@zhanguym/chatroom 1.0.0 → 1.1.0-beta.0

package/dist/plugins/process/plugin.js

@@ -1,16 +1,16 @@
-import { createServiceToken } from "#plugins/types";
+import { createServiceToken } from "#app/service-registry";
 import { PipeProcessBackend } from "./infrastructure/pipe-process-backend.js";
 import { PtyProcessBackend } from "./infrastructure/pty-process-backend.js";
 import { registerProcessTools } from "./mcp.js";
 import { ProcessSupervisor } from "./process-supervisor.js";
-export const ProcessService = createServiceToken("process");
+export const ProcessServiceToken = createServiceToken("process");
 export function createProcessPlugin() {
     let service = null;
     return {
         id: "process",
         activate(context) {
             service = new ProcessSupervisor({ pipe: new PipeProcessBackend(), pty: new PtyProcessBackend() }, context.operations, context.events, context.config.process.maxOutputBytes, context.config.process.defaultTimeoutMs, context.config.process.maxCompletedProcesses);
-            context.services.provide(ProcessService, service);
+            context.services.provide(ProcessServiceToken, service);
         },
         registerMcp(mcp) {
             if (!service)

package/dist/plugins/process/process-supervisor.d.ts

@@ -23,6 +23,7 @@ export declare class ProcessSupervisor {
     }, operations: OperationLog, eventBus: RuntimeEventBus, maxOutputBytes: number, defaultTimeoutMs: number, maxCompletedProcesses: number);
     start(request: ProcessStartRequest, operationContext: ProcessOperationContext): Promise<ProcessSnapshot>;
     read(processId: ProcessId): ProcessSnapshot;
+    summary(processId: ProcessId): ProcessSummary;
     list(): ProcessSnapshot[];
     summaries(): ProcessSummary[];
     write(processId: ProcessId, data: string): ProcessSnapshot;

package/dist/plugins/process/process-supervisor.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { ChatRoomError } from "#core/errors/chatroom-error";
 import { childEnvironment } from "#core/runtime/child-environment";
-import { HeadTailBuffer } from "./head-tail-buffer.js";
+import { HeadTailBuffer } from "#core/runtime/head-tail-buffer";
 export class ProcessSupervisor {
     backends;
     operations;
@@ -54,6 +54,12 @@ export class ProcessSupervisor {
                 this.operations.finish(operationId, "error", null, error);
             throw new ChatRoomError("PROCESS_FAILED", `Failed to start process: ${request.command}`, undefined, { cause: error });
         }
+        if (this.shuttingDown) {
+            backend.kill("SIGKILL");
+            if (!adoptedOperation)
+                this.operations.finish(operationId, "cancelled", null, new Error("Process supervisor shut down during process startup"));
+            throw new ChatRoomError("CONFLICT", "Process supervisor is shutting down");
+        }
         let resolveSettled;
         const settled = new Promise((resolve) => {
             resolveSettled = resolve;
@@ -97,13 +103,17 @@ export class ProcessSupervisor {
                 }, 2000).unref();
             }, timeoutMs).unref();
         const snapshot = this.snapshotOf(processId, managed);
-        this.eventBus.emit({ type: "process", process: snapshot });
+        this.eventBus.emit({ type: "process", processId });
         return snapshot;
     }
     read(processId) {
         const item = this.require(processId);
         return this.snapshotOf(processId, item);
     }
+    summary(processId) {
+        const item = this.require(processId);
+        return this.summaryOf(processId, item);
+    }
     list() {
         return [...this.processes.entries()]
             .map(([id, item]) => this.snapshotOf(id, item))
@@ -155,7 +165,7 @@ export class ProcessSupervisor {
             item.outputEventTimer = setTimeout(() => {
                 item.outputEventTimer = null;
                 if (item.state === "running")
-                    this.eventBus.emit({ type: "process-output", processId });
+                    this.eventBus.emit({ type: "process", processId, output: true });
             }, 500).unref();
         }
     }
@@ -185,7 +195,7 @@ export class ProcessSupervisor {
         }, exitCode === 0 && !signal
             ? undefined
             : { exitCode, signal, timedOut: snapshot.timedOut });
-        this.eventBus.emit({ type: "process", process: snapshot });
+        this.eventBus.emit({ type: "process", processId });
         item.resolveSettled(snapshot);
         this.trimCompletedProcesses();
     }
@@ -195,6 +205,7 @@ export class ProcessSupervisor {
             .sort(([, a], [, b]) => b.startedAt.getTime() - a.startedAt.getTime());
         for (const [processId] of completed.slice(this.maxCompletedProcesses)) {
             this.processes.delete(processId);
+            this.eventBus.emit({ type: "process", processId, deleted: true });
         }
     }
     require(processId) {

