@schlenkr/ragents 0.1.9 → 0.1.11

package/apps/server/src/plugin-support/process-sandbox.ts

@@ -6,7 +6,7 @@ import { SandboxManager, type SandboxRuntimeConfig } from "@anthropic-ai/sandbox
 import { containsWorkspacePath, type ProcessLaunch, type ProcessSandbox } from "@ragents/workspace-executor";
 import { hostRoot } from "../host-version.js";
 
-/** Paketquellen und Git-Hosting, die Builds im Arbeitsbereich brauchen; der eigene Server kommt immer dazu. */
+/** Package sources and git hosting that builds in the workspace need; the own server is always added. */
 export const PROCESS_SANDBOX_DEFAULT_NETWORK: readonly string[] = [
   "registry.npmjs.org",
   "api.nuget.org",
@@ -16,25 +16,27 @@ export const PROCESS_SANDBOX_DEFAULT_NETWORK: readonly string[] = [
   "*.githubusercontent.com",
 ];
 
-/** Die Ordner eines Runs, aus denen seine Regeln entstehen; alles andere unter den geschützten Wurzeln bleibt ihm verborgen. */
+/** The folders of a run from which its rules are made; everything else under the protected roots stays hidden from it. */
 export interface RunSandboxFolders {
   readonly writable: readonly string[];
   readonly readable: readonly string[];
-  /** Der eigene Temp-Ordner des Runs; er ist beschreibbar und steht in TMPDIR. */
+  /** The run's own temp folder; it is writable and set in TMPDIR. */
   readonly temporary: string;
 }
 
-/** Was der Sandbox-Host je Run von der Prozess-Sandbox braucht. */
+/** What the sandbox host needs from the process sandbox per run. */
 export interface RunProcessSandboxes {
   readonly forRun: (folders: RunSandboxFolders) => ProcessSandbox;
 }
 
 export interface ServerProcessSandboxOptions {
-  /** Erlaubte Ziele im Netz, Domains wie in der Profildatei; alles andere scheitert am Proxy. */
+  /** Allowed network targets, domains as in the profile file; everything else fails at the proxy. */
   readonly network: readonly string[];
-  /** Die Adresse dieses Servers, etwa http://127.0.0.1:4710; ohne HTTP keine. */
+  /** The address of this server, such as http://127.0.0.1:4710; none without HTTP. */
   readonly serverAddress: string | undefined;
   readonly dataDirectory: string;
+  /** How the operator turns the sandbox off, as written in the profile file; every message that prevents the start names it. */
+  readonly disableSetting: string;
   readonly hostRoot?: string;
   readonly platform?: NodeJS.Platform;
   readonly environment?: NodeJS.ProcessEnv;
@@ -46,7 +48,7 @@ const shellWord = (value: string): string => `'${value.replaceAll("'", "'\\''")}
 
 const shellCommand = (words: readonly string[]): string => words.map(shellWord).join(" ");
 
-/** Die Umgebung innerhalb der Sandbox: eigener Temp-Ordner, und jeder Netzaufruf geht über den Proxy, auch der zum eigenen Server. */
+/** The environment inside the sandbox: its own temp folder, and every network call goes through the proxy, including the one to the own server. */
 const insideEnvironment = (temporary: string, searchPath: string, platform: NodeJS.Platform): readonly string[] => [
   `PATH=${searchPath}`,
   `TMPDIR=${temporary}`,
@@ -55,13 +57,13 @@ const insideEnvironment = (temporary: string, searchPath: string, platform: Node
   "NO_PROXY=",
   "no_proxy=",
   "NODE_USE_ENV_PROXY=1",
-  // .NET verbindet sich sonst über IPv4-gemappte IPv6-Adressen mit dem Proxy, die die Sandbox von macOS nicht als localhost erkennt.
+  // Otherwise .NET connects to the proxy over IPv4-mapped IPv6 addresses, which the macOS sandbox does not recognize as localhost.
   "DOTNET_SYSTEM_NET_DISABLEIPV6=1",
-  // Build-Knoten und Compiler-Server von .NET überleben den Befehl und nähmen sonst Builds anderer Runs in ihrer eigenen Sandbox an.
+  // .NET build nodes and compiler servers outlive the command and would otherwise accept builds of other runs in their own sandbox.
   "MSBUILDDISABLENODEREUSE=1",
   "DOTNET_CLI_USE_MSBUILD_SERVER=0",
   "UseSharedCompilation=false",
-  // Die Werkzeug-Shims von macOS (git, clang) legen ihren Cache sonst im gesperrten Temp des Servers an.
+  // Otherwise the macOS tool shims (git, clang) create their cache in the server's blocked temp.
   ...platform === "darwin" ? [`xcrun_db=${path.join(temporary, "xcrun_db")}`] : [],
 ];
 
@@ -74,7 +76,7 @@ const serverTarget = (address: string | undefined): readonly string[] => {
 const homeRoots = (platform: NodeJS.Platform): readonly string[] =>
   platform === "darwin" ? ["/Users"] : ["/home", "/root"];
 
