@schlenkr/ragents 0.1.9 → 0.1.11

package/apps/server/package.json

@@ -19,7 +19,7 @@
     "@ragents/engine": "workspace:*",
     "@ragents/workspace-executor": "workspace:*",
     "handlebars": "^4.7.9",
-    "quassel": "^0.2.2",
+    "quassel": "^0.4.0",
     "tsx": "^4.20.0",
     "typebox": "^1.3.13",
     "vscode-jsonrpc": "^9.0.2"

package/apps/server/src/access-projection.ts

@@ -1,37 +1,9 @@
-import { emptyUsage, type AccessContext, type JsonValue, type PluginState, type RunView } from "@ragents/engine";
+import { emptyUsage, type AccessContext, type AccessProjectionRegistry, type RunView } from "@ragents/engine";
 import type { ChatEvent, Message } from "quassel/events";
 import type { ActorConversations } from "./ragents/actor-chat-history.js";
 
-const record = (value: JsonValue | undefined): Record<string, JsonValue | undefined> | undefined =>
-  value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
-
-const hiddenStates = new Set(["ragents.system-prompt", "ragents.model", "ragents.start-options"]);
-
-const visibleState = (entry: PluginState): PluginState | undefined => {
-  if (hiddenStates.has(entry.pluginId)) return undefined;
-  if (entry.pluginId === "ragents.actor-programs.invocations") return { ...entry, state: { version: 1, revision: entry.updatedAt } };
-  if (entry.pluginId !== "ragents.actor-programs") return entry;
-  const state = record(entry.state);
-  const program = state?.program ? record(state.program) : undefined;
-  if (!program) return entry;
-  const views = Array.isArray(program.views) ? program.views.map((value) => {
-    const view = record(value);
-    return view ? { id: view.id, key: view.key, title: view.title, visible: view.visible, placements: view.placements } : value;
-  }) : [];
-  return { ...entry, state: {
-    version: 1,
-    program: {
-      name: program.name,
-      title: program.title,
-      actorId: program.actorId,
-      actorHandle: program.actorHandle,
-      revision: program.revision,
-      views,
-    },
-  } };
-};
-
-export const accessibleRunView = (view: RunView, access: AccessContext): RunView => access.can("runs.inspect") ? view : {
+/** Each plugin shows its own plugin states and plugin events through its access projection (docs/spec/plugins.md, registrations of the PluginHost). */
+export const accessibleRunView = (view: RunView, access: AccessContext, projections: AccessProjectionRegistry): RunView => access.can("runs.inspect") ? view : {
   ...view,
   actors: view.actors.map((actor) => actor.kind === "human" ? { ...actor, grants: [] } : {
     ...actor,
@@ -50,29 +22,27 @@ export const accessibleRunView = (view: RunView, access: AccessContext): RunView
   inputs: view.inputs.map((input) => ({ ...input, content: input.enqueuedBy === view.ownerId && input.presentation !== "background" ? input.content : "",
     lifecycle: input.lifecycle.kind === "discarded" ? { ...input.lifecycle, reason: "Verworfen" } : input.lifecycle,
   })),
-  turns: view.turns.map((turn) => ({ ...turn, usage: emptyUsage(), toolCalls: [], reason: turn.reason ? "Die Verarbeitung wurde beendet." : null })),
+  turns: view.turns.map((turn) => ({ ...turn, usage: emptyUsage(), toolCalls: [], reason: turn.reason ? "Processing was stopped." : null })),
   subscriptions: [],
   pluginStates: view.pluginStates.flatMap((entry) => {
-    const state = visibleState(entry);
+    const state = projections.state(entry, access);
     return state ? [state] : [];
   }),
 };
 
-export const accessibleChatEvent = (event: ChatEvent, access: AccessContext): ChatEvent | undefined => {
+export const accessibleChatEvent = (event: ChatEvent, access: AccessContext, projections: AccessProjectionRegistry): ChatEvent | undefined => {
   if (access.can("runs.inspect")) return event;
   if (event.kind === "status" && event.startup?.status === "failed") return {
     ...event,
-    startup: { status: "failed", message: "Der Start konnte nicht abgeschlossen werden. Bitte wende Dich an den zuständigen Betreuer." },
+    startup: { status: "failed", message: "The start could not be completed. Please contact the person responsible." },
   };
   const trace = access.can("runs.trace");
   if (event.kind === "thinking") return trace ? event : { kind: "thinking", delta: "", at: event.at };
   if (event.kind === "tool") return trace ? event : { kind: "tool", id: event.id, name: "", arguments: "", at: event.at };
   if (event.kind === "tool-result") return trace ? event : { kind: "tool-result", id: event.id, result: "", isError: event.isError };
-  if (event.kind === "system") return { ...event, text: "Hinweis zur Verarbeitung. Bei Fragen wende Dich an den zuständigen Agenten." };
+  if (event.kind === "system") return { ...event, text: "Processing notice. If you have questions, contact the responsible agent." };
   if (event.kind !== "plugin") return event;
-  if (hiddenStates.has(event.pluginId)) return undefined;
-  if (event.pluginId === "ragents.actor-programs" || event.pluginId === "ragents.actor-programs.invocations") return undefined;
-  return event;
+  return projections.chatEvent(event.pluginId, event, access);
 };
 
 const visibleMessage = (message: Message, actorId: string, trace: boolean): Message[] => {

package/apps/server/src/access-service.ts

@@ -1,7 +1,7 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import type { IncomingMessage } from "node:http";
 