package/dist/plugins/types.d.ts

@@ -6,17 +6,7 @@ import type { McpToolControl } from "#mcp/server/tool-control";
 import type { RuntimeEventBus } from "#app/event-bus";
 import type { ExternalAccessRegistry } from "#app/external-access-registry";
 import type { LogWriter } from "#core/logging/types";
-export interface ServiceToken<T> {
-    readonly key: symbol;
-    readonly name: string;
-    readonly __type?: T;
-}
-export declare function createServiceToken<T>(name: string): ServiceToken<T>;
-export declare class ServiceRegistry {
-    private readonly values;
-    provide<T>(token: ServiceToken<T>, value: T): void;
-    require<T>(token: ServiceToken<T>): T;
-}
+import type { ServiceRegistry } from "#app/service-registry";
 export interface PluginContext {
     config: ChatRoomConfig;
     database: AppDatabase;

package/dist/plugins/types.js

@@ -1,17 +1 @@
-export function createServiceToken(name) {
-    return { key: Symbol(name), name };
-}
-export class ServiceRegistry {
-    values = new Map();
-    provide(token, value) {
-        if (this.values.has(token.key))
-            throw new Error(`Service already provided: ${token.name}`);
-        this.values.set(token.key, value);
-    }
-    require(token) {
-        const value = this.values.get(token.key);
-        if (value === undefined)
-            throw new Error(`Required service unavailable: ${token.name}`);
-        return value;
-    }
-}
+export {};

package/dist/plugins/web/api-types.d.ts

@@ -1,11 +1,13 @@
 import type { Operation as DomainOperation } from "#core/operations/types";
-import type { GitBranch, GitChange, GitCommit, GitDiff, GitStatus } from "#plugins/git/types";
+import type { GitBranch, GitChange, GitCommit, GitDiff, GitStatus } from "#app/git-access";
 import type { ProcessSnapshot, ProcessSummary } from "#plugins/process/types";
+import type { AgentAttachment, AgentHistory, AgentHistoryUpdate, AgentInteractionResponse, AgentItem, AgentModel, AgentProviderId, AgentProviderDetails, AgentReviewTarget, AgentProviderStatus, AgentSession, AgentTurn, AgentTurnSource } from "#plugins/agent/types";
 import type { McpToolSummary as DomainMcpToolSummary } from "#mcp/server/tool-control";
 import type { CloudServiceId, CloudStatus as DomainCloudStatus } from "#plugins/cloud/types";
-import type { ComputerDisplay, ComputerPermission, ComputerSnapshot, ComputerStatus } from "#plugins/computer/types";
-import type { WorkspaceEntry, WorkspaceFile, WorkspaceInfo, WorkspaceSkill } from "#plugins/workspace/types";
-export type { ComputerDisplay, ComputerPermission, ComputerStatus, GitBranch, GitChange, GitCommit, GitDiff, GitStatus, ProcessSnapshot, ProcessSummary, WorkspaceEntry, WorkspaceFile, WorkspaceInfo, WorkspaceSkill, };
+import type { ComputerDisplay, ComputerPermission, ComputerStatus } from "#plugins/computer/types";
+import type { WorkspaceEntry, WorkspaceInfo, WorkspaceSkill } from "#app/workspace-access";
+import type { WorkspaceFile } from "#plugins/workspace/types";
+export type { AgentAttachment, AgentHistory, AgentHistoryUpdate, AgentInteractionResponse, AgentItem, AgentModel, AgentProviderId, AgentProviderDetails, AgentReviewTarget, AgentProviderStatus, AgentSession, AgentTurn, AgentTurnSource, ComputerDisplay, ComputerPermission, ComputerStatus, GitBranch, GitChange, GitCommit, GitDiff, GitStatus, ProcessSnapshot, ProcessSummary, WorkspaceEntry, WorkspaceFile, WorkspaceInfo, WorkspaceSkill, };
 export interface ComputerPreviewView {
     snapshotId: string;
     revision: number;
@@ -18,7 +20,9 @@ export interface ComputerPreviewView {
         y: number;
     } | null;
     elementCount: number;
-    screenshot: ComputerSnapshot["screenshot"] | null;
+    screenshot: {
+        mimeType: "image/jpeg" | "image/png";
+    } | null;
 }
 export type Operation = DomainOperation;
 export interface AuthStatus {
@@ -46,6 +50,17 @@ export type CloudService = CloudServiceId;
 export type CloudStatus = DomainCloudStatus;
 export interface WorkspaceFileContent {
     content: string;
+    bytes: number;
+    truncated: boolean;
+    modifiedAt: string;
+}
+export interface WorkspaceFilePage {
+    items: WorkspaceFile[];
+    nextOffset: number | null;
+}
+export interface WorkspaceProjectFiles {
+    paths: string[];
+    truncated: boolean;
 }
 export interface CloudManagementSession {
     url: string;