-/** Der echte Pfad, auch für einen Ordner, den es noch nicht gibt: sein nächster vorhandener Vorfahr wird aufgelöst. */
+/** The real path, even for a folder that does not exist yet: its nearest existing ancestor is resolved. */
 const realOrGiven = (entry: string): string => {
   try {
     return realpathSync(entry);
@@ -84,17 +86,17 @@ const realOrGiven = (entry: string): string => {
   }
 };
 
-/** Ein Eintrag ist oft ein Symlink (fnm, Homebrew, /tmp unter macOS); die Sandbox prüft das Ziel. */
+/** An entry is often a symlink (fnm, Homebrew, /tmp on macOS); the sandbox checks the target. */
 const resolvedTarget = (entry: string): readonly string[] => {
   const target = realOrGiven(entry);
   return target === entry ? [] : [target];
 };
 
-/** Unter Linux sind alle Unix-Sockets erlaubt; die Sockets, die aus der Sandbox hinausführen, bleiben deshalb unsichtbar. */
+/** On Linux all Unix sockets are allowed; the sockets that lead out of the sandbox therefore stay invisible. */
 const hostSockets = (platform: NodeJS.Platform): readonly string[] =>
   platform === "linux" ? ["/var/run/docker.sock", "/run/docker.sock"].filter((socket) => existsSync(socket)) : [];
 
-/** Wo Geheimnisse und fremde Runs liegen können: Home-Ordner, Temp und der Datenordner des Servers. */
+/** Where secrets and other runs can live: home folders, temp and the server's data folder. */
 const protectedRoots = (options: ServerProcessSandboxOptions, platform: NodeJS.Platform): readonly string[] => [
   os.homedir(),
   ...homeRoots(platform),
@@ -104,16 +106,16 @@ const protectedRoots = (options: ServerProcessSandboxOptions, platform: NodeJS.P
   ...hostSockets(platform),
 ].map(realOrGiven);
 
-/** Was sich alle Runs teilen müssen: unter macOS legen .NET seine benannten Mutexe und MSBuild die Sockets seiner Build-Knoten fest unter /tmp an; unter Linux ist /tmp je Befehl ein eigener leerer Ordner. */
+/** What all runs must share: on macOS .NET creates its named mutexes and MSBuild the sockets of its build nodes at fixed places under /tmp; on Linux /tmp is a separate empty folder per command. */
 const sharedWritable = (platform: NodeJS.Platform): readonly string[] => platform === "darwin"
   ? [".dotnet", `.dotnet-uid${os.userInfo().uid}`, "MSBuild*"].map((name) => path.join(realOrGiven("/tmp"), name))
   : [];
 
-/** Wo Prozesse der Sandbox Unix-Sockets anlegen und erreichen: im Datenordner (Temp der Runs) und unter macOS in /tmp für die Build-Knoten von MSBuild. */
+/** Where sandbox processes create and reach Unix sockets: in the data folder (temp of the runs) and on macOS in /tmp for the MSBuild build nodes. */
 const socketRoots = (dataDirectory: string, platform: NodeJS.Platform): readonly string[] =>
   [dataDirectory, ...platform === "darwin" ? ["/tmp"] : []].map(realOrGiven);
 
-/** Die Sandbox liest einen Symlink in einem gesperrten Ordner nicht (etwa fnm unter ~/.local/state); PATH nennt deshalb die Ziele. */
+/** The sandbox does not read a symlink in a blocked folder (such as fnm under ~/.local/state); PATH therefore names the targets. */
 const resolvedSearchPath = (environment: NodeJS.ProcessEnv): string =>
   [...new Set((environment.PATH ?? "").split(path.delimiter).filter((entry) => entry !== "").map(realOrGiven))].join(path.delimiter);
 
@@ -127,14 +129,14 @@ const entriesOf = (directory: string): readonly string[] => {
   }
 };
 
-/** Ein freigegebener Ordner, der einen gesperrten enthält, wird in seine übrigen Einträge zerlegt; sonst hebelte er die Sperre aus oder die Sperre die Freigaben darin. */
+/** An allowed folder that contains a blocked one is split into its remaining entries; otherwise it would override the block, or the block the allowances inside it. */
 const besideProtected = (entry: string, hidden: readonly string[]): readonly string[] => {
   if (hidden.some((root) => isInside(root, entry))) return [];
   if (!hidden.some((root) => isInside(entry, root))) return [entry];
   return entriesOf(entry).flatMap((child) => besideProtected(child, hidden));
 };
 
-/** Bubblewrap bindet lesbare Ordner nach den beschreibbaren ein; ein lesbarer Vorfahr überdeckte einen beschreibbaren Ordner darin schreibgeschützt und wird deshalb in seine übrigen Einträge zerlegt. */
+/** Bubblewrap binds readable folders after the writable ones; a readable ancestor would cover a writable folder inside it as read-only and is therefore split into its remaining entries. */
 const readableBeside = (entry: string, writable: readonly string[]): readonly string[] => {
   const inside = writable.filter((candidate) => isInside(entry, candidate));
   if (inside.length === 0) return [entry];
@@ -142,7 +144,7 @@ const readableBeside = (entry: string, writable: readonly string[]): readonly st
   return entriesOf(entry).flatMap((child) => readableBeside(child, inside));
 };
 
