@timqi/pier 0.1.14 → 0.3.0

package/dist/boards/boards.js

@@ -1,5 +1,5 @@
-// Boards: static pages an agent writes, derived by scanning $PIER_HOME/boards,
-// never registered (docs/design/05-boards.md). Only <board>/site is reachable
+// Boards: static pages an agent writes under $PIER_HOME/boards, never
+// registered (docs/design/05-boards.md). Only <board>/site is reachable
 // over HTTP, so a public board leaks nothing about how it was made. Bytes are
 // served on two password-free prefixes, `/p/*` (published) and `/b/*` (a
 // signed prefix the boundary mints), stylesheet included, and run sandboxed.
@@ -10,7 +10,7 @@ import { logger } from "../log.js";
 import { pierPath } from "../paths.js";
 export const defaultBoardsDir = () => pierPath("boards");
 /** Deleted boards keep their bytes under `<slug>.deleted-<ts>`, which this
- *  pattern excludes from every scan — one rename is the whole delete path. */
+ *  pattern refuses on every route — one rename is the whole delete path. */
 const SLUG = /^[a-z0-9][a-z0-9-]{0,63}$/;
 /** Without the 32 bits after the slug, `/p/` could be walked with a dictionary.
  *  Minted the first time a manifest is seen public, by whichever path did it. */
@@ -55,14 +55,27 @@ let viewKey = randomBytes(32);
 export const rotateBoardViews = () => {
     viewKey = randomBytes(32);
 };
-const sign = (slug, expires) => createHmac("sha256", viewKey).update(`${slug}\0${String(expires)}`).digest("base64url").slice(0, 22);
+const sign = (board, expires, key = viewKey) => createHmac("sha256", key).update(`${board}\0${String(expires)}`).digest("base64url").slice(0, 22);
 /** `<expiry in base36>-<signature>`: its own path segment, so the first hyphen
  *  is the cut and a hyphenated slug stays unambiguous. */
-const mintView = (slug) => {
+const mintView = (board, key) => {
     const expires = Date.now() + VIEW_TTL_MS;
-    return `${expires.toString(36)}-${sign(slug, expires)}`;
+    return `${expires.toString(36)}-${sign(board, expires, key)}`;
 };
-function validView(slug, view) {
+/** What a prefix is signed for: the slug and its directory, because a delete
+ *  renames the board away and frees the slug, and a prefix must not open the
+ *  successor. Null when there is no such directory. */
+async function boardOf(dir, slug) {
+    try {
+        return `${slug}\0${String((await stat(join(dir, slug))).ino)}`;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            logger("boards").warn(`cannot stat board ${slug}`, err);
+        return null;
+    }
+}
+function validView(board, view) {
     const cut = view.indexOf("-");
     if (cut < 1)
         return false;
@@ -74,9 +87,9 @@ function validView(slug, view) {
         return false;
     if (expires <= Date.now())
         return false;
-    return sameToken(sign(slug, expires), view.slice(cut + 1));
+    return sameToken(sign(board, expires), view.slice(cut + 1));
 }
-/** Malformed boards are reported once, not on every scan. */
+/** Malformed boards are reported once, not on every request. */
 const warned = new Set();
 /** The one place a slug becomes a path, so it is validated here (`../../etc`,
  *  NUL). Extra keys survive a write. The one write-back is minting a token for
@@ -104,7 +117,6 @@ async function readManifest(dir, slug) {
         ...m,
         title: typeof m.title === "string" && m.title ? m.title : slug,
         description: typeof m.description === "string" ? m.description : "",
-        sessions: Array.isArray(m.sessions) ? m.sessions.filter((s) => typeof s === "string") : [],
         public: m.public === true,
         token: typeof m.token === "string" && TOKEN.test(m.token) ? m.token : "",
     };
@@ -130,7 +142,7 @@ async function updatedAt(dir, slug) {
         (await stat(join(dir, slug)).catch(() => null));
     return (info?.mtime ?? new Date()).toISOString();
 }
-export async function listBoards(dir) {
+async function listBoards(dir) {
     let entries;
     try {
         entries = (await readdir(dir, { withFileTypes: true }))
@@ -143,17 +155,14 @@ export async function listBoards(dir) {
             logger("boards").warn(`cannot scan ${dir}`, err);
         return [];
     }
-    // One board's manifest says nothing about the next one's, so the scan waits
-    // once for all of them rather than once per board.
     const boards = await Promise.all(entries.map(async (slug) => {
         const manifest = await readManifest(dir, slug);
         if (!manifest)
             return null;
-        const { title, description, sessions, public: isPublic, token } = manifest;
-        return { slug, title, description, sessions, public: isPublic, token, updatedAt: await updatedAt(dir, slug) };
