@withbuddi/buddi 0.1.0-pre.31 → 0.1.0-pre.32

package/node_modules/@buddi/gateway/dist/web/server.js

@@ -46,6 +46,7 @@ import { agentMuteRoute, focusRoute, listNotificationsRoute, markSeenRoute, noti
 import { catalogSkillLookup, discardProposalFromWeb, keepAllProposalsFromWeb, keepProposalFromWeb, readProposals, registryChangeLookup } from './proposals.js';
 import { latestDigest, readDigestSchedule, setDigestSchedule } from '../agents/learning-digest.js';
 import { readAgentSkills, removeLearnedSkillFromWeb } from '../agents/learned-skills.js';
+import { createSkillRoute, deleteSkillRoute, editSkillRoute, grantSkillRoute, listSkillsRoute, skillDetailRoute, skillDownload, trustSkillRoute, } from './skills.js';
 import { bindMcpRequests, requestThroughMcp } from '../mcp/requests.js';
 import { randomUUID, createHmac } from 'node:crypto';
 import { StringDecoder } from 'node:string_decoder';
@@ -90,16 +91,20 @@ import { readAgentAttention, streamAttention } from './attention.js';
 import { PreviewApp, PreviewTickets, parsePreviewApiPath } from './preview.js';
 import { allowedOrigins, isLoopback, webAssetsDir, webUrl } from './config.js';
 import { TAILSCALE_SETTING_KEY, daemonWhois, isLoginRefusal, isUnansweredRefusal, plausibleLogin, proxiedThroughTailscale, sameLogin, tailscaleIdentity, tailscaleRefusalReason, tailscaleSelf, toTailscaleSetting, } from './tailscale.js';
+import { clientKey } from './client-key.js';
 import { retryHref, sendSignedOut, wantsSignedOutPage } from './signed-out.js';
 import { extensionEndpoint } from './extension.js';
 import { REMOTE_HAND_SOCKET_PATH, RemoteHandEndpoint } from './remote-hand.js';
-import { csrfCookieName, CSRF_HEADER, sessionCookieName, requestPort, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, remoteKey, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
+import { csrfCookieName, CSRF_HEADER, sessionCookieName, requestPort, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
 import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readJobFailures, readMissions, readOverview, setGlanceHidden, setHomeDismissed, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
 import { RateLimiter, SessionStore, } from './sessions.js';
 import { supervisorCall } from './service.js';
 import { backupJobRoute, createBackupRoute, discardUpload, listBackups, passphraseRoute, receiveUpload, restoreRoute, scheduleRoute, verifyBackupRoute, } from './backups.js';
 import { acceptAgentRoute, approveRoute, listPlugins, pluginJobRoute, receivePluginUpload, rejectRoute, openedRoute, stageRoute, toggleRoute, uninstallRoute, updateRoute, uploadRoute, } from './plugins.js';
 import { marketAssetRoute, marketRoute } from './market.js';
+import { catalogueRoute, agentsCatalogue, installRoute as catalogueInstallRoute, jobRoute as catalogueJobRoute, confirmJobRoute as catalogueConfirmJobRoute, planRoute as cataloguePlanRoute, removePreviewRoute, removeRoute as removeAgentRoute, updatePlanRoute as catalogueUpdatePlanRoute, updateRoute as catalogueUpdateRoute, } from './catalogue.js';
+import { createCatalogueService } from './catalogue-source.js';
+import { catalogueBindingOf } from '../agents/platform.js';
 import { pluginFoldersRoute } from './folders.js';
 import { tipsRoute } from '../tips/route.js';
 import { createWidgets, widgetsRoute } from './widgets.js';
@@ -107,7 +112,7 @@ import { createRequirements } from '../plugins/requires.js';
 import { placesList, placesRoute } from './places.js';
 import { OWNER_DATE_FORMATS, OWNER_TIME_FORMATS } from '@buddi/core';
 import { readFacts, webSettingsStore } from '../tips/facts.js';
-import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers, readTeammates } from './agent-offers.js';
+import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers } from './agent-offers.js';
 import { currentVersion, upgradeJobRoute, upgradeRoute, versionCheckRoute, versionRoute, } from './version.js';
 import { leaveRecoveryMode, readRecoveryView } from './recovery.js';
 import { readNeedsYou } from './needs-you.js';
@@ -120,7 +125,7 @@ import { LOCKED_BODY, LockUnavailable, allowedWhileLocked, clientOf, createLock
 import { matchApiRoute, TOKEN_REFUSALS } from './api-routes.js';
 import { apiTokensRoute, bearerOf, verifyApiToken } from './api-tokens.js';
 import { LockImageRefusal, MAX_LOCK_IMAGE_BYTES, normaliseLockImage } from './lock-image.js';
-import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, retryJobsFromWeb, dismissJobsFromWeb, undismissJobsFromWeb, setMissionEnabledFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
