@sigrun/sigrun 0.0.0-stage → 0.1.0

package/dist/server/index.js

@@ -0,0 +1,232 @@
+/**
+ * The §5 HTTP server foundation (spec §5).
+ *
+ * `createServer` builds a Fastify app over one `OpenedHarness` — a thin
+ * layer: conversation endpoints serialize pi-durable's native
+ * `ConversationView` (via `views.ts`), `GET /v1/meta` reports boot facts.
+ * The factory registers routes and returns; it never listens (the deploy
+ * entry listens; tests use `app.inject()`).
+ *
+ * Route modules registered here, each a pure `(app, ctx)` registrar over
+ * the shared `ServerContext`: the deploy probes (`routes/probes.ts`),
+ * the boot-fact routes (`routes/meta.ts`), the conversation lifecycle +
+ * session-meta routes incl. the JSONL import parser
+ * (`routes/conversations.ts`), the SSE view stream (`routes/stream.ts`),
+ * the submission lifecycle routes (`routes/submissions.ts`), the
+ * interaction + ambient seam routes (docs/approval-ux-seams.md,
+ * `routes/interactions.ts`), the workspace file routes
+ * (`routes/files.ts`), the provider surface routes
+ * (`routes/providers.ts`), the settings store routes
+ * (`routes/settings.ts`), and the Prometheus text exposition
+ * (`routes/metrics.ts`, W2 Task 8). This module only composes: the Fastify
+ * instance, the identity hook, the webui mount, the reserved-root
+ * ensure, and the register calls — no route handler lives here.
+ *
+ * **Conversation listing (durable):** `GET /v1/conversations` (in
+ * `routes/conversations.ts`) scans storage — `scanConversations` over the
+ * handle `openHarness` exposes — so the listing is the DURABLE set:
+ * conversations other processes or earlier servers created (a restart
+ * forgets nothing), and conversations tasks/tools created inside
+ * pi-durable (the cron case) all list. The harness itself has no
+ * enumeration; the storage scan is authoritative.
+ */
+import Fastify from "fastify";
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { buildCommandCatalog, SLASH_COMMANDS } from "./commands.js";
+import { effectiveMethods } from "../config.js";
+import { registerAuthPipeline } from "./auth/pipeline.js";
+import { isLoopbackHost } from "./auth/loopback.js";
+import { storeAgentChange } from "./helpers.js";
+import { registerCoreOwnershipParticipant } from "./ownership.js";
+import { createHostBridge } from "./host-bridge.js";
+import { registerJobsOwnershipParticipant } from "../jobs/transfer.js";
+import { registerAuthRoutes } from "./routes/auth.js";
+import { registerConversationRoutes } from "./routes/conversations.js";
+import { registerEventRoutes } from "./routes/events.js";
+import { registerExtensionRoutes as registerExtensionSettingsRoutes } from "./routes/extensions.js";
+import { registerExtensionRoutes as mountExtensionRoutes } from "./routes/extension-routes.js";
+import { registerFileRoutes } from "./routes/files.js";
+import { registerJobRoutes } from "./routes/jobs.js";
+import { registerInteractionRoutes } from "./routes/interactions.js";
+import { registerMetaRoutes } from "./routes/meta.js";
+import { registerMetricsRoutes } from "./routes/metrics.js";
+import { registerOnboardingRoutes } from "./routes/onboarding.js";
+import { registerProbeRoutes } from "./routes/probes.js";
+import { registerProviderRoutes } from "./routes/providers.js";
+import { registerSettingsRoutes } from "./routes/settings.js";
+import { registerStreamRoutes } from "./routes/stream.js";
+import { startNotifications } from "./notifications.js";
+import { registerSubmissionRoutes } from "./routes/submissions.js";
+import { registerUserRoutes } from "./routes/users.js";
+import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
+/**
+ * Build the §5 server over one opened harness.
+ *
+ * Ensures the reserved root conversation exists at factory time (the §5
+ * default), so the first list serves it.
+ *
+ * @param opened the booted harness (from `openHarness`) — the server serves
+ * exactly this harness's conversations.
