@sigrun/sigrun 0.7.0 → 0.9.0

package/dist/notices/validate.js

@@ -0,0 +1,311 @@
+/**
+ * Notice input validation (notices spec §1): shape, the `NOTICE_LIMITS`
+ * bounds, the key and action-id grammars, https-only `open`, duplicate
+ * action ids, and — on the post path only — that every `extension`
+ * action names a handler the posting extension declared.
+ *
+ * Two entry points, because a STORED notice outlives its extension:
+ * `validateNoticeShape` is what the store re-validates a loaded entry
+ * with (spec §3: a notice whose extension is disabled or unloaded stays
+ * dismissible), while `validateNoticeInput` adds the declared-handler
+ * gate a fresh post must pass. Both rebuild the accepted input from the
+ * validated fields only, so an unknown key — including a stored
+ * `id`/`owner`/`at`, which are the store's own checks — never rides into
+ * the record.
+ *
+ * Every rejection names the offending field (`actions[0].url`); the
+ * caller renders `<field>: <message>`, the spec's fail-loud posture.
+ * Access checks (does the user exist, can they see the conversation)
+ * belong to the service, not here.
+ */
+import { ICON_NAMES, canonicalJson } from "@sigrun/shared/blocks";
+import { NOTICE_ACTION_ID_RE, NOTICE_KEY_RE, NOTICE_LIMITS, } from "@sigrun/shared/notices";
+/**
+ * Every `Tone` member as a runtime set. The `Record<Tone, true>` annotation
+ * is the drift guard: a member added to the blocks union without a line
+ * here fails the typecheck rather than being rejected at post time.
+ */
+const TONES = new Set(Object.keys({
+    neutral: true,
+    accent: true,
+    good: true,
+    warn: true,
+    bad: true,
+    info: true,
+}));
+/** The closed icon set (the block contract's own names). */
+const ICONS = new Set(ICON_NAMES);
+/** The three action kinds (spec §1). */
+const ACTION_KINDS = ["navigate", "open", "extension"];
+/** The core targets a `navigate` action may name (the blocks `CoreTarget`). */
+const TARGET_KEYS = ["conversation", "job", "settings", "view"];
+/**
+ * Validate a notice's shape, bounds and grammars — no handler check.
+ * Used on load (a stored entry) and as the first half of the post path.
+ */
+export function validateNoticeShape(input) {
+    if (!isRecord(input)) {
+        return invalid("notice", "a notice must be an object");
+    }
+    const user = input.user;
+    if (typeof user !== "string" || user === "") {
+        return invalid("user", "must be a non-empty string");
+    }
+    const title = input.title;
+    if (typeof title !== "string" || title === "") {
+        return invalid("title", "must be a non-empty string");
+    }
+    if (title.length > NOTICE_LIMITS.title) {
+        return invalid("title", `longer than ${NOTICE_LIMITS.title} characters`);
+    }
+    const conversationId = input.conversationId;
+    if (conversationId !== undefined) {
+        if (typeof conversationId !== "number" || !Number.isInteger(conversationId)) {
+            return invalid("conversationId", "must be an integer");
+        }
+    }
+    const key = input.key;
+    if (key !== undefined) {
+        if (typeof key !== "string" || !NOTICE_KEY_RE.test(key)) {
+            return invalid("key", `must match ${NOTICE_KEY_RE.source}`);
+        }
+    }
+    const body = input.body;
+    if (body !== undefined) {
+        if (typeof body !== "string") {
+            return invalid("body", "must be a string");
+        }
+        if (body.length > NOTICE_LIMITS.body) {
+            return invalid("body", `longer than ${NOTICE_LIMITS.body} characters`);
+        }
+    }
+    const tone = input.tone;
+    if (tone !== undefined && !isTone(tone)) {
+        return invalid("tone", `must be one of ${[...TONES].join("|")}`);
+    }
+    const actions = validateActions(input.actions);
+    if (!actions.ok)
+        return actions;
+    return {
+        ok: true,
+        value: {
+            user,
+            title,
+            ...(conversationId === undefined ? {} : { conversationId }),
+            ...(key === undefined ? {} : { key }),
+            ...(body === undefined ? {} : { body }),