-/** Toolchains unter einem geschützten Ordner (etwa Node aus fnm oder dotnet-Werkzeuge im Home) bleiben lesbar, nie aber ein Vorfahr des Datenordners. */
+/** Toolchains under a protected folder (such as Node from fnm or dotnet tools in the home folder) stay readable, but never an ancestor of the data folder. */
 const toolchainDirectories = (options: ServerProcessSandboxOptions, protectedPaths: readonly string[]): readonly string[] => {
   const environment = options.environment ?? process.env;
   const entries = [
@@ -158,13 +160,13 @@ const toolchainDirectories = (options: ServerProcessSandboxOptions, protectedPat
   return [...new Set(safe)];
 };
 
-/** Was ein Server der Sandbox für alle seine Runs freigibt: Netzziele und die Ordner, in denen Unix-Sockets liegen dürfen. */
+/** What a server grants the sandbox for all its runs: network targets and the folders in which Unix sockets may live. */
 interface SandboxGrant {
   readonly network: readonly string[];
   readonly unixSockets: readonly string[];
 }
 
-/** Die Bibliothek hat genau einen Zustand je Prozess; mehrere Hosts in einem Prozess teilen ihn, ihre Netzfreigaben werden vereinigt. */
+/** The library has exactly one state per process; several hosts in one process share it, and their network grants are merged. */
 class SharedSandboxRuntime {
   readonly #holders = new Map<object, SandboxGrant>();
   #started: Promise<void> | undefined;
@@ -176,11 +178,11 @@ class SharedSandboxRuntime {
         allowedDomains: [...new Set(grants.flatMap((grant) => grant.network))],
         deniedDomains: [],
         allowUnixSockets: [...new Set(grants.flatMap((grant) => grant.unixSockets))],
-        // Linux kann Unix-Sockets nur ganz oder gar nicht sperren; die Build-Werkzeuge (MSBuild-Knoten) brauchen sie.
+        // Linux can block Unix sockets only all or nothing; the build tools (MSBuild nodes) need them.
         ...process.platform === "linux" ? { allowAllUnixSockets: true } : {},
       },
       filesystem: { denyRead: [], allowWrite: [], denyWrite: [], allowGitConfig: true },
-      // Unter macOS prüfen .NET und Go Zertifikate über trustd; ohne diesen Dienst scheitert jedes TLS.
+      // On macOS .NET and Go check certificates via trustd; without this service every TLS connection fails.
       ...process.platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {},
     };
   }
@@ -213,43 +215,42 @@ class SharedSandboxRuntime {
 
 const sharedRuntime = new SharedSandboxRuntime();
 
-const unsupported = (platform: NodeJS.Platform): Error => new Error(platform === "win32"
-  ? "Die Prozess-Sandbox gibt es auf einem Windows-Server nicht: dort lassen sich die Ordnerregeln je Run nicht setzen. "
-    + "Wer den Server trotzdem unter Windows betreibt, schaltet sie in der Profildatei ausdrücklich ab: "
-    + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace."
-  : `Die Prozess-Sandbox kennt die Plattform ${platform} nicht; unterstützt sind macOS und Linux. `
-    + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+const unsupported = (platform: NodeJS.Platform, disableSetting: string): Error => new Error(platform === "win32"
+  ? "The process sandbox does not exist on a Windows server: the folder rules per run cannot be set there. "
+    + `Whoever runs the server on Windows anyway turns it off explicitly in the profile file: ${disableSetting}.`
+  : `The process sandbox does not know the platform ${platform}; macOS and Linux are supported. `
+    + `${disableSetting} turns it off explicitly.`);
 
-const missingDependencies = (errors: readonly string[]): Error => new Error(
-  `Die Prozess-Sandbox kann nicht starten: ${errors.join("; ")}. `
-  + "Unter Linux braucht sie bubblewrap, socat und ripgrep (Debian/Ubuntu: apt-get install bubblewrap socat ripgrep). "
-  + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+const missingDependencies = (errors: readonly string[], disableSetting: string): Error => new Error(
+  `The process sandbox cannot start: ${errors.join("; ")}. `
+  + "On Linux it needs bubblewrap, socat and ripgrep (Debian/Ubuntu: apt-get install bubblewrap socat ripgrep). "
+  + `${disableSetting} turns it off explicitly.`);
 
-const failedSelfTest = (detail: string): Error => new Error(
-  `Die Prozess-Sandbox lässt sich auf diesem Rechner nicht starten: ${detail.trim() || "ohne Ausgabe"}. `
-  + "Unter Linux braucht bubblewrap Benutzer-Namensräume; in einem Container muss das Profil des Containers sie erlauben. "
-  + "PROCESS_SANDBOX: \"off\" in der Sektion ragents.workspace schaltet sie ausdrücklich ab.");
+const failedSelfTest = (detail: string, disableSetting: string): Error => new Error(
+  `The process sandbox cannot be started on this machine: ${detail.trim() || "no output"}. `
+  + "On Linux bubblewrap needs user namespaces; in a container the container's profile must allow them. "
+  + `${disableSetting} turns it off explicitly.`);
 
