPlugins(config.plugins);
+const stylesheet = await createStylesheet({ root, bundles: loaded.bundles, dev: devMode });
+const bundleFolders: ReadonlyMap<string, string> = new Map(loaded.bundles.map((plugin) => [plugin.id, plugin.folder]));
+const defaultStartEntry = configuredDefaultStartEntry();
 const composition: ProfileComposition = {
   product: { id: config.productId, title: config.productTitle },
   pluginIds: loaded.ids,
   modules: loaded.modules,
+  web: loaded.web,
+  ...(defaultStartEntry !== undefined ? { defaultStartEntry } : {}),
 };
 
-const provider = new RunSessionProvider((bridges) => composeProfile(composition, bridges));
+/** Bindet den Port und nennt den tatsächlich gebundenen; ein belegter Port bricht den Start ab. */
+const listenOn = (target: Server, port: number, host: string | undefined): Promise<number> => new Promise((resolve, reject) => {
+  target.once("error", reject);
+  target.listen(port, host, () => {
+    target.off("error", reject);
+    const address = target.address();
+    if (!address || typeof address === "string") reject(new Error(`Der Server lauscht nicht auf einem TCP-Port: ${String(address)}`));
+    else resolve(address.port);
+  });
+});
+
+// Der Port steht vor dem Aufbau fest, damit jede Adresse ab dem Start stimmt; Anfragen warten, bis der Server fertig ist.
+const opened = Promise.withResolvers<void>();
+const server = createServer((req, res) => { void opened.promise.then(() => handleRequest(req, res)); });
+const port = withoutHttp ? undefined : await listenOn(server, config.port, announce ? "127.0.0.1" : undefined);
+const provider = new RunSessionProvider((bridges) => composeProfile(composition, bridges), port === undefined ? undefined : `http://127.0.0.1:${port}`);
 validateConfigFileSections({
   hostKeys: hostConfigKeys,
   knownPluginIds: loaded.known,
@@ -166,8 +204,7 @@ const accessSessions = createAccessSessionManager({
   anonymousUser: configuredAnonymousUser(),
   cookieName: profileAccessCookieName(product.id, config.productProfile),
 });
-const globalChat = provider.plugins.optionalService(globalChatToken);
-const globalAccess = globalChat?.access ? { runId: globalChat.runId, ...globalChat.access } : undefined;
+const globalAccess = globalRunPolicyOf(provider.plugins.optionalService(globalChatToken));
 await loadExternalAccess();
 await provider.init();
 const workspaceMode = provider.plugins.service(workspaceRuntimeToken).describe().mode;
@@ -177,13 +214,24 @@ provider.plugins.methods.register("host", [
     sessions: provider,
     plugins: provider.plugins,
     global: globalAccess,
+    runOwner: (runId) => provider.runOwner(runId),
+    runOwnerOnly: (runId) => provider.runOwnerOnly(runId),
     settingsGuarded: () => !process.env.ACCESS_TOKEN && !accessSessions.enabled,
     external: { open: externalAccessOpen, set: setExternalAccess },
   }),
 ]);
-provider.plugins.channels.register("host", coreChannels({ sessions: provider, global: globalAccess }));
-provider.plugins.http.register("host", [provider.engineArtifactRoute(), attachmentContentRoute(provider, globalAccess)]);
-const dispatcher = new RpcDispatcher({ methods: provider.plugins.methods, channels: provider.plugins.channels });
+provider.plugins.channels.register("host", coreChannels({
+  sessions: provider,
+  global: globalAccess,
+  runOwner: (runId) => provider.runOwner(runId),
+  runOwnerOnly: (runId) => provider.runOwnerOnly(runId),
+}));
+provider.plugins.http.register("host", [provider.engineArtifactRoute(), attachmentContentRoute(provider, provider.runAccess())]);
+const dispatcher = new RpcDispatcher({
+  methods: provider.plugins.methods,
+  channels: provider.plugins.channels,
+  assertRunReachable: (access, runId, operates) => assertRunAccess(access, runId, operates, provider.runAccess()),
+});
 const rpc = new RpcHttpTransport({ dispatcher });
 
 const jsonResponse = (res: ServerResponse, status: number, body: unknown): void => {
@@ -196,23 +244,23 @@ const isLoopbackRequest = (req: IncomingMessage): boolean => {
   return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
 };
 