+            ...(tone === undefined ? {} : { tone }),
+            ...(actions.value === undefined ? {} : { actions: actions.value }),
+        },
+    };
+}
+/**
+ * `validateNoticeShape` plus the declared-handler gate: every `extension`
+ * action must name a handler the posting extension declared (the loader's
+ * `noticeActions` keys). Used on post only — a stored notice survives its
+ * extension being unloaded, so load re-validation never calls this.
+ */
+export function validateNoticeInput(input, declaredHandlers) {
+    const shape = validateNoticeShape(input);
+    if (!shape.ok)
+        return shape;
+    for (const [index, action] of (shape.value.actions ?? []).entries()) {
+        if (action.kind !== "extension")
+            continue;
+        if (!declaredHandlers.has(action.name)) {
+            return invalid(`actions[${index}].name`, `no declared handler named ${JSON.stringify(action.name)}`);
+        }
+    }
+    return shape;
+}
+/**
+ * The action list: the count bound, then each action's own shape (the
+ * duplicate-id check rides on the id pass, so the first offending action
+ * wins). Undefined = the notice carries no actions.
+ */
+function validateActions(input) {
+    if (input === undefined)
+        return { ok: true };
+    if (!Array.isArray(input)) {
+        return invalid("actions", "must be an array");
+    }
+    if (input.length > NOTICE_LIMITS.actions) {
+        return invalid("actions", `more than ${NOTICE_LIMITS.actions} actions`);
+    }
+    const actions = [];
+    const ids = new Set();
+    for (let index = 0; index < input.length; index += 1) {
+        const action = validateAction(input[index], `actions[${index}]`);
+        if (!action.ok)
+            return action;
+        if (ids.has(action.value.id)) {
+            return invalid(`actions[${index}].id`, `duplicate action id ${JSON.stringify(action.value.id)}`);
+        }
+        ids.add(action.value.id);
+        actions.push(action.value);
+    }
+    return { ok: true, value: actions };
+}
+/** One action: the shared id/label/icon, then its kind's own fields. */
+function validateAction(input, field) {
+    if (!isRecord(input)) {
+        return invalid(field, "must be an object");
+    }
+    const id = input.id;
+    if (typeof id !== "string" || !NOTICE_ACTION_ID_RE.test(id)) {
+        return invalid(`${field}.id`, `must match ${NOTICE_ACTION_ID_RE.source}`);
+    }
+    const label = input.label;
+    if (typeof label !== "string" || label === "") {
+        return invalid(`${field}.label`, "must be a non-empty string");
+    }
+    if (label.length > NOTICE_LIMITS.label) {
+        return invalid(`${field}.label`, `longer than ${NOTICE_LIMITS.label} characters`);
+    }
+    const icon = input.icon;
+    if (icon !== undefined && !isIconName(icon)) {
+        return invalid(`${field}.icon`, "must be a known icon name");
+    }
+    const base = { id, label, ...(icon === undefined ? {} : { icon }) };
+    const kind = input.kind;
+    if (!ACTION_KINDS.some((known) => known === kind)) {
+        return invalid(`${field}.kind`, `must be one of ${ACTION_KINDS.join("|")}`);
+    }
+    if (kind === "navigate") {
+        const target = validateTarget(input.target, `${field}.target`);
+        if (!target.ok)
+            return target;
+        return { ok: true, value: { ...base, kind, target: target.value } };
+    }
+    if (kind === "open") {
+        const url = input.url;
+        if (typeof url !== "string" || !url.startsWith("https://")) {
+            return invalid(`${field}.url`, "must be an https URL");
+        }
+        if (url.length > NOTICE_LIMITS.url) {
+            return invalid(`${field}.url`, `longer than ${NOTICE_LIMITS.url} characters`);
+        }
+        return { ok: true, value: { ...base, kind, url } };
+    }
+    const name = input.name;
+    if (typeof name !== "string" || name === "") {
+        return invalid(`${field}.name`, "must be a non-empty string");
+    }
+    const payload = input.payload;
+    if (payload !== undefined) {
+        if (!isJsonObject(payload)) {
+            return invalid(`${field}.payload`, "must be a JSON object");