+        const { title, description, public: isPublic, token } = manifest;
+        return { slug, title, description, public: isPublic, token, updatedAt: await updatedAt(dir, slug) };
     }));
-    // Freshest first: the board someone just wrote is the one they came to see.
-    // Slug breaks ties so equal mtimes still list in a stable order.
+    // Freshest first; slug breaks ties so equal mtimes still list in a stable order.
     return boards
         .filter((board) => board !== null)
         .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt) || a.slug.localeCompare(b.slug));
@@ -231,8 +240,7 @@ async function serveFile(c, dir, slug, rest) {
 }
 export function registerBoardRoutes(app, dir = defaultBoardsDir()) {
     app.get("/api/boards", async (c) => c.json(await listBoards(dir)));
-    // Publishing is the one decision a human owns; every other field belongs to
-    // the agent that wrote the board.
+    // Publishing is the one manifest field a human owns; the rest is the agent's.
     app.patch("/api/boards/:slug", async (c) => {
         const slug = c.req.param("slug");
         const body = (await c.req.json().catch(() => null));
@@ -242,21 +250,19 @@ export function registerBoardRoutes(app, dir = defaultBoardsDir()) {
         if (!manifest)
             return c.json({ error: "no such board" }, 404);
         manifest.public = body.public;
-        // Publishing an unpublished board is the case readManifest cannot mint for:
-        // it read the manifest while it was still private.
+        // readManifest mints only for a manifest it read as public.
         if (manifest.public && !manifest.token)
             manifest.token = mintToken();
         await writeManifest(dir, slug, manifest);
         return c.json({ public: manifest.public, token: manifest.token });
     });
+    // A rename, so the undo is on disk; signed prefixes are bound to the
+    // directory's inode (boardOf), so none opens a successor on the same slug.
     app.delete("/api/boards/:slug", async (c) => {
         const slug = c.req.param("slug");
         if (!(await readManifest(dir, slug)))
             return c.json({ error: "no such board" }, 404);
         await rename(join(dir, slug), join(dir, `${slug}.deleted-${Date.now()}`));
-        // A capability names a slug, and a slug can be taken again: the prefixes
-        // handed out for the board that just died must not open its successor.
-        rotateBoardViews();
         return c.json({ deleted: slug });
     });
     // Declared before the wildcards below: `_assets` is not a slug.
@@ -285,10 +291,12 @@ export function registerBoardRoutes(app, dir = defaultBoardsDir()) {
     // needs no cookie and can be sandboxed into an opaque origin.
     const mint = async (c) => {
         const slug = c.req.param("slug") ?? "";
-        // Signed before the read: a sign-out landing during it would otherwise
-        // hand this request a capability made with the key that replaced the
-        // revoked one.
-        const view = SLUG.test(slug) ? mintView(slug) : "";
+        // The key as this request found it: a sign-out landing during the reads
+        // would otherwise hand it a capability made with the key that replaced
+        // the revoked one.
+        const key = viewKey;
+        const board = SLUG.test(slug) ? await boardOf(dir, slug) : null;
+        const view = board ? mintView(board, key) : "";
         // A board that is gone says so here, rather than after a redirect.
         if (!view || !(await readManifest(dir, slug)))
             return c.notFound();
@@ -304,10 +312,12 @@ export function registerBoardRoutes(app, dir = defaultBoardsDir()) {
         const rest = c.req.path.slice(`/b/${slug}/${view}/`.length);
         if (!SLUG.test(slug))
             return c.notFound();
-        // Expired, forged, or signed with a key that has since rotated: send it
-        // back through the boundary, which re-mints for a live session in one hop
-        // and asks a stranger for the password. Existence stays unsaid either way.
-        if (!validView(slug, view)) {
+        // Expired, forged, signed with a key that has since rotated, or for a
+        // board since renamed away: send it back through the boundary, which
+        // re-mints for a live session in one hop and asks a stranger for the
+        // password. Existence stays unsaid either way.
+        const board = await boardOf(dir, slug);
+        if (!board || !validView(board, view)) {
             return c.redirect(`/boards/${slug}/${rest}${new URL(c.req.url).search}`);
         }
         if (!(await readManifest(dir, slug)))

