@sigrun/sigrun 0.6.1 → 0.7.0

package/dist/server/index.js

@@ -34,6 +34,7 @@ import Fastify from "fastify";
 import { join } from "node:path";
 import { LoginFlows } from "./login/flows.js";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { SessionMetaDoc } from "./session-meta.js";
 import { buildCommandCatalog, SLASH_COMMANDS } from "./commands.js";
 import { effectiveMethods } from "../config.js";
 import { registerAuthPipeline } from "./auth/pipeline.js";
@@ -41,6 +42,12 @@ import { isLoopbackHost } from "./auth/loopback.js";
 import { SseRegistry } from "./sse-registry.js";
 import { storeAgentChange } from "./helpers.js";
 import { registerCoreOwnershipParticipant } from "./ownership.js";
+import { createJobsView } from "./core-views/jobs.js";
+import { createSkillsView } from "./core-views/skills.js";
+import { learnedSkillsDir } from "../curation/paths.js";
+import { primaryAdmin } from "../harness/identity/primary-admin.js";
+import { isSuperuser } from "./auth/principal.js";
+import { accessPrincipalOf } from "./auth/access-principal.js";
 import { createHostBridge } from "./host-bridge.js";
 import { registerJobsOwnershipParticipant } from "../jobs/transfer.js";
 import { registerAdminRoutes } from "./routes/admin.js";
@@ -108,6 +115,13 @@ import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
  * env-less boot).
  */
 export async function createServer(opened, config, contributedBundles = [], options) {
+    // Polish A1 (spec §5.2): a server EXISTS here, so every seam host's
+    // bridge is expected — synchronously, before the first await, so a
+    // pre-bind call made while this function opens keeps the bounded wait
+    // instead of failing fast. Rigs that start a server need no open
+    // option; `serve`/`webui/e2e` additionally pass `expectHostBridge:
+    // true` at open for the window BEFORE this call.
+    opened.expectHostBridge();
     const app = Fastify({
         logger: false,
         // U7 Task 3: the image route's GET `src=data:` form carries up to
@@ -273,6 +287,44 @@ export async function createServer(opened, config, contributedBundles = [], opti
             })),
         },
     ]);
+    // The core-owned views (tabs+skills Tasks 4/5/12): the reserved `core`
+    // slug's `SurfaceDef<"view">` list — the built-in Jobs view (Task 5)
+    // and the built-in Skills view (Task 12). The jobs view shares the
+    // routes' access rule (`jobs-access.ts`) and the routes' principal
+    // projection (accessPrincipalOf over the live directory), so the
+    // view and `GET /v1/jobs` always agree on which rows a caller sees.
+    // The skills view resolves every root per CALLER (their workspace +
+    // learned repos, the deployment's config dir and package roots) and
+    // bumps every rendered instance after every write.
+    surfacesService.attachCoreViews([
+        createJobsView({
+            jobs: opened.jobs,
+            now: () => new Date(),
+            accessPrincipal: (principal) => accessPrincipalOf(principal, opened.identity.users),
+        }),
+        createSkillsView({
+            curationOf: (user) => opened.curationOf(user),
+            workspaceRoot: (user) => opened.workspaceRootOf(user),
+            workspaceHistoryFor: (user) => opened.history.workspace(user),
+            learnedDirOf: (user) => {
+                if (opened.identity.users.get(user) === undefined)
+                    return undefined;
+                return learnedSkillsDir(join(opened.extensionStores.roots.dataDir, "users", user));
+            },
+            userDir: join(opened.extensionStores.roots.configDir, "skills"),
+            packageRoots: () => opened.skillRoots,
+            bump: () => surfacesService.bumpAllInstances("core", "skills"),
+            // Whole-branch review I3: the userless superuser (the naive
+            // single-operator principal) acts as the PRIMARY ADMIN — the
+            // identity package's own seam (the jail's fallback). Absent (an
+            // empty directory), the superuser keeps its own scope. An
+            // anonymous NON-superuser never resolves (access none).
+            resolveUserlessCaller: (principal) => principal.user ??
+                (isSuperuser(principal)
+                    ? primaryAdmin(opened.identity.users.list())?.user
+                    : undefined),
+        }),
+    ]);
     app.decorate("surfaces", surfacesService);
     // The chat-block change seam (UI-blocks U5 Task 2, spec §8.2):
     // show_blocks/update_blocks AND the user-edit route publish
@@ -342,6 +394,42 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // the first event) and never stopped — the surface rides the server
     // lifetime, like the routes above.
     startNotifications(ctx);
+    // The jobs view's freshness (tabs+skills Task 5): every `job.changed`
+    // host event bumps every rendered `core/jobs` instance's rev through
+    // the bus's bounded side lane (the hub contract — no work inline);
+    // watching clients refetch the data document (the tree is static).
+    opened.events.subscribe((event) => {
+        if (event.type !== "job.changed")
+            return;
+        void opened.eventBus.runBounded("core/jobs job.changed", () => {
+            surfacesService.bumpAllInstances("core", "jobs");
+        });
+    });
+    // Workspace skills history (tabs+skills Task 10): every settled run
+    // catches up the conversation owner's `<workspace>/skills` repo on the
+    // bus's bounded side lane. Every error is caught and logged — the
+    // settle hook NEVER throws into the event bus — and ownerless
+    // conversations (no SessionMeta owner) do nothing.
+    opened.events.subscribe((event) => {
+        if (event.type !== "run.settled")
+            return;
+        void opened.eventBus.runBounded("history run.settled", async () => {
+            try {
+                const meta = await opened.harness.snapshot(SessionMetaDoc, event.conversationId, BACKGROUND_CONTEXT);
+                const owner = meta?.owner;
+                if (owner === undefined)
+                    return;
+                await opened.history.workspace(owner)?.catchUp({
+                    actor: { kind: "agent" },
+                    summary: "agent changes",
+                    conversationId: event.conversationId,
+                });
+            }
+            catch (error) {
+                console.warn(`workspace history catch-up failed: ${String(error)}`);
+            }
+        });
+    });
     // The pipeline is registered FIRST (W1 Task 3): it replaces the naive
     // `X-Sigrun-User` hook — Host/Origin checks, the public surface, the
     // env service token, the setup gate, and method resolution stamp

