@songsid/agend 2.3.1 → 2.3.2-beta.10

package/dist/settings-api.js

@@ -1,7 +1,10 @@
+import { officeInputPatch } from "./dashboard-permissions.js";
+import { setNoticeMode } from "./notice-delivery.js";
+import { DEFAULT_REPLY_TRIGGERS } from "./reply-triggers.js";
 import { PUBLIC_TUNNEL_SECRET_ID, PUBLIC_TUNNEL_TOKEN_HINT } from "./public-tunnel-config.js";
 import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { normalizeSettingsInstancePatch, removesInstanceOverride } from "./settings-instance-patch.js";
-import { settingsRequestExecution, settingsRequestLocalAdmin, settingsWrite } from "./settings-request-capability.js";
+import { isSettingsReplay, settingsRequestExecution, settingsRequestLocalAdmin, settingsWrite } from "./settings-request-capability.js";
 import { noteSettingsWrite, settingsUndo, undoSettingsPaths } from "./settings-transaction.js";
 import { readBoundedWebBody } from "./web-body.js";
 import { gatewayRequestContext } from "./web-request-context.js";
@@ -183,6 +186,8 @@ export function handleSettingsRequest(req, res, url, ctx) {
     const path = url.pathname;
     if (!isSettingsPath(path))
         return false;
+    // #2667: validated with the ClassicBot rooms there are now — a guest grant naming one is not an unknown name.
+    const validateFleet = (config) => validateFleetConfig(config, { rooms: ctx.classicRoomNames?.() ?? [] });
     const method = req.method ?? "GET";
     // ── The page: the app shell, which mounts the Settings panel (#1408 step 3) ──
     if (isSettingsPage(path)) {
@@ -200,6 +205,7 @@ export function handleSettingsRequest(req, res, url, ctx) {
     if (method === "GET" && path === "/api/settings/schema") {
         json(res, 200, {
             ...buildSettingsImpactSchema(),
+            reply_triggers_default: DEFAULT_REPLY_TRIGGERS,
             // Non-null means a restart cannot clear the fleet row, so the page shows
             // the mismatch instead of offering a button that can never succeed.
             fleet_signature_mismatch: ctx.fleetSignatureMismatchKeys?.() ?? null,
@@ -210,6 +216,12 @@ export function handleSettingsRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // #2347: what the app-wide "Restart now" banner reads — small, so every page can ask after a Save settles.
+    if (method === "GET" && path === "/api/settings/restart-pending") {
+        const pending = ctx.settingsRestartPending?.() ?? null;
+        json(res, 200, pending ? { pending: true, keys: pending.keys, job_id: pending.job_id } : { pending: false });
+        return true;
+    }
     if (method === "GET" && path === "/api/settings/fleet") {
         json(res, 200, redactInlineSecrets(ctx.fleetConfig ?? {}));
         return true;
@@ -727,6 +739,60 @@ export function handleSettingsRequest(req, res, url, ctx) {
         json(res, 200, ctx.guestOverview());
         return true;
     }
+    // #2348: the picker's people (GET) and an admin's "Send sign-in code" (POST: a DM to an applied grant's account, once
+    // a minute per account — a code is not a settings change: the grant it needs was already confirmed). Never over the
+    // public link; the caller asked again after the body, as the sign-out below.
+    if (path === "/api/settings/guests/people" && method === "GET") {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "guest_settings_not_over_public_link" });
+            return true;
+        }
+        if (!ctx.guestPeople) {
+            json(res, 404, { error: "not available" });
+            return true;
+        }
+        if (!guestSettingsCaller(req, url, ctx)) {
+            json(res, 401, { error: "not authorized" });
+            return true;
+        }
+        res.setHeader("Cache-Control", "no-store");
+        json(res, 200, ctx.guestPeople());
+        return true;
+    }
+    if (path === "/api/settings/guests/send-code" && method === "POST") {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "guest_settings_not_over_public_link" });
+            return true;
+        }
+        if (!ctx.sendGuestCodeByAdmin) {
+            json(res, 404, { error: "not available" });
+            return true;
+        }
+        const caller = guestSettingsCaller(req, url, ctx);
+        if (!caller) {
+            json(res, 401, { error: "not authorized" });
+            return true;
+        }
+        readBody(req, 4096).then(async (buf) => {
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            if (guestSettingsCaller(req, url, ctx) !== caller)
+                return json(res, 401, { error: "no longer authorized" });
+            let body;
+            try {
+                body = JSON.parse(buf.toString("utf-8"));
+            }
+            catch {
+                return json(res, 400, { error: "invalid JSON" });
+            }
+            if (typeof body?.adapterId !== "string" || !body.adapterId || typeof body.userId !== "string" || !body.userId)
+                return json(res, 400, { error: "adapterId and userId required" });
+            // #2365 review: the initiating admin's session, asked again after every wait inside the issuance.