package/dist/plugins/web/http/agent-api-router.d.ts

@@ -0,0 +1,3 @@
+import { Router } from "express";
+import type { AgentRuntime } from "#plugins/agent/runtime";
+export declare function createAgentApiRouter(agents: AgentRuntime): Router;

package/dist/plugins/web/http/agent-api-router.js

@@ -0,0 +1,254 @@
+import { Router } from "express";
+import { ChatRoomError } from "#core/errors/chatroom-error";
+import { isAgentProviderId, isAgentPermissionMode } from "#plugins/agent/types";
+import { asyncRoute, bodyRecord, requireString, } from "#presentation/http/http-utils";
+export function createAgentApiRouter(agents) {
+    const router = Router();
+    router.get("/agents/providers", asyncRoute(async (_req, res) => {
+        res.json(await agents.providerStatuses());
+    }));
+    router.get("/agents/providers/:provider/models", asyncRoute(async (req, res) => {
+        res.json(await agents.models(requireProvider(requireString(req.params.provider, "provider"))));
+    }));
+    router.get("/agents/providers/:provider/details", asyncRoute(async (req, res) => {
+        res.json(await agents.providerDetails(requireProvider(requireString(req.params.provider, "provider"))));
+    }));
+    router.get("/agents/sessions", (_req, res) => {
+        res.json(agents.listSessions());
+    });
+    router.post("/agents/sessions", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        res.json(await agents.createSession({
+            workspaceRoot: requireString(body.workspaceRoot, "workspaceRoot"),
+            provider: requireProvider(requireString(body.provider, "provider")),
+            model: null,
+            reasoningEffort: null,
+            reasoningSummary: null,
+            serviceTier: null,
+            approvalPolicy: null,
+            approvalsReviewer: null,
+            permissionMode: null,
+            ...parseConfig(body),
+        }));
+    }));
+    router.get("/agents/sessions/:sessionId/history", (req, res) => {
+        res.json(agents.history(requireString(req.params.sessionId, "sessionId")));
+    });
+    router.get("/agents/sessions/:sessionId/update", (req, res) => {
+        res.json(agents.historyUpdate(requireString(req.params.sessionId, "sessionId"), parseIdList(req.query.turnIds), parseIdList(req.query.itemIds)));
+    });
+    router.put("/agents/sessions/:sessionId/config", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        res.json(await agents.configureSession(requireString(req.params.sessionId, "sessionId"), parseConfig(body)));
+    }));
+    router.post("/agents/sessions/:sessionId/turns", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        res.json(await agents.startTurn(requireString(req.params.sessionId, "sessionId"), {
+            text: typeof body.text === "string" ? body.text : "",
+            attachments: parseAttachments(body.attachments),
+            outputSchema: body.outputSchema ?? null,
+        }, "human"));
+    }));
+    router.post("/agents/sessions/:sessionId/steer", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        requireKeys(body, ["text", "attachments"]);
+        if (body.text !== undefined && typeof body.text !== "string")
+            throw new ChatRoomError("INVALID_INPUT", "text must be a string");
+        await agents.steer(requireString(req.params.sessionId, "sessionId"), {
+            text: typeof body.text === "string" ? body.text : "",
+            attachments: parseAttachments(body.attachments),
+        }, "human");
+        res.status(204).end();
+    }));
+    router.post("/agents/sessions/:sessionId/review", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        requireKeys(body, ["target"]);
+        res.json(await agents.startReview(requireString(req.params.sessionId, "sessionId"), parseReviewTarget(body.target), "human"));
+    }));
+    router.post("/agents/sessions/:sessionId/interrupt", asyncRoute(async (req, res) => {