package/dist/channels/chains.js

@@ -48,10 +48,6 @@ export class Chains {
         else
             this.held -= 1;
     }
-    /** The backpressure primitive. */
-    oldest() {
-        return Promise.race(this.active.values()).catch(() => { });
-    }
     /** Two adapters handling one message would prompt twice; a hung handler
      *  holding up the Console's save is worse than either, hence the bound. */
     async drain(timeoutMs) {

package/dist/channels/commands.js

@@ -1,19 +1,14 @@
 // Slash commands in IM text, parsed once for every platform: clients add
-// whitespace and capitalise.
-/** The configure-first trigger, one spelling on both platforms: `s <text>`
- *  (Lark also `/s <text>`), the text being the panel's pending question. A bare
- *  `s` carries no question and is prose. */
+// whitespace and capitalise. `%` is `/` too: Slack's client eats an unregistered `/`.
+/** The configure-first trigger: `/s <text>` or `%s <text>`, the text being the
+ *  panel's pending question. `/s` alone carries no question and is prose. */
 export function settingsDraft(text) {
-    return /^\/?s[ \t]+(\S[\s\S]*)$/i.exec(text.trim())?.[1];
+    return /^[/%]s[ \t]+(\S[\s\S]*)$/i.exec(text.trim())?.[1];
 }
 export function parseCommand(text) {
     const trimmed = text.trim();
-    if (!trimmed.startsWith("/"))
-        return null;
     // Args verbatim: a path or a sentence must keep its own spacing.
-    const match = /^\/(\S+)[ \t]*([\s\S]*)$/.exec(trimmed);
-    const name = match?.[1] ?? "";
-    if (!name)
-        return null; // a bare "/" is not a command
-    return { name: name.toLowerCase(), args: match?.[2] ?? "" };
+    const match = /^[/%](\S+)[ \t]*([\s\S]*)$/.exec(trimmed);
+    // A bare "/" or "%" is not a command.
+    return match?.[1] ? { name: match[1].toLowerCase(), args: match[2] ?? "" } : null;
 }

package/dist/channels/config.js

@@ -1,7 +1,7 @@
 // Channel config persistence and the permission gate every adapter shares: one
 // JSON document per platform, so a surface configuring one reads and writes one row.
 import { randomInt } from "node:crypto";
-import { defaultChannelConfig, } from "./types.js";
+import { defaultChannelConfig, PLATFORMS, } from "./types.js";
 const BIND_CODE_TTL_MS = 10 * 60_000;
 /** Six symbols out of 36 is 2 billion, but a caller who may retry forever only
  *  needs the TTL; five wrong tries void the code instead. */
@@ -72,6 +72,32 @@ export class ChannelStore {
     chat(platform, chatId) {
         return this.get(platform).chats.find((c) => c.id === chatId);
     }
+    /** One home instance-wide: setting it clears every other row on both
+     *  platforms. Refuses a chat that is unknown or not a DM; `null` leaves no home anywhere. */
+    setHome(platform, chatId) {
+        if (chatId !== null && this.cached(platform).chats.find((c) => c.id === chatId)?.kind !== "dm") {
+            throw new Error(`${platform}:${chatId} is not a known DM`);
+        }
+        for (const p of PLATFORMS) {
+            const config = this.get(p);
+            for (const chat of config.chats) {
+                if (p === platform && chat.id === chatId)
+                    chat.home = true;
+                else
+                    delete chat.home;
+            }
+            this.save(p, config);
+        }
+    }
+    // On the per-message path: no clone.
+    home() {
+        for (const platform of PLATFORMS) {
+            const chat = this.cached(platform).chats.find((c) => c.home);
+            if (chat)
+                return { platform, chatId: chat.id };
+        }
+        return undefined;
+    }
     /** No platform reliably lists every chat a bot is in, so discovery is passive
      *  and happens on every message: the unchanged case must cost no clone. A new
      *  chat copies the platform defaults and owns them from then on. */