-const runSelfTest = (launch: ProcessLaunch, environment: NodeJS.ProcessEnv): Promise<void> => new Promise((resolve, reject) => {
+const runSelfTest = (launch: ProcessLaunch, environment: NodeJS.ProcessEnv, disableSetting: string): Promise<void> => new Promise((resolve, reject) => {
   const child = spawn(launch.command, [...launch.args], { stdio: ["ignore", "ignore", "pipe"], env: environment });
   let stderr = "";
   const timer = setTimeout(() => {
     child.kill("SIGKILL");
-    reject(failedSelfTest(`keine Antwort nach ${SELF_TEST_TIMEOUT_MS / 1000} Sekunden`));
+    reject(failedSelfTest(`no response after ${SELF_TEST_TIMEOUT_MS / 1000} seconds`, disableSetting));
   }, SELF_TEST_TIMEOUT_MS);
   child.stderr.on("data", (chunk: Buffer) => { stderr = (stderr + chunk.toString("utf8")).slice(-2_000); });
   child.once("error", (error) => {
     clearTimeout(timer);
-    reject(failedSelfTest(error.message));
+    reject(failedSelfTest(error.message, disableSetting));
   });
   child.once("close", (code) => {
     clearTimeout(timer);
     if (code === 0) resolve();
-    else reject(failedSelfTest(`Code ${code ?? "Signal"}: ${stderr}`));
+    else reject(failedSelfTest(`code ${code ?? "signal"}: ${stderr}`, disableSetting));
   });
 });
 
-/** Die Prozess-Sandbox des Servers: jeder Prozess eines Runs, den der Executor des Servers startet, läuft mit den Ordnern und Netzzielen seines Runs. */
+/** The server's process sandbox: every process of a run that the server's executor starts runs with the folders and network targets of its run. */
 export class ServerProcessSandbox implements RunProcessSandboxes {
   readonly #options: ServerProcessSandboxOptions;
   readonly #platform: NodeJS.Platform;
@@ -260,23 +261,23 @@ export class ServerProcessSandbox implements RunProcessSandboxes {
   constructor(options: ServerProcessSandboxOptions) {
     this.#options = options;
     this.#platform = options.platform ?? process.platform;
-    if (this.#platform !== "darwin" && this.#platform !== "linux") throw unsupported(this.#platform);
+    if (this.#platform !== "darwin" && this.#platform !== "linux") throw unsupported(this.#platform, options.disableSetting);
     this.#protected = protectedRoots(options, this.#platform);
     this.#readable = [options.hostRoot ?? hostRoot(), ...toolchainDirectories(options, this.#protected)];
     this.#searchPath = resolvedSearchPath(options.environment ?? process.env);
   }
 
-  /** Prüft die Voraussetzungen, startet den Netz-Proxy und startet einmal einen Prozess in der Sandbox; jedes Scheitern ist ein Startfehler. */
+  /** Checks the prerequisites, starts the network proxy and starts one process in the sandbox once; every failure is a start error. */
   async start(): Promise<void> {
     const { errors } = SandboxManager.checkDependencies();
-    if (errors.length > 0) throw missingDependencies(errors);
+    if (errors.length > 0) throw missingDependencies(errors, this.#options.disableSetting);
     await sharedRuntime.acquire(this, {
       network: [...this.#options.network, ...serverTarget(this.#options.serverAddress)],
       unixSockets: socketRoots(this.#options.dataDirectory, this.#platform),
     });
     try {
       const probe = this.forRun({ writable: [], readable: [], temporary: path.join(this.#options.dataDirectory, "sandbox-self-test") });
-      await runSelfTest(await probe.wrap({ command: "true", args: [] }), this.#options.environment ?? process.env);
+      await runSelfTest(await probe.wrap({ command: "true", args: [] }), this.#options.environment ?? process.env, this.#options.disableSetting);
     } catch (error) {
       await sharedRuntime.release(this);
       throw error;

package/apps/server/src/plugin-support/product-model-settings-contract.ts

@@ -14,18 +14,18 @@ export interface ProductModelSettings {
 
 const settings = openJson<ProductModelSettings>("ProductModelSettings");
 
-/** Je Produktplugin ein Paar: die Modellvorgaben lesen und speichern. */
+/** One pair per product plugin: read and save the model defaults. */
 export const productModelSettingsContracts = (pluginId: string) => ({
   read: defineOperation({
     id: `${pluginId}.modelSettings.read`,
-    description: "Die Modellvorgaben der Rollen mit dem verfügbaren Modellkatalog. Recht: settings.read.",
+    description: "The model defaults of the roles with the available model catalog. Right: settings.read.",
     rights: ["settings.read"],
     input: Type.Object({}, { additionalProperties: false }),
     result: settings,
   }),
   save: defineOperation({
     id: `${pluginId}.modelSettings.save`,
-    description: "Die Modellvorgaben der Rollen speichern. Rechte: settings.read und settings.write.",
+    description: "Save the model defaults of the roles. Rights: settings.read and settings.write.",
     rights: ["settings.read", "settings.write"],
     input: Type.Object({ value: openJson<ProductModelDraft>("ProductModelDraft") }, { additionalProperties: false }),
     result: settings,

package/apps/server/src/plugin-support/product-model-settings.ts

@@ -11,8 +11,8 @@ type AgentModelProfile = Extract<AgentProfile, { driver: "agent" }>;
 const invalid = (message: string): DomainError => new DomainError("product-model-invalid", message, 400);
 
 const objectOf = (value: unknown, fields: readonly string[]): Record<string, unknown> => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid(`${fields.join(", ")} sind erforderlich.`);
-  if (Object.keys(value).some((key) => !fields.includes(key))) throw invalid(`Erlaubt sind nur ${fields.join(", ")}.`);
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid(`${fields.join(", ")} are required.`);
+  if (Object.keys(value).some((key) => !fields.includes(key))) throw invalid(`Only ${fields.join(", ")} are allowed.`);
   return value as Record<string, unknown>;
 };
 