-const server = createServer(async (req, res) => {
+async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> {
   const url = new URL(req.url ?? "/", "http://localhost");
   const startedAt = Date.now();
   res.once("close", () =>
     console.log(`${req.method} ${url.pathname} -> ${res.statusCode} (${Date.now() - startedAt} ms)`));
   if (externalGate(req, res)) return;
 
-  const serviceRequest = (accessSessions.enabled || configuredAnonymousUser() !== undefined) && isAccessServiceRequest(req, url);
+  const coordinator = accessSessions.enabled || configuredAnonymousUser() !== undefined ? coordinatorRequestUser(req, url) : undefined;
+  const serviceRequest = coordinator !== undefined;
   if (!serviceRequest && !accessSessions.enabled && await accessGate(
     req, res, url, (pathname) => pathname.startsWith("/api/") || provider.isPluginApiPath(pathname),
-    productTitle, accessCookieName,
+    (pathname) => isPublicBundleFile(bundleFolders, pathname), productTitle, accessCookieName,
   )) return;
   if (await accessSessions.handle(req, res, url)) return;
-  const access = createAccessContext(serviceRequest
-    ? { enabled: true, user: { id: "host-service", label: "Host", rights: ["runs.read", "runs.write", "runs.create", "runs.inspect"] } }
-    : accessSessions.snapshot(req));
-  const protectedPath = /^\/(?:api|rpc|files)(?:\/|$)/.test(url.pathname) || provider.isPluginApiPath(url.pathname);
+  const access = createAccessContext(coordinator ? accessSessions.coordinatorSnapshot(coordinator.userId) : accessSessions.snapshot(req));
+  const protectedPath = /^\/(?:api|rpc|files)(?:\/|$)/.test(url.pathname) || provider.isPluginApiPath(url.pathname)
+    || isBundleSourceMap(bundleFolders, url.pathname);
   if (protectedPath && access.enabled && !access.user) {
     jsonResponse(res, 401, { error: "Bitte melde dich an.", code: "login-required" });
     return;
@@ -224,11 +272,37 @@ const server = createServer(async (req, res) => {
   }
   if (protectedPath && !serviceRequest) accessSessions.track(req, res);
 
+  if (isWebBundlePath(bundleFolders, url.pathname)) {
+    const file = await webBundleFile(bundleFolders, url.pathname, req.headers["if-none-match"]);
+    res.writeHead(file.status, file.headers);
+    res.end(req.method === "HEAD" ? undefined : file.body);
+    return;
+  }
   if (await rpc.handle(req, res, url, access, isLoopbackRequest(req) && isLocalRequest(req))) return;
   if (await provider.pluginRoutes(req, res, url, access)) return;
   if (url.pathname === "/health") {
     res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ ok: true, external: externalAccessOpen() }));
+    res.end(JSON.stringify({ ok: true, external: externalAccessOpen(), pid: process.pid }));
+    return;
+  }
+
+  if (url.pathname === STYLESHEET_PATH) {
+    // Ein Bundle kann gerade neu entstehen; das kostet diesen Abruf, nicht den Server.
+    const built = await stylesheet().catch((error: unknown) => error instanceof Error ? error : new Error(String(error)));
+    if (built instanceof Error) {
+      res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end(built.message);
+      return;
+    }
+    const { css, etag } = built;
+    const caching = { "Cache-Control": "no-cache", ETag: etag };
+    if (req.headers["if-none-match"] === etag) {
+      res.writeHead(304, caching);
+      res.end();
+      return;
+    }
+    res.writeHead(200, { ...caching, "Content-Type": "text/css; charset=utf-8" });
+    res.end(req.method === "HEAD" ? undefined : css);
     return;
   }
 
