@songsid/agend 2.3.4-beta.7 → 2.3.5-alpha.3

package/dist/web-api.js

@@ -1,4 +1,5 @@
 import { CANVAS_WORKER_EXPERIMENTAL_MESSAGE } from "./web-experimental.js";
+import { MachineSlotLimitError } from "./windows-agents.js";
 import { daemonTopicMode } from "./web-only-fleet.js";
 import { webHumanOrigin } from "./human-delivery-receipts.js";
 import { classifyWebPeer, confirmAfterBody, noAuthority } from "./authority/web-authority.js";
@@ -32,6 +33,7 @@ import { shellRoute } from "./web-shell-routes.js";
 import { createReadStream, createWriteStream, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createHash, randomUUID } from "node:crypto";
 import { CreateInstanceArgs, CreateScheduleArgs, UpdateScheduleArgs, validateArgs } from "./outbound-schemas.js";
 import { scheduleView } from "./web-schedules.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
@@ -54,6 +56,12 @@ import { resolveTz } from "./tz-utils.js";
 import { QUERY_MAX_CHARS, RESULT_MAX, SEARCH_SOURCES } from "./search/search-store.js";
 import { xmsgShown } from "./search/search-docs.js";
 import { WebSendDedupe } from "./web-send-dedupe.js";
+import { handleWindowsCliRequest, nativeCliAuthorization } from "./windows-cli-api.js";
+import { createNativeInstance, handleNativeInstanceRequest } from "./native-instance-api.js";
+import { isWindowsInstance, isNativePaneInstance, isNativeExecInstance } from "./native-instance-registry.js";
+import { handleNativeModelCatalog } from "./native-model-catalog.js";
+import { claudeDocumentedModels } from "./model-catalog-defaults.js";
+import { handleRuntimeRequest } from "./runtime-api.js";
 // ── Strict public-facing schemas ────────────────────────────────────────────
 // web-api endpoints must reject unknown fields so the dashboard cannot inject
 // internal-only flags that would reach handleCreate/scheduler/config writers.
@@ -1871,6 +1879,27 @@ export function handleWebRequest(req, res, url, ctx) {
         return false;
     }
     // ── Static files ───────────────────────────────────────
+    // Native local tools retain their administrator boundary on the shared chat/read/action routes.
+    const nativePath = /^\/ui\/(?:chat|instance|cancel|stop|start|restart)\/([^/]+)$/.exec(path);
+    let nativeTarget = url.searchParams.get("instance") ?? "";
+    if (nativePath) {
+        try {
+            nativeTarget = decodeURIComponent(nativePath[1]);
+        }
+        catch {
+            nativeTarget = "";
+        }
+    }
+    if (isWindowsInstance(ctx.fleetConfig?.instances?.[nativeTarget]) && !nativeCliAuthorization(req, url, ctx)) {
+        json(res, 403, { error: "Windows runtime requires an administrator on the local dashboard" });
+        return true;
+    }
+    if (handleNativeInstanceRequest(req, res, url, ctx))
+        return true;
+    if (handleWindowsCliRequest(req, res, url, ctx))
+        return true;
+    if (handleRuntimeRequest(req, res, url, ctx))
+        return true;
     // #1408: the app shell, for exactly the paths the classifier names (src/web-shell-routes.ts). One page for every
     // route; the client router mounts the panel. A malformed instance name is a 400, an unknown one is the shell (the
     // panel says "not found"), so the response never tells which names exist.
@@ -1926,7 +1955,45 @@ export function handleWebRequest(req, res, url, ctx) {
             json(res, 400, { error: "backend (and optional instance) required" });
             return true;
         }
-        json(res, 200, { backend, models: ctx.modelCatalogFor?.(backend, instance) ?? [] });
+        const runtime = url.searchParams.get("runtime"), refresh = url.searchParams.get("refresh");
+        const machineId = url.searchParams.get("machineId");
+        if (machineId !== null && (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(machineId) || runtime === "wsl")) {
+            json(res, 400, { error: "Invalid model runtime machine" });
+            return true;
+        }
+        if ((runtime !== null && runtime !== "wsl" && runtime !== "windows") || (refresh !== null && refresh !== "1")) {
+            json(res, 400, { error: "Invalid model catalog options" });
+            return true;
+        }
+        if (handleNativeModelCatalog(req, res, url, ctx))
+            return true;
+        const models = ctx.modelCatalogFor?.(backend, instance) ?? [];
+        const answerCatalog = () => {
+            if (backend === "claude-code" && !models.length) {
+                const version = ctx.backendAvailabilityRows?.().find(row => row.backend === backend)?.version;
+                json(res, 200, { backend, models: claudeDocumentedModels(version), source: "official-catalog" });
+            }
+            else
+                json(res, 200, { backend, models });
+        };
+        // The existing catalog belongs to this instance/account and always wins.