+            const out = await ctx.sendGuestCodeByAdmin({ adapterId: body.adapterId, userId: body.userId }, caller, () => guestSettingsCaller(req, url, ctx) === caller);
+            json(res, out.status, out.body);
+        }).catch(() => json(res, 400, { error: "bad request" }));
+        return true;
+    }
     if (path === "/api/settings/guests/revoke" && method === "POST") {
         if (gatewayRequestContext(req)) {
             json(res, 403, { error: "guest_settings_not_over_public_link" });
@@ -835,13 +901,22 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 }
             }
             const { session: sessionPatch, terminal: terminalPatch } = parsed;
+            // #2499 review: who is saving, asked now, before the save — a session policy saved with it can end this very session
+            // (a shorter sign-in time), and the audit must still name who did it. A confirmation's replay is no one's: null.
+            const auditBy = parsed.guests?.grants !== undefined && !isSettingsReplay(req) ? guestSettingsCaller(req, url, ctx) : null;
             const changes = [];
-            const web = { ...cfg.web };
+            let web = { ...cfg.web };
             let webTerminal = cfg.web_terminal;
             if (parsed.canvasWorker !== undefined) {
                 web.experimental = { ...web.experimental, canvas_worker: parsed.canvasWorker };
                 changes.push({ path: ["web", "experimental", "canvas_worker"], value: parsed.canvasWorker });
             }
+            if (parsed.notifyLogin !== undefined) {
+                const holder = { defaults: cfg.defaults, web };
+                setNoticeMode(holder, "login", parsed.notifyLogin);
+                web = holder.web;
+                changes.push({ path: ["web", "notify_login"], value: web.notify_login }, { path: ["web", "notice_delivery", "login"], remove: true });
+            }
             if (parsed.echo !== undefined) {
                 web.echo_to_channel = parsed.echo;
                 changes.push({ path: ["web", "echo_to_channel"], value: parsed.echo });
@@ -890,6 +965,16 @@ export function handleSettingsRequest(req, res, url, ctx) {
             }
             // #1920 phase 3: guest sign-in (Settings → Web sign-ins → Guests); widening it is confirmed (settings-change.ts).
             if (parsed.guests) {
+                // #2348: a new grant names someone AgEnD has seen in chat, on a connection of this fleet, who is not a fleet admin
+                // (admins sign in as admins). One already granted may be edited or removed whatever the list says now.
+                for (const [key, grant] of Object.entries(parsed.guests.grants ?? {})) {
+                    if (grant === null || (cfg.web?.guests?.grants && Object.hasOwn(cfg.web.guests.grants, key)))
+                        continue;
+                    const at = key.indexOf(":");
+                    const refused = ctx.guestGrantRefusal ? ctx.guestGrantRefusal(key.slice(0, at), key.slice(at + 1)) : "guest grants are not available";
+                    if (refused)
+                        return json(res, 400, { error: refused, key: "guest_grant_refused", account: key });
+                }
                 const applied = applyGuestsPatch(cfg.web?.guests, parsed.guests);
                 if (applied.next)
                     web.guests = applied.next;
@@ -908,8 +993,8 @@ export function handleSettingsRequest(req, res, url, ctx) {
             }
             if (!changes.length)
                 return json(res, 200, { ok: true });
-            const before = validateFleetConfig(cfg);
-            const after = validateFleetConfig({ ...cfg, web, web_terminal: webTerminal });
+            const before = validateFleet(cfg);
+            const after = validateFleet({ ...cfg, web, web_terminal: webTerminal });
             if (rejectIfWorse(res, before, after))
                 return;
             const previous = { web: cfg.web, hadWeb: "web" in cfg, terminal: cfg.web_terminal, hadTerminal: "web_terminal" in cfg };
@@ -934,6 +1019,39 @@ export function handleSettingsRequest(req, res, url, ctx) {
             if (parsed.canvasWorker !== undefined && (previous.web?.experimental?.canvas_worker === true) !== parsed.canvasWorker) {
                 ctx.canvasWorkerSettingChanged?.();
             }
+            // #2348: a grant taken away (or emptied) ends that person's guest access now — sessions, an outstanding code, and
+            // remembered browsers — not at their next request. A narrowed grant keeps its sessions; they see less from now on.