+        }
+        // The bound is canonical JSON bytes (spec §1): key order never
+        // changes whether a payload fits.
+        if (Buffer.byteLength(canonicalJson(payload), "utf8") > NOTICE_LIMITS.payloadBytes) {
+            return invalid(`${field}.payload`, `larger than ${NOTICE_LIMITS.payloadBytes} bytes`);
+        }
+    }
+    const confirm = input.confirm;
+    if (confirm !== undefined) {
+        if (typeof confirm !== "string") {
+            return invalid(`${field}.confirm`, "must be a string");
+        }
+        if (confirm.length > NOTICE_LIMITS.confirm) {
+            return invalid(`${field}.confirm`, `longer than ${NOTICE_LIMITS.confirm} characters`);
+        }
+    }
+    return {
+        ok: true,
+        value: {
+            ...base,
+            kind: "extension",
+            name,
+            ...(payload === undefined ? {} : { payload }),
+            ...(confirm === undefined ? {} : { confirm }),
+        },
+    };
+}
+/**
+ * A `navigate` target: exactly ONE core key, its value shaped as the
+ * blocks `CoreTarget` member declares it (a view target carries the
+ * extension slug, the view id and optional params).
+ */
+function validateTarget(input, field) {
+    if (!isRecord(input)) {
+        return invalid(field, "must be a CoreTarget object");
+    }
+    const present = TARGET_KEYS.filter((key) => input[key] !== undefined);
+    if (present.length !== 1) {
+        return invalid(field, `must carry exactly one of ${TARGET_KEYS.join("|")}`);
+    }
+    const key = present[0];
+    const raw = input[key];
+    if (key === "conversation") {
+        if (typeof raw !== "number" || !Number.isInteger(raw)) {
+            return invalid(`${field}.conversation`, "must be an integer");
+        }
+        return { ok: true, value: { conversation: raw } };
+    }
+    if (key === "job") {
+        if (typeof raw !== "string" || raw === "") {
+            return invalid(`${field}.job`, "must be a non-empty string");
+        }
+        return { ok: true, value: { job: raw } };
+    }
+    if (key === "settings") {
+        if (typeof raw !== "string" || raw === "") {
+            return invalid(`${field}.settings`, "must be a non-empty string");
+        }
+        return { ok: true, value: { settings: raw } };
+    }
+    if (!isRecord(raw)) {
+        return invalid(`${field}.view`, "must be an object");
+    }
+    const extension = raw.extension;
+    const id = raw.id;
+    if (typeof extension !== "string" || extension === "") {
+        return invalid(`${field}.view.extension`, "must be a non-empty string");
+    }
+    if (typeof id !== "string" || id === "") {
+        return invalid(`${field}.view.id`, "must be a non-empty string");
+    }
+    const params = raw.params;
+    if (params !== undefined && !isJsonObject(params)) {
+        return invalid(`${field}.view.params`, "must be a JSON object");
+    }
+    return {
+        ok: true,
+        value: {
+            view: { extension, id, ...(params === undefined ? {} : { params }) },
+        },
+    };
+}
+function invalid(field, message) {
+    return { ok: false, field, message };
+}
+/** A plain record (arrays and null excluded). */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A member of the blocks `Tone` union. */
+function isTone(value) {
+    return typeof value === "string" && TONES.has(value);
+}
+/** A member of the block contract's closed icon set. */
+function isIconName(value) {
+    return typeof value === "string" && ICONS.has(value);
+}
+/** A structurally valid JSON object (a `JsonObject`, never an array). */
+function isJsonObject(value) {
+    return isRecord(value) && Object.values(value).every(isJsonValue);
+}
+/** A structurally valid JSON value. */
+function isJsonValue(value) {
+    if (value === null)
+        return true;
+    const type = typeof value;
+    if (type === "string" || type === "boolean")
+        return true;
+    if (type === "number")
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.every(isJsonValue);
+    return isRecord(value) && Object.values(value).every(isJsonValue);
+}

