agent-office-studio 0.8.0 → 0.9.2

package/server/economy.js

@@ -19,6 +19,8 @@ const weekStart = (ms) => { const d = Math.floor(ms / 86400000); return (d - ((d
 // moment it is offered, so a wallet can never go below zero.
 export const BET = { minStake: 100, maxStake: 5000, maxOpen: 3, maxMinutes: 60, openMs: 6 * 3600000, liveMs: 24 * 3600000, keep: 40 };
 export const GOAL = { minTarget: 1000, maxTarget: 1e9, maxName: 40 };
+// A handed-off job whose brief is a review, a test pass or an audit.
+const REVIEW = /review|adversarial|audit|qa\b|test/i;
 const day = (ms) => new Date(ms).toISOString().slice(0, 10);
 
 export function emptyBooks() {
@@ -57,7 +59,7 @@ export class Economy {
   get books() { return this.b; }
   wallet(id) { return this.b.wallets[id] || 0; }
   statsOf(id) {
-    return (this.b.stats[id] ||= { jobs: 0, earned: 0, byTier: {}, kudos: 0, bought: 0, streak: 0, lastDay: '' });
+    return (this.b.stats[id] ||= { jobs: 0, earned: 0, byTier: {}, kudos: 0, bought: 0, streak: 0, lastDay: '', minutes: 0, cleanKudos: 0, comebacks: 0, handed: 0, reviews: 0 });
   }
 
   record(entry) {
@@ -109,6 +111,7 @@ export class Economy {
     const again = !!job.payCounted;
     job.payCounted = true;
     const s = this.statsOf(job.agentId);
+    if (again) { job.reopens = (job.reopens || 0) + 1; s.comebacks = (s.comebacks || 0) + 1; }
     let boost = 0;
     if (!again) {
       // The day's first finish keeps or restarts the streak, and the
@@ -124,11 +127,23 @@ export class Economy {
     const e = this.credit(job.agentId, q.wage * (1 + boost) + (again ? 0 : q.bonus), { kind: 'pay', jobId: job.id, title: job.title, minutes: Math.round(q.minutes * 10) / 10, tier: q.tier, mult: q.mult, ...(boost ? { streak: s.streak, boost } : {}) });
     if (e) job.earned = (job.earned || 0) + e.gross;
     if (again) return { pay: e, achievements: this.milestones(job.agentId) };
+    // A hand-off from someone betting on this job is not teamwork, so it
+    // earns no hand-off badges. Checked before the bets close.
+    this.sweep();
+    const fromBet = this.b.bets.some((x) => this.boundTo(x, job) && this.inBet(x, job.requestedByAgent));
     // A bet that cannot be settled cleanly must never hold up the pay.
     try { this.settleBets(job, q.minutes); } catch (err) { this.record({ kind: 'bet', phase: 'error', jobId: job.id, why: err.message }); }
+    // Quality counters. "Quick" is against this agent's own average, so a
+    // slower model is not penalised, and short jobs don't count.
+    const quick = s.jobs >= 5 && q.minutes >= 0.5 && q.minutes < 0.5 * ((s.minutes || 0) / s.jobs);
+    s.minutes = (s.minutes || 0) + q.minutes;
+    if (job.requestedBy && job.status === 'done' && !fromBet) {
+      s.handed = (s.handed || 0) + 1;
+      if (REVIEW.test(`${job.title || ''} ${job.prompt || ''}`)) s.reviews = (s.reviews || 0) + 1;
+    }
     s.jobs++;
     if (q.tier) s.byTier[q.tier] = (s.byTier[q.tier] || 0) + 1;
-    const won = this.milestones(job.agentId, q);
+    const won = this.milestones(job.agentId, { ...q, quick });
     return { pay: e, achievements: won };
   }
 
@@ -156,7 +171,9 @@ export class Economy {
     job.kudosPaid = true;
     this.b.kudos.push(job.id);
     if (this.b.kudos.length > 2000) this.b.kudos.splice(0, 1000);
-    this.statsOf(job.agentId).kudos++;
+    const ks = this.statsOf(job.agentId);
+    ks.kudos++;
+    if (!job.reopens) ks.cleanKudos = (ks.cleanKudos || 0) + 1;
     const e = this.credit(job.agentId, PAY.finishBonus * modelPay(job.model), { kind: 'kudos', jobId: job.id, title: job.title });
     return { pay: e, achievements: this.milestones(job.agentId) };
   }
@@ -415,11 +432,17 @@ export class Economy {
     return bet.state === 'live' && bet.subject === job.agentId && Number.isFinite(job.startedAt) && bet.acceptedAt <= job.startedAt;
   }
 