+        if (models.length || !ctx.cliModelCatalogFor) {
+            answerCatalog();
+            return true;
+        }
+        const canAnswer = () => !res.headersSent && !res.destroyed && !res.writableEnded && stillAuthorized(req, res, url, ctx);
+        void (async () => {
+            const cliModels = await ctx.cliModelCatalogFor?.(backend, instance) ?? [];
+            if (!canAnswer())
+                return;
+            if (cliModels.length)
+                json(res, 200, { backend, models: cliModels, source: "cli-cache" });
+            else
+                answerCatalog();
+        })().catch(() => {
+            if (canAnswer())
+                json(res, 503, { error: "CLI model cache unavailable" });
+        });
         return true;
     }
     if (method === "GET" && path === "/ui/backends") {
@@ -2925,6 +2992,116 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // ── #3008: connections from outside (a web-only fleet) ──
+    // GET /ui/outside: the state (any admin; over the outside link too, read-only). Everything that changes it is this
+    // computer's admin's, on this computer (the fleet asks the live session each time; the public link refuses these
+    // routes outright): POST /ui/outside/enroll (a new secret, shown once), POST /ui/outside/enroll/confirm {code},
+    // POST /ui/outside/remove, POST /ui/outside/switch {on}. Never a guest (not in GUEST_ROUTES).
+    if (method === "GET" && path === "/ui/outside") {
+        res.setHeader("Cache-Control", "no-store");
+        json(res, 200, ctx.webOutsideStatus?.(req) ?? { webOnly: false, here: false, enrolled: false, enrolledAt: null, outside: false, pausedForMs: 0, link: null });
+        return true;
+    }
+    if (method === "POST" && (path === "/ui/outside/enroll" || path === "/ui/outside/enroll/confirm" || path === "/ui/outside/remove" || path === "/ui/outside/switch")) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "outside_not_here" });
+            return true;
+        }
+        (async () => {
+            let body;
+            try {
+                body = await parseBody(req);
+            }
+            catch {
+                json(res, 400, { error: "Invalid JSON" });
+                return;
+            }
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            res.setHeader("Cache-Control", "no-store");
+            if (path === "/ui/outside/enroll") {
+                const r = ctx.webOutsideBeginEnrollment?.(req) ?? null;
+                if (!r) {
+                    json(res, 403, { error: "outside_not_here" });
+                    return;
+                }
+                json(res, 200, r);
+                return;
+            }
+            if (path === "/ui/outside/enroll/confirm") {
+                const code = body && typeof body === "object" ? body.code : undefined;
+                if (typeof code !== "string" || code.length > 32) {
+                    json(res, 400, { error: "code required" });
+                    return;
+                }
+                const r = ctx.webOutsideConfirmEnrollment?.(req, code) ?? "not_here";
+                json(res, r === "ok" ? 200 : r === "not_here" ? 403 : r === "unsaved" ? 503 : 400, r === "ok" ? { ok: true } : { error: r === "not_here" ? "outside_not_here" : r });
+                return;
+            }
+            if (path === "/ui/outside/remove") {
+                const r = ctx.webOutsideRemove?.(req) ?? "not_here";
+                json(res, r === "ok" ? 200 : r === "unsaved" ? 503 : 403, r === "ok" ? { ok: true } : { error: r === "unsaved" ? "unsaved" : "outside_not_here" });
+                return;
+            }
+            const on = body && typeof body === "object" ? body.on : undefined;
+            if (typeof on !== "boolean") {
+                json(res, 400, { error: "on must be true or false" });
+                return;
+            }
+            const r = ctx.webOutsideSwitch?.(req, on) ?? "not_here";
+            json(res, r === "ok" ? 200 : r === "not_here" ? 403 : r === "unsaved" ? 503 : 409, r === "ok" ? { ok: true } : { error: r === "not_here" ? "outside_not_here" : r });
+        })().catch(err => {
+            ctx.logger.error({ err: err.message }, "Outside connections change failed");
+            try {
+                json(res, 500, { error: "outside_failed" });
+            }
+            catch { /* already answered */ }
+        });
+        return true;
+    }
+    // ── alpha.2 (M-2300): an agent's Windows request, decided by a web-only fleet's owner in Needs you ──
+    // The list is the owner's only: anyone else (a guest, a LAN or public-link session, a chat fleet's admin) reads an
+    // empty one, so nothing actionable ever reaches them. The stream's `agent_proposals` event carries nothing.