@@ -256,17 +330,14 @@ const server = createServer(async (req, res) => {
   }
   res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
   res.end("Nicht gefunden");
-});
+}
 
-if (!withoutHttp) {
-  server.listen(config.port, announce ? "127.0.0.1" : undefined, () => {
-    const address = server.address();
-    const port = address && typeof address !== "string" ? address.port : config.port;
-    console.log(`${productTitle}-Server: http://localhost:${port} (Workspace-Modus: ${workspaceMode}, Daten: ${config.dataDir})`);
-    if (announce) {
-      process.stdout.write(`${JSON.stringify({ ragents: { url: `http://127.0.0.1:${port}`, token: process.env.ACCESS_TOKEN ?? null, pid: process.pid } })}\n`);
-    }
-  });
+opened.resolve();
+if (port !== undefined) {
+  console.log(`${productTitle}-Server: http://localhost:${port} (Workspace-Modus: ${workspaceMode}, Daten: ${config.dataDir})`);
+  if (announce) {
+    process.stdout.write(`${JSON.stringify({ ragents: { url: `http://127.0.0.1:${port}`, token: process.env.ACCESS_TOKEN ?? null, pid: process.pid } })}\n`);
+  }
 }
 if (stdioMode) {
   const stdio = startStdioTransport({ dispatcher, input: process.stdin, output: process.stdout });
@@ -308,5 +379,13 @@ const shutdownInner = async (): Promise<void> => {
 process.on("SIGINT", shutdown);
 process.on("SIGTERM", shutdown);
 process.on("SIGHUP", shutdown);
+// Ein Aufrufer wie die VS-Code-Erweiterung nennt sich in RAGENTS_PARENT_PID; verschwindet er, endet der Host wie bei SIGTERM.
+watchParentProcess({
+  parentPid: process.env.RAGENTS_PARENT_PID,
+  onGone: (pid) => {
+    console.error(`Der aufrufende Prozess ${pid} lebt nicht mehr; der Host fährt herunter.`);
+    shutdown();
+  },
+});
 // Absturz und Shutdown-Zeitüberschreitung enden in process.exit: das Lock geht trotzdem zurück.
 process.on("exit", () => provider.closeJournal());

package/apps/server/src/settings.ts

@@ -10,12 +10,12 @@ import {
   type CatalogModel,
   type PluginHost,
   type ProductDescriptor,
-  type PublicAgentExtensionContribution,
+  type PublicAgentHookContribution,
   type PublicPluginManifest,
   type PublicPromptContribution,
   type PublicSkillContribution,
   type PublicToolDescriptor,
-} from "@aicontainer/ragents";
+} from "@ragents/engine";
 import { config } from "./config.js";
 import { configFilePath } from "./config-file.js";
 import type { Engine, RuntimeContract } from "./ragents/engine.js";
@@ -45,7 +45,7 @@ export interface SettingsSystemPrompt {
   runtimeContracts: readonly RuntimeContract[];
 }
 
-export interface InternalAgentExtensionContribution {
+export interface InternalAgentHookContribution {
   id: string;
   owner: string;
   kind: "internal";
@@ -80,7 +80,7 @@ export interface SettingsResponse {
   systemPrompt: SettingsSystemPrompt;
   promptContributions: readonly PublicPromptContribution[];
   plugins: readonly PublicPluginManifest[];
-  agentExtensions: readonly (PublicAgentExtensionContribution | InternalAgentExtensionContribution)[];
+  agentHooks: readonly (PublicAgentHookContribution | InternalAgentHookContribution)[];
   skills: readonly PublicSkillContribution[];
   tools: readonly PublicToolDescriptor[];
 }
@@ -103,10 +103,10 @@ const runtimeSettings = (plugins: PluginHost): SettingsRuntime => {
   };
 };
 