@@ -53,7 +53,7 @@ export class ProductModelSettingsStore {
     const selected = this.#selection(profile.name);
     return {
       ...profile, ...selected,
-      description: `${selected.model} mit Denktiefe ${selected.thinking}. ${profile.description}`,
+      description: `${selected.model} with thinking level ${selected.thinking}. ${profile.description}`,
     };
   });
 
@@ -87,25 +87,25 @@ export class ProductModelSettingsStore {
 
   #selection(name: string): ProductModelDraft["profiles"][number] {
     const selected = this.#current.profiles.find((profile) => profile.name === name);
-    if (!selected) throw invalid(`Die Rolle ${name} hat keine Modellvorgabe.`);
+    if (!selected) throw invalid(`The role ${name} has no model default.`);
     return selected;
   }
 
   #validate(value: unknown): ProductModelDraft {
     const { profiles } = objectOf(value, ["profiles"]);
     const expected = this.#agentProfiles();
-    if (!Array.isArray(profiles) || profiles.length !== expected.length) throw invalid(`Vollständig erforderlich sind die Rollen: ${expected.map((profile) => profile.name).join(", ")}.`);
+    if (!Array.isArray(profiles) || profiles.length !== expected.length) throw invalid(`All of these roles are required: ${expected.map((profile) => profile.name).join(", ")}.`);
     const seen = new Set<string>();
     const validated = profiles.map((item: unknown) => {
       const entry = objectOf(item, ["name", "model", "thinking"]);
       const profile = expected.find((candidate) => candidate.name === entry.name);
-      if (!profile) throw invalid(`Unbekannte Rolle ${String(entry.name)}.`);
-      if (seen.has(profile.name)) throw invalid(`Die Rolle ${profile.name} steht doppelt.`);
+      if (!profile) throw invalid(`Unknown role ${String(entry.name)}.`);
+      if (seen.has(profile.name)) throw invalid(`The role ${profile.name} is listed twice.`);
       seen.add(profile.name);
-      if (profile.provider !== this.#choice.provider) throw invalid(`Die Rolle ${profile.name} verwendet einen anderen Provider.`);
-      if (typeof entry.model !== "string" || !this.#choice.options.includes(entry.model)) throw invalid(`Das Modell ${String(entry.model)} steht nicht zur Wahl.`);
+      if (profile.provider !== this.#choice.provider) throw invalid(`The role ${profile.name} uses a different provider.`);
+      if (typeof entry.model !== "string" || !this.#choice.options.includes(entry.model)) throw invalid(`The model ${String(entry.model)} is not available for selection.`);
       const allowed = this.#choice.thinkingOptionsFor(entry.model);
-      if (!isThinkingLevel(entry.thinking) || !allowed.includes(entry.thinking)) throw invalid(`Die Denktiefe ${String(entry.thinking)} ist für ${entry.model} nicht verfügbar (gültig: ${allowed.join(", ")}).`);
+      if (!isThinkingLevel(entry.thinking) || !allowed.includes(entry.thinking)) throw invalid(`The thinking level ${String(entry.thinking)} is not available for ${entry.model} (valid: ${allowed.join(", ")}).`);
       return { name: profile.name, model: entry.model, thinking: entry.thinking };
     });
     return { profiles: expected.map((profile) => validated.find((entry) => entry.name === profile.name)!) };

package/apps/server/src/plugin-support/product-relay.ts

@@ -10,7 +10,7 @@ export interface RelayConnection {
   readonly token: string;
 }
 
-/** Was das Relay je Alias über das dahinterliegende Modell verrät, samt den Kompaktierungswerten des Alias; der echte Name bleibt beim Server. */
+/** What the relay reveals per alias about the model behind it, including the alias's compaction values; the real name stays with the server. */
 export interface RelayCatalogEntry {
   readonly id: string;
   readonly object: "model";
@@ -46,8 +46,8 @@ const isEntry = (value: unknown): value is RelayCatalogEntry => {
 export const relayBaseUrl = (url: string): string => {
   let parsed: URL;
   try { parsed = new URL(url); }
-  catch { throw new Error(`RELAY_URL ist keine gültige Adresse: ${url}`); }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`RELAY_URL braucht http oder https: ${url}`);
+  catch { throw new Error(`RELAY_URL is not a valid address: ${url}`); }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`RELAY_URL needs http or https: ${url}`);
   return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}${RELAY_API_PATH}`;
 };
 
@@ -67,7 +67,7 @@ const modelOf = (entry: RelayCatalogEntry, baseUrl: string): Model<"openai-compl
   ...(entry.catalog.compat ? { compat: entry.catalog.compat as Model<"openai-completions">["compat"] } : {}),
 });
 