+        await agents.interrupt(requireString(req.params.sessionId, "sessionId"));
+        res.status(204).end();
+    }));
+    router.post("/agents/sessions/:sessionId/interactions/:itemId", asyncRoute(async (req, res) => {
+        res.json(await agents.respondInteraction(requireString(req.params.sessionId, "sessionId"), requireString(req.params.itemId, "itemId"), parseInteractionResponse(bodyRecord(req.body))));
+    }));
+    router.post("/agents/sessions/:sessionId/provider", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        res.json(await agents.switchProvider(requireString(req.params.sessionId, "sessionId"), requireProvider(requireString(body.provider, "provider")), parseConfig(body)));
+    }));
+    router.delete("/agents/sessions/:sessionId", asyncRoute(async (req, res) => {
+        await agents.deleteSession(requireString(req.params.sessionId, "sessionId"));
+        res.status(204).end();
+    }));
+    return router;
+}
+function parseIdList(value) {
+    const values = Array.isArray(value) ? value : value == null ? [] : [value];
+    const output = new Set();
+    for (const entry of values) {
+        if (typeof entry !== "string")
+            continue;
+        for (const id of entry.split(",")) {
+            if (!id)
+                continue;
+            if (!/^[A-Za-z0-9_-]+$/.test(id))
+                throw new ChatRoomError("INVALID_INPUT", "Invalid Agent update id");
+            output.add(id);
+            if (output.size > 256)
+                throw new ChatRoomError("INVALID_INPUT", "Too many Agent update ids");
+        }
+    }
+    return [...output];
+}
+function requireProvider(value) {
+    if (isAgentProviderId(value))
+        return value;
+    throw new ChatRoomError("INVALID_INPUT", "Invalid Agent provider id");
+}
+function optionalString(value) {
+    if (value === null || value === undefined || value === "")
+        return null;
+    if (typeof value !== "string")
+        throw new ChatRoomError("INVALID_INPUT", "Expected a string");
+    return value;
+}
+function parseAttachments(value) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value))
+        throw new ChatRoomError("INVALID_INPUT", "attachments must be an array");
+    return value.map((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            throw new ChatRoomError("INVALID_INPUT", "Invalid attachment at index " + index);
+        const record = entry;
+        const kind = requireString(record.kind, "attachments.kind");
+        if (!["image", "audio", "skill", "file"].includes(kind))
+            throw new ChatRoomError("INVALID_INPUT", "Invalid attachment kind");
+        return {
+            kind: kind,
+            name: requireString(record.name, "attachments.name"),
+            path: requireString(record.path, "attachments.path"),
+            mimeType: optionalString(record.mimeType),
+        };
+    });
+}
+function parseInteractionResponse(body) {
+    const type = requireString(body.type, "type");
+    if (type === "approval") {
+        const decision = requireString(body.decision, "decision");
+        return { type, decision };
+    }
+    if (type === "input") {
+        if (!body.answers ||
+            typeof body.answers !== "object" ||
+            Array.isArray(body.answers))
+            throw new ChatRoomError("INVALID_INPUT", "answers must be an object");
+        const answers = {};
+        for (const [key, value] of Object.entries(body.answers)) {
+            if (!Array.isArray(value) ||
+                value.some((entry) => typeof entry !== "string"))
+                throw new ChatRoomError("INVALID_INPUT", "Interaction answers must be string arrays");
+            answers[key] = value;
+        }
+        return { type, answers };
+    }
+    throw new ChatRoomError("INVALID_INPUT", "Unsupported interaction response");
+}
+function parseConfig(body) {
+    const config = {};
+    for (const key of ["model", "reasoningEffort", "serviceTier"]) {