package/dist/server/conversation-ops.js

@@ -20,7 +20,9 @@ import { AgentDoc, configure } from "@earendil-works/pi-durable";
 import { accessOf, isSharing, } from "@sigrun/shared/access";
 import { extname } from "node:path";
 import { touchActivity } from "../harness/activity.js";
+import { excludeInteractiveTools } from "../harness/interactive-tools.js";
 import { ensureRequestId, recordAuthor, } from "../curation/attribution.js";
+import { QueuedHumanInputsDoc, declinePendingOnMessage, } from "../harness/interactions.js";
 import { resolveServedModelRefreshing } from "../harness/providers/refresh.js";
 import { isSuperuser } from "./auth/principal.js";
 import { isConfinedPath, parseSubmissionInput } from "./content-parts.js";
@@ -243,6 +245,16 @@ export async function createConversationOp(ctx, input = {}) {
         if (input.source !== undefined)
             draft.source = input.source;
         await opened.rewriteUserSelection(tx, conversation.id, undefined, input.owner);
+        // Ask-user Task 3 (spec §6): a conversation created FOR a job hides
+        // the interactive tools — the creation-time filter edits the stored
+        // enabled-tools filter, so the tool is neither offered nor reachable
+        // from nested `executeTool()` calls. An explicit `agent.tools`
+        // selection naming one loses it the same way. A SECOND commit after
+        // `harness.createConversation` is fine: document access is
+        // unrestricted here.
+        if (input.job !== undefined) {
+            await excludeInteractiveTools(tx, conversation.id, opened.interactiveTools);
+        }
     }, BACKGROUND_CONTEXT);
     const view = await readView(conversation);
     return { id: conversation.id, view };
@@ -390,7 +402,45 @@ export async function submitOp(ctx, conversation, input, opts = {}) {
     // The submit pass-through is retired (§6.7): the memory seam's
     // runSettled owns capture, so submissions admit directly.
     const submission = await conversation.submit(draft, BACKGROUND_CONTEXT);
+    // Ask-user Task 2: a human message (no entry, declinesQuestions: true)
+    // declines every pending declinable question and records itself in the
+    // queued-inputs ledger when it was admitted while busy. A rejected
+    // submit (whenBusy: "reject" while busy) throws above and reaches none
+    // of this.
+    if (opts.declinesQuestions === true && opts.entry === undefined) {
+        const declined = await declinePendingOnMessage(opened.harness, conversation.id, opts.user, Date.now(), BACKGROUND_CONTEXT);
+        void declined; // the returned callIds are observational only
+        const admitted = await submission.status(BACKGROUND_CONTEXT);
+        if (admitted.status === "queued") {
+            await opened.harness.commit(async (tx) => {
+                const doc = await tx.doc(QueuedHumanInputsDoc, conversation.id);
+                const byId = doc.byId;
+                byId[String(submission.id)] = {
+                    ...(opts.user !== undefined ? { user: opts.user } : {}),
+                };
+            }, BACKGROUND_CONTEXT);
+        }
+    }
     await recordAuthor(conversation, { submissionId: submission.id }, opts.user, BACKGROUND_CONTEXT);
+    // The implied clear (notices spec §3.2 rule 2): the user's next prompt
+    // in a conversation is them dealing with that conversation's notices,
+    // so every one of THEIR notices naming it goes. Attribution is the
+    // submit path's own (`opts.user` — the route's principal, the bridge's
+    // mapped user, the answer's acting user), exactly like authorship. A
+    // job or curator internal run submits through `conversation.submit`
+    // directly, never this op, so a scheduled run clears nothing. It sits
+    // behind the attribution pair so the notice store's file I/O never
+    // widens the window where the live run's input has no `bySubmission`
+    // key; a failing clear is logged, never fatal — a notice system must
+    // not break a turn.
+    if (opts.user !== undefined) {
+        try {
+            await ctx.notices.clearConversationFor(opts.user, Number(conversation.id));
+        }
+        catch (error) {
+            console.warn(`notices: clearing conversation ${String(conversation.id)} for ${opts.user} failed: ${String(error)}`);
+        }
+    }
     // Admission stamps activity: the sidebar's activity sort must move the
     // moment a prompt lands — before the run settles.
     await touchActivity(opened.harness, conversation.id, opened.now, BACKGROUND_CONTEXT);

