@schlenkr/ragents 0.1.8 → 0.1.10

package/apps/server/src/plugin-support/model-aliases.ts

@@ -1,10 +1,10 @@
-import { aliasedModel, type ModelAlias as RuntimeModelAlias } from "@ragents/agent";
+import { aliasedModel, compactionProblem, type ModelAlias as RuntimeModelAlias } from "@ragents/agent";
 import { getSupportedThinkingLevels, type Api, type Model } from "@ragents/ai";
 import { getBuiltinModels, type BuiltinProvider } from "@ragents/ai/providers/all";
 import { isThinkingLevel, type ThinkingLevel } from "@ragents/engine";
 import { declaredEnvironment } from "./plugin-config.js";
 
-/** Ein Alias des Profils mit seinem Ziel und optional der Denktiefe, die gilt, solange niemand eine andere wählt. */
+/** Ein Alias des Profils mit Ziel und Kompaktierungswerten und optional der Denktiefe, die gilt, solange niemand eine andere wählt. */
 export interface ModelAlias extends RuntimeModelAlias {
   readonly thinking?: ThinkingLevel;
 }
@@ -17,47 +17,77 @@ export const modelAliasEnvDescriptors = [
 ] as const;
 
 const ALIAS = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const ENTRY_KEYS: readonly string[] = ["alias", "model", "thinking", "compaction"];
 
-/** MODEL_ALIASES: eine Liste "alias=anbieter/modell" oder "alias=anbieter/modell@denktiefe"; der Alias ist der einzige Name, den Oberfläche, Journal und Relay-Clients sehen. */
-export const parseModelAliases = (entries: readonly string[]): readonly ModelAlias[] => {
-  const aliases = entries.map((entry): ModelAlias => {
-    const separator = entry.indexOf("=");
-    const alias = separator > 0 ? entry.slice(0, separator).trim() : "";
-    const rest = separator > 0 ? entry.slice(separator + 1).trim() : "";
-    const at = rest.lastIndexOf("@");
-    const target = at < 0 ? rest : rest.slice(0, at);
-    const thinking = at < 0 ? undefined : rest.slice(at + 1);
-    const slash = target.indexOf("/");
-    if (!ALIAS.test(alias) || slash <= 0 || slash === target.length - 1) {
-      throw new Error(`MODEL_ALIASES: "${entry}" hat nicht das Format "alias=anbieter/modell" oder "alias=anbieter/modell@denktiefe"`);
-    }
-    if (thinking !== undefined && !isThinkingLevel(thinking)) throw new Error(`MODEL_ALIASES: "${entry}" nennt die unbekannte Denktiefe "${thinking}"`);
-    return { alias, upstream: target.slice(0, slash), model: target.slice(slash + 1), ...(thinking === undefined ? {} : { thinking }) };
-  });
+const aliasOf = (value: unknown, index: number): ModelAlias => {
+  const location = `MODEL_ALIASES[${index}]`;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${location} must be an object with alias, model, compaction and optionally thinking`);
+  }
+  const entry = value as Record<string, unknown>;
+  const unknown = Object.keys(entry).find((key) => !ENTRY_KEYS.includes(key));
+  if (unknown) throw new Error(`${location}.${unknown} is not supported; allowed are ${ENTRY_KEYS.join(", ")}`);
+  if (typeof entry.alias !== "string" || !ALIAS.test(entry.alias)) {
+    throw new Error(`${location}.alias needs 1 to 64 lowercase letters, digits, dots, underscores or hyphens`);
+  }
+  const target = typeof entry.model === "string" ? entry.model : "";
+  const slash = target.indexOf("/");
+  if (slash <= 0 || slash === target.length - 1) throw new Error(`${location}.model of ${entry.alias} needs the form "provider/model"`);
+  if (entry.thinking !== undefined && !isThinkingLevel(entry.thinking)) {
+    throw new Error(`${location}.thinking of ${entry.alias} names the unknown thinking level "${String(entry.thinking)}"`);
+  }
+  const problem = compactionProblem(entry.compaction);
+  if (problem) throw new Error(`${location}, ${entry.alias}: ${problem}`);
+  return {
+    alias: entry.alias,
+    upstream: target.slice(0, slash),
+    model: target.slice(slash + 1),
+    ...(entry.thinking === undefined ? {} : { thinking: entry.thinking }),
+    compaction: entry.compaction as ModelAlias["compaction"],
+  };
+};
+
+/** MODEL_ALIASES: eine Liste von { alias, model: "anbieter/modell", thinking?, compaction }; der Alias ist der einzige Name, den Oberfläche, Journal und Relay-Clients sehen. */
+export const parseModelAliases = (entries: unknown): readonly ModelAlias[] => {
+  if (!Array.isArray(entries)) throw new Error("MODEL_ALIASES must be a list of aliases");
+  const aliases = entries.map(aliasOf);
   const duplicate = aliases.find((entry, index) => aliases.findIndex((other) => other.alias === entry.alias) !== index);
-  if (duplicate) throw new Error(`MODEL_ALIASES nennt den Alias ${duplicate.alias} mehrfach`);
+  if (duplicate) throw new Error(`MODEL_ALIASES names the alias ${duplicate.alias} more than once`);
   return aliases;
 };
 
 const env = declaredEnvironment(modelAliasEnvDescriptors);
 