+  inBet(bet, id) {
+    return !!id && (id === bet.by || id === bet.against);
+  }
+
   // The job finished for the first time, in `minutes` of active work.
   settleBets(job, minutes) {
     this.sweep();
     for (const bet of this.b.bets.filter((x) => this.boundTo(x, job))) {
       if (!(minutes > 0)) { this.close(bet, 'void', 'no working time was recorded'); continue; }
+      // A job one side of the bet handed over is one they could have sized to win.
+      if (this.inBet(bet, job.requestedByAgent)) { this.close(bet, 'void', 'the job came from someone in the bet'); continue; }
       const under = minutes < bet.minutes;
       this.close(bet, under ? 'won' : 'lost', `${Math.round(minutes * 10) / 10} min on "${job.title}"`, under ? bet.by : bet.against);
     }

package/server/files.js

@@ -0,0 +1,115 @@
+// Edit a project's files from the office: list a folder, read a text file,
+// save it back. Everything stays inside one project folder (symlinks that
+// lead out are refused), .git is off limits, and a save only lands if the
+// file is still as it was when it was opened, so an agent mid-job and the
+// boss never silently overwrite each other.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const MAX_BYTES = 1024 * 1024;
+const HIDDEN = new Set(['.git', 'node_modules', '.DS_Store']);
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+
+// The real path of `rel` inside `root`, or an error. A file that doesn't
+// exist yet is checked through its nearest folder that does.
+function resolve(root, rel, { mustExist = true } = {}) {
+  if (typeof rel !== 'string' || rel.includes('\0')) throw fail(400, 'Bad path.');
+  const parts = rel.split(/[\/\\]+/).filter((p) => p && p !== '.');
+  if (parts.includes('..')) throw fail(403, 'That path leads outside the project.');
+  if (parts.some((p) => p.toLowerCase() === '.git')) throw fail(403, 'The .git folder is off limits.');
+  const realRoot = fs.realpathSync(root);
+  const abs = path.join(realRoot, ...parts);
+  let probe = abs;
+  for (;;) {
+    try { fs.lstatSync(probe); break; } catch {
+      if (mustExist && probe === abs) throw fail(404, 'No such file.');
+      const up = path.dirname(probe);
+      if (up === probe) throw fail(404, 'No such file.');
+      probe = up;
+    }
+  }
+  const real = fs.realpathSync(probe);
+  if (real !== realRoot && !real.startsWith(realRoot + path.sep)) throw fail(403, 'That path leads outside the project.');
+  return { abs, rel: parts.join('/'), realRoot };
+}
+
+export function list(root, rel = '') {
+  const { abs, rel: at } = resolve(root, rel);
+  let entries;
+  try { entries = fs.readdirSync(abs, { withFileTypes: true }); } catch (err) {
+    throw fail(err.code === 'ENOTDIR' ? 400 : 404, err.code === 'ENOTDIR' ? 'That is a file, not a folder.' : 'No such folder.');
+  }
+  const out = [];
+  for (const e of entries) {
+    if (HIDDEN.has(e.name)) continue;
+    // A link is shown as what it points to, if that is still inside.
+    let st;
+    try { st = fs.statSync(path.join(abs, e.name)); resolve(root, [at, e.name].filter(Boolean).join('/')); } catch { continue; }
+    out.push({ name: e.name, dir: st.isDirectory(), size: st.isDirectory() ? 0 : st.size });
+  }
+  out.sort((a, b) => (b.dir - a.dir) || a.name.localeCompare(b.name, undefined, { sensitivity: 'base' }));
+  return { path: at, entries: out };
+}
+
+export function read(root, rel) {
+  const { abs, rel: at } = resolve(root, rel);
+  const st = fs.statSync(abs);
+  if (!st.isFile()) throw fail(400, 'That is a folder, not a file.');
+  if (st.size > MAX_BYTES) throw fail(413, `Too big to edit here (${Math.round(st.size / 1024)} KB; the limit is ${MAX_BYTES / 1024} KB).`);
+  const buf = fs.readFileSync(abs);
+  if (buf.includes(0)) throw fail(415, 'That looks like a binary file, so it can’t be edited here.');
+  return { path: at, text: buf.toString('utf8'), mtime: st.mtimeMs, size: st.size };
+}
+
+// A PDF to show in the viewer: its real path and size, or an error. Only files
+// that are really PDFs are served, whatever they are called.
+export function pdf(root, rel) {
+  const { abs } = resolve(root, rel);
+  const st = fs.statSync(abs);
+  if (!st.isFile()) throw fail(400, 'That is a folder, not a file.');
+  if (!/\.pdf$/i.test(abs)) throw fail(415, 'That is not a PDF.');
+  const fd = fs.openSync(abs, 'r');
+  const head = Buffer.alloc(5);
+  try { fs.readSync(fd, head, 0, 5, 0); } finally { fs.closeSync(fd); }
+  if (head.toString('latin1') !== '%PDF-') throw fail(415, 'That file is not a valid PDF.');
+  return { abs, size: st.size };
+}
+
+// An HTML page to show in the preview: its real path and size, or an error.
+export const MAX_PAGE = 8 * 1024 * 1024;
+export function page(root, rel) {
+  const { abs } = resolve(root, rel);
+  const st = fs.statSync(abs);
+  if (!st.isFile()) throw fail(400, 'That is a folder, not a file.');
+  if (!/\.html?$/i.test(abs)) throw fail(415, 'That is not an HTML page.');
+  if (st.size > MAX_PAGE) throw fail(413, `Too big to preview (${Math.round(st.size / 1048576)} MB; the limit is ${MAX_PAGE / 1048576} MB).`);
+  return { abs, size: st.size };
+}
+
+// `mtime` is what read() gave; null means the file must not exist yet.
+export function write(root, rel, text, mtime) {
+  if (typeof text !== 'string') throw fail(400, 'Nothing to save.');
+  if (Buffer.byteLength(text) > MAX_BYTES) throw fail(413, `Too big to save here (the limit is ${MAX_BYTES / 1024} KB).`);
+  const { abs, rel: at } = resolve(root, rel, { mustExist: false });
+  if (!at) throw fail(400, 'Which file?');
+  let st = null;
+  try { st = fs.statSync(abs); } catch {}
+  if (st?.isDirectory()) throw fail(400, 'That is a folder.');
+  if (st && mtime !== st.mtimeMs) throw fail(409, 'This file changed on disk since you opened it. Reload it to see what changed.');
+  if (!st && mtime != null) throw fail(409, 'This file was deleted since you opened it.');
+  fs.mkdirSync(path.dirname(abs), { recursive: true });
+  // Written beside it and renamed, so a crash never leaves half a file, and
+  // the file keeps its permissions.
+  const tmp = `${abs}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(tmp, text, { mode: st ? st.mode & 0o7777 : 0o644 });
+    fs.renameSync(tmp, abs);
+  } catch (err) {
+    try { fs.unlinkSync(tmp); } catch {}
+    throw fail(500, `Could not save: ${err.message}`);
+  }
+  const now = fs.statSync(abs);
+  return { path: at, mtime: now.mtimeMs, size: now.size };
+}