package/dist/channels/control.js

@@ -50,7 +50,7 @@ export function createControl({ router, factory, conversations, store, modelMenu
                 model: session.model,
                 thinking: session.thinkingLevel,
                 tokens: usage?.tokens ?? null,
-                contextWindow: usage?.contextWindow ?? null,
+                compactAt: usage?.compactAt ?? null,
             };
         },
         pins: modelMenu,
@@ -89,21 +89,10 @@ export function createControl({ router, factory, conversations, store, modelMenu
             const seen = new Set([...(own ? [own] : []), ...projectCwds(await factory.list())]);
             return [...seen].slice(0, limit);
         },
-        async recent(key, exchanges) {
-            const session = await live(key);
-            if (!session)
-                return [];
-            const pairs = [];
-            for (const turn of await session.history()) {
-                const last = pairs.at(-1);
-                if (turn.role === "user")
-                    pairs.push({ user: turn.text });
-                // The first reply after a user turn; later assistant turns of the same
-                // exchange are continuations of the same answer.
-                else if (turn.role === "assistant" && last && last.assistant === undefined)
-                    last.assistant = turn.text;
-            }
-            return pairs.slice(-exchanges);
+        isHome(key) {
+            const home = store.home();
+            return home?.platform === key.channelId && home.chatId === chatOf(key.conversationId);
         },
+        skills: async (key) => (await live(key))?.skills() ?? [],
     };
 }

package/dist/channels/conversations.js

@@ -18,11 +18,11 @@ export class ConversationStore {
      *  one launched from the chat defaults, which a re-create reads again. */
     set(key, sessionId, launch) {
         this.db.prepare(`
-      INSERT INTO conversations(channel_id, conversation_id, session_id, updated_at, launch)
-      VALUES (?, ?, ?, ?, ?)
+      INSERT INTO conversations(channel_id, conversation_id, session_id, launch)
+      VALUES (?, ?, ?, ?)
       ON CONFLICT(channel_id, conversation_id) DO UPDATE SET
-        session_id = excluded.session_id, updated_at = excluded.updated_at, launch = excluded.launch
-    `).run(key.channelId, key.conversationId, sessionId, Date.now(), launch ? JSON.stringify(launch) : null);
+        session_id = excluded.session_id, launch = excluded.launch
+    `).run(key.channelId, key.conversationId, sessionId, launch ? JSON.stringify(launch) : null);
     }
     launchOf(key) {
         const row = this.db.prepare(`
@@ -47,11 +47,6 @@ export class ConversationStore {
     `).get(sessionId);
         return row && { channelId: row.channel_id, conversationId: row.conversation_id };
     }
-    /** Every session some IM conversation answers for, in one query. */
-    boundSessions() {
-        const rows = this.db.prepare(`SELECT session_id FROM conversations`).all();
-        return new Set(rows.map((r) => r.session_id));
-    }
     /** Every thread of one chat: a chat that is gone would otherwise keep its
      *  sessions bound to a conversation nothing can reach. */
     forgetChat(channelId, chatId) {