-export const configuredModelAliases = (): readonly ModelAlias[] => parseModelAliases(env.list("MODEL_ALIASES"));
+/** Die Aliasse des Profils; in der Umgebung steht MODEL_ALIASES als JSON der Liste aus der Profildatei. */
+export const configuredModelAliases = (): readonly ModelAlias[] => {
+  const value = env.optional("MODEL_ALIASES");
+  if (value === undefined || value === "") return [];
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("MODEL_ALIASES is no JSON list of aliases");
+  }
+  return parseModelAliases(parsed);
+};
 
 /** Der Katalog der Aliasse aus den eingebauten Katalogen ihrer Anbieter, so wie die Modelllaufzeit sie anbietet. */
 export const aliasCatalog = (aliases: readonly ModelAlias[] = configuredModelAliases()): readonly Model<Api>[] => {
-  if (aliases.length === 0) throw new Error(`Der Anbieter ${ALIAS_PROVIDER} braucht MODEL_ALIASES im Abschnitt host`);
+  if (aliases.length === 0) throw new Error(`The provider ${ALIAS_PROVIDER} needs MODEL_ALIASES in the host section`);
   return aliases.map((entry) => {
     const target = getBuiltinModels(entry.upstream as BuiltinProvider).find((model) => model.id === entry.model);
-    if (!target) throw new Error(`MODEL_ALIASES: das Modell ${entry.model} hinter ${entry.alias} fehlt im Katalog von ${entry.upstream}`);
+    if (!target) throw new Error(`MODEL_ALIASES: the model ${entry.model} behind ${entry.alias} is missing from the catalog of ${entry.upstream}`);
     const supported = getSupportedThinkingLevels(target);
     if (entry.thinking !== undefined && !supported.includes(entry.thinking)) {
-      throw new Error(`MODEL_ALIASES: die Denktiefe ${entry.thinking} gibt es für ${entry.alias} nicht (gültig: ${supported.join(", ")})`);
+      throw new Error(`MODEL_ALIASES: the thinking level ${entry.thinking} does not exist for ${entry.alias} (valid: ${supported.join(", ")})`);
     }
-    return aliasedModel(ALIAS_PROVIDER, entry.alias, target);
+    const problem = compactionProblem(entry.compaction, target);
+    if (problem) throw new Error(`MODEL_ALIASES: ${entry.alias} on ${entry.upstream}/${entry.model}: ${problem}`);
+    return aliasedModel(ALIAS_PROVIDER, entry, target);
   });
 };
 
-/** Die Aliasse des Profils, geprüft gegen die Kataloge ihrer Ziele samt Denktiefe. */
+/** Die Aliasse des Profils, geprüft gegen die Kataloge ihrer Ziele samt Denktiefe und Kompaktierungswerten. */
 export const validatedModelAliases = (): readonly ModelAlias[] => {
   const aliases = configuredModelAliases();
   if (aliases.length > 0) aliasCatalog(aliases);

package/apps/server/src/plugin-support/process-sandbox.ts

@@ -35,6 +35,8 @@ export interface ServerProcessSandboxOptions {
   /** Die Adresse dieses Servers, etwa http://127.0.0.1:4710; ohne HTTP keine. */
   readonly serverAddress: string | undefined;
   readonly dataDirectory: string;
+  /** Wie der Betreiber die Sandbox abschaltet, so wie er es in die Profildatei schreibt; jede Meldung, die den Start verhindert, nennt es. */
+  readonly disableSetting: string;
   readonly hostRoot?: string;
   readonly platform?: NodeJS.Platform;
   readonly environment?: NodeJS.ProcessEnv;
@@ -213,39 +215,38 @@ class SharedSandboxRuntime {
 
 const sharedRuntime = new SharedSandboxRuntime();
 
-const unsupported = (platform: NodeJS.Platform): Error => new Error(platform === "win32"
+const unsupported = (platform: NodeJS.Platform, disableSetting: string): Error => new Error(platform === "win32"
   ? "Die Prozess-Sandbox gibt es auf einem Windows-Server nicht: dort lassen sich die Ordnerregeln je Run nicht setzen. "
-    + "Wer den Server trotzdem unter Windows betreibt, schaltet sie in der Profildatei ausdrücklich ab: "
-    + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace."
+    + `Wer den Server trotzdem unter Windows betreibt, schaltet sie in der Profildatei ausdrücklich ab: ${disableSetting}.`
   : `Die Prozess-Sandbox kennt die Plattform ${platform} nicht; unterstützt sind macOS und Linux. `
-    + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+    + `${disableSetting} schaltet sie ausdrücklich ab.`);
 
-const missingDependencies = (errors: readonly string[]): Error => new Error(
+const missingDependencies = (errors: readonly string[], disableSetting: string): Error => new Error(
   `Die Prozess-Sandbox kann nicht starten: ${errors.join("; ")}. `
   + "Unter Linux braucht sie bubblewrap, socat und ripgrep (Debian/Ubuntu: apt-get install bubblewrap socat ripgrep). "
-  + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+  + `${disableSetting} schaltet sie ausdrücklich ab.`);
 