-const internalAgentExtensions: readonly InternalAgentExtensionContribution[] = [
+const internalAgentHooks: readonly InternalAgentHookContribution[] = [
   turnDispatcherExtensionName,
   skillPreloadExtensionName,
-].map((name): InternalAgentExtensionContribution => ({
+].map((name): InternalAgentHookContribution => ({
   id: name,
   owner: runtimeOwner,
   kind: "internal",
@@ -124,7 +124,6 @@ const toolsSettings = (plugins: PluginHost): readonly PublicToolDescriptor[] =>
       ...tool,
     })),
     ...plugins.tools.describe(),
-    ...plugins.agentRuntime.describeTools(),
   ];
   const names = new Set<string>();
   for (const tool of tools) {
@@ -203,7 +202,7 @@ export const settingsResponse = async (
   },
   promptContributions: engine.promptContributions,
   plugins: plugins.publicManifests(),
-  agentExtensions: [...plugins.agentRuntime.describe(), ...internalAgentExtensions],
+  agentHooks: [...plugins.agentRuntime.describe(), ...internalAgentHooks],
   skills: await plugins.skills.describe(undefined),
   tools: toolsSettings(plugins),
 });

package/apps/server/src/title-compactor.ts

@@ -1,13 +1,13 @@
 import path from "node:path";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { ModelRuntime } from "@aicontainer/agent";
+import type { ModelRuntime } from "@ragents/agent";
 import type { TitleModelSelection } from "./title-settings-contract.js";
 
 const MAX_PROMPT_CHARS = 4_000;
 const MAX_TITLE_CHARS = 80;
 
 const instruction =
-  "Du fasst den ersten Auftrag einer Unterhaltung als Listentitel zusammen. "
+  "Du fasst den ersten Auftrag eines Runs als Listentitel zusammen. "
   + "Antworte NUR mit einer Titelzeile: drei bis acht Wörter, höchstens 80 Zeichen, in der Sprache des Auftrags. "
   + "Nenne die konkrete Aufgabe, keine Einleitung, keine Anführungszeichen, kein Satzzeichen am Ende. "
   + "Verwende die Begriffe des Auftrags und erhalte seine unterscheidenden Fachbegriffe. "
@@ -21,9 +21,9 @@ export interface TitleCompactor {
 
 export interface TitleCompactorOptions {
   selection: () => TitleModelSelection | null;
-  agentHomeDir: string;
   sessionsDir: string;
-  modelRuntime?: () => Promise<ModelRuntime>;
+  /** The model runtime of the server, with the providers of the profile. */
+  modelRuntime: () => Promise<ModelRuntime>;
   onError?: (error: unknown) => void;
   onTitle?: (runId: string, title: string) => void;
 }
@@ -44,10 +44,7 @@ export const createTitleCompactor = (options: TitleCompactorOptions): TitleCompa
   let stopped = false;
   let runtime: Promise<ModelRuntime> | undefined;
 
-  const modelRuntime = () => runtime ??= options.modelRuntime?.() ?? ModelRuntime.create({
-    authPath: path.join(options.agentHomeDir, "auth.json"),
-    modelsPath: path.join(options.agentHomeDir, "models.json"),
-  });
+  const modelRuntime = () => runtime ??= options.modelRuntime();
 
   const titleFile = (runId: string) => path.join(options.sessionsDir, runId, "title.json");
 

package/apps/server/src/title-settings.ts

@@ -1,8 +1,8 @@
 import { readFile, mkdir, writeFile, rename } from "node:fs/promises";
 import path from "node:path";
-import type { ModelRuntime } from "@aicontainer/agent";
-import { getSupportedThinkingLevels } from "@aicontainer/ai";
-import { DomainError } from "@aicontainer/ragents";
+import type { ModelRuntime } from "@ragents/agent";
+import { getSupportedThinkingLevels } from "@ragents/ai";
+import { DomainError } from "@ragents/engine";
 import type { TitleModelSelection, TitleModelSettings } from "./title-settings-contract.js";
 