-/** Holt den Aliaskatalog des Relays genau einmal; ohne erreichbares Relay ist der Start ein Fehler mit Adresse und Ursache. */
+/** Fetches the relay's alias catalog exactly once; without a reachable relay the start is an error with address and cause. */
 export const createRelayCatalog = (connection: RelayConnection, fetchImpl: typeof fetch = fetch): RelayCatalog => {
   const baseUrl = relayBaseUrl(connection.url);
   let loading: Promise<readonly Model<Api>[]> | undefined;
@@ -78,14 +78,14 @@ export const createRelayCatalog = (connection: RelayConnection, fetchImpl: typeo
     try {
       response = await fetchImpl(address, { headers: { authorization: `Bearer ${connection.token}` }, signal: AbortSignal.timeout(15_000) });
     } catch (error) {
-      throw new Error(`Das Modell-Relay ${address} ist nicht erreichbar: ${error instanceof Error ? error.message : String(error)}`);
+      throw new Error(`The model relay ${address} is unreachable: ${error instanceof Error ? error.message : String(error)}`);
     }
     if (!response.ok) {
-      throw new Error(`Das Modell-Relay ${address} lehnt den Katalogabruf ab: ${response.status} ${(await response.text()).slice(0, 200)}`);
+      throw new Error(`The model relay ${address} rejects the catalog request: ${response.status} ${(await response.text()).slice(0, 200)}`);
     }
     const body = await response.json() as { data?: unknown };
-    if (!Array.isArray(body.data) || !body.data.every(isEntry)) throw new Error(`Das Modell-Relay ${address} liefert keinen gültigen Aliaskatalog`);
-    if (body.data.length === 0) throw new Error(`Das Modell-Relay ${address} bietet keine Modelle an`);
+    if (!Array.isArray(body.data) || !body.data.every(isEntry)) throw new Error(`The model relay ${address} does not return a valid alias catalog`);
+    if (body.data.length === 0) throw new Error(`The model relay ${address} offers no models`);
     for (const entry of body.data) {
       const problem = compactionProblem(entry.catalog.compaction, entry.catalog);
       if (problem) throw new Error(`The model relay ${address} offers ${entry.id} without valid compaction values: ${problem}`);
@@ -98,7 +98,7 @@ export const createRelayCatalog = (connection: RelayConnection, fetchImpl: typeo
     baseUrl,
     load,
     models: () => {
-      if (!loaded) throw new Error(`Der Modellkatalog des Relays ${baseUrl} ist noch nicht geladen`);
+      if (!loaded) throw new Error(`The model catalog of the relay ${baseUrl} is not loaded yet`);
       return loaded;
     },
     registration: async () => ({

package/apps/server/src/plugin-support/product-start-options.ts

@@ -28,14 +28,14 @@ const systemPromptSchema = Type.Object({
 export const modelStartOption = (choice: ModelChoice, preferredThinking: ThinkingLevel | (() => ThinkingLevel)): StartOptionContribution => {
   const resolved = (model: string, wanted: string | undefined): ModelStartOptionValue => {
     if (!choice.options.includes(model)) {
-      throw new DomainError("model-unknown", `Das Modell ${model} steht nicht zur Wahl.`, 404);
+      throw new DomainError("model-unknown", `The model ${model} is not available for selection.`, 404);
     }
     const allowed = choice.thinkingOptionsFor(model);
     if (wanted !== undefined) {
       if (!isThinkingLevel(wanted) || !allowed.includes(wanted)) {
         throw new DomainError(
           "thinking-unknown",
-          `Das Reasoning ${wanted} steht für dieses Modell nicht zur Wahl (gültig: ${allowed.join(", ")}).`,
+          `The reasoning ${wanted} is not available for this model (valid: ${allowed.join(", ")}).`,
           400,
         );
       }
@@ -80,11 +80,11 @@ export const systemPromptStartOption = (catalog: () => SystemPromptCatalog): Sta
     const current = catalog();
     for (const promptId of promptIds) {
       if (!current.options.some((option) => option.id === promptId)) {
-        throw new DomainError("prompt-unknown", `Der Systemprompt ${promptId} ist nicht konfiguriert.`, 404);
+        throw new DomainError("prompt-unknown", `The system prompt ${promptId} is not configured.`, 404);
       }
     }
     const duplicate = promptIds.find((id, index) => promptIds.indexOf(id) !== index);
-    if (duplicate) throw new DomainError("prompt-duplicate", `Der Systemprompt ${duplicate} steht doppelt.`, 400);
+    if (duplicate) throw new DomainError("prompt-duplicate", `The system prompt ${duplicate} is listed twice.`, 400);
     return { promptIds: [...promptIds], shareWithAgents };
   },
   describe: () => {

package/apps/server/src/plugin-support/prompt.ts

@@ -29,7 +29,7 @@ export const boundToTools = (
   ...toolNames: readonly string[]
 ): PromptContribution => {
   if (toolNames.length === 0) {
-    throw new Error(`Der Prompt-Beitrag ${contribution.id} nennt kein Werkzeug, an das er gebunden ist`);
+    throw new Error(`The prompt contribution ${contribution.id} names no tool it is bound to`);
   }
   return { ...contribution, delivery: contribution.delivery ?? "on-demand", requiresTools: toolNames };
 };

package/apps/server/src/plugin-support/provision.ts

@@ -11,7 +11,7 @@ export type ProvisionState =
   | { readonly kind: "ready" }
   | { readonly kind: "gap"; readonly name: string; readonly instruction: string; readonly installable: boolean };
 