-const failedSelfTest = (detail: string): Error => new Error(
+const failedSelfTest = (detail: string, disableSetting: string): Error => new Error(
   `Die Prozess-Sandbox lässt sich auf diesem Rechner nicht starten: ${detail.trim() || "ohne Ausgabe"}. `
   + "Unter Linux braucht bubblewrap Benutzer-Namensräume; in einem Container muss das Profil des Containers sie erlauben. "
-  + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+  + `${disableSetting} schaltet sie ausdrücklich ab.`);
 
-const runSelfTest = (launch: ProcessLaunch, environment: NodeJS.ProcessEnv): Promise<void> => new Promise((resolve, reject) => {
+const runSelfTest = (launch: ProcessLaunch, environment: NodeJS.ProcessEnv, disableSetting: string): Promise<void> => new Promise((resolve, reject) => {
   const child = spawn(launch.command, [...launch.args], { stdio: ["ignore", "ignore", "pipe"], env: environment });
   let stderr = "";
   const timer = setTimeout(() => {
     child.kill("SIGKILL");
-    reject(failedSelfTest(`keine Antwort nach ${SELF_TEST_TIMEOUT_MS / 1000} Sekunden`));
+    reject(failedSelfTest(`keine Antwort nach ${SELF_TEST_TIMEOUT_MS / 1000} Sekunden`, disableSetting));
   }, SELF_TEST_TIMEOUT_MS);
   child.stderr.on("data", (chunk: Buffer) => { stderr = (stderr + chunk.toString("utf8")).slice(-2_000); });
   child.once("error", (error) => {
     clearTimeout(timer);
-    reject(failedSelfTest(error.message));
+    reject(failedSelfTest(error.message, disableSetting));
   });
   child.once("close", (code) => {
     clearTimeout(timer);
     if (code === 0) resolve();
-    else reject(failedSelfTest(`Code ${code ?? "Signal"}: ${stderr}`));
+    else reject(failedSelfTest(`Code ${code ?? "Signal"}: ${stderr}`, disableSetting));
   });
 });
 
@@ -260,7 +261,7 @@ export class ServerProcessSandbox implements RunProcessSandboxes {
   constructor(options: ServerProcessSandboxOptions) {
     this.#options = options;
     this.#platform = options.platform ?? process.platform;
-    if (this.#platform !== "darwin" && this.#platform !== "linux") throw unsupported(this.#platform);
+    if (this.#platform !== "darwin" && this.#platform !== "linux") throw unsupported(this.#platform, options.disableSetting);
     this.#protected = protectedRoots(options, this.#platform);
     this.#readable = [options.hostRoot ?? hostRoot(), ...toolchainDirectories(options, this.#protected)];
     this.#searchPath = resolvedSearchPath(options.environment ?? process.env);
@@ -269,14 +270,14 @@ export class ServerProcessSandbox implements RunProcessSandboxes {
   /** Prüft die Voraussetzungen, startet den Netz-Proxy und startet einmal einen Prozess in der Sandbox; jedes Scheitern ist ein Startfehler. */
   async start(): Promise<void> {
     const { errors } = SandboxManager.checkDependencies();
-    if (errors.length > 0) throw missingDependencies(errors);
+    if (errors.length > 0) throw missingDependencies(errors, this.#options.disableSetting);
     await sharedRuntime.acquire(this, {
       network: [...this.#options.network, ...serverTarget(this.#options.serverAddress)],
       unixSockets: socketRoots(this.#options.dataDirectory, this.#platform),
     });
     try {
       const probe = this.forRun({ writable: [], readable: [], temporary: path.join(this.#options.dataDirectory, "sandbox-self-test") });
-      await runSelfTest(await probe.wrap({ command: "true", args: [] }), this.#options.environment ?? process.env);
+      await runSelfTest(await probe.wrap({ command: "true", args: [] }), this.#options.environment ?? process.env, this.#options.disableSetting);
     } catch (error) {
       await sharedRuntime.release(this);
       throw error;

package/apps/server/src/plugin-support/product-relay.ts

@@ -1,4 +1,5 @@
-import type { Api, Model } from "@ragents/ai";
+import { compactionProblem } from "@ragents/agent";
+import type { Api, Model, ModelCompaction } from "@ragents/ai";
 import type { ModelProviderRegistration } from "@ragents/engine";
 
 export const RELAY_PROVIDER = "relay";
@@ -9,7 +10,7 @@ export interface RelayConnection {
   readonly token: string;
 }
 
-/** Was das Relay je Alias über das dahinterliegende Modell verrät; der echte Name bleibt beim Server. */
+/** Was das Relay je Alias über das dahinterliegende Modell verrät, samt den Kompaktierungswerten des Alias; der echte Name bleibt beim Server. */
 export interface RelayCatalogEntry {
   readonly id: string;
   readonly object: "model";
@@ -19,6 +20,7 @@ export interface RelayCatalogEntry {
     readonly input: Model<Api>["input"];
     readonly contextWindow: number;
     readonly maxTokens: number;
+    readonly compaction: ModelCompaction;
     readonly compat?: Model<Api>["compat"];
   };
 }
@@ -61,6 +63,7 @@ const modelOf = (entry: RelayCatalogEntry, baseUrl: string): Model<"openai-compl
   cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
   contextWindow: entry.catalog.contextWindow,
   maxTokens: entry.catalog.maxTokens,
+  compaction: entry.catalog.compaction,
   ...(entry.catalog.compat ? { compat: entry.catalog.compat as Model<"openai-completions">["compat"] } : {}),
 });
 