package/dist/server/core-views/skills-tree.js

@@ -346,20 +346,11 @@ function skillActions(params, historyAvailable, deleted) {
     }
     return buttons;
 }
-/** The form fields (new skill vs edit: the name is read-only on an existing skill). */
+/** The form fields (new skill vs edit: the name is read-only on an
+ *  existing skill). A new skill always lands in the workspace: the
+ *  learned root is the curator's, so the form offers no choice. */
 function formFields(editingExisting) {
-    const whereChoice = {
-        type: "choice",
-        name: "where",
-        label: "Where",
-        required: true,
-        options: [
-            { id: "workspace", label: "Workspace" },
-            { id: "learned", label: "Learned" },
-        ],
-    };
     return [
-        ...(editingExisting ? [] : [whereChoice]),
         {
             type: "text",
             name: "name",

package/dist/server/core-views/skills.js

@@ -436,7 +436,7 @@ export function createSkillsView(deps) {
     /** The form's pre-filled values (a new skill starts empty; an edit reads the current text). */
     async function formDataOf(params, selection) {
         if (params.skill === undefined || selection === undefined) {
-            return { name: "", description: "", body: "", where: "workspace" };
+            return { name: "", description: "", body: "" };
         }
         try {
             const text = await readSkillFile(selection.skill.rootDir, selection.skill.name, "SKILL.md");
@@ -445,7 +445,6 @@ export function createSkillsView(deps) {
                 name: selection.skill.name,
                 description: parsed?.description ?? selection.skill.description,
                 body: parsed?.body ?? "",
-                where: "workspace",
             };
         }
         catch {
@@ -453,7 +452,6 @@ export function createSkillsView(deps) {
                 name: selection.skill.name,
                 description: selection.skill.description,
                 body: "",
-                where: "workspace",
             };
         }
     }
@@ -722,34 +720,24 @@ export function createSkillsView(deps) {
                 const user = userOf(ctx);
                 if (user === undefined)
                     return { ok: false, error: { message: "forbidden" } };
-                const where = fieldOf(payload, "where") ?? "workspace";
+                // New skills land in the workspace only: the learned root is
+                // the curator's (a user edits, pins or deletes learned skills,
+                // never creates one).
+                const where = fieldOf(payload, "where");
+                if (where !== undefined && where !== "workspace") {
+                    return {
+                        ok: false,
+                        error: { message: "new skills go in the workspace; learned skills come from the curator", field: "where" },
+                    };
+                }
                 const name = fieldOf(payload, "name");
                 const description = fieldOf(payload, "description");
-                const body = fieldOf(payload, "body");
                 if (name === undefined || !validSkillName(name)) {
                     return { ok: false, error: { message: "a valid skill name is required (lowercase letters, digits, dashes)", field: "name" } };
                 }
                 if (description === undefined || description.trim() === "") {
                     return { ok: false, error: { message: "a description is required", field: "description" } };
                 }
-                if (where === "learned") {
-                    const curation = deps.curationOf(user);
-                    if (curation === undefined) {
-                        return { ok: false, error: { message: "learned skills are unavailable" } };
-                    }
-                    try {
-                        await curation.store.apply(name, { kind: "create", content: skillFileText(name, description.trim(), body ?? "") }, { actor: "user" });
-                    }
-                    catch (error) {
-                        return failure(error);
-                    }
-                    deps.bump();
-                    return {
-                        ok: true,
-                        toast: `Created ${name}`,
-                        navigate: { type: "navigate", params: { skill: name, root: "learned" } },
-                    };
-                }
                 return workspaceWrite(ctx, payload, { mode: "create" });
             },
             save: async (ctx, payload) => {