+        if (Object.hasOwn(body, key))
+            config[key] = optionalString(body[key]);
+    }
+    if (Object.hasOwn(body, "approvalPolicy"))
+        config.approvalPolicy = parseApprovalPolicy(body.approvalPolicy);
+    if (Object.hasOwn(body, "approvalsReviewer")) {
+        const value = optionalString(body.approvalsReviewer);
+        if (value !== null &&
+            !["user", "auto_review", "guardian_subagent"].includes(value))
+            throw new ChatRoomError("INVALID_INPUT", "Invalid approvalsReviewer");
+        config.approvalsReviewer = value;
+    }
+    if (Object.hasOwn(body, "permissionMode")) {
+        const value = optionalString(body.permissionMode);
+        if (value !== null && !isAgentPermissionMode(value))
+            throw new ChatRoomError("INVALID_INPUT", "Invalid permissionMode");
+        config.permissionMode = value;
+    }
+    if (Object.hasOwn(body, "reasoningSummary")) {
+        const value = optionalString(body.reasoningSummary);
+        if (value !== null &&
+            !["auto", "concise", "detailed", "none"].includes(value))
+            throw new ChatRoomError("INVALID_INPUT", "Invalid reasoning summary");
+        config.reasoningSummary = value;
+    }
+    return config;
+}
+function parseApprovalPolicy(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (value === "untrusted" || value === "on-request" || value === "never")
+        return value;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new ChatRoomError("INVALID_INPUT", "Invalid approvalPolicy");
+    const record = value;
+    requireKeys(record, ["granular"]);
+    const granularValue = record.granular;
+    if (!granularValue ||
+        typeof granularValue !== "object" ||
+        Array.isArray(granularValue))
+        throw new ChatRoomError("INVALID_INPUT", "Invalid granular approvalPolicy");
+    const granular = granularValue;
+    const keys = [
+        "sandbox_approval",
+        "rules",
+        "skill_approval",
+        "request_permissions",
+        "mcp_elicitations",
+    ];
+    requireKeys(granular, [...keys]);
+    if (keys.some((key) => !Object.hasOwn(granular, key) || typeof granular[key] !== "boolean"))
+        throw new ChatRoomError("INVALID_INPUT", "Granular approvalPolicy fields must be booleans");
+    return {
+        granular: {
+            sandbox_approval: granular.sandbox_approval,
+            rules: granular.rules,
+            skill_approval: granular.skill_approval,
+            request_permissions: granular.request_permissions,
+            mcp_elicitations: granular.mcp_elicitations,
+        },
+    };
+}
+function requireKeys(body, allowed) {
+    if (Object.keys(body).some((key) => !allowed.includes(key)))
+        throw new ChatRoomError("INVALID_INPUT", "Unexpected request field");
+}
+function parseReviewTarget(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new ChatRoomError("INVALID_INPUT", "target must be an object");
+    const target = value;
+    const type = requireString(target.type, "target.type");
+    switch (type) {
+        case "uncommittedChanges":
+            requireKeys(target, ["type"]);
+            return { type };
+        case "baseBranch":
+            requireKeys(target, ["type", "branch"]);
+            return { type, branch: requireString(target.branch, "target.branch") };
+        case "commit":
+            requireKeys(target, ["type", "sha", "title"]);
+            return {
+                type,
+                sha: requireString(target.sha, "target.sha"),
+                title: optionalString(target.title),
+            };
+        case "custom":
+            requireKeys(target, ["type", "instructions"]);
+            return {
+                type,
+                instructions: requireString(target.instructions, "target.instructions"),
+            };
+        default:
+            throw new ChatRoomError("INVALID_INPUT", "Unsupported review target");
+    }
+}