+import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, retryJobsFromWeb, dismissJobsFromWeb, undismissJobsFromWeb, setMissionEnabledFromWeb, keepMissionFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
 /** How often approvals past their expiry are swept, and waiting delegations told. */
 export const EXPIRY_SWEEP_MS = 60_000;
 /**
@@ -552,7 +557,7 @@ export function createWebApp(deps) {
         const scope = requestScope(req);
         const arrived = proxied || (publicHost !== undefined && host === publicHost) ? 'tailnet' : scope === 'local' ? 'local' : 'remote';
         const setting = arrived === 'tailnet' ? await readTailscaleSetting() : null;
-        const lockedForMs = limiter.retryAfterMs(remoteKey(req), now);
+        const lockedForMs = limiter.retryAfterMs(clientKey(req), now);
         return {
             retry: retryHref(pathname, search),
             arrived,
@@ -644,7 +649,7 @@ export function createWebApp(deps) {
         const now = deps.now();
         const method = (req.method ?? 'GET').toUpperCase();
         const url = parseUrl(req);
-        const key = remoteKey(req);
+        const key = clientKey(req);
         // No CORS, and therefore no preflight.
         if (method === 'OPTIONS')
             return sendEmpty(res, 405);
@@ -961,6 +966,44 @@ export function createWebApp(deps) {
             requirements,
             ...(deps.plugins ? { engine: deps.plugins } : {}),
         });
+        /**
+         * The agent catalogue (catalogue.ts): the service the platform tools are
+         * bound to when there is one, so the routes and Agent Father read the same
+         * list; else one built here over the same market cache.
+         */
+        const catalogueDeps = () => {
+            const live = deps.registry;
+            const bound = catalogueBindingOf(deps.registry);
+            const env = deps.env ?? process.env;
+            const agentsDir = bound?.agentsDir ?? agentSearchPath(env).owner.dir;
+            return {
+                ...pagesDeps(),
+                env,
+                log,
+                pool: deps.pool,
+                service: bound?.service ?? createCatalogueService({ env, log, registry: deps.registry, ctx: deps.ctx, now: deps.now }),
+                binding: bound ?? { catalog: deps.catalog, agentsDir, trashRoot: path_.join(path_.dirname(path_.resolve(agentsDir)), '.trash') },
+                approve: (actionId) => decideApprovalFromWeb(writeDeps, actionId, 'approved'),
+                reject: (actionId) => decideApprovalFromWeb(writeDeps, actionId, 'rejected'),
+                ...(deps.plugins ? { engine: deps.plugins } : {}),
+                ...(live.register && live.unregister && live.manifests ? { liveRegistry: deps.registry } : {}),
+            };
+        };
+        /** The Skills page (skills.ts): the owner's folders, the catalog to check each write against. */
+        const skillsDeps = () => {
+            const bound = catalogueBindingOf(deps.registry);
+            const search = agentSearchPath(deps.env ?? process.env);
+            const agentsDir = bound?.agentsDir ?? search.owner.dir;
+            return {
+                catalog: deps.catalog,
+                agentsDir,
+                skillsDir: search.owner.skillsDir,
+                trashRoot: bound?.trashRoot ?? path_.join(path_.dirname(path_.resolve(agentsDir)), '.trash'),
+                plugins: () => deps.registry.manifests().map((m) => m.name),
+                now: deps.now,
+                pool: deps.pool,
+            };
+        };
         /** Is a mailbox connected? The email plugin's own read, the one Home's offer asks. */
         const mailboxSet = async () => {
             const answer = await runPageQuery(pagesDeps(), 'email', 'triage_offer', new URLSearchParams()).catch(() => null);
@@ -1462,10 +1505,12 @@ export function createWebApp(deps) {
                     // Agents a plugin offers on Home while nobody has them. Accepting
                     // is the Plugins page's own accept route, below.
                     return sendJson(res, 200, await readAgentOffers(agentOffersDeps()));
-                case '/api/teammates':
-                    // "Add a teammate": the starter team and the plugin teammates, each
-                    // added, addable, or greyed with why. Adding is the accept route below.
-                    return sendJson(res, 200, await readTeammates(agentOffersDeps()));
+                /*
+                 * The agent catalogue: buddi's ready-made agents from withbuddi.com,
+                 * each with where it stands here. Fetched when stale, the copy offline.