-/** Je Koordinator ein Token für seine Werkzeuge; er handelt als dessen Benutzer, null ist der eine Zugang ohne Anmeldung. */
+/** One token per coordinator for its tools; it acts as that coordinator's user, null is the one access without sign-in. */
 const coordinatorTokens = new Map<string | null, string>();
 
 export const coordinatorAccessToken = (userId: string | null): string => {
@@ -13,11 +13,11 @@ export const coordinatorAccessToken = (userId: string | null): string => {
 };
 
 export const profileAccessCookieName = (productId: string | undefined, profile: string | undefined): string => {
-  if (!productId || !profile) throw new Error("Die Benutzeranmeldung benötigt PRODUCT_ID und PRODUCT_PROFILE");
+  if (!productId || !profile) throw new Error("User sign-in requires PRODUCT_ID and PRODUCT_PROFILE");
   return `${productId}-${profile}-user`;
 };
 
-/** Der Benutzer, für den ein Koordinator lokal die Nachrichtenschicht aufruft; sonst undefined. */
+/** The user for whom a coordinator calls the message layer locally; otherwise undefined. */
 export const coordinatorRequestUser = (request: IncomingMessage, url: URL): { userId: string | null } | undefined => {
   const address = request.socket.remoteAddress;
   if (address !== "127.0.0.1" && address !== "::1" && address !== "::ffff:127.0.0.1") return undefined;

package/apps/server/src/access-session.ts

@@ -44,20 +44,20 @@ export const isSameOriginRequest = (request: IncomingMessage): boolean => {
 };
 