package/dist/server/host-bridge.js

@@ -17,6 +17,7 @@
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { accessOf as accessOfShared } from "@sigrun/shared/access";
+import { completeOnce } from "../harness/complete.js";
 import { effectiveAdmin } from "../harness/identity/groups.js";
 import { userWire } from "./routes/users.js";
 import { accessPrincipalOf } from "./auth/access-principal.js";
@@ -24,6 +25,7 @@ import { abortOp, compactOp, configureOp, ConversationOpError, createConversatio
 import { listModels } from "./helpers.js";
 import { notifyExtension } from "./notifications.js";
 import { SessionMetaDoc } from "./session-meta.js";
+import { isJobRunConversation } from "../harness/interactive-tools.js";
 import { accountLinkWire, serializeConversationView } from "./views.js";
 /**
  * Host-side callers see effective admin derived from stored groups;
@@ -70,6 +72,9 @@ export function createHostBridge(ctx) {
                     ...(opts?.whenBusy === undefined
                         ? {}
                         : { whenBusy: opts.whenBusy }),
+                    // Ask-user Task 2: a host submit counts as a human message
+                    // (declines pending questions) only when it carries a user.
+                    declinesQuestions: opts?.user !== undefined,
                 });
             },
             async watch(id, listener) {
@@ -193,6 +198,32 @@ export function createHostBridge(ctx) {
                     state: job.state,
                 };
             },
+            async activeRun(conversationId) {
+                const jobs = await opened.jobs.list();
+                let best;
+                for (const job of jobs) {
+                    const run = job.lastRun;
+                    if (run === undefined)
+                        continue;
+                    if (run.outcome !== "running")
+                        continue;
+                    if (run.conversationId !== Number(conversationId))
+                        continue;
+                    if (best !== undefined && run.startedAt <= best.startedAt)
+                        continue;
+                    best = { jobId: job.id, owner: job.owner, startedAt: run.startedAt };
+                }
+                // startedAt is the tiebreak only — the wire shape is {jobId, owner}.
+                return best === undefined ? undefined : { jobId: best.jobId, owner: best.owner };
+            },
+            async isJobRun(conversationId) {
+                // The detection reads COMMITTED durable state (session meta,
+                // the live doc, submission records) — it never participates in
+                // the caller's transaction, so the bridge's own background
+                // context is the honest one (the HandlerContext arg is a
+                // cancellation surface only).
+                return await isJobRunConversation(opened.harness, conversationId, BACKGROUND_CONTEXT);
+            },
         },
         users: {
             // The directory in wire form (emails are admin material; the
@@ -252,11 +283,32 @@ export function createHostBridge(ctx) {
             },
         },
         // Gateway C4b: the model catalog — the SAME source function the
-        // `GET /v1/models` route serves (one construction, never two).
+        // `GET /v1/models` route serves (one construction, never two) —
+        // plus one-shot completions (warden Task 4), read-live settings
+        // per call so a `namingModel` change applies without a restart.
+        // Warden Task 6: the decision registry — the seam host's
+        // `decisions` members delegate here; `slug` is the CALLING
+        // extension's identity (read at call time), which the registry
+        // stamps as `caller` on the provider's context.
+        decisions: {
+            async evaluate(slug, request, opts = {}) {
+                return opened.decisions.evaluate(slug, request, opts);
+            },
+            async list() {
+                return opened.decisions.list();
+            },
+        },
         models: {
             async list() {
                 return listModels(opened);
             },
+            async complete(input) {
+                return completeOnce({
+                    models: opened.models,
+                    defaultModel: opened.defaultModel,
+                    readSettings: () => opened.settings.read(),
+                }, input);
+            },
         },
         commands: {
             // The merged catalog rows (`GET /v1/commands`' core + extension
@@ -304,6 +356,15 @@ export function createHostBridge(ctx) {
             },
         },
         notify: (slug, input) => notifyExtension(ctx, slug, input),
+        // Notices Task 3: the calling extension's slug is the posting owner
+        // (the service enforces the owner scoping); rejections surface to the
+        // caller as rejected promises, the same fail-loud posture as ambient
+        // writes.
+        notices: {
+            post: (slug, input) => ctx.notices.post(slug, input),
+            clear: (slug, selector) => ctx.notices.clear(slug, selector),
+            list: (slug, user) => ctx.notices.listForExtension(slug, user),
+        },
         surfaces: {
             // UI-blocks U3 Task 4 (spec §7.3): the same bumpRev the actions
             // route takes — the rev advance and the hub event are one step.