+                 */
+                case '/api/catalogue':
+                    return reply(res, await catalogueRoute(catalogueDeps(), url));
                 case '/api/chat/views':
                     // How the installed plugins want their tool output drawn. The page
                     // owns the renderers and learns the domain mapping from here, so an
@@ -1483,6 +1528,9 @@ export function createWebApp(deps) {
                         // Which agent a chat that names nobody lands on, and whether the
                         // files disagree about it. An installation fact, not a file flag.
                         default: readDefaultAgent(deps.catalog),
+                        // Which agents came from the catalogue, with their drift against the
+                        // kept list, so an agent's page needs no catalogue fetch. Never fetches.
+                        catalogue: await agentsCatalogue(catalogueDeps()).catch(() => ({})),
                     });
                 case '/api/groups':
                     // The list is read every few seconds, so it is also where a delete whose minute has passed is made final.
@@ -1656,6 +1704,13 @@ export function createWebApp(deps) {
             const backupJob = /^\/api\/backups\/jobs\/([0-9a-f-]{36})$/i.exec(path);
             if (backupJob)
                 return reply(res, await backupJobRoute(backupDeps(), backupJob[1]));
+            const catalogueJob = /^\/api\/catalogue\/jobs\/([0-9a-f-]{36})$/i.exec(path);
+            if (catalogueJob)
+                return reply(res, catalogueJobRoute(catalogueJob[1]));
+            // What removing an agent does, before the owner says so: nothing changes.
+            const removePreview = /^\/api\/agents\/([^/]+)\/remove$/.exec(path);
+            if (removePreview)
+                return reply(res, await removePreviewRoute(catalogueDeps(), decodeURIComponent(removePreview[1])));
             const pluginJob = /^\/api\/plugins\/jobs\/([0-9a-f-]{36})$/i.exec(path);
             if (pluginJob)
                 return reply(res, pluginJobRoute(pluginDeps(), pluginJob[1]));
@@ -1730,6 +1785,25 @@ export function createWebApp(deps) {
                     return sendJson(res, 404, { error: 'no such agent' });
                 return sendJson(res, 200, view);
             }
+            // The Skills page: every skill, grouped, who holds each; one whole; one as its file.
+            if (path === '/api/skills')
+                return reply(res, listSkillsRoute(skillsDeps()));
+            const skillRead = /^\/api\/skills\/([^/]+)(\/download)?$/.exec(path);
+            if (skillRead) {
+                const id = decodeURIComponent(skillRead[1]);
+                if (!skillRead[2])
+                    return reply(res, skillDetailRoute(skillsDeps(), id));
+                const file = skillDownload(skillsDeps(), id);
+                if (!file)
+                    return sendJson(res, 404, { error: `There is no skill "${id}".` });
+                res.statusCode = 200;
+                res.setHeader('Content-Type', 'text/markdown; charset=utf-8');
+                res.setHeader('Content-Disposition', `attachment; filename="${file.filename}"`);
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.end(method === 'HEAD' ? undefined : file.text);
+                return;
+            }
             // The Skills tab: every skill the agent loads, learned ones with their versions.
             const agentSkills = /^\/api\/agents\/([^/]+)\/skills$/.exec(path);
             if (agentSkills) {
@@ -1932,6 +2006,10 @@ export function createWebApp(deps) {
                 const forgotten = await extension.unpair();
                 return sendJson(res, forgotten.status, forgotten.body);
             }
+            // Delete a skill: the agents that asked for it stop, the file goes to the trash.
+            const skillGone = /^\/api\/skills\/([^/]+)$/.exec(path);
+            if (skillGone)
+                return reply(res, await deleteSkillRoute(skillsDeps(), decodeURIComponent(skillGone[1])));
             // Revoke an API token: the next request carrying it is a 401.
             const tokenGone = /^\/api\/api-tokens\/([0-9a-f-]{36})$/i.exec(path);
             if (tokenGone) {
@@ -2163,6 +2241,15 @@ export function createWebApp(deps) {
                 // shows the mode's own sentence when it cannot.
                 const taken = sessionId ?? status.session?.id;
                 const offer = action === 'takeover' && taken ? browser.hand?.({ sessionId: taken }) : undefined;
+                /*
+                 * "Your browser" with Chrome closed: the take-over itself succeeds (the
+                 * agent is paused), but there is no tab anywhere to show or drive. Said
+                 * as that, with a reason the dashboard offers its ways out on, rather
+                 * than the mode's "use this conversation's host tab".