 export const createAccessSessionManager = (options: AccessSessionOptions) => {
-  if (!/^[A-Za-z0-9_-]+$/.test(options.cookieName)) throw new Error("Ungültiger Name für das Anmeldungscookie");
-  if (options.users?.length === 0) throw new Error("Eine aktivierte Anmeldung braucht mindestens einen Benutzer");
-  if (options.users && options.anonymousUser) throw new Error("Benutzeranmeldung und anonymer Zugang schließen einander aus");
+  if (!/^[A-Za-z0-9_-]+$/.test(options.cookieName)) throw new Error("Invalid name for the sign-in cookie");
+  if (options.users?.length === 0) throw new Error("Enabled sign-in needs at least one user");
+  if (options.users && options.anonymousUser) throw new Error("User sign-in and anonymous access exclude each other");
   const enabled = options.users !== undefined;
   const now = options.now ?? Date.now;
   const sessionTtlMs = options.sessionTtlMs ?? 12 * 60 * 60 * 1000;
   if (!Number.isSafeInteger(sessionTtlMs) || sessionTtlMs < 1 || sessionTtlMs > 2_147_483_647) {
-    throw new Error("Ungültige Gültigkeitsdauer für Anmeldungen");
+    throw new Error("Invalid validity period for sign-ins");
   }
   const passwords = new Map<string, PasswordRecord>();
-  // Persönliche Token liegen nur als SHA-256 im Speicher; der Vergleich läuft zeitkonstant über alle Einträge.
+  // Personal tokens are kept in memory only as SHA-256; the comparison runs in constant time over all entries.
   const personalTokens: Array<{ digest: Buffer; user: AccessUser }> = [];
   for (const entry of options.users ?? []) {
-    if (passwords.has(entry.id)) throw new Error(`Doppelter Benutzer: ${entry.id}`);
+    if (passwords.has(entry.id)) throw new Error(`Duplicate user: ${entry.id}`);
     const salt = randomBytes(16);
     const user = Object.freeze({ id: entry.id, label: entry.label, rights: Object.freeze([...entry.rights]),
       ...(entry.startEntries ? { startEntries: Object.freeze([...entry.startEntries]) } : {}),
@@ -65,14 +65,14 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
     passwords.set(entry.id, { user, salt, hash: scryptSync(entry.password, salt, 32) });
     if (entry.token === undefined) continue;
     const digest = digestOf(entry.token);
-    if (personalTokens.some((known) => timingSafeEqual(known.digest, digest))) throw new Error(`Der Token von Benutzer ${entry.id} gehört bereits einem anderen Benutzer`);
+    if (personalTokens.some((known) => timingSafeEqual(known.digest, digest))) throw new Error(`The token of user ${entry.id} already belongs to another user`);
     personalTokens.push({ digest, user });
   }
   const dummySalt = randomBytes(16);
   const dummyHash = randomBytes(32);
   const sessions = new Map<string, LoginSession>();
   const wellFormed = (token: string | undefined): string | undefined => token !== undefined && /^[A-Za-z0-9_-]{43}$/.test(token) ? token : undefined;
-  // Clients ohne Cookie (VS-Code-Erweiterung, ihre iframes) senden den Token als Bearer; GET-Abrufe ohne Header (Ereignisstrom, Frames) als Abfrageparameter.
+  // Clients without a cookie (VS Code extension, its iframes) send the token as bearer; GET requests without headers (event stream, frames) as a query parameter.
   const tokenFor = (request: IncomingMessage): string | undefined => {
     const authorization = request.headers.authorization;
     if (authorization !== undefined) return wellFormed(/^Bearer (.+)$/.exec(authorization)?.[1]);
@@ -83,7 +83,7 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
     if (matches.length !== 1) return undefined;
     return wellFormed(matches[0]!.slice(options.cookieName.length + 1));
   };
-  // Ein persönlicher Token gilt nur als Bearer oder, bei GET, als Abfrageparameter; nie als Cookie.
+  // A personal token is only valid as bearer or, for GET, as a query parameter; never as a cookie.
   const offeredToken = (request: IncomingMessage): string | undefined => {
     const authorization = request.headers.authorization;
     if (authorization !== undefined) return /^Bearer (.+)$/.exec(authorization)?.[1];
@@ -127,7 +127,7 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
     const expected = url.pathname === "/api/access" ? "GET" : "POST";
     if (request.method !== expected) {
       response.setHeader("Allow", expected);
-      writeJson(response, 405, { error: "Methode nicht erlaubt" });
+      writeJson(response, 405, { error: "Method not allowed" });
       return true;
     }
     if (expected === "GET") {
@@ -135,11 +135,11 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
       return true;
     }
     if (!isSameOriginRequest(request)) {
-      writeJson(response, 403, { error: "Anmeldung und Abmeldung sind nur von derselben Website möglich" });
+      writeJson(response, 403, { error: "Sign-in and sign-out are only possible from the same website" });
       return true;
     }
     if (!enabled) {
-      writeJson(response, 409, { error: "Die Anmeldung ist in diesem Profil ausgeschaltet" });
+      writeJson(response, 409, { error: "Sign-in is turned off in this profile" });
       return true;
     }
     if (url.pathname === "/api/access/logout") {
@@ -150,25 +150,25 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
       return true;
     }
     if (request.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-      writeJson(response, 415, { error: "Die Anmeldung benötigt application/json" });
+      writeJson(response, 415, { error: "Sign-in requires application/json" });
       return true;
     }
     try {
       const credentials = await readJsonBody(request, (body) => {
-        if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Benutzerkennung und Passwort fehlen");
+        if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("User id and password are missing");
         const value = body as Record<string, unknown>;
         if (Object.keys(value).some((key) => key !== "id" && key !== "password")
           || typeof value.id !== "string" || !value.id || value.id.length > 64
           || typeof value.password !== "string" || !value.password || value.password.length > 2048) {
-          throw new Error("Benutzerkennung und Passwort sind ungültig");
+          throw new Error("User id and password are invalid");
         }
         return { id: value.id, password: value.password };
-      }, "Die Anmeldung enthält kein gültiges JSON", 4096);
+      }, "The sign-in does not contain valid JSON", 4096);
       const record = passwords.get(credentials.id);
       const hash = await derivePassword(credentials.password, record?.salt ?? dummySalt);
       const matches = timingSafeEqual(hash, record?.hash ?? dummyHash);
       if (!record || !matches) {
-        writeJson(response, 401, { error: "Benutzerkennung oder Passwort stimmen nicht" });
+        writeJson(response, 401, { error: "User id or password is incorrect" });
         return true;
       }
       const previous = tokenFor(request);
@@ -182,7 +182,7 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
     } catch (error) {
       if (!request.aborted && !response.destroyed) {
         writeJson(response, error instanceof PayloadTooLargeError ? 413 : 400, {
-          error: error instanceof PayloadTooLargeError ? "Die Anmeldedaten sind zu groß" : "Die Anmeldedaten sind ungültig",
+          error: error instanceof PayloadTooLargeError ? "The sign-in data is too large" : "The sign-in data is invalid",
         });
       }
     }
@@ -200,7 +200,7 @@ export const createAccessSessionManager = (options: AccessSessionOptions) => {
     response.once("close", release);
     response.once("finish", release);
   };
-  /** Der Zugang, mit dem die Werkzeuge des Koordinators eines Benutzers handeln: dessen aktueller Stand, null ist der eine Zugang ohne Anmeldung. */
+  /** The access with which the tools of a user's coordinator act: that user's current state, null is the one access without sign-in. */
   const coordinatorSnapshot = (userId: string | null): AccessSnapshot => userId === null
     ? { enabled, user: enabled ? null : options.anonymousUser ?? null }
     : { enabled: true, user: passwords.get(userId)?.user ?? null };

package/apps/server/src/api/contracts.ts

@@ -14,29 +14,32 @@ import type { TitleModelSettings } from "../title-settings-contract.js";
 
 export { runContracts };
 