package/dist/plugins/web/http/api-router.js

@@ -9,6 +9,7 @@ import { createComputerApiRouter } from "./computer-api-router.js";
 import { apiAuthentication, createPrivateAuthApiRouter, createPublicAuthApiRouter, } from "./auth-api-router.js";
 import { createRuntimeApiRouter } from "./runtime-api-router.js";
 import { createLogsApiRouter } from "./logs-api-router.js";
+import { createAgentApiRouter } from "./agent-api-router.js";
 export function createApiRouter(application, eventBus, auth, passkeys, ingress, cloud, logs, runtimeStatus) {
     const router = Router();
     router.use(createPublicAuthApiRouter(auth, passkeys, ingress, logs));
@@ -20,6 +21,13 @@ export function createApiRouter(application, eventBus, auth, passkeys, ingress,
         res.json(application.operations.list({
             limit: boundedIntegerQuery(req.query.limit, 100, 0, 500),
             offset: boundedIntegerQuery(req.query.offset, 0, 0, 100000),
+            ...(typeof req.query.beforeStartedAt === "string" &&
+                typeof req.query.beforeOperationId === "string"
+                ? {
+                    beforeStartedAt: req.query.beforeStartedAt,
+                    beforeOperationId: req.query.beforeOperationId,
+                }
+                : {}),
             ...(typeof req.query.pluginId === "string"
                 ? { pluginId: req.query.pluginId }
                 : {}),
@@ -41,6 +49,7 @@ export function createApiRouter(application, eventBus, auth, passkeys, ingress,
     router.use(createWorkspaceApiRouter(application));
     router.use(createGitApiRouter(application));
     router.use(createProcessApiRouter(application));
+    router.use(createAgentApiRouter(application.agents));
     router.use(createComputerApiRouter(application.computer, application.operations, ingress));
     router.use(createCloudApiRouter(cloud, application.operations));
     return router;