package/dist/server/index.js

@@ -35,6 +35,8 @@ import { join } from "node:path";
 import { LoginFlows } from "./login/flows.js";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { SessionMetaDoc } from "./session-meta.js";
+import { NoticesService } from "../notices/service.js";
+import { visibleToUser } from "./visibility.js";
 import { buildCommandCatalog, SLASH_COMMANDS } from "./commands.js";
 import { effectiveMethods } from "../config.js";
 import { registerAuthPipeline } from "./auth/pipeline.js";
@@ -64,6 +66,7 @@ import { registerInteractionRoutes } from "./routes/interactions.js";
 import { registerMeRoutes } from "./routes/me.js";
 import { registerMetaRoutes } from "./routes/meta.js";
 import { registerMetricsRoutes } from "./routes/metrics.js";
+import { registerNoticeRoutes } from "./routes/notices.js";
 import { registerOnboardingRoutes } from "./routes/onboarding.js";
 import { registerProbeRoutes } from "./routes/probes.js";
 import { registerProviderRoutes } from "./routes/providers.js";
@@ -201,6 +204,27 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // effective method list), and the boot env (the settings routes'
     // `effective` block reads it).
     const sse = new SseRegistry();
+    // The notices service (notices Task 3): over the per-user store files,
+    // with `visibleToUser` as its arbitrary-user visibility answer and the
+    // hub as its notice.changed sink (the events route's notice.changed
+    // case narrows delivery to the notice user's own streams).
+    const noticesService = new NoticesService({
+        opened,
+        userArea: (user) => join(opened.extensionStores.roots.dataDir, "users", user),
+        visible: (conversationId, user) => visibleToUser(
+        // SAFETY: `visibleToUser` reads only `opened` off the context
+        // (its own doc); the full ServerContext does not exist yet.
+        { opened }, conversationId, user),
+        publish: (event) => {
+            opened.events.publish(event);
+        },
+        now: () => new Date(),
+        log: (line) => console.warn(line),
+    }, {
+        ...(options?.noticeActionTimeoutMs === undefined
+            ? {}
+            : { actionTimeoutMs: options.noticeActionTimeoutMs }),
+    });
     // The chat-surface seam's unsubscribe (filled in just below, after
     // the events hub exists to publish onto; never reassigned after).
     let unsubscribeChatSurfaceChanged = () => { };
@@ -366,6 +390,7 @@ export async function createServer(opened, config, contributedBundles = [], opti
         publishSettingsChanged: opened.publishSettingsChanged,
         watchersByConversation: new Map(),
         surfaces: surfacesService,
+        notices: noticesService,
         sse,
         imageProxy: { cache: imageCache, deps: imageDeps, key: imageKey },
         ...(options?.gateway === undefined ? {} : { gateway: options.gateway }),
@@ -452,6 +477,7 @@ export async function createServer(opened, config, contributedBundles = [], opti
     registerEventRoutes(app, ctx);
     registerSubmissionRoutes(app, ctx);
     registerInteractionRoutes(app, ctx);
+    registerNoticeRoutes(app, ctx);
     registerFileRoutes(app, ctx);
     registerProviderRoutes(app, ctx);
     registerSettingsRoutes(app, ctx);

package/dist/server/routes/events.js

@@ -178,6 +178,26 @@ export function registerEventRoutes(app, ctx) {
                         treeRev: event.treeRev,
                     };
                 }
+                // Notices (notices Task 4, spec §4): the hub copy carries the
+                // recipient user (NoticeChangedInternal — routing metadata,
+                // never wire); the stream delivers ONLY to the notice user's
+                // own principal, and the DELIVERED frame is the wire shape
+                // (the user stripped — a notice event never crosses to another
+                // principal's stream, and its wire carries no user).
+                case "notice.changed": {
+                    // SAFETY: every notice.changed the hub sees comes from the
+                    // notices service, which always attaches the recipient user
+                    // (NoticeChangedInternal) — the wire union's member omits it
+                    // because the DELIVERED frame never carries it.
+                    const internal = event;
+                    if (principal.user !== internal.user)
+                        return undefined;
+                    return {
+                        type: "notice.changed",
+                        ids: internal.ids,
+                        change: internal.change,
+                    };
+                }
                 // An unknown member is NEVER delivered — deny by construction,
                 // not by enumerating the leak shapes. The satisfies check keeps
                 // this arm exhaustive: a new HostEventWire member without a