-const runId = Type.String({ minLength: 1, maxLength: 64, description: "Kennung des Runs" });
+const runId = Type.String({ minLength: 1, maxLength: 64, description: "Id of the run" });
 
 const attachment = Type.Object({
   name: Type.String({ minLength: 1 }),
   mediaType: Type.String({ minLength: 1 }),
-  data: Type.String({ description: "Inhalt als Base64" }),
+  data: Type.String({ description: "Content as Base64" }),
 }, { additionalProperties: false });
 
 const sessionInfo = openJson<SessionInfo>("SessionInfo");
 
-/** Rechte je Run prüft der Host dynamisch; Verträge ohne `rights` nennen ihre Regel in der Beschreibung. */
+/** The host checks per-run rights dynamically; contracts without `rights` state their rule in the description. */
+/** What a UI gets from the server at startup: the plugins' profile and the server's RAgents version, against which it checks its own. */
+export type HostBootstrap = PublicPluginProfile & { readonly version: string };
+
 export const coreContracts = {
   runs: {
     list: defineOperation({
       id: "ragents.runs.list",
-      description: "Alle Runs des Profils mit Titel, Zeiten und Metadaten. Recht: runs.read.",
+      description: "All runs of the profile with title, times and metadata. Right: runs.read.",
       rights: ["runs.read"],
       input: Type.Object({}, { additionalProperties: false }),
       result: Type.Array(sessionInfo),
     }),
     delete: defineOperation({
       id: "ragents.runs.delete",
-      description: "Einen Run mit seinen Daten löschen. Rechte: runs.read und runs.delete.",
+      description: "Delete a run with its data. Rights: runs.read and runs.delete.",
       rights: ["runs.read", "runs.delete"],
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: Type.Null(),
@@ -45,43 +48,43 @@ export const coreContracts = {
   chat: {
     send: defineOperation({
       id: "ragents.chat.send",
-      description: "Eine Nachricht an den Koordinator des Runs; startet einen neuen Run oder funkt in einen laufenden. Mit entry startet sie den Run über diese Skill-Vorlage und deren festgelegte Startoptionen. Rechte: runs.read und runs.write, für einen neuen Run runs.create; beim globalen Chat dessen Rechte.",
+      description: "A message to the run's coordinator; starts a new run or cuts into a running one. With entry, it starts the run through this skill template and the start options it fixes. Rights: runs.read and runs.write, for a new run runs.create; for the global chat its rights.",
       input: Type.Object({
         runId,
         text: Type.Optional(Type.String()),
         attachments: Type.Optional(Type.Array(attachment)),
         userLocation: Type.Optional(openJson<ChatUserLocation>("ChatUserLocation")),
-        entry: Type.Optional(Type.String({ minLength: 1, description: "Kennung der Skill-Vorlage, über die diese Nachricht den Run startet" })),
+        entry: Type.Optional(Type.String({ minLength: 1, description: "Id of the skill template through which this message starts the run" })),
       }, { additionalProperties: false }),
       result: Type.Null(),
     }),
     sendToActor: defineOperation({
       id: "ragents.chat.sendToActor",
-      description: "Eine Nachricht an einen bestimmten LLM-Actor des Runs. Rechte wie ragents.chat.send.",
+      description: "A message to a specific LLM actor of the run. Rights as for ragents.chat.send.",
       input: Type.Object({ runId, actorId: Type.String({ minLength: 1 }), text: Type.Optional(Type.String()), attachments: Type.Optional(Type.Array(attachment)) }, { additionalProperties: false }),
       result: Type.Null(),
     }),
     start: defineOperation({
       id: "ragents.chat.start",
-      description: "Einen Run über eine Script-Vorlage starten, ohne Nachricht; die Startoptionen, die die Vorlage festlegt, gelten. Rechte: runs.read, runs.write und die Freigabe der Vorlage.",
+      description: "Start a run through a script template, without a message; the start options the template fixes apply. Rights: runs.read, runs.write and the template's release.",
       input: Type.Object({ runId, entry: Type.String({ minLength: 1 }), input: Type.Optional(Type.Any()) }, { additionalProperties: false }),
       result: Type.Null(),
     }),
     stop: defineOperation({
       id: "ragents.chat.stop",
-      description: "Not-Aus für den ganzen Run: bricht alle Turns und einen laufenden Start ab und stoppt alle Actors. Einen einzelnen Turn unterbricht ragents.runs.interruptTurn. Rechte: runs.read und runs.write.",
+      description: "Emergency stop for the whole run: aborts all turns and a running start and stops all actors. ragents.runs.interruptTurn interrupts a single turn. Rights: runs.read and runs.write.",
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: Type.Null(),
     }),