+    if (method === "GET" && path === "/ui/agent-proposals") {
+        const list = ctx.webAgentProposals?.(req) ?? null;
+        json(res, 200, { owner: list !== null, proposals: list ?? [] });
+        return true;
+    }
+    const proposalMatch = method === "POST" ? /^\/ui\/agent-proposals\/([0-9a-f]{32})$/.exec(path) : null;
+    if (proposalMatch) {
+        if (!ctx.webDecideAgentProposal) {
+            json(res, 404, { error: "not_found" });
+            return true;
+        }
+        const decide = ctx.webDecideAgentProposal.bind(ctx), id = proposalMatch[1];
+        (async () => {
+            let body;
+            try {
+                body = await parseBody(req);
+            }
+            catch {
+                json(res, 400, { error: "Invalid JSON" });
+                return;
+            }
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            const decision = body && typeof body === "object" ? body.decision : undefined;
+            if (decision !== "confirm" && decision !== "reject") {
+                json(res, 400, { error: "decision must be confirm or reject" });
+                return;
+            }
+            const r = await decide(req, id, decision);
+            if (!res.headersSent && !res.destroyed)
+                json(res, r.status, r.body);
+        })().catch(err => {
+            ctx.logger.error({ err: err.message }, "Agent request decision failed");
+            try {
+                json(res, 500, { error: "decide_failed" });
+            }
+            catch { /* already answered */ }
+        });
+        return true;
+    }
     if (method === "POST" && path === "/ui/needs/ack") {
         if (!ctx.acknowledgeNeedsItem) {
             json(res, 404, { error: "Nothing to acknowledge here" });
@@ -3050,6 +3227,20 @@ export function handleWebRequest(req, res, url, ctx) {
                 json(res, 400, { error: "instance and command required" });
                 return;
             }
+            if (isNativeExecInstance(ctx.fleetConfig?.instances[instance])) {
+                json(res, 400, { error: "This runtime does not support CLI control commands; use Agent settings or Cancel" });
+                return;
+            }
+            if (isNativePaneInstance(ctx.fleetConfig?.instances[instance])) {
+                if (!nativeCliAuthorization(req, url, ctx)) {
+                    json(res, 403, { error: "Windows runtime requires an administrator on the local dashboard" });
+                    return;
+                }
+                if (command !== "model") {
+                    json(res, 400, { error: "This persistent Windows runtime supports the model command; use its shared controls for other actions" });
+                    return;
+                }
+            }
             if (body.args !== undefined && str(body.args, MAX_COMMAND_ARGS) === undefined) {
                 json(res, 400, { error: "args too long" });
                 return;
@@ -3313,6 +3504,10 @@ export function handleWebRequest(req, res, url, ctx) {
                 const body = await parseBody(req);
                 if (!permitWebContinuation(req, res, ctx))
                     return;
+                if (body?.runtime === "windows") {
+                    await createNativeInstance(req, res, url, ctx, body);
+                    return;
+                }
                 const v = validateArgs(CreateInstanceArgs, body, "create_instance");
                 if (!v.ok) {
                     json(res, 400, { error: v.error });
@@ -4074,6 +4269,9 @@ function uploadRecipient(ctx, name) {
 /** Closed, path-free explanations; arbitrary launch errors stay in the host log. */
 function webDeliveryFailure(err) {
     const message = err instanceof Error ? err.message : "";
+    // M-2297: the per-PC agent limit — say so, with the agents holding its slots (names only: no path, no id).
+    if (err instanceof MachineSlotLimitError)
+        return { reason: "machine_limit", error: message, limit: err.limit, holders: err.holders.map(h => ({ name: h.name, unknown: h.unknown })) };
     if (/No warm slot is free/.test(message))
         return { reason: "wake_capacity", error: "No slot is free to wake this instance. Retry when another instance is idle." };
     if (/login|log in|sign in|\bauth(?:entication|orization)?\b|credential|api.?key/i.test(message))
@@ -4121,6 +4319,15 @@ function handleSendMessage(req, res, ctx) {
                 return;
             }
             const { instance, message: typed, attachments = [], replyTo, clientId } = parsed.data;
+            const native = isWindowsInstance(ctx.fleetConfig?.instances[instance]);
+            if (native && !nativeCliAuthorization(req, new URL(req.url ?? "/", "http://localhost"), ctx)) {
+                json(res, 403, { error: "Windows runtime requires an administrator on the local dashboard" });
+                return;
+            }
+            if (native && attachments.length) {
+                json(res, 400, { error: "Attachments are not supported by this runtime yet" });
+                return;
+            }
             // #1920 step 2b: a guest writes only to an in-scope instance, while guests may chat, and never a command.
             const guest = guestRequestOf(req);
             const refused = guestChatRefusal(guest, instance);
@@ -4174,6 +4381,16 @@ function handleSendMessage(req, res, ctx) {
                     break;
                 }
             }
+            const locationHold = ctx.generalLocationDeliveryHold?.(instance);
+            if (locationHold) {
+                const messageId = newWebMessageId(), ts = new Date().toISOString();
+                // Settle this client ID as answered. A Retry after reconnect must never queue its old input.