-/** Was ein Plugin in `provision.ts` exportiert: der Werkzeugordner ist sein einziger Ablageort. */
+/** What a plugin exports in `provision.ts`: the tool folder is its only storage location. */
 export interface PluginProvision {
   readonly check: (target: string) => Promise<ProvisionState>;
   readonly apply: (target: string, log: (line: string) => void) => Promise<void>;
@@ -36,11 +36,11 @@ export type ArchiveDownload = (url: string) => Promise<Buffer>;
 
 export const downloadArchive: ArchiveDownload = async (url) => {
   const response = await fetch(url);
-  if (!response.ok) throw new Error(`${url} kommt nicht an: ${response.status} ${response.statusText}`);
+  if (!response.ok) throw new Error(`${url} does not arrive: ${response.status} ${response.statusText}`);
   return Buffer.from(await response.arrayBuffer());
 };
 
-/** Legt die Einträge unterhalb von `prefix` als frischen Ordner `directory` im Werkzeugordner ab. */
+/** Stores the entries below `prefix` as a fresh folder `directory` in the tool folder. */
 export const unpackArchive = async (
   archive: Buffer,
   prefix: string,
@@ -48,13 +48,13 @@ export const unpackArchive = async (
   directory: string,
 ): Promise<number> => {
   const entries = readZipEntries(archive, (name) => name.startsWith(prefix));
-  if (entries.length === 0) throw new Error(`Das Archiv enthält keine Einträge unter ${prefix}`);
+  if (entries.length === 0) throw new Error(`The archive contains no entries under ${prefix}`);
   const destination = path.join(target, directory);
   await rm(destination, { recursive: true, force: true });
   for (const entry of entries) {
     const relative = entry.name.slice(prefix.length).split("/");
     if (relative.some((segment) => segment === "" || segment === "." || segment === "..")) {
-      throw new Error(`Der Archiveintrag ${entry.name} verlässt den Werkzeugordner`);
+      throw new Error(`The archive entry ${entry.name} leaves the tool folder`);
     }
     const file = path.join(destination, ...relative);
     await mkdir(path.dirname(file), { recursive: true });
@@ -79,7 +79,7 @@ export const writeProvisionStamp = async (target: string, version: string): Prom
 
 const run = promisify(execFile);
 
-/** Die Hauptversionen der installierten .NET-Laufzeiten, oder undefined, wenn es kein dotnet gibt. */
+/** The major versions of the installed .NET runtimes, or undefined when there is no dotnet. */
 export const dotnetRuntimeMajors = async (): Promise<readonly number[] | undefined> => {
   const output = await run("dotnet", ["--list-runtimes"], { maxBuffer: 4 * 1024 * 1024 }).catch(() => undefined);
   if (!output) return undefined;
@@ -87,5 +87,5 @@ export const dotnetRuntimeMajors = async (): Promise<readonly number[] | undefin
   return [...new Set(majors)].sort((left, right) => left - right);
 };
 
-export const DOTNET_INSTRUCTION = "dotnet fehlt auf diesem Rechner; das .NET-SDK von https://dotnet.microsoft.com/download "
-  + "installieren und dafür sorgen, dass dotnet im PATH steht";
+export const DOTNET_INSTRUCTION = "dotnet is missing on this machine; install the .NET SDK from https://dotnet.microsoft.com/download "
+  + "and make sure dotnet is on the PATH";

package/apps/server/src/plugin-support/run-scripts.ts

@@ -10,18 +10,18 @@ const RUN_FIELDS = ["title", "description", "order", "guide", "tags", "coordinat
 
 const requiredFile = (directory: string, name: string): string => {
   const file = path.join(directory, name);
-  if (!statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`Dem Run-Script ${directory} fehlt die Datei ${name}`);
+  if (!statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`The run script ${directory} is missing the file ${name}`);
   return file;
 };
 
-/** Die Kopfzeile fixed-start-options ist ein JSON-Objekt in einer Zeile: Startoption-Id auf festen Wert. */
+/** The header line fixed-start-options is a JSON object on one line: start option id to fixed value. */
 const fixedStartOptionsOf = (file: string, value: string | undefined): Readonly<Record<string, JsonValue>> | undefined => {
   if (value === undefined) return undefined;
   let parsed: unknown;
   try { parsed = JSON.parse(value); }
-  catch (error) { throw new Error(`${file}: fixed-start-options ist kein JSON (${error instanceof Error ? error.message : String(error)})`); }
+  catch (error) { throw new Error(`${file}: fixed-start-options is not JSON (${error instanceof Error ? error.message : String(error)})`); }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`${file}: fixed-start-options muss ein JSON-Objekt aus Startoption-Id und Wert sein`);
+    throw new Error(`${file}: fixed-start-options must be a JSON object of start option id and value`);
   }
   return parsed as Record<string, JsonValue>;
 };
@@ -34,7 +34,7 @@ const packageFiles = (directory: string, relative = ""): ActorProgramFile[] =>
       if (!relative && ["actors", "RUN.md"].includes(entry.name)) return [];
       const filePath = path.posix.join(relative, entry.name);
       if (entry.isDirectory()) return packageFiles(directory, filePath);
-      if (!entry.isFile()) throw new Error(`${directory}: ${filePath} ist keine reguläre Paketdatei`);
+      if (!entry.isFile()) throw new Error(`${directory}: ${filePath} is not a regular package file`);
       return [{path: filePath, content: readFileSync(path.join(directory, filePath), "utf8")}];
     });
 