package/dist/plugins/web/http/computer-api-router.js

@@ -1,6 +1,6 @@
 import { Router } from "express";
 import { z } from "zod";
-import { asyncRoute } from "#presentation/http/http-utils";
+import { asyncRoute, requireString } from "#presentation/http/http-utils";
 import { ChatRoomError } from "#core/errors/chatroom-error";
 const settingsPatchSchema = z
     .object({
@@ -20,8 +20,8 @@ export function createComputerApiRouter(computer, operations, ingress) {
         res.json(await computer.requestPermission("screenRecording"));
     }));
     function assertLocalPermissionRequest(req) {
-        if (ingress.isExternalWeb(req))
-            throw new ChatRoomError("FORBIDDEN", "Computer permissions can be requested only from the local WebUI");
+        if (ingress.isRemoteWeb(req))
+            throw new ChatRoomError("FORBIDDEN", "Computer permissions can be requested only from the local Web UI");
     }
     router.patch("/computer/settings", asyncRoute(async (req, res) => {
         const parsed = settingsPatchSchema.parse(req.body);
@@ -39,11 +39,24 @@ export function createComputerApiRouter(computer, operations, ingress) {
         }, async () => computer.setSettings(patch)));
     }));
     router.get("/computer/preview", (req, res) => {
-        const scope = ingress.isExternalWeb(req) ? "remote" : "local";
+        const scope = ingress.isRemoteWeb(req) ? "remote" : "local";
         res.json(presentPreview(computer.latestSnapshot(scope), computer.latestSnapshotTimestamp()));
     });
+    router.get("/computer/preview/image", (req, res) => {
+        const scope = ingress.isRemoteWeb(req) ? "remote" : "local";
+        const snapshotId = requireString(req.query.snapshotId, "snapshotId");
+        const screenshot = computer.screenshot(scope, snapshotId);
+        if (!screenshot)
+            throw new ChatRoomError("NOT_FOUND", "Computer screenshot not found");
+        const data = Buffer.from(screenshot.data, "base64");
+        res.setHeader("Content-Type", screenshot.mimeType);
+        res.setHeader("Content-Length", String(data.byteLength));
+        res.setHeader("Cache-Control", "private, max-age=31536000, immutable");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.send(data);
+    });
     router.post("/computer/snapshot", asyncRoute(async (req, res) => {
-        const scope = ingress.isExternalWeb(req) ? "remote" : "local";
+        const scope = ingress.isRemoteWeb(req) ? "remote" : "local";
         const value = await computer.snapshot(scope, {
             includeScreenshot: true,
             includeElements: true,
@@ -64,6 +77,8 @@ function presentPreview(value, capturedAt) {
         activeWindow: value.activeWindow,
         cursor: value.cursor,
         elementCount: value.elements.length,
-        screenshot: value.screenshot ?? null,
+        screenshot: value.screenshot
+            ? { mimeType: value.screenshot.mimeType }
+            : null,
     };
 }

package/dist/plugins/web/http/process-api-router.js

@@ -3,6 +3,9 @@ import { asyncRoute, requireString } from "#presentation/http/http-utils";
 export function createProcessApiRouter(application) {
     const router = Router();
     router.get("/processes", (_req, res) => res.json(application.listProcesses()));
+    router.get("/processes/:processId/summary", (req, res) => {
+        res.json(application.getProcessSummary(requireString(req.params.processId, "processId")));
+    });
     router.get("/processes/:processId", (req, res) => {
         res.json(application.getProcess(requireString(req.params.processId, "processId")));
     });