+            const ended = new Map();
+            for (const [key, grant] of Object.entries(parsed.guests?.grants ?? {})) {
+                if (grant !== null && grant.instances.length)
+                    continue;
+                const at = key.indexOf(":");
+                try {
+                    ended.set(key, ctx.revokeGuestWebSessions?.({ adapterId: key.slice(0, at), userId: key.slice(at + 1) })?.count ?? 0);
+                }
+                catch (err) {
+                    ctx.logger.warn({ err }, "settings: could not end a removed guest's sessions");
+                }
+            }
+            // #2348 delta §5: every grant change is audited, widening (confirmed in General, replayed here) or narrowing (at
+            // once) alike: who, how, the agents added and taken away. Agent names only; never message content. Shown under
+            // Recent changes in Settings → Guests (guestOverview), never to a guest or over the public link.
+            if (parsed.guests?.grants !== undefined && ctx.noteGuestGrantChange) {
+                const was = previous.web?.guests?.grants ?? {}, now = cfg.web?.guests?.grants ?? {};
+                const by = auditBy, via = isSettingsReplay(req) ? "confirmed" : "direct";
+                for (const key of new Set([...Object.keys(was), ...Object.keys(now)])) {
+                    const a = new Set(Object.hasOwn(was, key) ? was[key].instances : []), b = new Set(Object.hasOwn(now, key) ? now[key].instances : []);
+                    const added = [...b].filter((n) => !a.has(n)), removed = [...a].filter((n) => !b.has(n));
+                    if (!added.length && !removed.length)
+                        continue;
+                    try {
+                        ctx.noteGuestGrantChange({ by, via, account: key, added, removed, endedSessions: ended.get(key) ?? 0 });
+                    }
+                    catch (err) {
+                        ctx.logger.warn({ err }, "settings: could not audit a guest grant change");
+                    }
+                }
+            }
             json(res, 200, { ok: true, warnings: saveWarnings(before, after) });
         }).catch(() => json(res, 400, { error: "bad request" }));
         return true;
@@ -990,8 +1108,8 @@ export function handleSettingsRequest(req, res, url, ctx) {
             const changes = parsed.map(c => c.value === null
                 ? { path: ["web", "appearance", c.group, c.key], value: undefined, remove: true }
                 : { path: ["web", "appearance", c.group, c.key], value: c.value });
-            const before = validateFleetConfig(cfg);
-            const after = validateFleetConfig({ ...cfg, web });
+            const before = validateFleet(cfg);
+            const after = validateFleet({ ...cfg, web });
             if (rejectIfWorse(res, before, after))
                 return;
             const previous = { web: cfg.web, hadWeb: "web" in cfg };
@@ -1031,7 +1149,7 @@ export function handleSettingsRequest(req, res, url, ctx) {
             const restored = restoreRedactedSecrets(body, cfg.defaults);
             if ("path" in restored)
                 return json(res, 400, { error: `redacted value has no stored credential: defaults.${restored.path}` });
-            const merged = { ...cfg.defaults, ...restored.value };
+            const merged = { ...cfg.defaults, ...officeInputPatch(restored.value) };
             // #1310: locale:null means "clear the key" (user chose Auto). Mirrors
             // how the instance save handles model ("" → delete) and nullable overrides.
             if (body.locale === null || body.locale === "")
@@ -1039,11 +1157,16 @@ export function handleSettingsRequest(req, res, url, ctx) {
             // General → Defaults' "not set" for the tool profile: the key goes (worker for an agent, general for a General).