package/dist/server/jobs-access.js

@@ -0,0 +1,62 @@
+/**
+ * The §5.9 job access rule, shared (tabs+skills Task 5): moved OUT of
+ * `routes/jobs.ts` unchanged in behaviour so the REST routes and the
+ * `core/jobs` view (`core-views/jobs.ts`) resolve the SAME verdicts —
+ * hidden is absence/404 everywhere, never a 403 tell; a read-only
+ * caller on a write path is the one 403.
+ *
+ * Two shapes, exactly the routes' old inline logic:
+ *
+ * - {@link jobAccess} — the access verdict for one LIVE row (the
+ *   record's owner/sharing through `accessOf`);
+ * - {@link resolveJob} — one job resolved for the access rule: the
+ *   live record's row when it exists; for a RETIRED job (the history
+ *   routes' case) the newest revision's shape, which answers until
+ *   retention trims the records. `undefined` only when neither exists.
+ */
+import { accessOf } from "@sigrun/shared/access";
+/** The §5.9 resource form ({owner?, sharing?}) of a job row. */
+function resourceOf(row) {
+    return {
+        ...(row.owner === undefined ? {} : { owner: row.owner }),
+        ...(row.sharing === undefined ? {} : { sharing: row.sharing }),
+    };
+}
+/** The caller's access to one LIVE job row (§5.9 `accessOf`). */
+export function jobAccess(principal, row) {
+    return accessOf(principal, resourceOf(row));
+}
+/**
+ * Resolve one job for the access rule: the live record's row when it
+ * exists; for a RETIRED job the newest revision's shape (access is
+ * evaluated against that revision's owner/sharing — the record is gone
+ * with the retire). `undefined` only when neither exists (unknown id).
+ */
+export async function resolveJob(jobs, principal, id) {
+    const wire = await jobs.get(id);
+    if (wire !== undefined) {
+        const { access: _ignored, ...row } = wire;
+        return { row, access: accessOf(principal, resourceOf(row)) };
+    }
+    // Retired: the newest revision answers until retention trims it.
+    const [newest] = await jobs.revisions(id);
+    if (newest === undefined)
+        return undefined;
+    const row = {
+        id,
+        name: newest.spec.name,
+        source: newest.source,
+        ...(newest.owner === undefined ? {} : { owner: newest.owner }),
+        ...(newest.sharing === undefined ? {} : { sharing: newest.sharing }),
+        schedule: newest.spec.schedule,
+        action: newest.spec.action,
+        enabled: newest.enabled,
+        version: newest.version,
+    };
+    return {
+        // The retired row's status went with the record; the nudge only
+        // needs identity + definition (clients refetch the list).
+        row: { ...row, state: "disabled" },
+        access: accessOf(principal, resourceOf(row)),
+    };
+}