@@ -83,6 +86,10 @@ export const createRelayCatalog = (connection: RelayConnection, fetchImpl: typeo
     const body = await response.json() as { data?: unknown };
     if (!Array.isArray(body.data) || !body.data.every(isEntry)) throw new Error(`Das Modell-Relay ${address} liefert keinen gültigen Aliaskatalog`);
     if (body.data.length === 0) throw new Error(`Das Modell-Relay ${address} bietet keine Modelle an`);
+    for (const entry of body.data) {
+      const problem = compactionProblem(entry.catalog.compaction, entry.catalog);
+      if (problem) throw new Error(`The model relay ${address} offers ${entry.id} without valid compaction values: ${problem}`);
+    }
     loaded = body.data.map((entry) => modelOf(entry, baseUrl));
     return loaded;
   };
@@ -110,6 +117,7 @@ export const createRelayCatalog = (connection: RelayConnection, fetchImpl: typeo
           cost: model.cost,
           contextWindow: model.contextWindow,
           maxTokens: model.maxTokens,
+          ...(model.compaction ? { compaction: model.compaction } : {}),
           ...(model.compat ? { compat: model.compat } : {}),
         })),
       },

package/apps/server/src/plugin-support/workspace-sandbox-host.ts

@@ -1,5 +1,6 @@
 import { mkdir, realpath } from "node:fs/promises";
 import path from "node:path";
+import { Value } from "typebox/value";
 import {
   DomainError,
   serviceToken,
@@ -28,6 +29,7 @@ import {
   type SessionIdent,
   type WorkspaceExecuteOptions,
   type WorkspaceExecutor,
+  type WorkspaceExecutorParts,
   type WorkspaceProcessContext,
 } from "@ragents/workspace-executor";
 import { hostRoot } from "../host-version.js";
@@ -70,6 +72,8 @@ export const sandboxServicesToken = serviceToken<SandboxServices>("ragents.works
 
 export interface WorkspaceSandboxHostOptions {
   contributorName: string;
+  /** Was die Plugins des Profils zum Executor dieses Servers beitragen; jeder Arbeitsplatz der Runs trägt dieselben Beiträge. */
+  contributions: readonly WorkspaceExecutorParts[];
   workspaceFor: (runId: string) => Promise<SessionWorkspace>;
   identFor: (runId: string) => Promise<SessionIdent | undefined>;
   skillPaths: () => Promise<readonly string[]>;
@@ -83,6 +87,10 @@ export interface WorkspaceSandboxHostOptions {
   processSandbox?: RunProcessSandboxes;
   /** Die Bash des Executors dieses Servers; unter Windows Pflicht, sonst ohne Angabe die des Systems. */
   bash?: string;
+  /** Das rg des Executors dieses Servers; ohne Angabe gilt eines im PATH. */
+  rg?: string;
+  /** Die Zeitgrenze von bash in Sekunden für Aufrufe ohne eigene, auf jeder Maschine der Runs; ohne Angabe die des Werkzeugs. */
+  bashTimeoutSeconds?: number;
 }
 
 const sandboxDescriptions: Readonly<Record<string, string>> = {
@@ -98,16 +106,13 @@ const describeSandboxTool = (definition: AgentToolDefinition): AgentToolDefiniti
   return { ...definition, description, longDescription: definition.description, nativeTool: true };
 };
 
-const sandboxDescriptorDefinitions = [
+const sandboxDefinitions = (bashTimeoutSeconds: number | undefined): readonly AgentToolDefinition[] => [
   createReadToolDefinition("."),
   createEditToolDefinition("."),
   createWriteToolDefinition("."),
-  createBashToolDefinition("."),
+  createBashToolDefinition(".", bashTimeoutSeconds === undefined ? {} : { defaultTimeoutSeconds: bashTimeoutSeconds }),
 ] as readonly AgentToolDefinition[];
 
-const sandboxDescriptors = sandboxDescriptorDefinitions.map((definition) =>
-  toolDescriptorFrom(describeSandboxTool(definition), alwaysAvailable));
-
 const fileToolNames = new Set(["read", "edit", "write"]);
 
 interface StableRunParts {
@@ -142,6 +147,7 @@ const existingRoots = async (roots: readonly ResolvedWorkspaceRoot[]): Promise<R
 /** Der Executor des Servers mit den Wurzeln des Servers; eine Operation mit Alias läuft dort, jede andere beim Executor der Bindung des Runs. */
 export class WorkspaceSandboxHost implements SandboxServices {
   readonly #options: WorkspaceSandboxHostOptions;
+  readonly #definitions: readonly AgentToolDefinition[];
   readonly #workspaceRoots: RegisteredWorkspaceRoot[] = [];
   readonly #local: WorkspaceOperationExecutor;
   readonly #stable = new Map<string, Promise<StableRunParts>>();
@@ -150,9 +156,10 @@ export class WorkspaceSandboxHost implements SandboxServices {
 
   constructor(options: WorkspaceSandboxHostOptions) {
     this.#options = options;
+    this.#definitions = sandboxDefinitions(options.bashTimeoutSeconds);
     this.#local = new WorkspaceOperationExecutor({
       contextFor: (runId) => this.serverProcessContextFor(runId),
-      modules: workspaceExecutorModules(),
+      modules: workspaceExecutorModules({ contributions: options.contributions }),
     });
   }
 