 const preferred = ["google/gemma-4-26b-a4b-it", "qwen/qwen3.8-flash", "openai/gpt-5.4-nano"];

package/apps/server/src/web-bundles.ts

@@ -0,0 +1,79 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+const WEB_BUNDLE_FILE = /^\/plugins\/([^/]+)\/web\/(.+)$/;
+
+/** An address in the web folder of a profile bundle; the host serves it before any plugin route, so no route can take its place. */
+export const isWebBundlePath = (folders: ReadonlyMap<string, string>, pathname: string): boolean => {
+  const match = WEB_BUNDLE_FILE.exec(pathname);
+  return match !== null && folders.has(match[1]!);
+};
+
+/** Source maps carry the plugin sources and stay behind access; everything else of a web half loads without token, as in an iframe without cookie. */
+export const isBundleSourceMap = (folders: ReadonlyMap<string, string>, pathname: string): boolean =>
+  isWebBundlePath(folders, pathname) && pathname.endsWith(".map");
+
+export const isPublicBundleFile = (folders: ReadonlyMap<string, string>, pathname: string): boolean =>
+  isWebBundlePath(folders, pathname) && !pathname.endsWith(".map");
+
+const CONTENT_TYPES: Readonly<Record<string, string>> = {
+  ".js": "text/javascript",
+  ".css": "text/css",
+  ".map": "application/json",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+};
+
+export interface WebFileResponse {
+  readonly status: 200 | 304 | 404;
+  readonly headers: Readonly<Record<string, string>>;
+  readonly body?: Buffer;
+}
+
+/** A content hash as ETag; the browser revalidates every file, because entry and exports keep their names across builds. */
+export const etagOf = (content: Buffer | string): string => `"${createHash("sha256").update(content).digest("base64url").slice(0, 22)}"`;
+
+const notFound: WebFileResponse = { status: 404, headers: { "Content-Type": "text/plain; charset=utf-8" }, body: Buffer.from("Nicht gefunden") };
+
+const relativeFile = (encoded: string): string | undefined => {
+  try {
+    return decodeURIComponent(encoded);
+  } catch {
+    return undefined;
+  }
+};
+
+/** Serves only the web folder of the profile's bundles; server code and assets of a bundle never leave the host. */
+export const webBundleFile = async (
+  folders: ReadonlyMap<string, string>,
+  pathname: string,
+  ifNoneMatch: string | undefined,
+): Promise<WebFileResponse> => {
+  const match = WEB_BUNDLE_FILE.exec(pathname);
+  const folder = match ? folders.get(match[1]!) : undefined;
+  const relative = match ? relativeFile(match[2]!) : undefined;
+  if (!folder || relative === undefined) return notFound;
+  const webFolder = path.join(folder, "web");
+  const file = path.resolve(webFolder, relative);
+  if (!file.startsWith(webFolder + path.sep)) return notFound;
+  const content = await readFile(file).catch(() => undefined);
+  if (!content) return notFound;
+  const etag = etagOf(content);
+  // Chunks und Assets tragen ihren Hash im Namen und ändern sich nie; Einstieg und Exporte behalten ihren Namen über jeden Bau.
+  const hashed = /^(chunks|assets)\//.test(path.relative(webFolder, file).split(path.sep).join("/"));
+  const caching = { "Cache-Control": hashed ? "public, max-age=31536000, immutable" : "no-cache", ETag: etag };
+  if (ifNoneMatch === etag) return { status: 304, headers: caching };
+  return { status: 200, headers: { ...caching, "Content-Type": CONTENT_TYPES[path.extname(file)] ?? "application/octet-stream" }, body: content };
+};