     capabilities: defineOperation({
       id: "ragents.chat.capabilities",
-      description: "Welche Anhänge das Modell eines Actors annimmt; der Modellname erscheint nur mit runs.inspect. Recht: runs.read.",
+      description: "Which attachments an actor's model accepts; the model name appears only with runs.inspect. Right: runs.read.",
       input: Type.Object({ runId, actor: Type.Optional(Type.String({ minLength: 1 })) }, { additionalProperties: false }),
       result: openJson<ChatAttachmentCapabilities>("ChatAttachmentCapabilities"),
     }),
     actorHistory: defineOperation({
       id: "ragents.chat.actorHistory",
-      description: "Die Gesprächsverläufe aller Actors des Runs, ohne runs.inspect ohne Werkzeugdetails. Recht: runs.read.",
+      description: "The conversation histories of all actors of the run, without runs.inspect without tool details. Right: runs.read.",
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: openJson<ActorConversations>("ActorConversations"),
     }),
@@ -89,14 +92,14 @@ export const coreContracts = {
   startOptions: {
     list: defineOperation({
       id: "ragents.startOptions.list",
-      description: "Die Startoptionen eines Runs mit Wert und Darstellung, nur die, deren eigene Rechte der Aufrufer hat; die Modellwahl etwa verlangt runs.inspect. Nach dem Start ist jede außer den änderbaren gesperrt. Rechte: runs.read, runs.create.",
+      description: "The start options of a run with value and presentation, only those whose own rights the caller has; the model choice, for example, requires runs.inspect. After the start, all except the changeable ones are locked. Rights: runs.read, runs.create.",
       rights: ["runs.read", "runs.create"],
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: Type.Array(openJson<StartOptionState>("StartOptionState")),
     }),
     select: defineOperation({
       id: "ragents.startOptions.select",
-      description: "Eine Startoption vor dem Start wählen, eine änderbare wie die Modellwahl auch danach mit Wirkung ab dem nächsten Turn; fehlt ein Recht der Option selbst, scheitert die Wahl mit access-denied. Rechte: runs.read, runs.write, runs.create.",
+      description: "Choose a start option before the start, a changeable one such as the model choice also afterwards, taking effect from the next turn; if a right of the option itself is missing, the choice fails with access-denied. Rights: runs.read, runs.write, runs.create.",
       rights: ["runs.read", "runs.write", "runs.create"],
       input: Type.Object({ runId, optionId: Type.String({ minLength: 1, maxLength: 128 }), value: Type.Any() }, { additionalProperties: false }),
       result: openJson<StartOptionState>("StartOptionState"),
@@ -105,25 +108,25 @@ export const coreContracts = {
   transfer: {
     export: defineOperation({
       id: "ragents.runs.export",
-      description: "Einen gestoppten Run als Archiv holen: Journal, Payloads, Modellkontexte und seine Plugin-Ablagen. Rechte: runs.read und runs.inspect.",
+      description: "Fetch a stopped run as an archive: journal, payloads, model contexts and its plugin stores. Rights: runs.read and runs.inspect.",
       rights: ["runs.read", "runs.inspect"],
       input: Type.Object({ runId }, { additionalProperties: false }),
       result: openJson<RunTransferExport>("RunTransferExport"),
     }),
     import: defineOperation({
       id: "ragents.runs.import",
-      description: "Ein Run-Archiv annehmen, sein Journal wiedergeben und den Run gestoppt öffnen. Rechte: runs.read, runs.write und runs.create.",
+      description: "Accept a run archive, replay its journal and open the run stopped. Rights: runs.read, runs.write and runs.create.",
       rights: ["runs.read", "runs.write", "runs.create"],
       input: Type.Object({
-        archive: Type.String({ minLength: 1, description: "Das tar.gz des Exports als Base64" }),
-        workspacePath: Type.Optional(Type.String({ minLength: 1, description: "Ersatzordner auf diesem Server für einen Run mit Bindung path" })),
+        archive: Type.String({ minLength: 1, description: "The export's tar.gz as Base64" }),
+        workspacePath: Type.Optional(Type.String({ minLength: 1, description: "Replacement folder on this server for a run with binding path" })),
       }, { additionalProperties: false }),
       result: openJson<RunTransferImport>("RunTransferImport"),
     }),
   },
   prepare: defineOperation({
     id: "ragents.runs.prepare",
-    description: "Den Auftrag eines neuen Runs im Gespräch mit einer eigenen Koordinator-Instanz ausarbeiten. Rechte: runs.read, runs.write, runs.create.",
+    description: "Work out the task of a new run in a conversation with a separate coordinator instance. Rights: runs.read, runs.write, runs.create.",