@@ -234,6 +241,7 @@ export class WorkspaceSandboxHost implements SandboxServices {
       runOperation: workspace.runOperation,
       ...(sandbox ? { sandbox } : {}),
       ...(this.#options.bash === undefined ? {} : { bash: this.#options.bash }),
+      ...(this.#options.rg === undefined ? {} : { rg: this.#options.rg }),
     });
   }
 
@@ -288,7 +296,7 @@ export class WorkspaceSandboxHost implements SandboxServices {
   workspaceTools(): ToolContributor {
     return {
       name: this.#options.contributorName,
-      descriptors: sandboxDescriptors,
+      descriptors: this.#definitions.map((definition) => toolDescriptorFrom(describeSandboxTool(definition), alwaysAvailable)),
       tools: (context) => this.#workspaceToolsFor(context),
     };
   }
@@ -330,12 +338,13 @@ export class WorkspaceSandboxHost implements SandboxServices {
   }
 
   #workspaceToolsFor(context: PluginContext): Promise<RunFunction[]> {
-    return Promise.resolve(sandboxDescriptorDefinitions.map((definition) => {
+    return Promise.resolve(this.#definitions.map((definition) => {
       const described = describeSandboxTool(definition);
       const proxy = {
         ...described,
+        // Die Vorgaben des Schemas, etwa die Zeitgrenze von bash, setzt der Server ein; so gilt auf jeder Maschine, was das Modell im Schema sieht.
         execute: (toolCallId: string, params: unknown, signal: AbortSignal | undefined) =>
-          this.execute(context.runId, described.name, params, {
+          this.execute(context.runId, described.name, Value.Default(described.parameters, structuredClone(params)), {
             toolCallId,
             ...(signal ? { signal } : {}),
           }),

package/apps/server/src/profile/bundle-manifest.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
+import { EXECUTOR_CONTRIBUTION_FILE } from "@ragents/workspace-executor";
 import { ragentsDataRoot } from "../data-directory.js";
 import { filesBelow } from "../folder-install.js";
 import { HOST_API_VERSION, type HostApiHalf } from "../host-api.js";
@@ -9,7 +10,7 @@ import { isCheckout } from "../host-web.js";
 import { bundlesRoot, pluginIdOf } from "../plugin-support/plugins-root.js";
 
 export const BUNDLE_MANIFEST_FILE = "ragents-bundle.json";
-export const BUNDLE_FORMAT = 3;
+export const BUNDLE_FORMAT = 4;
 
 /** The value names a half imports from each module of the host API. */
 export type HostNames = Readonly<Record<string, readonly string[]>>;
@@ -27,12 +28,14 @@ export interface BundleManifest {
   readonly sourceStand: string;
   readonly server: string;
   readonly web?: { readonly entry: string; readonly css?: string; readonly classes: string };
+  /** The contribution to every executor, a self-contained file that any Node process loads. */
+  readonly executor?: typeof EXECUTOR_CONTRIBUTION_FILE;
   readonly exports: Readonly<Record<HostApiHalf, Readonly<Record<string, string>>>>;
   readonly uses: readonly string[];
   readonly assets: readonly string[];
 }
 
-const MANIFEST_KEYS = new Set(["format", "id", "api", "hostNames", "stand", "sourceStand", "server", "web", "exports", "uses", "assets"]);
+const MANIFEST_KEYS = new Set(["format", "id", "api", "hostNames", "stand", "sourceStand", "server", "web", "executor", "exports", "uses", "assets"]);
 const SOURCE_MARKERS = ["ragents-plugin.json", "server/index.ts", "server/index.tsx"];
 
 const isRecord = (value: unknown): value is Record<string, unknown> =>
@@ -167,6 +170,7 @@ export const readBundleManifest = (folder: string): BundleManifest => {
     ...(typeof raw.sourceStand === "string" ? [] : ["sourceStand"]),
     ...(typeof raw.server === "string" ? [] : ["server"]),
     ...(isWeb(raw.web) ? [] : ["web"]),
+    ...(raw.executor === undefined || raw.executor === EXECUTOR_CONTRIBUTION_FILE ? [] : ["executor"]),
     ...(isRecord(raw.exports) && isPathRecord(raw.exports.server) && isPathRecord(raw.exports.web) ? [] : ["exports"]),
     ...(isStringList(raw.uses) ? [] : ["uses"]),
     ...(isStringList(raw.assets) ? [] : ["assets"]),
@@ -176,7 +180,7 @@ export const readBundleManifest = (folder: string): BundleManifest => {
   const webFiles = web === undefined ? [] : [web.entry, web.classes, ...(web.css === undefined ? [] : [web.css])];
   const misplaced = webFiles.filter((entry) => !entry.startsWith("web/") || entry.split("/").includes(".."));
   if (misplaced.length > 0) throw new Error(`${file}: ${misplaced.join(", ")} liegt nicht unter web/; ${rebuildHint(folder)}`);
-  for (const required of [raw.server as string, ...webFiles]) {
+  for (const required of [raw.server as string, ...webFiles, ...(raw.executor === undefined ? [] : [EXECUTOR_CONTRIBUTION_FILE])]) {
     if (!statSync(path.join(folder, required), { throwIfNoEntry: false })?.isFile()) throw new Error(`Dem Bundle ${id} fehlt ${required}; ${rebuildHint(folder)}`);
   }
   return raw as unknown as BundleManifest;