@@ -45,29 +45,29 @@ const filesOf = (directory: string): ActorProgramFile[] => {
 
 const runScriptFrom = (directory: string, name: string, id: string): ScriptStartEntry => {
   if (!PACKAGE_NAME.test(name))
-    throw new Error(`${directory}: der Ordnername ${name} ist kein Handle (Kleinbuchstaben, Ziffern, Bindestrich)`);
+    throw new Error(`${directory}: the folder name ${name} is not a handle (lowercase letters, digits, hyphen)`);
   const runFile = requiredFile(directory, "RUN.md");
-  const {fields} = frontMatterOf(runFile, readFileSync(runFile, "utf8"), "title und description");
+  const {fields} = frontMatterOf(runFile, readFileSync(runFile, "utf8"), "title and description");
   const unknown = [...fields.keys()].filter((key) => !RUN_FIELDS.includes(key));
-  if (unknown.length > 0) throw new Error(`${runFile}: unbekannte Kopfzeilen ${unknown.join(", ")}`);
+  if (unknown.length > 0) throw new Error(`${runFile}: unknown header lines ${unknown.join(", ")}`);
   const title = fields.get("title");
   const description = fields.get("description");
-  if (!title) throw new Error(`${runFile}: title fehlt`);
-  if (!description) throw new Error(`${runFile}: description fehlt`);
+  if (!title) throw new Error(`${runFile}: title is missing`);
+  if (!description) throw new Error(`${runFile}: description is missing`);
   const order = numberOf(runFile, "order", fields.get("order"));
   const guide = fields.get("guide");
   const tags = tagsOf(runFile, fields.get("tags"));
   const category = fields.get("category");
-  if (category !== undefined && !category.trim()) throw new Error(`${runFile}: category ist leer`);
+  if (category !== undefined && !category.trim()) throw new Error(`${runFile}: category is empty`);
   const fixedStartOptions = fixedStartOptionsOf(runFile, fields.get("fixed-start-options"));
   const programsDirectory = path.join(directory, "actors");
   const programsStats = statSync(programsDirectory, {throwIfNoEntry: false});
-  if (programsStats && !programsStats.isDirectory()) throw new Error(`${programsDirectory} muss ein Verzeichnis sein`);
+  if (programsStats && !programsStats.isDirectory()) throw new Error(`${programsDirectory} must be a directory`);
   const programs = programsStats ? readdirSync(programsDirectory, {withFileTypes: true})
     .sort((left, right) => left.name.localeCompare(right.name))
     .map((entry) => {
       if (!entry.isDirectory() || !PACKAGE_NAME.test(entry.name))
-        throw new Error(`${programsDirectory}: ${entry.name} ist kein Actor-Programm-Ordner`);
+        throw new Error(`${programsDirectory}: ${entry.name} is not an actor program folder`);
       return {name: entry.name, files: filesOf(path.join(programsDirectory, entry.name))};
     }) : [];
   return {
@@ -90,16 +90,16 @@ export const runScriptsFromDirectory = (directory: string, idPrefix: string): re
   const resolved = path.resolve(directory);
   let entries;
   try { entries = readdirSync(resolved, {withFileTypes: true}); }
-  catch (error) { throw new Error(`Das Run-Script-Verzeichnis ${resolved} ist nicht lesbar (${error instanceof Error ? error.message : String(error)})`); }
+  catch (error) { throw new Error(`The run script directory ${resolved} is not readable (${error instanceof Error ? error.message : String(error)})`); }
   const packages = entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const stray = entries.filter((entry) => !entry.isDirectory()).map((entry) => entry.name);
-  if (stray.length > 0) throw new Error(`${resolved} enthält Dateien statt Run-Script-Ordner: ${stray.join(", ")}`);
-  if (packages.length === 0) throw new Error(`${resolved} enthält keinen Run-Script-Ordner`);
+  if (stray.length > 0) throw new Error(`${resolved} contains files instead of run script folders: ${stray.join(", ")}`);
+  if (packages.length === 0) throw new Error(`${resolved} contains no run script folder`);
   return packages.map((name) => runScriptFrom(path.join(resolved, name), name, `${idPrefix}.${name}`));
 };
 
 export const runScriptFromDirectory = (directory: string): ScriptStartEntry => {
-  if (!path.isAbsolute(directory)) throw new Error("Das Run-Script-Paket braucht einen absoluten Serverdateipfad");
+  if (!path.isAbsolute(directory)) throw new Error("The run script package needs an absolute server file path");
   const resolved = path.resolve(directory);
   return runScriptFrom(resolved, path.basename(resolved), `local.${path.basename(resolved)}`);
 };