+                 */
+                if (offer && offer.supported && !offer.hand && status.mode === 'extension' && !extension.connected()) {
+                    return sendJson(res, 200, { ...status, hand: false, handReason: 'browser-offline', handMessage: 'Your browser isn’t connected.' });
+                }
                 return sendJson(res, 200, offer
                     ? { ...status, hand: !!offer.hand, ...(offer.hand ? {} : { handMessage: offer.message }) }
                     : status);
@@ -2462,6 +2549,9 @@ export function createWebApp(deps) {
             }
             return finish(res, await setMissionEnabledFromWeb(writeDeps, decodeURIComponent(missionEnabled[1]), enabled));
         }
+        const missionKeep = /^\/api\/missions\/([^/]+)\/keep$/.exec(path);
+        if (missionKeep)
+            return finish(res, await keepMissionFromWeb(writeDeps, decodeURIComponent(missionKeep[1])));
         const missionSchedule = /^\/api\/missions\/([^/]+)\/schedule$/.exec(path);
         if (missionSchedule) {
             return finish(res, await setScheduleFromWeb(writeDeps, decodeURIComponent(missionSchedule[1]), {
@@ -2558,6 +2648,31 @@ export function createWebApp(deps) {
         if (offerDismissed) {
             return reply(res, await dismissAgentOffer(agentOffersDeps(), decodeURIComponent(offerDismissed[1]), decodeURIComponent(offerDismissed[2])));
         }
+        /*
+         * The agent catalogue's writes: a plan writes nothing; install answers a
+         * job; update and remove are the owner's click as the approval, like the
+         * accept route below.
+         */
+        const catalogueConfirm = /^\/api\/catalogue\/jobs\/([0-9a-f-]{36})\/confirm$/i.exec(path);
+        if (catalogueConfirm) {
+            return reply(res, await catalogueConfirmJobRoute(catalogueDeps(), catalogueConfirm[1], (body ?? {})));
+        }
+        const catalogueWrite = /^\/api\/catalogue\/([a-z][a-z0-9-]{0,39})\/(plan|install|update\/plan|update)$/.exec(path);
+        if (catalogueWrite) {
+            const name = catalogueWrite[1];
+            const verb = catalogueWrite[2];
+            const input = (body ?? {});
+            if (verb === 'plan')
+                return reply(res, await cataloguePlanRoute(catalogueDeps(), name, input));
+            if (verb === 'install')
+                return reply(res, await catalogueInstallRoute(catalogueDeps(), name, input));
+            if (verb === 'update/plan')
+                return reply(res, await catalogueUpdatePlanRoute(catalogueDeps(), name, input));
+            return reply(res, await catalogueUpdateRoute(catalogueDeps(), name, input));
+        }
+        const removeAgent = /^\/api\/agents\/([^/]+)\/remove$/.exec(path);
+        if (removeAgent)
+            return reply(res, await removeAgentRoute(catalogueDeps(), decodeURIComponent(removeAgent[1])));
         const acceptAgent = /^\/api\/plugins\/([^/]+)\/agents\/([^/]+)\/accept$/.exec(path);
         if (acceptAgent) {
             return reply(res, await acceptAgentRoute({
@@ -3186,7 +3301,7 @@ export function createWebApp(deps) {
                     ? {
                         send: (input) => chat.send({
                             agentId: input.agentId,
-                            conversationId: input.conversationId,
+                            ...(input.conversationId === undefined ? {} : { conversationId: input.conversationId }),
                             text: input.prompt,
                             offer: input.offer,
                         }),
@@ -3228,6 +3343,18 @@ export function createWebApp(deps) {
                 })
                 : await discardProposalFromWeb(writeDeps, id, typeof body.reason === 'string' ? body.reason : undefined));
         }
+        /* The Skills page's writes (skills.ts): each checked by reloading the catalog. */
+        if (path === '/api/skills')
+            return reply(res, createSkillRoute(skillsDeps(), body));
+        const skillWrite = /^\/api\/skills\/([^/]+)\/(text|grants|trust)$/.exec(path);
+        if (skillWrite) {
+            const id = decodeURIComponent(skillWrite[1]);
+            if (skillWrite[2] === 'text')
+                return reply(res, editSkillRoute(skillsDeps(), id, body));
+            if (skillWrite[2] === 'grants')
+                return reply(res, grantSkillRoute(skillsDeps(), id, body));
+            return reply(res, trustSkillRoute(skillsDeps(), id));
+        }
         /*
          * "Remove this skill": a learned skill's current file goes, its versions
          * stay, and the proposal it came from counts as discarded from now.