     rights: ["runs.read", "runs.write", "runs.create"],
     input: Type.Intersect([Type.Object({ runId }), openJson<RunPreparationRequest>("RunPreparationRequest")]),
     result: openJson<RunPreparationResponse>("RunPreparationResponse"),
@@ -131,28 +134,28 @@ export const coreContracts = {
   settings: {
     read: defineOperation({
       id: "ragents.settings.read",
-      description: "Modelle, Plugins, Werkzeuge, Skills und Laufzeitinformationen des Profils. Recht: settings.read; nur lokal oder mit Zugang.",
+      description: "Models, plugins, tools, skills and runtime information of the profile. Right: settings.read; only locally or with access.",
       rights: ["settings.read"],
       input: Type.Object({}, { additionalProperties: false }),
       result: openJson<SettingsResponse>("SettingsResponse"),
     }),
     skill: defineOperation({
       id: "ragents.settings.skill",
-      description: "Die Dateien eines registrierten Skills lesen; null, wenn er nicht registriert ist. Recht: settings.read.",
+      description: "Read the files of a registered skill; null if it is not registered. Right: settings.read.",
       rights: ["settings.read"],
       input: Type.Object({ id: Type.String({ minLength: 1 }) }, { additionalProperties: false }),
       result: Type.Union([openJson<SettingsSkillDetail>("SettingsSkillDetail"), Type.Null()]),
     }),
     titlesRead: defineOperation({
       id: "ragents.settings.titles.read",
-      description: "Das Modell für automatische Überschriften und die Auswahl lesen. Recht: settings.read.",
+      description: "Read the model for automatic titles and the choices. Right: settings.read.",
       rights: ["settings.read"],
       input: Type.Object({}, { additionalProperties: false }),
       result: openJson<TitleModelSettings>("TitleModelSettings"),
     }),
     titlesSave: defineOperation({
       id: "ragents.settings.titles.save",
-      description: "Das Modell für automatische Überschriften setzen oder die Erzeugung ausschalten. Recht: settings.write.",
+      description: "Set the model for automatic titles or turn their generation off. Right: settings.write.",
       rights: ["settings.write"],
       input: Type.Object({ value: Type.Any() }, { additionalProperties: false }),
       result: openJson<TitleModelSettings>("TitleModelSettings"),
@@ -161,15 +164,15 @@ export const coreContracts = {
   plugins: {
     bootstrap: defineOperation({
       id: "ragents.plugins.bootstrap",
-      description: "Produkt, aktive Plugins mit Web-Konfiguration und freigegebene Vorlagen für die Oberfläche.",
+      description: "Product, active plugins with web configuration, released templates and the server's RAgents version for the UI.",
       input: Type.Object({}, { additionalProperties: false }),
-      result: openJson<PublicPluginProfile>("PublicPluginProfile"),
+      result: openJson<HostBootstrap>("HostBootstrap"),
     }),
   },
   external: {
     set: defineOperation({
       id: "ragents.external.set",
-      description: "Den Zugang von außen ein- oder ausschalten; nur vom eigenen Rechner. Recht: settings.write.",
+      description: "Turn external access on or off; only from the local machine. Right: settings.write.",
       rights: ["settings.write"],
       input: Type.Object({ state: Type.Union([Type.Literal("on"), Type.Literal("off")]) }, { additionalProperties: false }),
       result: Type.Object({ external: Type.Boolean() }),
@@ -178,20 +181,20 @@ export const coreContracts = {
   channels: {
     runs: defineChannel({
       id: "ragents.runs",
-      description: "Meldet jede Änderung der Run-Liste. Recht: runs.read.",
+      description: "Reports every change of the run list. Right: runs.read.",
       rights: ["runs.read"],
       params: Type.Object({}, { additionalProperties: false }),
       message: Type.Object({ type: Type.Literal("changed") }),
     }),
     run: defineChannel({
       id: "ragents.run",
-      description: "Meldet jedes neue Journalereignis eines Runs; erst ready, dann run. Rechte wie das Lesen des Runs.",
+      description: "Reports every new journal event of a run; first ready, then run. Rights as for reading the run.",
       params: Type.Object({ runId }, { additionalProperties: false }),
       message: Type.Object({ kind: Type.Union([Type.Literal("ready"), Type.Literal("run")]) }),
     }),
     chat: defineChannel({
       id: "ragents.chat",
-      description: "Der Chatverlauf des Koordinators: erst der gespeicherte Verlauf, dann live. Rechte wie das Lesen des Runs.",
+      description: "The coordinator's chat history: first the stored history, then live. Rights as for reading the run.",
       params: Type.Object({ runId }, { additionalProperties: false }),
       message: openJson<ChatEvent>("ChatEvent"),
     }),