package/apps/server/src/profile/compose.ts

@@ -1,4 +1,5 @@
 import { PluginHost, type PluginWebAddresses } from "@ragents/engine";
+import { pluginToolsDirectory, prepareExecutorContribution, type LoadedExecutorContribution } from "@ragents/workspace-executor";
 import { config, HOST_SECRET_ENV_NAMES } from "../config.js";
 import { SESSION_MODE, SESSIONS_MODE } from "../layout.js";
 import { withFolderAssets } from "../plugin-support/plugin-folder.js";
@@ -6,6 +7,7 @@ import type { PluginModule } from "../plugin-support/plugin-module.js";
 import { runManagementToken } from "../ragents/global-chat.js";
 import { registerTypeScriptFunctions } from "../ragents/typescript-tools.js";
 import {
+  executorContributionsToken,
   hostAddressToken,
   runtimeProviderToken,
   secretEnvNamesToken,
@@ -27,6 +29,8 @@ export interface ProfileComposition {
   readonly modules: ReadonlyMap<string, PluginModule>;
   /** The plugins with a web half and where the browser loads it; the web loads exactly these. */
   readonly web: ReadonlyMap<string, PluginWebAddresses>;
+  /** Die Beiträge der Bundles zum Executor; der Server baut sie mit den Werkzeugordnern seines Datenordners. */
+  readonly executor: readonly LoadedExecutorContribution[];
   /** Die Vorlage aus defaultStartEntry der Profildatei; der Host lehnt eine nicht registrierte beim Versiegeln ab. */
   readonly defaultStartEntry?: string;
 }
@@ -43,6 +47,8 @@ export const composeProfile = (options: ProfileComposition, bridges: HostBridges
   host.provideHost(runWorkspaceProviderToken, bridges.sessionWorkspaceFor);
   host.provideHost(runtimeProviderToken, bridges.runtime);
   host.provideHost(hostAddressToken, () => bridges.apiBaseUrl);
+  host.provideHost(executorContributionsToken, options.executor.map((loaded) =>
+    prepareExecutorContribution(loaded, pluginToolsDirectory(config.dataDir, loaded.plugin))));
   host.provideHost(runManagementToken, () => {
     if (!bridges.sessions) throw new Error("Der Host stellt keine Sitzungsverwaltung bereit");
     return bridges.sessions();

package/apps/server/src/profile/plugin-discovery.ts

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import type { PluginWebAddresses } from "@ragents/engine";
+import { loadExecutorContribution, type LoadedExecutorContribution } from "@ragents/workspace-executor";
 import { announceBundles } from "../host-resolution.js";
 import { checkedHostApiRecord } from "../host-version.js";
 import { isPluginModule, type PluginModule } from "../plugin-support/plugin-module.js";
@@ -133,6 +134,8 @@ export interface LoadedPlugins {
   readonly bundles: readonly ResolvedPlugin[];
   /** The plugins whose bundle carries a web half, with the addresses the browser loads it from. */
   readonly web: ReadonlyMap<string, PluginWebAddresses>;
+  /** The contributions to every executor, in the order of the plugin list; each machine builds them for itself. */
+  readonly executor: readonly LoadedExecutorContribution[];
 }
 
 export const loadPlugins = async (
@@ -160,5 +163,7 @@ export const loadPlugins = async (
     const addresses = webAddressesOf(plugin);
     return addresses === undefined ? [] : [[plugin.id, addresses] as const];
   }));
-  return { known, ids, modules, bundles: plugins, web };
+  const executor = await Promise.all(plugins.flatMap((plugin) => plugin.manifest.executor === undefined ? []
+    : [loadExecutorContribution(plugin.id, path.join(plugin.folder, plugin.manifest.executor))]));
+  return { known, ids, modules, bundles: plugins, web, executor };
 };

package/apps/server/src/profile/provisioning.ts

@@ -1,10 +1,7 @@
 import { mkdir } from "node:fs/promises";
 import { hostDataDirectory, pluginToolsDirectory } from "@ragents/workspace-executor/src/tools.ts";
 import { isPluginProvision, type PluginProvision } from "../plugin-support/provision.js";
-import { importBundles, resolvePluginEntries, type ResolvedPlugin } from "./plugin-discovery.js";
-
-/** Die Plugins, deren Werkzeuge jeder Arbeitsplatz-Executor auf seiner Maschine braucht: Sprachserver und Browser. */
-export const WORKSPACE_PROVISION_PLUGINS = ["ragents.lsp-roslyn", "ragents.lsp-fsharp", "ragents.browser"] as const;
+import { discoverPluginIds, importBundles, resolvePluginEntries, type ResolvedPlugin } from "./plugin-discovery.js";
 