package/dist/server/notifications.js

@@ -84,20 +84,32 @@ export function startNotifications(ctx) {
             ? `${config.publicUrl}/#/c/${base.conversationId}`
             : undefined;
         for (const user of recipients) {
-            const event = {
-                type: base.type,
-                conversationId: base.conversationId,
-                jobId: base.jobId,
-                ...(base.callId === undefined ? {} : { callId: base.callId }),
+            // Absent optional fields are OMITTED, never null/undefined —
+            // the conditional spreads keep the wire shape exact (callId
+            // rides ONLY interaction.pending; outcome ONLY run.settled).
+            // Build per-variant so the per-recipient event is a complete
+            // NotificationEvent with NO widening cast.
+            const shared = {
+                ...(base.conversationId === undefined
+                    ? {}
+                    : { conversationId: base.conversationId }),
+                ...(base.jobId === undefined ? {} : { jobId: base.jobId }),
                 user,
                 title: base.title,
                 body: base.body,
                 ...(url === undefined ? {} : { url }),
-                // The settled outcome rides ONLY run.settled events — the
-                // other variants never gain the field (the type is the union;
-                // the conditional spread keeps the wire shape exact).
-                ...(base.outcome === undefined ? {} : { outcome: base.outcome }),
             };
+            const event = base.type === "interaction.pending"
+                ? {
+                    type: "interaction.pending",
+                    ...shared,
+                    ...(base.callId === undefined
+                        ? {}
+                        : { callId: base.callId }),
+                }
+                : base.type === "job.failed"
+                    ? { type: "job.failed", ...shared }
+                    : { type: "run.settled", ...shared, outcome: base.outcome };
             deliverEvent(ctx, targets, event);
         }
     };
@@ -157,10 +169,10 @@ export function startNotifications(ctx) {
         // second answer read, no inferred status). An unanswered run never
         // titles itself "Reply ready": the reason is the run's own, with
         // the bare status as the fallback for a reason-less settle.
+        const reason_ = reason ?? "unanswered";
         const settledOutcome = outcome === "answered"
             ? { status: "answered" }
-            : { status: "unanswered", reason: reason ?? "unanswered" };
-        const settledReason = reason ?? "unanswered";
+            : { status: "unanswered", reason: reason_ };
         deliver({
             type: "run.settled",
             conversationId,
@@ -171,7 +183,7 @@ export function startNotifications(ctx) {
                 : "Run ended without a reply",
             body: outcome === "answered"
                 ? displayName(meta, conversationId)
-                : `${displayName(meta, conversationId)} — ${settledReason}`,
+                : `${displayName(meta, conversationId)} — ${reason_}`,
             outcome: settledOutcome,
         }, [meta?.owner]);
     };

package/dist/server/routes/extensions.js

@@ -116,7 +116,15 @@ export function registerExtensionRoutes(app, ctx) {
                 routes: [],
             });
         }
-        return { extensions };
+        // The core-owned views (tabs+skills Task 4): the reserved `core`
+        // slug's view defs under `coreViews` — core views are NOT
+        // extensions, so no `extensions[]` row exists for them (the health
+        // dot is unaffected). Absent when none attach (sparse).
+        const coreViews = ctx.surfaces.coreViews();
+        return {
+            extensions,
+            ...(coreViews.length === 0 ? {} : { coreViews }),
+        };
     });
     // The per-extension settings object (`settings/<slug>.json`), absent
     // file → `{}`. GET is ungated beyond the pipeline: settings values are