+                acceptedId = messageId;
+                ctx.emitSseEvent("message", { instance, sender: person.name, role: "user", text: typed, ts, messageId, ...(person.bound ? { from: person.voterKey } : {}), ...(clientId ? { clientId } : {}) });
+                ctx.emitSseEvent("message", { instance, role: "status", sender: "AgEnD", text: locationHold, ts, messageId: newWebMessageId() });
+                json(res, 200, { sent: true, messageId, serviceResponse: true });
+                return;
+            }
             let files = [];
             if (attachments.length > 0) {
                 const taken = ctx.webFiles?.takeForMessage(instance, attachments);
@@ -4196,15 +4413,39 @@ function handleSendMessage(req, res, ctx) {
             // Recheck the same admission all the way through a wake, before the facade's actual IPC handoff.
             const requestUrl = new URL(req.url ?? "/", "http://localhost");
             const admission = admissionOf(req, requestUrl, ctx);
-            const stillCurrent = () => !res.destroyed && admission !== null && admissionOf(req, requestUrl, ctx) === admission
+            // The sender's authority, without the request's own lifetime: the same admission, the same guest still allowed, the
+            // instance still registered (a Windows one still Windows). A Windows turn is journaled before /ui/send answers and its
+            // process starts after, so the bridge rechecks this one (a revoke in between still stops it); never res, which a
+            // finished response marks destroyed (S-30: every web-chat turn to a Windows agent was refused).
+            const authorityCurrent = () => admission !== null && admissionOf(req, requestUrl, ctx) === admission
                 && (!guest || (guest.current() && !guestChatRefusal(guest, instance)))
-                && (registered ? registeredChatInstance(ctx, instance) : ctx.instanceIpcClients.has(instance));
+                && (native ? isWindowsInstance(ctx.fleetConfig?.instances[instance]) && nativeCliAuthorization(req, requestUrl, ctx)
+                    : registered ? registeredChatInstance(ctx, instance) : ctx.instanceIpcClients.has(instance));
+            const stillCurrent = () => !res.destroyed && authorityCurrent();
             const message = typed;
             // #1939 S1: what the receipt records about who authorized it (observe only: agents still read web as recognition).
             const { authority } = confirmAfterBody(arrival, webAuthorityOf(req, new URL(req.url ?? "/", "http://localhost"), ctx, instance));
             const ts = new Date().toISOString();
             // The id the agent is given, and the one its delivery reports come back under: the page's ticks.
-            const messageId = newWebMessageId();
+            const nativeRequestId = isNativeExecInstance(ctx.fleetConfig?.instances[instance]) ? (() => {
+                if (!clientId)
+                    return randomUUID();
+                const hash = createHash("sha256").update(`agend-native-web\0${WebSendDedupe.key(person.key, instance, clientId)}`).digest("hex");
+                return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-8${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
+            })() : undefined;
+            const messageId = nativeRequestId ? `native:${nativeRequestId}:user` : newWebMessageId();
+            if (nativeRequestId && ctx.nativeInstanceRuntime) {
+                const previous = ctx.nativeInstanceRuntime().get(instance)?.turns.find(turn => turn.id === nativeRequestId);
+                if (previous) {
+                    if (previous.prompt !== delivery.text) {
+                        json(res, 409, { error: "clientId belongs to a different message" });
+                        return;
+                    }
+                    acceptedId = messageId;
+                    json(res, 200, { sent: true, messageId, repeated: true });
+                    return;
+                }
+            }
             // Use real Telegram context so daemon's lastChatId/lastThreadId are set,
             // enabling reply tool even when first message comes from Web UI.
             // Pure Web UI mode (no channel config) leaves these empty; the agent's reply then comes back to the
@@ -4250,11 +4491,12 @@ function handleSendMessage(req, res, ctx) {
             let delivered;
             try {
                 const deliver = (name, payload) => ctx.deliverHumanToInstance
-                    ? ctx.deliverHumanToInstance(name, payload, webHumanOrigin(false, authority), typed, { stillCurrent })
-                    : ctx.deliverToInstance(name, payload, { stillCurrent });
+                    ? ctx.deliverHumanToInstance(name, payload, webHumanOrigin(false, authority), typed, { stillCurrent, ...(native ? { authorityCurrent } : {}) })
+                    : ctx.deliverToInstance(name, payload, { stillCurrent, ...(native ? { authorityCurrent } : {}) });
                 delivered = await deliver(instance, {
                     type: "fleet_inbound",
                     content: delivery.text,
+                    ...(nativeRequestId ? { requestId: nativeRequestId } : {}),
                     targetSession: instance,
                     meta: {
                         chat_id: groupId ? String(groupId) : "",