package/dist/channels/lark-api.js

@@ -100,29 +100,30 @@ export class LarkApi {
         });
     }
     // --- messages ------------------------------------------------------------------
-    async replyCard(messageId, card) {
-        const res = await this.client.im.v1.message.reply({
-            path: { message_id: messageId },
-            data: {
-                msg_type: "interactive",
-                content: JSON.stringify(card),
-                // Lark's equivalent of posting to a thread_ts.
-                reply_in_thread: true,
-            },
-        });
-        return { messageId: ok("message.reply", res).data?.message_id ?? "" };
+    replyCard(messageId, card) {
+        return this.post({ root: messageId }, "interactive", card);
     }
-    async createCard(chatId, card) {
-        const res = await this.client.im.v1.message.create({
-            params: { receive_id_type: "chat_id" },
-            data: { receive_id: chatId, msg_type: "interactive", content: JSON.stringify(card) },
-        });
-        return { messageId: ok("message.create", res).data?.message_id ?? "" };
+    sendCard(chatId, card) {
+        return this.post({ chatId }, "interactive", card);
+    }
+    async post(to, type, content) {
+        const data = { msg_type: type, content: JSON.stringify(content) };
+        const res = "root" in to
+            // `reply_in_thread` is Lark's equivalent of posting to a thread_ts.
+            ? ok("message.reply", await this.client.im.v1.message.reply({
+                path: { message_id: to.root },
+                data: { ...data, reply_in_thread: true },
+            }))
+            : ok("message.create", await this.client.im.v1.message.create({
+                params: { receive_id_type: "chat_id" },
+                data: { ...data, receive_id: to.chatId },
+            }));
+        return { messageId: res.data?.message_id ?? "" };
     }
     /** Images take the image endpoint so they render inline; `stream` is Lark's
      *  "type unknown". The SDK unwraps an upload response to its `data`, so a
      *  failure arrives as a missing key, not a code. */
-    async uploadFile(rootId, file) {
+    async uploadFile(to, file) {
         const bytes = Buffer.from(file.bytes);
         let content;
         if (file.image) {
@@ -141,14 +142,7 @@ export class LarkApi {
                 throw new Error(`lark file.create: no file_key for ${file.name}`);
             content = { file_key: res.file_key };
         }
-        ok("message.reply", await this.client.im.v1.message.reply({
-            path: { message_id: rootId },
-            data: {
-                msg_type: file.image ? "image" : "file",
-                content: JSON.stringify(content),
-                reply_in_thread: true,
-            },
-        }));
+        await this.post(to, file.image ? "image" : "file", content);
     }
     async patchCard(messageId, card) {
         ok("message.patch", await this.client.im.v1.message.patch({