+ * @param config parsed sigrun config; the listen entry consumes
+ * `config.port`, the meta route derives `health.backup` from
+ * `config.backup` presence, and `capabilities.backup` from the same
+ * presence (the §5 backup affordance gate). Identity is the W1 request
+ * pipeline (`auth/pipeline.ts`, registered FIRST below): Host/Origin
+ * checks, the public surface, the env service token, the setup gate,
+ * then the configured methods — the resolved principal stamps
+ * `SessionMeta.owner` at create/fork/import.
+ * @param options.listenHost the host the server will bind (default
+ * `"0.0.0.0"`); the pipeline's Host check and the default method list
+ * (`effectiveMethods`) both derive from it.
+ * @param contributedBundles the extension-contributed webui-bundle registry
+ * (build-and-webui Task 6 threads it here from boot; the serve-time
+ * resolution (Task 5) selects a NAME selector against it — an empty
+ * registry is the no-extension deploy).
+ * @param options.env the boot env (`process.env` at the deploy entry) — the
+ * `/v1/settings` `effective` block classifies env-sourced server keys
+ * against it (spec §6.6). Defaults to `{}` for hand-built test servers
+ * (every key then reports file/default, which is accurate for an
+ * env-less boot).
+ */
+export async function createServer(opened, config, contributedBundles = [], options) {
+    const app = Fastify({ logger: false });
+    const listenHost = options?.listenHost ?? "0.0.0.0";
+    const env = options?.env ?? {};
+    // The one body-limit error shape (spec §6.2, W2): Fastify's
+    // `FST_ERR_CTP_BODY_TOO_LARGE` (raised by any route's `bodyLimit` — the
+    // raw upload PUT, the base64 POST, the JSONL import) becomes the
+    // sigrun `413 {error: "too_large", maxBytes}` with the limit the
+    // failing route actually enforced. Everything else passes through the
+    // default error serialization unchanged.
+    app.setErrorHandler((error, request, reply) => {
+        if (error.code === "FST_ERR_CTP_BODY_TOO_LARGE") {
+            return reply.code(413).send({
+                error: "too_large",
+                maxBytes: request.routeOptions.bodyLimit,
+            });
+        }
+        return reply.send(error);
+    });
+    const methods = effectiveMethods(config.auth, listenHost);
+    // The auth posture warnings (W1 Task 3, the plan's Global
+    // Constraints): once per server, never per request.
+    if (methods.length === 0 && !isLoopbackHost(listenHost)) {
+        console.warn(`sigrun: authentication is DISABLED (methods: []) on a non-loopback bind (${listenHost}) — any reachable client is trusted`);
+    }
+    const broadTrusted = config.auth.proxy.trustedProxies.some((cidr) => {
+        const slash = cidr.indexOf("/");
+        if (slash === -1)
+            return false;
+        const prefix = Number(cidr.slice(slash + 1));
+        const v6 = cidr.includes(":");
+        return v6 ? prefix <= 32 : prefix <= 8;
+    });
+    if (methods.includes("proxy") && broadTrusted) {
+        console.warn("sigrun: auth.proxy.trustedProxies includes a very broad range — a forward-auth method trusts every peer it matches");
+    }
+    // The webui channel bundle (Task 20, spec §4.1/§6; serve-time resolution
+    // is build-and-webui Task 5): resolve enabled-gate → contributed NAME →
+    // PATH → default against `config.webui` and the contributed registry,
+    // then mount the static bundle + SPA fallback when one resolves. An
+    // explicit-but-unresolvable selector rejects here (fail loud, per the
+    // deploy entry's boot contract). Explicit routes win over the static
+    // wildcard, so the /v1 API + probes are unaffected by the mount.
+    const webuiBundle = await resolveWebuiBundle(config, contributedBundles);
+    if (webuiBundle !== undefined) {
+        await serveWebuiBundle(app, webuiBundle);
+    }
+    // The merged slash-command catalog (W5 Task 3): ONE build here — the
+    // core table plus every loaded extension's `commands` declarations —
+    // so the catalog route, the meta collision record, and the invoke
+    // route share one merge (and its warnings fire once, not per route).
+    const commandCatalog = buildCommandCatalog(SLASH_COMMANDS, opened.extensionCommands);
+    // The reserved root is ensured before any route runs. The listing is
+    // durable (the module docstring's "Conversation listing (durable)"
+    // section): it scans storage, so this server serves every recorded
+    // conversation, not only its own creates.