package/apps/server/src/api/core-methods.ts

@@ -25,12 +25,14 @@ export interface CoreMethodSources {
     saveTitleModelSettings: (value: unknown) => Promise<TitleModelSettings>;
   };
   plugins: PluginHost;
+  /** The RAgents version of this server; a UI with a different version shows the difference. */
+  version: string;
   global: GlobalRunPolicy | undefined;
-  /** Der Benutzer eines Runs: null ohne Eigentümer, undefined für eine Kennung ohne Run. */
+  /** The user of a run: null without an owner, undefined for an id without a run. */
   runOwner: (runId: string) => string | null | undefined;
-  /** Ob nur der Eigentümer den Run bedient. */
+  /** Whether only the owner operates the run. */
   runOwnerOnly: (runId: string) => boolean;
-  /** Einstellungen sind ohne Anmeldung und Zugangstoken nur vom eigenen Rechner lesbar. */
+  /** Without sign-in and access token, settings are readable only from the local machine. */
   settingsGuarded: () => boolean;
   external: { open: () => boolean; set: (value: boolean) => Promise<void> };
 }
@@ -39,7 +41,7 @@ const userOf = (access: AccessContext): ChatUser | undefined => access.user ? {
 
 const userIdOf = (access: AccessContext): string | null => access.user?.id ?? null;
 
-/** Der Oberflächenkontext nennt den beim Absenden geöffneten Run; auch er ist ein Zugriff auf diesen Run. */
+/** The UI context names the run open when sending; it too is an access to that run. */
 const locatedRun = (userLocation: unknown): string | undefined => {
   const named = typeof userLocation === "object" && userLocation !== null && "runId" in userLocation
     ? (userLocation as { runId: unknown }).runId : undefined;
@@ -50,7 +52,7 @@ const messageOf = (text: string | undefined, attachments: unknown) => {
   try {
     const trimmed = text?.trim() ?? "";
     const parsed = parseChatAttachments(attachments);
-    if (!trimmed && parsed.length === 0) throw new Error("Text oder Anhänge fehlen");
+    if (!trimmed && parsed.length === 0) throw new Error("Text or attachments are missing");
     return { text: trimmed, attachments: parsed };
   } catch (error) {
     throw new DomainError("invalid-message", error instanceof Error ? error.message : String(error), 400);
@@ -59,15 +61,15 @@ const messageOf = (text: string | undefined, attachments: unknown) => {
 
 const TECHNICAL_ATTACHMENT_ERRORS = ["attachment-model-unsupported", "attachment-tools-required", "attachments-unsupported"];
 