package/apps/server/src/web-stylesheet.ts

@@ -0,0 +1,85 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { compile, optimize } from "@tailwindcss/node";
+import { Scanner } from "@tailwindcss/oxide";
+import { rebuildHint } from "./profile/bundle-manifest.js";
+import type { ResolvedPlugin } from "./profile/plugin-discovery.js";
+import { etagOf } from "./web-bundles.js";
+
+/** The one stylesheet the web links as /ragents.css: theme, base and every utility the host and the web bundles use. */
+export const STYLESHEET_PATH = "/ragents.css";
+
+export interface Stylesheet {
+  readonly css: string;
+  readonly etag: string;
+}
+
+const stylesheetEntry = (root: string): string => path.join(root, "apps/web/src/ui/tailwind.css");
+
+/** The Tailwind candidates of the host web, found in its sources. */
+export const hostWebClasses = (root: string): readonly string[] =>
+  new Scanner({ sources: [{ base: path.join(root, "apps/web/src"), pattern: "**/*", negated: false }] }).scan();
+
+const classListFile = (plugin: ResolvedPlugin): string | undefined =>
+  plugin.manifest.web === undefined ? undefined : path.join(plugin.folder, plugin.manifest.web.classes);
+
+const readClassList = async (plugin: ResolvedPlugin, file: string): Promise<string> =>
+  readFile(file, "utf8").catch((cause: unknown) => {
+    throw new Error(`Das Bundle ${plugin.id} hat keine lesbare Klassenliste ${file}; ${rebuildHint(plugin.folder)}`, { cause });
+  });
+
+const parsedClasses = (plugin: ResolvedPlugin, file: string, text: string): readonly string[] => {
+  const classes = JSON.parse(text) as unknown;
+  if (!Array.isArray(classes) || classes.some((entry) => typeof entry !== "string")) {
+    throw new Error(`Die Klassenliste ${file} des Bundles ${plugin.id} ist keine Liste von Texten; ${rebuildHint(plugin.folder)}`);
+  }
+  return classes as readonly string[];
+};
+
+/** Compiles the host's Tailwind entry for the given candidates; the order of the utilities stays Tailwind's. */
+export const compileStylesheet = async (root: string, candidates: readonly string[], minify: boolean): Promise<Stylesheet> => {
+  const entry = stylesheetEntry(root);
+  const compiler = await compile(await readFile(entry, "utf8"), { base: path.dirname(entry), onDependency: () => {} });
+  const built = compiler.build([...new Set(candidates)]);
+  const css = minify ? optimize(built, { minify: true }).code : built;
+  return { css, etag: etagOf(css) };
+};
+
+export interface StylesheetSource {
+  readonly root: string;
+  readonly bundles: readonly ResolvedPlugin[];
+  /** Dev mode compiles anew for every request, so that new classes in host code appear without a restart. */
+  readonly dev: boolean;
+}
+
+interface ClassLists {
+  /** The raw text of every class list, so that a rebuilt bundle shows as a change. */
+  readonly texts: string;
+  readonly candidates: readonly string[];
+}
+
+const readClassLists = async (bundles: readonly ResolvedPlugin[]): Promise<ClassLists> => {
+  const lists = await Promise.all(bundles.map(async (plugin) => {
+    const file = classListFile(plugin);
+    if (file === undefined) return { text: "", classes: [] as readonly string[] };
+    const text = await readClassList(plugin, file);
+    return { text, classes: parsedClasses(plugin, file, text) };
+  }));
+  return { texts: lists.map((list) => list.text).join("\0"), candidates: lists.flatMap((list) => list.classes) };
+};
+
+/** Compiles the stylesheet at start and again whenever a bundle's class list changed, so that a rebuilt web half needs only a reload; dev mode also rescans the host sources. */
+export const createStylesheet = async (source: StylesheetSource): Promise<() => Promise<Stylesheet>> => {
+  const hostClasses = hostWebClasses(source.root);
+  const compileFrom = (lists: ClassLists): Promise<Stylesheet> =>
+    compileStylesheet(source.root, [...(source.dev ? hostWebClasses(source.root) : hostClasses), ...lists.candidates], !source.dev);
+  const initial = await readClassLists(source.bundles);
+  let current = { texts: initial.texts, stylesheet: await compileFrom(initial) };
+  return async () => {
+    const lists = await readClassLists(source.bundles);
+    if (!source.dev && lists.texts === current.texts) return current.stylesheet;
+    const stylesheet = await compileFrom(lists);
+    if (!source.dev) current = { texts: lists.texts, stylesheet };
+    return stylesheet;
+  };
+};