package/dist/plugins/web/http/workspace-api-router.js

@@ -1,7 +1,10 @@
-import { Router } from "express";
+import { randomUUID } from "node:crypto";
+import express, { Router } from "express";
 import { ChatRoomError } from "#core/errors/chatroom-error";
-import { asyncRoute, bodyRecord, requireString, } from "#presentation/http/http-utils";
+import { asyncRoute, bodyRecord, boundedIntegerQuery, requireString, } from "#presentation/http/http-utils";
 const MAX_WRITE_BYTES = 1024 * 1024;
+const MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+const MAX_IMAGE_PREVIEW_BYTES = 32 * 1024 * 1024;
 export function createWorkspaceApiRouter(application) {
     const router = Router();
     router.get("/workspaces", asyncRoute(async (_req, res) => {
@@ -27,7 +30,21 @@ export function createWorkspaceApiRouter(application) {
     router.get("/workspace/files", asyncRoute(async (req, res) => {
         const fs = await application.workspaces.fs(requireString(req.query.root, "root"));
         const filePath = typeof req.query.path === "string" ? req.query.path : ".";
-        res.json(await fs.list(filePath, { recursive: req.query.recursive === "1" }));
+        const limit = boundedIntegerQuery(req.query.limit, 300, 1, 500);
+        const offset = boundedIntegerQuery(req.query.offset, 0, 0, 100000);
+        const page = await fs.list(filePath, {
+            recursive: req.query.recursive === "1",
+            offset,
+            maxEntries: limit + 1,
+        });
+        const hasMore = page.length > limit;
+        res.json({
+            items: page.slice(0, limit),
+            nextOffset: hasMore ? offset + limit : null,
+        });
+    }));
+    router.get("/workspace/project-files", asyncRoute(async (req, res) => {
+        res.json(await application.workspaces.projectFilesResult(requireString(req.query.root, "root")));
     }));
     router.get("/workspace/file", asyncRoute(async (req, res) => {
         const fs = await application.workspaces.fs(requireString(req.query.root, "root"));
@@ -51,19 +68,70 @@ export function createWorkspaceApiRouter(application) {
             input: { root: fs.root, path: filePath, bytes },
         }, () => fs.write(filePath, body.content)));
     }));
+    router.post("/workspace/attachment", express.raw({
+        type: "application/octet-stream",
+        limit: MAX_ATTACHMENT_BYTES,
+    }), asyncRoute(async (req, res) => {
+        const root = requireString(req.query.root, "root");
+        const sessionId = requireString(req.query.sessionId, "sessionId");
+        if (!/^[A-Za-z0-9_-]+$/.test(sessionId))
+            throw new ChatRoomError("INVALID_INPUT", "Invalid attachment session id");
+        const originalName = requireString(req.query.name, "name");
+        if (!Buffer.isBuffer(req.body))
+            throw new ChatRoomError("INVALID_INPUT", "Attachment body must be binary");
+        const fs = await application.workspaces.fs(root);
+        const session = application.agents.getSession(sessionId);
+        if (session.workspaceRoot !== fs.root)
+            throw new ChatRoomError("FORBIDDEN", "Agent session belongs to another workspace");
+        const filePath = ".chatroom/agent-attachments/" +
+            sessionId +
+            "/" +
+            randomUUID() +
+            "-" +
+            attachmentFileName(originalName);
+        const file = await application.operations.run({
+            pluginId: "workspace",
+            source: "gui",
+            action: "attachment.upload",
+            input: { root: fs.root, path: filePath, bytes: req.body.byteLength },
+        }, () => fs.writeBytes(filePath, req.body));
+        res.json({
+            ...file,
+            name: originalName,
+            mimeType: typeof req.headers["x-chatroom-mime-type"] === "string"
+                ? req.headers["x-chatroom-mime-type"]
+                : null,
+        });
+    }));
     router.get("/workspace/file/image", asyncRoute(async (req, res) => {
         const filePath = requireString(req.query.path, "path");
         const mime = imageMime(filePath);
         if (!mime)
             throw new ChatRoomError("INVALID_INPUT", "File type is not supported for image preview");
         const fs = await application.workspaces.fs(requireString(req.query.root, "root"));
-        const file = await fs.readBytes(filePath, { maxBytes: 10 * 1024 * 1024 });
+        const file = await fs.readBytes(filePath, {
+            maxBytes: MAX_IMAGE_PREVIEW_BYTES,
+        });
         if (file.truncated)
             throw new ChatRoomError("INVALID_INPUT", "Image is too large to preview");
+        const etag = 'W/"' +
+            file.bytes.toString(16) +
+            "-" +
+            Date.parse(file.modifiedAt).toString(16) +
+            '"';
+        const requestedVersion = typeof req.query.v === "string" ? req.query.v : null;
         res.setHeader("Content-Type", mime);
-        res.setHeader("Content-Length", String(file.data.byteLength));
-        res.setHeader("Cache-Control", "no-store");
+        res.setHeader("ETag", etag);
+        res.setHeader("Last-Modified", file.modifiedAt);
+        res.setHeader("Cache-Control", requestedVersion === file.modifiedAt
+            ? "private, max-age=31536000, immutable"
+            : "private, no-cache");
         res.setHeader("X-Content-Type-Options", "nosniff");
+        if (req.headers["if-none-match"] === etag) {
+            res.status(304).end();
+            return;
+        }
+        res.setHeader("Content-Length", String(file.data.byteLength));
         res.send(file.data);
     }));
     return router;
@@ -89,3 +157,8 @@ function imageMime(filePath) {
             return null;
     }
 }
+function attachmentFileName(value) {
+    const name = value.split(/[\\/]/).pop()?.trim() ?? "";
+    const safe = name.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+    return (safe || "attachment").slice(0, 160);
+}