+    // The root conversation's agent carries the settings store's
+    // sigrun-resolved fields too (Task 8b): the root is created once, so its
+    // tool filter / thinking override snapshot at factory time — later
+    // creates re-read the store.
+    const root = await opened.harness.root(BACKGROUND_CONTEXT, {
+        agent: storeAgentChange(opened, opened.defaultModel),
+    });
+    const rootId = root.id;
+    // The shared context every route module receives: the opened harness,
+    // the config, the root id (computed once, never per request), the
+    // resolved webui bundle, the auth-derivation inputs (listenHost + the
+    // effective method list), and the boot env (the settings routes'
+    // `effective` block reads it).
+    const ctx = {
+        opened,
+        config,
+        rootId,
+        webuiBundle,
+        commandCatalog,
+        listenHost,
+        methods,
+        env,
+        watchersByConversation: new Map(),
+    };
+    // The host bridge (W5 Task 5, spec §9.5/§9.7): ONE bridge over this
+    // server's context, bound onto every seam host — the extension-facing
+    // conversations/users/access/identity surface then runs the SAME
+    // conversation ops the routes below run (never a second
+    // implementation). Bound here, after the context exists and before any
+    // route or extension code can serve a request; calls issued earlier
+    // (a factory body) have been waiting on exactly this assignment.
+    opened.bindHostBridge(createHostBridge(ctx));
+    // The notifications surface (W5 Task 6, spec §9.6): one hub
+    // subscription turning host events into per-recipient
+    // NotificationEvents for every collected notifier contribution,
+    // delivered on the event bus's bounded side lane. Started after the
+    // host bridge binds (a notify ctx's `host` serves real calls from
+    // the first event) and never stopped — the surface rides the server
+    // lifetime, like the routes above.
+    startNotifications(ctx);
+    // The pipeline is registered FIRST (W1 Task 3): it replaces the naive
+    // `X-Sigrun-User` hook — Host/Origin checks, the public surface, the
+    // env service token, the setup gate, and method resolution stamp
+    // `request.principal` before any route runs.
+    registerAuthPipeline(app, ctx);
+    registerAuthRoutes(app, ctx);
+    registerOnboardingRoutes(app, ctx);
+    registerUserRoutes(app, ctx);
+    registerProbeRoutes(app, ctx);
+    registerMetaRoutes(app, ctx);
+    registerMetricsRoutes(app, ctx);
+    registerConversationRoutes(app, ctx);
+    registerStreamRoutes(app, ctx);
+    registerEventRoutes(app, ctx);
+    registerSubmissionRoutes(app, ctx);
+    registerInteractionRoutes(app, ctx);
+    registerFileRoutes(app, ctx);
+    registerProviderRoutes(app, ctx);
+    registerSettingsRoutes(app, ctx);
+    registerExtensionSettingsRoutes(app, ctx);
+    // The extension HTTP routes (W5 Task 2, spec §9.2): every collected
+    // `routes` contribution mounted at `/v1/ext/<slug>/<path>` behind the
+    // web-standard Request/Response adapter — per-route auth rides the
+    // pipeline's stage-4b public skip and this module's admin check.
+    mountExtensionRoutes(app, ctx);
+    // The jobs routes (W4 Task 4, spec §8.4): the access-scoped CRUD +
+    // run-now + history surface over `OpenedHarness.jobs` (Task 3's
+    // service). Hidden-is-404 per §5.9; `file:`/`ext:` ids are immutable
+    // (409 `job_declared`); the history routes answer for retired jobs
+    // until retention trims them.
+    registerJobRoutes(app, ctx);
+    // The core ownership participant (W1 Task 4): registered FIRST so
+    // conversations transfer before any extension's `userDeleted`
+    // observer runs (W4's jobs participant registers behind it).
+    registerCoreOwnershipParticipant(ctx);
+    // The jobs ownership participant (W4 Task 3, spec §5.8/§8.3): every
+    // `api` job record owned by the deleted user moves to the transferee
+    // through `writeJobChange` (a NEW hash — the owner rides the spec
+    // identity — so version bumps + a `changedBy:"transfer"` revision,
+    // and the follow-up reconcile recreates the executor task). File jobs
+    // whose DECLARED owner was the deleted user are not touched here; the
+    // next boot's reconciliation warns (the declared owner no longer
+    // exists — the job runs ownerless until the file is edited).