package/apps/server/tsconfig.json

@@ -15,17 +15,17 @@
       "ES2024"
     ],
     "paths": {
-      "@aicontainer/server/*": [
+      "@ragents/host/*": [
         "../../apps/server/src/*"
       ],
-      "@aicontainer/web/*": [
+      "@ragents/web/*": [
         "../../apps/web/src/*"
       ],
-      "@aicontainer/plugins/*": [
+      "@ragents/plugins/*": [
         "../../plugins/*"
       ],
       "@ragents/workflow": [
-        "../../plugins/ragents.actor-programs/workflow/index.ts"
+        "../../apps/server/src/plugin-support/actor-programs/workflow/index.ts"
       ]
     }
   },

package/apps/server/tsconfig.plugin.json

@@ -0,0 +1,58 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "typeRoots": [
+      "./node_modules/@types",
+      "../../node_modules/@types"
+    ],
+    "paths": {
+      "@ragents/host/*": [
+        "./src/*"
+      ],
+      "@ragents/web/ui": [
+        "../web/src/ui/index.ts"
+      ],
+      "@ragents/web/*": [
+        "../web/src/*"
+      ],
+      "@ragents/plugins/*": [
+        "../../plugins/*"
+      ],
+      "@ragents/engine": [
+        "../../packages/ragents/src/index.ts"
+      ],
+      "@ragents/engine/*": [
+        "../../packages/ragents/*"
+      ],
+      "@ragents/ai": [
+        "../../packages/ai/dist/index.d.ts"
+      ],
+      "@ragents/ai/providers/*": [
+        "../../packages/ai/dist/providers/*.d.ts"
+      ],
+      "@ragents/agent": [
+        "../../packages/agent/dist/index.d.ts"
+      ],
+      "@ragents/workspace-executor": [
+        "../../packages/workspace-executor/src/index.ts"
+      ],
+      "@ragents/workspace-executor/*": [
+        "../../packages/workspace-executor/*"
+      ],
+      "@ragents/workflow": [
+        "./src/plugin-support/actor-programs/workflow/index.ts"
+      ],
+      "typebox/*": [
+        "../../node_modules/typebox/build/*/index.d.mts"
+      ],
+      "*": [
+        "./node_modules/@types/*",
+        "../../node_modules/@types/*",
+        "./node_modules/*",
+        "../../node_modules/*",
+        "../web/node_modules/*"
+      ]
+    }
+  },
+  "include": []
+}

package/apps/web/dist/assets/highlighted-body-KPVGNVTW-B9qYBARS.js

@@ -0,0 +1 @@
+import{r,S as d,E as p,j as E,c as f}from"./mermaid-HWGCJPDP-CvYYFK_n.js";var j=({code:i,language:e,maxHeight:o,raw:a,className:u,startLine:m,lineNumbers:n,...h})=>{let{shikiTheme:l}=r.useContext(d),t=p(),[c,s]=r.useState(a);return r.useEffect(()=>{if(!t){s(a);return}let g=t.highlight({code:i,language:e,themes:l},x=>{s(x)});g&&s(g)},[i,e,l,t,a]),E.jsx(f,{className:u,language:e,lineNumbers:n,maxHeight:o,result:c,startLine:m,...h})};export{j as HighlightedCodeBlockBody};