package/server/guests.js

@@ -32,6 +32,9 @@ const REMOTE_LOG = 600;
 const MAX_THREADS = 300;
 const utcDay = (ms = Date.now()) => new Date(ms).toISOString().slice(0, 10);
 const fail = (code, message) => Object.assign(new Error(message), { code });
+// Handles and project names match exactly, ignoring case only: the relay
+// treats bob-x and bobx as two people, and so must we.
+const same = (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
 
 // ---------- what a host may put on our page ----------
 //
@@ -152,13 +155,13 @@ export class Guests {
     this.office = office;
     this.copies = visits;
     this.file = path.join(dataDir, 'guests.json');
-    this.used = {};
+    this.used = Object.create(null);
     // Where each of our jobs at a host was asked for (chat thread and
     // channel), and the project last used at each host.
     this.asked = { threads: {}, lastRepo: {} };
     try {
       const saved = JSON.parse(fs.readFileSync(this.file, 'utf8'));
-      this.used = saved.used || {};
+      this.used = Object.assign(Object.create(null), saved.used);
       this.asked = { threads: saved.asked?.threads || {}, lastRepo: saved.asked?.lastRepo || {} };
     } catch {}
     this.remote = new Map(); // link id -> { link, host, staff, repos, clearance, jobs: Map(host job id -> job) }
@@ -207,6 +210,17 @@ export class Guests {
     return mode;
   }
 