+    registerJobsOwnershipParticipant(ctx);
+    return app;
+}

package/dist/server/notifications.js

@@ -0,0 +1,185 @@
+/**
+ * The notifications surface (core hardening W5 Task 6, spec §9.6): ONE
+ * subscription on the event hub that turns host events into
+ * per-recipient `NotificationEvent`s and delivers them to every
+ * collected notifier contribution (`OpenedHarness.notifierBindings`)
+ * through the event bus's bounded side lane (`eventBus.runBounded`).
+ *
+ * Emitted events (spec §9.6):
+ *
+ * - `interaction.pending` — always. An agent needs a human.
+ * - `job.failed` — always. A job's run record settled `failed` (read
+ *   off the hub's `job.changed` carries; deduped per failed RUN, since
+ *   `job.changed` fires for every record change and a failed `lastRun`
+ *   stays in the row until the next settle).
+ * - `run.settled` — per the LIVE `notifications.runSettled` setting:
+ *   `"unwatched"` (default) only when no `/stream` client is attached
+ *   (the away-from-desk case — `ServerContext.watchersByConversation`),
+ *   `"cron"` only for job-run conversations (`SessionMeta.source ===
+ *   "cron"`), `"always"`, `"never"`.
+ *
+ * Recipients: each event goes to the resource's owner. For
+ * `interaction.pending` it ALSO goes to every directory user with
+ * `write` access (`accessOf`) — anyone who can answer.
+ *
+ * Delivery is best-effort: each notify call is deadline-bounded on the
+ * side lane, a throwing or over-deadline notifier is logged and
+ * isolated (the other notifiers still receive the event), and nothing
+ * is retried durably — reliability is a notifier's own concern. The
+ * hub listener itself never blocks (the hub contract): every delivery
+ * is kicked fire-and-forget onto the side lane.
+ *
+ * Transports live in extensions (ntfy, Signal, web push); core ships
+ * none — with zero notifier contributions this module subscribes
+ * nothing at all.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { accessOf } from "@sigrun/shared/access";
+import { SessionMetaDoc } from "./session-meta.js";
+/** The conversation's display name (spec §9.6): name ?? autoName ?? fallback. */
+function displayName(meta, id) {
+    return meta?.name ?? meta?.autoName ?? `Conversation ${id}`;
+}
+/**
+ * Start the notifications surface. Returns its unsubscribe (the server
+ * never calls it today — the surface rides the process lifetime — but
+ * tests and embedders may). A no-op unsubscribe when no extension
+ * contributed a notifier: nothing subscribes, zero overhead.
+ */
+export function startNotifications(ctx) {
+    const { opened, config } = ctx;
+    const targets = [];
+    for (const binding of opened.notifierBindings) {
+        // The Task 2 ext-route host semantics: the captured seam host,
+        // cast across the not-yet-bridged members.
+        const host = opened.seamHosts.get(binding.extension);
+        for (const notifier of binding.notifiers) {
+            targets.push({ extension: binding.extension, notifier, host });
+        }
+    }
+    if (targets.length === 0)
+        return () => { };
+    const bus = opened.eventBus;
+    const watchers = ctx.watchersByConversation;
+    /** Deliver one occurrence to every recipient through every notifier. */
+    const deliver = (base, recipients) => {
+        // The deep link rides only when the deployment set a public URL and
+        // the event names a conversation.
+        const url = base.conversationId !== undefined && config.publicUrl !== undefined
+            ? `${config.publicUrl}/#/c/${base.conversationId}`
+            : undefined;
+        for (const user of recipients) {
+            const event = {
+                type: base.type,
+                conversationId: base.conversationId,
+                jobId: base.jobId,
+                user,
+                title: base.title,
+                body: base.body,
+                ...(url === undefined ? {} : { url }),
+            };
+            for (const target of targets) {
+                // Fire-and-forget per transport call: one notifier's failure or
+                // hang neither blocks nor loses the others' deliveries.