package/dist/server/routes/jobs.js

@@ -3,14 +3,15 @@
  * Task 3's JobsService.
  *
  * ACCESS (§5.9, the conversations rule applied to job records): every
- * route resolves `accessOf(principal, {owner, sharing})` against the
- * job RECORD — hidden is 404 `job_not_found` on every `:id` route and
- * absence from the list (no 403 tell); a read-only caller on a write
- * route gets 403. The owner is server-stamped at create
- * (`principal.user`; a body-carried `owner` is stripped) and moves only
- * through the transfer path; `sharing` is the PATCH share surface
- * (mirrored onto the record from the merged spec, exactly like a
- * declared job).
+ * route resolves the shared rule (`jobs-access.ts` — moved out of this
+ * module for tabs+skills Task 5 so the `core/jobs` view resolves the
+ * SAME verdicts) against the job RECORD — hidden is 404
+ * `job_not_found` on every `:id` route and absence from the list (no
+ * 403 tell); a read-only caller on a write route gets 403. The owner is
+ * server-stamped at create (`principal.user`; a body-carried `owner` is
+ * stripped) and moves only through the transfer path; `sharing` is the
+ * PATCH share surface (mirrored onto the record from the merged spec,
+ * exactly like a declared job).
  *
  * The HISTORY routes (`runs`/`revisions`) answer for a RETIRED job too,
  * until retention trims its records — access is evaluated against the
@@ -21,17 +22,10 @@
  * return 409 `job_declared` (edit the source instead). Run-now honors
  * the caller's write access and the job's own `overlap`.
  */
-import { accessOf } from "@sigrun/shared/access";
 import { accessPrincipalOf } from "../auth/access-principal.js";
+import { jobAccess, resolveJob, } from "../jobs-access.js";
 import { JobDeclaredError, JobNotFoundError } from "../../jobs/index.js";
 import { validateJobSpec } from "../../jobs/spec.js";
-/** The §5.9 resource form ({owner?, sharing?}) of a job row. */
-function resourceOf(row) {
-    return {
-        ...(row.owner === undefined ? {} : { owner: row.owner }),
-        ...(row.sharing === undefined ? {} : { sharing: row.sharing }),
-    };
-}
 /**
  * The shared `:id` error mapping: unknown/hidden → 404 `job_not_found`;
  * visible-but-readonly on a write route → 403 (the callers resolve
@@ -59,39 +53,12 @@ export function registerJobRoutes(app, ctx) {
     const jobs = opened.jobs;
     const accessPrincipal = (request) => accessPrincipalOf(request.principal, opened.identity.users);
     /**
-     * Resolve one job for the access rule: the live record's row when it
-     * exists; for a RETIRED job (the history routes' case) the newest
-     * revision's shape. `undefined` only when neither exists (unknown id).
+     * Resolve one job for the access rule (the shared seam): the live
+     * record's row when it exists; for a RETIRED job (the history
+     * routes' case) the newest revision's shape. `undefined` only when
+     * neither exists (unknown id).
      */
-    const resolve = async (request, id) => {
-        const principal = accessPrincipal(request);
-        const wire = await jobs.get(id);
-        if (wire !== undefined) {
-            const { access: _ignored, ...row } = wire;
-            return { row, access: accessOf(principal, resourceOf(row)) };
-        }
-        // Retired: the newest revision answers until retention trims it.
-        const [newest] = await jobs.revisions(id);
-        if (newest === undefined)
-            return undefined;
-        const row = {
-            id,
-            name: newest.spec.name,
-            source: newest.source,
-            ...(newest.owner === undefined ? {} : { owner: newest.owner }),
-            ...(newest.sharing === undefined ? {} : { sharing: newest.sharing }),
-            schedule: newest.spec.schedule,
-            action: newest.spec.action,
-            enabled: newest.enabled,
-            version: newest.version,
-        };
-        return {
-            // The retired row's status went with the record; the nudge only
-            // needs identity + definition (clients refetch the list).
-            row: { ...row, state: "disabled" },
-            access: accessOf(principal, resourceOf(row)),
-        };
-    };
+    const resolve = async (request, id) => await resolveJob(jobs, accessPrincipal(request), id);
     /** The read guard: unknown/hidden → the 404; the row otherwise. */
     const visible = async (request, reply, id) => {
         const resolved = await resolve(request, id);
@@ -106,7 +73,7 @@ export function registerJobRoutes(app, ctx) {
         const principal = accessPrincipal(request);
         const visibleJobs = [];
         for (const row of await jobs.list()) {
-            const access = accessOf(principal, resourceOf(row));
+            const access = jobAccess(principal, row);
             if (access === "none")
                 continue;
             visibleJobs.push({ ...row, access });
@@ -120,7 +87,7 @@ export function registerJobRoutes(app, ctx) {
         if (wire === undefined) {
             return await deny(reply, "job_not_found");
         }
-        const access = accessOf(accessPrincipal(request), resourceOf(wire));
+        const access = jobAccess(accessPrincipal(request), wire);
         if (access === "none") {
             return await deny(reply, "job_not_found");
         }
@@ -222,7 +189,7 @@ export function registerJobRoutes(app, ctx) {
         if (wire === undefined) {
             return await deny(reply, "job_not_found");
         }
-        const access = accessOf(accessPrincipal(request), resourceOf(wire));
+        const access = jobAccess(accessPrincipal(request), wire);
         if (access === "none") {
             return await deny(reply, "job_not_found");
         }
@@ -253,7 +220,7 @@ export function registerJobRoutes(app, ctx) {
         if (wire === undefined) {
             return await deny(reply, "job_not_found");
         }
-        const access = accessOf(accessPrincipal(request), resourceOf(wire));
+        const access = jobAccess(accessPrincipal(request), wire);
         if (access === "none") {
             return await deny(reply, "job_not_found");
         }