 /** The provisioning a bundle exports next to its plugin, if it brings one. */
 const provisionOf = (plugin: ResolvedPlugin, exported: Readonly<Record<string, unknown>>): PluginProvision | undefined => {
@@ -81,5 +78,9 @@ const withUsedBundles = (ids: readonly string[]): readonly ResolvedPlugin[] => {
   return [...resolved.values()];
 };
 
+/** Ein Arbeitsplatz hat kein Profil; er provisioniert die eingebauten Plugins seines Hosts, die zum Executor beitragen, denn deren Werkzeuge laufen auf ihm. */
+export const workspaceProvisionPlugins = (): readonly ResolvedPlugin[] => withUsedBundles(
+  resolvePluginEntries(discoverPluginIds()).filter((plugin) => plugin.manifest.executor !== undefined).map((plugin) => plugin.id));
+
 export const provisionWorkspace = (log: (line: string) => void): Promise<readonly PluginProvisionReport[]> =>
-  provisionPlugins(withUsedBundles(WORKSPACE_PROVISION_PLUGINS), hostDataDirectory(), log);
+  provisionPlugins(workspaceProvisionPlugins(), hostDataDirectory(), log);

package/apps/server/src/provider.ts

@@ -366,7 +366,7 @@ export class RunSessionProvider implements ChatSessionProvider {
     else if (start.kind === "package") {
       if (!local) throw new Error("Das Run-Script-Paket wurde nicht geladen");
       const { script, ...entry } = local;
-      await session.startPackageAndWait({ ...script, entry: { ...entry, coordinator: script.coordinator, owner: "ragents.overseer" } }, start.input, user);
+      await session.startPackageAndWait({ ...script, entry: { ...entry, coordinator: script.coordinator, owner: start.owner } }, start.input, user);
     }
     else await session.sendAndWait(start.message, user);
     return id;
@@ -398,7 +398,7 @@ export class RunSessionProvider implements ChatSessionProvider {
 
   runView(id: string, access: AccessContext = unrestrictedAccess): unknown {
     this.ensureUsable(id);
-    return accessibleRunView(this.requireEngine().runtime.view(id), access);
+    return accessibleRunView(this.requireEngine().runtime.view(id), access, this.plugins.accessProjections);
   }
 
   hasRun(id: string): boolean {

package/apps/server/src/ragents/engine.ts

@@ -32,6 +32,7 @@ import {
   type PublicPromptSnapshot,
   type RunStopBoundary,
   type RunStopOperation,
+  type RunView,
   type StartOptionContributionRegistry,
   type Workspaces,
 } from "@ragents/engine";
@@ -206,7 +207,6 @@ export const createEngine = async (options: EngineOptions): Promise<Engine> => {
     resolveSkills: async (context) => globalChat?.isCoordinator(context.runId) ? []
       : (await options.plugins.skills.resolve(contributionContextFor(context))).map(skillOfDirectory),
     resolveHooks: (context) => globalChat?.isCoordinator(context.runId) ? [] : options.plugins.agentRuntime.resolve(contributionContextFor(context)),
-    settings: { compaction: config.agentCompaction },
   });
   const configuredModels = await Promise.all(options.plugins.profiles.models().map(async (model) => {
     if (model.driver !== "agent") return model;
@@ -398,7 +398,7 @@ export const createEngine = async (options: EngineOptions): Promise<Engine> => {
     assertAvailable: options.assertAvailable,
     assertRunUsable: options.assertRunUsable,
     assertRunRights: (access: AccessContext, runId: string, kind: RunRightsKind) => assertRunRights(access, runId, kind, runAccess),
-    projectView: accessibleRunView,
+    projectView: (view: RunView, access: AccessContext) => accessibleRunView(view, access, options.plugins.accessProjections),
     hasRun: (runId: string) => journal.stateOf(runId) !== null,
   };
   const methods = runtimeMethods({

package/apps/server/src/ragents/global-chat.ts

@@ -31,7 +31,13 @@ export type ManagedRunStart = {
   /** Wer die Startoptionen wählt und den Run besitzt: der Benutzer der Anfrage, null ohne Anmeldung. */
   user: ChatUser | null;
 } & ({ kind: "message"; message: string } | { kind: "script"; entryId: string; input: JsonValue }
-  | { kind: "package"; directory: string; input: JsonValue });
+  | {
+    kind: "package";
+    directory: string;
+    input: JsonValue;
+    /** Das Plugin, das das Paket startet; es steht als Besitzer der Vorlage dieses Starts. */
+    owner: string;
+  });
 
 export interface RunManagement {
   /** Mit einem Zugang bleiben nur dessen eigene Runs übrig; ohne ihn ist es die Liste des Servers. */

package/apps/server/src/ragents/host-services.ts

@@ -5,6 +5,7 @@ import {
   type PluginHost,
   type ServiceToken,
 } from "@ragents/engine";
+import type { PreparedExecutorContribution } from "@ragents/workspace-executor";
 import type { SessionWorkspace } from "./workspace-runtime.js";
 import type { RunManagement } from "./global-chat.js";
 