+                void bus.runBounded(`notifier ${target.extension}.${target.notifier.name}`, () => target.notifier.notify(event, {
+                    host: target.host,
+                }));
+            }
+        }
+    };
+    /** One conversation's live SessionMeta (undefined on absence or read failure, logged). */
+    const metaOf = async (conversationId) => {
+        try {
+            // SAFETY: the host event's plain `number` is the branded
+            // ConversationId the snapshot takes; compared/used by value.
+            return await opened.harness.snapshot(SessionMetaDoc, conversationId, BACKGROUND_CONTEXT);
+        }
+        catch (error) {
+            console.error("notifications: session-meta read failed:", error);
+            return undefined;
+        }
+    };
+    /** interaction.pending → the owner plus every directory user with write. */
+    const handleInteraction = async (conversationId) => {
+        const meta = await metaOf(conversationId);
+        const owner = meta?.owner;
+        const sharing = meta?.sharing;
+        // The owner first (always a recipient — even one the directory no
+        // longer lists); then every directory user whose accessOf is write.
+        const recipients = new Set([owner]);
+        for (const { user, admin } of opened.identity.users.list()) {
+            if (accessOf({ user, superuser: admin }, { owner, sharing }) === "write") {
+                recipients.add(user);
+            }
+        }
+        deliver({
+            type: "interaction.pending",
+            conversationId,
+            jobId: undefined,
+            title: "Sigrun needs you",
+            body: displayName(meta, conversationId),
+        }, recipients);
+    };
+    /** run.settled → the owner, gated by the live `notifications.runSettled` mode. */
+    const handleRunSettled = async (conversationId) => {
+        const mode = opened.settings.read().notifications?.runSettled ?? "unwatched";
+        if (mode === "never")
+            return;
+        const meta = await metaOf(conversationId);
+        if (mode === "cron" && meta?.source !== "cron")
+            return;
+        if (mode === "unwatched" &&
+            (watchers.get(conversationId) ?? 0) > 0) {
+            return;
+        }
+        deliver({
+            type: "run.settled",
+            conversationId,
+            jobId: undefined,
+            title: "Reply ready",
+            body: displayName(meta, conversationId),
+        }, [meta?.owner]);
+    };
+    /**
+     * job.changed → job.failed once per failed RUN. `job.changed` fires
+     * for every record change; the run identity (jobId + fire key +
+     * startedAt) dedupes — a later change re-serving the same failed
+     * `lastRun` never re-notifies, and the next run's settle does.
+     */
+    const lastNotifiedFailedRun = new Map();
+    const handleJobChanged = (job) => {
+        const run = job.lastRun;
+        if (run?.outcome !== "failed")
+            return;
+        const identity = `${run.jobId}:${run.fireAt}:${run.manual}:${run.startedAt}`;
+        if (lastNotifiedFailedRun.get(job.id) === identity)
+            return;
+        lastNotifiedFailedRun.set(job.id, identity);
+        deliver({
+            type: "job.failed",
+            conversationId: run.conversationId,
+            jobId: job.id,
+            title: `Job ${job.name} failed`,
+            // The observer always settles a failed run with its error
+            // text; the fallback only covers a hand-corrupted record.
+            body: run.error ?? "the run failed",
+        }, [job.owner]);
+    };
+    const unsubscribe = opened.events.subscribe((event) => {
+        // The hub contract: no blocking work — each handling is kicked onto
+        // the bus's bounded side lane (resolution + delivery alike never
+        // run inline here).
+        if (event.type === "interaction.pending") {
+            void bus.runBounded("notifications interaction.pending", () => handleInteraction(event.conversationId));
+        }
+        else if (event.type === "run.settled") {
+            void bus.runBounded("notifications run.settled", () => handleRunSettled(event.conversationId));
+        }
+        else if (event.type === "job.changed") {
+            void bus.runBounded("notifications job.changed", () => {
+                handleJobChanged(event.job);
+            });
+        }
+    });
+    return unsubscribe;
+}

package/dist/server/ownership.js

@@ -0,0 +1,67 @@
+/**
+ * Ownership transfer (core hardening W1 Task 4, spec §5.8 user ruling
+ * 9): the participant seam `DELETE /v1/users/:user?transferTo=` drives.