-/** Ohne runs.inspect bekommt der Benutzer bei technischen Fehlern nur den allgemeinen Hinweis, wie bisher. */
+/** Without runs.inspect, the user gets only the general notice on technical errors, as before. */
 const guardedForUser = async <T>(access: AccessContext, work: () => Promise<T>): Promise<T> => {
   try {
     return await work();
   } catch (error) {
     if (access.can("runs.inspect")) throw error;
     const technical = error instanceof DomainError && TECHNICAL_ATTACHMENT_ERRORS.includes(error.code);
-    if (technical) throw new DomainError(error.code, "Dieser Agent kann die angehängte Datei nicht verarbeiten.", error.status);
-    if (!(error instanceof DomainError) || error.status >= 500) throw new DomainError("request-failed", "Die Anfrage konnte nicht verarbeitet werden.", 500);
+    if (technical) throw new DomainError(error.code, "This agent cannot process the attached file.", error.status);
+    if (!(error instanceof DomainError) || error.status >= 500) throw new DomainError("request-failed", "The request could not be processed.", 500);
     throw error;
   }
 };
@@ -80,10 +82,10 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
     return sessions.get(runId);
   };
   const assertMaySend = (access: AccessContext, runId: string) => {
-    if (!access.can("runs.create") && !sessions.hasRun?.(runId) && !global?.isCoordinator(runId)) throw new DomainError("access-denied", "Freie Runs sind für diesen Zugang nicht freigegeben.", 403);
+    if (!access.can("runs.create") && !sessions.hasRun?.(runId) && !global?.isCoordinator(runId)) throw new DomainError("access-denied", "Free runs are not enabled for this access.", 403);
   };
   const assertSettingsReachable = (local: boolean) => {
-    if (!local && sources.settingsGuarded()) throw new DomainError("settings-local-only", "Einstellungen sind nur lokal oder mit Zugangstoken verfügbar", 403);
+    if (!local && sources.settingsGuarded()) throw new DomainError("settings-local-only", "Settings are only available locally or with an access token", 403);
   };
   return [
     implement(coreContracts.runs.list, (_input, { access }) => sessions.list(runListScope(access, policy))),
@@ -100,14 +102,14 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
     implement(coreContracts.chat.sendToActor, async ({ runId, actorId, text, attachments }, { access }) => {
       assertMaySend(access, runId);
       const current = await session(access, runId, "write");
-      if (!current.sendToActor) throw new DomainError("actor-send-unavailable", "Actor-Nachrichten sind nicht verfügbar", 404);
+      if (!current.sendToActor) throw new DomainError("actor-send-unavailable", "Actor messages are not available", 404);
       const message = messageOf(text, attachments);
       await guardedForUser(access, () => current.sendToActor!(actorId, message.text, message.attachments, userOf(access)));
       return null;
     }),
     implement(coreContracts.chat.start, async ({ runId, entry, input }, { access }) => {
       const trimmed = entry.trim();
-      if (!canStartEntry(access, trimmed)) throw new DomainError("access-denied", "Dieses Setup ist für diesen Zugang nicht freigegeben.", 403);
+      if (!canStartEntry(access, trimmed)) throw new DomainError("access-denied", "This setup is not enabled for this access.", 403);
       const current = await session(access, runId, "write");
       current.start(trimmed, input === undefined ? null : input, userOf(access));
       return null;
@@ -119,13 +121,13 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
     }),
     implement(coreContracts.chat.capabilities, async ({ runId, actor }, { access }) => {
       const current = await session(access, runId, "read");
-      if (!current.capabilities) throw new DomainError("capabilities-unavailable", "Modellfähigkeiten sind nicht verfügbar", 404);
+      if (!current.capabilities) throw new DomainError("capabilities-unavailable", "Model capabilities are not available", 404);
       const capabilities = await current.capabilities(actor ?? "primary", userIdOf(access));
       return access.can("runs.inspect") ? capabilities : { ...capabilities, model: "" };
     }),
     implement(coreContracts.chat.actorHistory, async ({ runId }, { access }) => {
       const current = await session(access, runId, "read");
-      if (!current.actorConversations) throw new DomainError("actor-history-unavailable", "Actor-Verläufe sind nicht verfügbar", 404);
+      if (!current.actorConversations) throw new DomainError("actor-history-unavailable", "Actor histories are not available", 404);
       return accessibleActorConversations(current.actorConversations(), access);
     }),
     implement(coreContracts.startOptions.list, ({ runId }, { access }) =>
@@ -139,23 +141,23 @@ export const coreMethods = (sources: CoreMethodSources): MethodContribution[] =>
     implement(coreContracts.transfer.export, ({ runId }) => sessions.exportRun(runId)),
     implement(coreContracts.transfer.import, ({ archive, workspacePath }) => {
       const decoded = Buffer.from(archive, "base64");
-      if (decoded.length === 0) throw new DomainError("run-transfer-invalid", "Das Archiv ist leer.", 400);
+      if (decoded.length === 0) throw new DomainError("run-transfer-invalid", "The archive is empty.", 400);
       return sessions.importRun(decoded, workspacePath);
     }),
     implement(coreContracts.settings.read, (_input, { local }) => { assertSettingsReachable(local); return sessions.settings(); }),
     implement(coreContracts.settings.skill, ({ id }, { local }) => { assertSettingsReachable(local); return sessions.skill(id); }),
     implement(coreContracts.settings.titlesRead, (_input, { local }) => { assertSettingsReachable(local); return sessions.titleModelSettings(); }),
     implement(coreContracts.settings.titlesSave, ({ value }, { local }) => { assertSettingsReachable(local); return sessions.saveTitleModelSettings(value); }),
-    implement(coreContracts.plugins.bootstrap, (_input, { access }) => sources.plugins.publicProfile(access)),
+    implement(coreContracts.plugins.bootstrap, (_input, { access }) => ({ ...sources.plugins.publicProfile(access), version: sources.version })),
     implement(coreContracts.external.set, async ({ state }, { local }) => {
-      if (!local) throw new DomainError("local-only", "Nur lokal schaltbar", 403);
+      if (!local) throw new DomainError("local-only", "Can only be switched locally", 403);
       await sources.external.set(state === "on");
       return { external: sources.external.open() };
     }),
   ];
 };
 
-export const coreChannels = (sources: Pick<CoreMethodSources, "sessions" | "global" | "runOwner" | "runOwnerOnly">): ChannelContribution[] => {
+export const coreChannels = (sources: Pick<CoreMethodSources, "sessions" | "plugins" | "global" | "runOwner" | "runOwnerOnly">): ChannelContribution[] => {
   const { sessions, global } = sources;
   const policy: RunAccessPolicy = { global, ownerOf: sources.runOwner, ownerOnly: sources.runOwnerOnly };
   return [
@@ -174,7 +176,7 @@ export const coreChannels = (sources: Pick<CoreMethodSources, "sessions" | "glob
       assertRunRights(access, runId, "read", policy);
       const current = await sessions.get(runId);
       return current.subscribe((event) => {
-        const visible = accessibleChatEvent(event, access);
+        const visible = accessibleChatEvent(event, access, sources.plugins.accessProjections);
         if (visible) emit(visible);
       });
     }),