@@ -23,6 +24,9 @@ export const runtimeProviderToken: ServiceToken<() => Orchestration> = serviceTo
 /** Die Adresse, unter der dieser Server seine API anbietet, etwa http://127.0.0.1:4710; ohne HTTP (nur stdio) keine. */
 export const hostAddressToken: ServiceToken<() => string | undefined> = serviceToken("host.address");
 
+/** Die Beiträge der Bundles dieses Profils zum Executor, gebaut für den Server; jeder Executor des Servers trägt sie, jeder Arbeitsplatz dieselben. */
+export const executorContributionsToken: ServiceToken<readonly PreparedExecutorContribution[]> = serviceToken("host.executor-contributions");
+
 export interface HostBridges {
   ensureSession: (runId: string) => void;
   ensureWorkspaceAccess: (access: AccessContext, runId: string) => void;

package/apps/server/src/ragents/session.ts

@@ -464,7 +464,7 @@ export class RunChatSession implements ChatSessionLike {
     this.#engine.runtime.enqueueInput(
       { actorId: state.ownerId, commandId: `chat:${randomUUID()}` },
       this.id,
-      { actorId: primaryActorId, content: text, artifactIds, sourceEventIds },
+      { actorId: primaryActorId, content: text, artifactIds, sourceEventIds, origin: "human" },
     );
   }
 

package/apps/server/src/server.ts

@@ -23,7 +23,7 @@ import { Protocol, teeConsole } from "./protocol.js";
 import { RunSessionProvider } from "./provider.js";
 import { readHelpResponse } from "./help-files.js";
 import { watchParentProcess } from "./parent-watch.js";
-import { hostRoot } from "./host-version.js";
+import { hostRoot, readPackageVersion } from "./host-version.js";
 import { hostWebProblem, isCheckout } from "./host-web.js";
 import { createStylesheet, STYLESHEET_PATH } from "./web-stylesheet.js";
 import { isBundleSourceMap, isPublicBundleFile, isWebBundlePath, webBundleFile } from "./web-bundles.js";
@@ -170,6 +170,7 @@ const composition: ProfileComposition = {
   pluginIds: loaded.ids,
   modules: loaded.modules,
   web: loaded.web,
+  executor: loaded.executor,
   ...(defaultStartEntry !== undefined ? { defaultStartEntry } : {}),
 };
 
@@ -213,6 +214,7 @@ provider.plugins.methods.register("host", [
   ...coreMethods({
     sessions: provider,
     plugins: provider.plugins,
+    version: readPackageVersion(),
     global: globalAccess,
     runOwner: (runId) => provider.runOwner(runId),
     runOwnerOnly: (runId) => provider.runOwnerOnly(runId),
@@ -222,6 +224,7 @@ provider.plugins.methods.register("host", [
 ]);
 provider.plugins.channels.register("host", coreChannels({
   sessions: provider,
+  plugins: provider.plugins,
   global: globalAccess,
   runOwner: (runId) => provider.runOwner(runId),
   runOwnerOnly: (runId) => provider.runOwnerOnly(runId),

package/apps/server/tsconfig.json

@@ -33,6 +33,8 @@
     "src",
     "../../plugins/*/server",
     "../../plugins/*/contract.ts",
+    "../../plugins/*/executor.ts",
+    "../../plugins/*/executor",
     "../../ragents.config.*.ts"
   ]
 }

package/apps/web/dist/assets/{highlighted-body-KPVGNVTW-xXXhTDbh.js → highlighted-body-KPVGNVTW-BO4wLQtE.js}

@@ -1 +1 @@
-import{r,S as d,E as p,j as E,c as f}from"./mermaid-HWGCJPDP-DfsU5ofC.js";var j=({code:i,language:e,maxHeight:o,raw:a,className:u,startLine:m,lineNumbers:n,...h})=>{let{shikiTheme:l}=r.useContext(d),t=p(),[c,s]=r.useState(a);return r.useEffect(()=>{if(!t){s(a);return}let g=t.highlight({code:i,language:e,themes:l},x=>{s(x)});g&&s(g)},[i,e,l,t,a]),E.jsx(f,{className:u,language:e,lineNumbers:n,maxHeight:o,result:c,startLine:m,...h})};export{j as HighlightedCodeBlockBody};
+import{r,S as d,E as p,j as E,c as f}from"./mermaid-HWGCJPDP-BLLeth5_.js";var j=({code:i,language:e,maxHeight:o,raw:a,className:u,startLine:m,lineNumbers:n,...h})=>{let{shikiTheme:l}=r.useContext(d),t=p(),[c,s]=r.useState(a);return r.useEffect(()=>{if(!t){s(a);return}let g=t.highlight({code:i,language:e,themes:l},x=>{s(x)});g&&s(g)},[i,e,l,t,a]),E.jsx(f,{className:u,language:e,lineNumbers:n,maxHeight:o,result:c,startLine:m,...h})};export{j as HighlightedCodeBlockBody};