+ *
+ * Core owns ONE participant — the conversation rewrite (`scanConversations`
+ * → session-meta snapshot → one commit per `owner === from` hit). Anything
+ * else that records owners (W4's jobs, extensions' own records via the
+ * `userDeleted` lifecycle event) registers through
+ * {@link registerOwnershipParticipant} and runs in registration order.
+ *
+ * Participants are held per {@link ServerContext} in a module `WeakMap`:
+ * the context record stays the immutable boot artifact the routes
+ * receive, while the registry is server-instance state.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { SCAN_PAGE_SIZE } from "./helpers.js";
+import { SessionMetaDoc } from "./session-meta.js";
+/** The per-server participant lists (registration order = run order). */
+const participants = new WeakMap();
+/**
+ * Register one transfer participant on `ctx`. Callers register at boot or
+ * module-init time (W4's jobs module); the registry never reorders.
+ */
+export function registerOwnershipParticipant(ctx, p) {
+    const list = participants.get(ctx) ?? [];
+    list.push(p);
+    participants.set(ctx, list);
+}
+/**
+ * Run every registered participant for the `from` → `to` transfer, in
+ * registration order. The core conversation participant is registered
+ * first (`createServer`), so conversations transfer before extensions
+ * observe `userDeleted`.
+ */
+export async function transferOwnership(ctx, from, to) {
+    for (const p of participants.get(ctx) ?? []) {
+        await p(from, to);
+    }
+}
+/**
+ * Register the core conversation-ownership participant: the durable scan
+ * is authoritative (conversations other processes created all transfer),
+ * and each `owner === from` hit is ONE commit that rewrites the
+ * session-meta doc's owner — never a read-modify-write across commits.
+ */
+export function registerCoreOwnershipParticipant(ctx) {
+    registerOwnershipParticipant(ctx, async (from, to) => {
+        const { opened } = ctx;
+        let cursor;
+        do {
+            const page = await opened.storage.scanConversations({ order: "ascending" }, SCAN_PAGE_SIZE, cursor, BACKGROUND_CONTEXT);
+            for (const record of page.items) {
+                const conversation = await opened.harness.conversation(record.id, BACKGROUND_CONTEXT);
+                if (conversation === undefined)
+                    continue;
+                const meta = await opened.harness.snapshot(SessionMetaDoc, conversation.id, BACKGROUND_CONTEXT);
+                if (meta?.owner !== from)
+                    continue;
+                await conversation.commit(async (tx) => {
+                    const draft = await tx.doc(SessionMetaDoc, conversation.id);
+                    draft.owner = to;
+                }, BACKGROUND_CONTEXT);
+            }
+            cursor = page.next;
+        } while (cursor !== undefined);
+    });
+}

package/dist/server/readiness.js

@@ -0,0 +1,36 @@
+/**
+ * The shared readiness storage check (core-hardening Task 5): the ONE
+ * derivation behind BOTH `GET /readyz`'s storage verdict and `/metrics`'s
+ * `sigrun_ready` gauge, so the k8s probe and the alerting signal cannot
+ * disagree.
+ *
+ * The check is the exact read `/readyz` has always done (W2 §6.1,
+ * storage-only readiness): resolve the reserved root conversation
+ * through the session line (`storage.conversation()` under
+ * `harness.conversation`) — one real sqlite record fetch proving the db
+ * file + session answer right now. A closed harness throws here
+ * (assertOpen) — caught, reported as "failed"; `undefined` (record gone)
+ * likewise fails — not a harness anyone should route traffic to.
+ *
+ * Core-hardening's finding: `sigrun_up` reflects `harness.inspect()`,
+ * which can stay healthy while this read fails — then `/readyz`
+ * answered 503 but the `/metrics` scrape stayed green and nothing
+ * paged. The gauge answers the same call this function makes.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+/**
+ * The readiness storage check: `"ok"` when the root conversation
+ * resolves through the session line, `"failed"` otherwise (thrown or
+ * absent — either way, not a harness to route traffic to). Never throws.
+ */
+export async function checkStorage(ctx) {
+    try {
+        const conversation = await ctx.opened.harness.conversation(ctx.rootId, BACKGROUND_CONTEXT);
+        // undefined = storage answered but the root record is gone — not a
+        // harness anyone should route traffic to.
+        return conversation === undefined ? "failed" : "ok";
+    }
+    catch {
+        return "failed";
+    }
+}