             if (body.tool_set === null || body.tool_set === "")
                 delete merged.tool_set;
-            const before = validateFleetConfig(cfg);
-            const after = validateFleetConfig({ ...cfg, defaults: merged });
+            const before = validateFleet(cfg);
+            const after = validateFleet({ ...cfg, defaults: merged });
             if (rejectIfWorse(res, before, after))
                 return;
-            settingsWrite(req, () => { cfg.defaults = merged; ctx.saveFleetConfig(); });
+            settingsWrite(req, () => {
+                cfg.defaults = merged;
+                if (typeof body.tips === "boolean" || body.tips === "dm")
+                    setNoticeMode(cfg, "tips", body.tips);
+                ctx.saveFleetConfig();
+            });
             json(res, 200, { ok: true, warnings: saveWarnings(before, after) });
         }).catch(() => json(res, 400, { error: "bad request" }));
         return true;
@@ -1133,8 +1256,8 @@ export function handleSettingsRequest(req, res, url, ctx) {
             }
             const next = { ...cfg, channels: normalizedBody };
             delete next.channel; // channels[] supersedes the legacy single channel
-            const before = validateFleetConfig(cfg);
-            const after = validateFleetConfig(next);
+            const before = validateFleet(cfg);
+            const after = validateFleet(next);
             if (rejectIfWorse(res, before, after))
                 return;
             const previous = { channels: cfg.channels, channel: cfg.channel, hadChannel: "channel" in cfg };
@@ -1185,6 +1308,8 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 delete merged.tool_progress;
             if (body.reply_completion_guard === null)
                 delete merged.reply_completion_guard;
+            if (body.reply_triggers === null)
+                delete merged.reply_triggers;
             const before = validateClassicBotConfig(classic);
             const after = validateClassicBotConfig({ ...classic, defaults: merged });
             if (rejectIfWorse(res, before, after))
@@ -1234,6 +1359,7 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 "model",
                 "auto_pause_after",
                 "collab",
+                "reply_triggers",
                 "context_lines",
                 "tool_progress",
                 "reply_completion_guard",
@@ -1251,6 +1377,9 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 && (typeof body.auto_pause_after !== "number" || !Number.isFinite(body.auto_pause_after) || body.auto_pause_after < 0)) {
                 return json(res, 400, { error: "auto_pause_after must be a non-negative finite number" });
             }
+            if (body.reply_triggers !== undefined && body.reply_triggers !== null && typeof body.reply_triggers !== "boolean") {
+                return json(res, 400, { error: "reply_triggers must be a boolean" });
+            }
             if (body.collab !== undefined && typeof body.collab !== "boolean")
                 return json(res, 400, { error: "collab must be a boolean" });
             if (body.context_lines !== undefined && (!Number.isInteger(body.context_lines) || body.context_lines < 0)) {
@@ -1290,6 +1419,8 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 delete merged.tool_progress;
             if (body.reply_completion_guard === null)
                 delete merged.reply_completion_guard;
+            if (body.reply_triggers === null)
+                delete merged.reply_triggers;
             channels[key] = merged;
             const before = validateClassicBotConfig(previous);
             const after = validateClassicBotConfig(classic);
@@ -1509,7 +1640,7 @@ export function handleSettingsRequest(req, res, url, ctx) {
             json(res, 400, { error: `redacted value has no stored credential: instances.${name}.${restored.path}` });
             return;
         }
-        const patch = restored.value;
+        const patch = officeInputPatch(restored.value);
         let mergedInst;
         try {
             mergedInst = normalizeSettingsInstancePatch(base, patch);
@@ -1518,8 +1649,8 @@ export function handleSettingsRequest(req, res, url, ctx) {
             json(res, 400, { error: "unsupported_instance_null" });
             return;
         }
-        const before = validateFleetConfig(cfg);
-        const after = validateFleetConfig({ ...cfg, instances: { ...cfg.instances, [name]: mergedInst } });
+        const before = validateFleet(cfg);
+        const after = validateFleet({ ...cfg, instances: { ...cfg.instances, [name]: mergedInst } });
         if (rejectIfWorse(res, before, after))
             return;
         settingsWrite(req, () => {
@@ -1579,7 +1710,7 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 // Settings → Agents → Delete, confirmed: the same removal as delete_instance — the agent stops, nothing of it is
                 // left behind (schedules, team places), and its fleet.yaml entry goes.
                 const execution = settingsRequestExecution(req), authorization = authorizeExplicitInstanceRemoval("dashboard-confirmed");
-                (execution ? ctx.removeInstance(name, authorization, execution) : ctx.removeInstance(name, authorization)).then(() => json(res, 200, { ok: true, deleted: name, warnings: validateFleetConfig(cfg).warnings }), (err) => json(res, 500, { error: err.message }));
+                (execution ? ctx.removeInstance(name, authorization, execution) : ctx.removeInstance(name, authorization)).then(() => json(res, 200, { ok: true, deleted: name, warnings: validateFleet(cfg).warnings }), (err) => json(res, 500, { error: err.message }));
                 return true;
             }
             // DELETE never blocks on validation; surface any resulting warnings.
@@ -1588,7 +1719,7 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 clearPausedMarker(join(ctx.dataDir, "instances", name));
                 ctx.saveFleetConfig();
             });
-            json(res, 200, { ok: true, warnings: validateFleetConfig(cfg).warnings });
+            json(res, 200, { ok: true, warnings: validateFleet(cfg).warnings });
             return true;
         }
         if (method === "POST" || method === "PATCH") {