package/dist/server/routes/meta.js

@@ -139,6 +139,15 @@ export function registerMetaRoutes(app, ctx) {
                     : { reason: opened.isolation.reason }),
                 osUsers: opened.osUsers.status,
             },
+            // The core-owned views (tabs+skills Task 4): the reserved `core`
+            // slug's view defs, projected per request from the surface service
+            // (the SAME list /v1/extensions serves) — the tab shell's rail
+            // reads them from here and never fetches /v1/extensions separately.
+            // Absent when no core views attached (sparse — Task 4 boots with an
+            // empty list, Tasks 5/12 attach the real views).
+            ...(ctx.surfaces.coreViews().length === 0
+                ? {}
+                : { coreViews: ctx.surfaces.coreViews() }),
             // The seam inventory: declaration-derived, no doc reads.
             seam: {
                 interactions: [...opened.seamKinds]

package/dist/server/routes/onboarding.js

@@ -111,6 +111,15 @@ function resolveProxyIdentity(request, ctx) {
         ...(email === undefined ? {} : { email }),
     };
 }
+/** The accepted claim-body keys, in the validator's switch order. */
+const CLAIM_BODY_FIELDS = [
+    "code",
+    "user",
+    "name",
+    "email",
+    "issueToken",
+    "tokenName",
+];
 /**
  * Validate the claim body strictly: unknown keys and wrong types are
  * client errors (the repo's fail-loud validator posture).
@@ -141,7 +150,10 @@ function validateClaimBody(body) {
                 result.issueToken = value;
                 break;
             default:
-                return { error: "invalid_field", field: key };
+                // Name BOTH directions: the sent key (field) and the accepted
+                // set (expected) — a `username` guess must point at `user`,
+                // never leave the operator to guess (fresh-eyes A3).
+                return { error: "invalid_field", field: key, expected: CLAIM_BODY_FIELDS };
         }
     }
     return result;

package/dist/server/surfaces/service.js

@@ -26,6 +26,7 @@
  */
 import { rewriteImages } from "../images/rewrite.js";
 import { validateTree } from "../../blocks/validate.js";
+import { coreViewInfos } from "../core-views/index.js";
 import { AccessCache } from "./access-cache.js";
 import { ActionDedup } from "./dedup.js";
 import { eventKey, instanceKey as defaultInstanceKey } from "./instance.js";
@@ -148,6 +149,43 @@ export class SurfaceService {
         this.publishChanged = options?.publishChanged;
         this.imageSign = options?.imageSign;
     }
+    /**
+     * Attach the core-owned views (tabs+skills Task 4): registered under
+     * the reserved `core` slug through the same `extra` lookup the
+     * settings surfaces use, so core views render/data/act through the
+     * ONE code path extension surfaces do. Their defs are retained for
+     * the `/v1/meta` + `/v1/extensions` `coreViews` projection (core
+     * views are NOT extensions — no `extensions[]` row, so the health
+     * dot is unaffected).
+     */
+    attachCoreViews(defs) {
+        this.extra.push({ extension: "core", defs });
+        this.coreViewDefs.push(...defs);
+    }
+    /** The attached core-view defs (attachCoreViews order). */
+    coreViewDefs = [];
+    /**
+     * The `coreViews` wire rows (tabs+skills Task 4): id/title/icon (+
+     * refreshMs) per attached core-view def.
+     */
+    coreViews() {
+        return coreViewInfos(this.coreViewDefs);
+    }
+    /**
+     * Bump every KNOWN instance of one surface (tabs+skills Task 4): the
+     * instance table's keys are `slug\u0001id\u0001key`, so a prefix scan
+     * finds every rendered instance; each gets a full {@link bumpRev}
+     * (rev advance + `surface.changed` publication). A surface with NO
+     * rendered instances is a no-op (nothing watches it).
+     */
+    bumpAllInstances(slug, id) {
+        const prefix = `${slug}\u0001${id}\u0001`;
+        for (const composite of this.instances.keys()) {
+            if (!composite.startsWith(prefix))
+                continue;
+            this.bumpRev(slug, id, composite.slice(prefix.length));
+        }
+    }
     /**
      * Attach the settings surfaces post-construction (their save
      * handlers close over THIS service for the optimistic-concurrency

package/dist/skills/index.js

@@ -111,7 +111,7 @@ function unquote(value) {
  * closing delimiter. Returns `undefined` when the block is absent or never
  * closes (neither required field could have parsed).
  */
-function parseSkillFile(text) {
+export function parseSkillFile(text) {
     const lines = text.split(/\r?\n/);
     if (lines[0]?.trim() !== FRONTMATTER_DELIMITER)
         return undefined;