package/dist/channels/lark-outbound.js

@@ -1,7 +1,9 @@
-// How a turn becomes cards in a Lark thread: one card per chunk, footer and
-// buttons on the last, and what an empty turn still has to say.
-import { formatTurnMeta, isSilentReply, originLabel, quietLabel } from "../core/reply.js";
+// How a turn becomes cards in a Lark thread, or the home chat's main flow: one
+// card per chunk, footer and buttons on the last, and what an empty turn still
+// has to say.
+import { formatTurnMeta, isSilentReply, quietLabel } from "../core/reply.js";
 import { sendAttachments, splitAttachments } from "./attach.js";
+import { noteBody } from "./lines.js";
 import { button, buttonRow, card, chunk, footer, LARK_MAX, markdown, OFFER_PREFIX, withFooter, withoutButtons, } from "./lark-render.js";
 const SENT_CACHE = 200;
 export class LarkOutbound {
@@ -18,7 +20,7 @@ export class LarkOutbound {
     /** An empty turn still posts its footer and says which kind of nothing (§5).
      *  The footer folds into the last chunk's element (a second element renders
      *  a blank gap); only a bodiless turn gets the standalone one. */
-    async reply(root, reply) {
+    async reply(to, reply) {
         // A local file link is dead in Lark: the bytes are uploaded instead.
         const { text: spoken, paths } = splitAttachments(reply.text);
         const text = spoken.trim();
@@ -27,6 +29,8 @@ export class LarkOutbound {
         const note = [quiet, meta].filter(Boolean).join(" · ");
         if (!(text || reply.suggestions.length || note || paths.length))
             return;
+        // An empty root is a main-flow button, which only the home chat has (lark.ts onAction).
+        const root = "root" in to ? to.root : "";
         const row = reply.suggestions.length
             ? buttonRow(reply.suggestions.map((label, index) => button(label, { key: `${OFFER_PREFIX}${index}`, root, label })))
             : undefined;
@@ -42,32 +46,16 @@ export class LarkOutbound {
                 elements.push(row);
             if (!elements.length)
                 continue;
-            const { messageId } = await this.api.replyCard(root, card(elements));
+            const { messageId } = await this.post(to, card(elements));
             if (last && row && messageId)
                 this.remember(messageId, card(elements));
         }
-        const lost = await sendAttachments(paths, (file) => this.api.uploadFile(root, file), this.log);
+        const lost = await sendAttachments(paths, (file) => this.api.uploadFile(to, file), this.log);
         if (lost)
-            await this.api.replyCard(root, card([markdown(lost)]));
+            await this.post(to, card([markdown(lost)]));
     }
-    /** The root, then one card inside its topic: on the phone a topic has its
-     *  own composer only once it has a reply. Answers the root's id. The handoff
-     *  writes no row when this throws, so a root left behind would invite a reply
-     *  into a thread nobody answers: it is taken back down. */
-    async open(chatId, note) {
-        const link = note.url ? `[Open on the web](${note.url})` : "(no public URL set — Settings → Instance)";
-        const { messageId: root } = await this.api.createCard(chatId, card([
-            markdown(`**Continued from web: ${note.title}**\n${link}\nReply in this thread to continue.`),
-        ]));
-        try {
-            await this.api.replyCard(root, card([markdown("Reply here to continue.")]));
-        }
-        catch (err) {
-            await this.api.deleteMessage(root)
-                .catch((e) => this.log(`orphan handoff root ${root} not deleted: ${String(e)}`));
-            throw err;
-        }
-        return root;
+    post(to, sent) {
+        return "root" in to ? this.api.replyCard(to.root, sent) : this.api.sendCard(to.chatId, sent);
     }
     /** Best-effort: a card sent before a restart keeps its row, logged. */
     async retire(messageId) {
@@ -80,6 +68,11 @@ export class LarkOutbound {
         const kept = withoutButtons(known);
         await this.api.patchCard(messageId, kept.body.elements.length ? kept : card([footer("Option taken.")])).catch((err) => this.log(`retiring options failed: ${String(err)}`));
     }
+    /** A note's root rewritten in place (a child thread's state); one card, so
+     *  the body is cut to the budget rather than split. */
+    async edit(messageId, note) {
+        await this.api.patchCard(messageId, card([markdown(chunk(noteBody(note, "*"), LARK_MAX)[0] ?? "")]));
+    }
     remember(messageId, sent) {
         this.sent.set(messageId, sent);
         while (this.sent.size > SENT_CACHE) {
@@ -91,11 +84,10 @@ export class LarkOutbound {
     }
     /** No footer: the turn this input triggers has not ended. Answers with the
      *  id of the last card posted, where the caller puts the 👀. */
-    async note(root, note) {
-        const body = note.text.split("\n").map((line) => `> ${line}`).join("\n");
+    async note(to, note) {
         let messageId;
-        for (const part of chunk(`*${originLabel(note.origin)}*\n${body}`, LARK_MAX)) {
-            messageId = (await this.api.replyCard(root, card([markdown(part)]))).messageId;
+        for (const part of chunk(noteBody(note, "*"), LARK_MAX)) {
+            messageId = (await this.post(to, card([markdown(part)]))).messageId;
         }
         return messageId;
     }

package/dist/channels/lark-panel.js

@@ -7,7 +7,7 @@ import { ChatPanel, CWD_DRAFT_TAIL, CWD_PLACEHOLDER, holdQuestion, PANEL_PREFIX,
 /** A form-submit button name: `cwdgo:<thread root>`. */
 export const CWD_SUBMIT_PREFIX = "cwdgo:";
 const CWD_FIELD = "cwd";
-const fresh = (root, messageId, draft) => ({ root, messageId, draft, dirs: [], sessions: [] });
+const fresh = (root, messageId, draft) => ({ root, messageId, draft, dirs: [] });
 export class LarkPanel extends ChatPanel {
     deps;
     fence = ["`", "`"];