+  // A job's mode, lowered to what the host allows now.
+  lowerMode(p, mode) {
+    return CLEARANCE.includes(mode) && CLEARANCE.indexOf(mode) <= CLEARANCE.indexOf(p.clearance) ? mode : p.clearance;
+  }
+
+  // Which of our agents may take the job: only those still lent to the guest.
+  lend(job, p) {
+    job.pool = p.agents || undefined;
+    if (p.agents && job.wantAgent && !p.agents.includes(job.wantAgent)) job.wantAgent = null;
+  }
+
   checkTokens(link, p) {
     if (this.tokensToday(link.id) >= p.tokensPerDay) throw fail(429, 'You have used today’s tokens for this office. They reset at midnight UTC.');
   }
@@ -229,12 +243,13 @@ export class Guests {
     switch (op) {
       case 'hello':
         return {
-          staff: this.office.staff(),
+          staff: this.office.staff().filter((s) => !p.agents || p.agents.includes(s.id)),
           modes: Object.fromEntries(Object.entries(this.office.modes()).filter(([k]) => CLEARANCE.indexOf(k) <= CLEARANCE.indexOf(p.clearance))),
           jobs: this.jobsOf(link.id).map((j) => guestJob(j)),
           policy: {
             repos: p.repos, clearance: p.clearance, tokensPerDay: p.tokensPerDay, tokensToday: this.tokensToday(link.id),
             ourAgents: p.ourAgents !== false, theirAgents: this.copies ? p.theirAgents || 'off' : 'off',
+            agents: p.agents || null,
           },
           // We can run a lent agent in one of the guest's own projects (createJob's `home`).
           home: true,
@@ -258,17 +273,23 @@ export class Guests {
         this.checkTokens(link, p);
         if (this.jobsOf(link.id, true).length >= MAX_OPEN_JOBS) throw fail(429, `You can have ${MAX_OPEN_JOBS} jobs going at once here. Wait for one to finish.`);
         const prompt = String(args.prompt ?? '').slice(0, MAX_PROMPT);
+        const agentId = typeof args.agentId === 'string' ? args.agentId : '';
+        if (p.agents && agentId && !p.agents.includes(agentId)) throw fail(403, 'That agent isn’t lent to you.');
         const job = this.office.createJob(
-          { repo: home ? `${home.repo}@${home.host}` : args.repo, prompt, mode, model: typeof args.model === 'string' ? args.model : '', agentId: typeof args.agentId === 'string' ? args.agentId : '' },
-          { from: `@${link.peer}`, guest: { link: link.id }, ...(home && { away: home }) },
+          { repo: home ? `${home.repo}@${home.host}` : args.repo, prompt, mode, model: typeof args.model === 'string' ? args.model : '', agentId },
+          { from: `@${link.peer}`, guest: { link: link.id }, ...(home && { away: home }), ...(p.agents && { pool: p.agents }) },
         );
         return { job: guestJob(job) };
       }
       case 'reply': {
         if (p.ourAgents === false) throw fail(403, 'This office doesn’t lend its agents any more.');
         const job = this.ownJob(link, args.job);
-        const mode = args.mode === undefined ? undefined : this.capMode(p, args.mode);
+        // Held to the host's limits as they are now: a job started at Full
+        // autonomy, in a project since unshared, doesn't carry on as it was.
+        const mode = args.mode === undefined ? this.lowerMode(p, job.mode) : this.capMode(p, args.mode);
+        if (!job.away && !p.repos.includes(job.repo)) throw fail(403, 'That project isn’t shared with you any more.');
         this.checkTokens(link, p);
+        this.lend(job, p);
         this.office.replyJob(job, { message: String(args.text ?? '').slice(0, MAX_PROMPT), mode });
         return { ok: true };
       }
@@ -288,17 +309,33 @@ export class Guests {
   // host, as an away job's `away`. The relay names both ends of a link, so a
   // guest can only point us at its own office.
   async homeFolder(link, repo) {
-    const norm = (v) => String(v).toLowerCase().replace(/[^a-z0-9]/g, '');
-    let e = [...this.remote.values()].find((x) => norm(x.host) === norm(link.peer));
-    const back = !e && this.links.links.find((l) => l.kind === 'guest' && l.role === 'guest' && norm(l.peer) === norm(link.peer));
+    let e = [...this.remote.values()].find((x) => same(x.host, link.peer));
+    const back = !e && this.links.links.find((l) => l.kind === 'guest' && l.role === 'guest' && same(l.peer, link.peer));
     if (back) e = await this.remoteHello(back).catch(() => null);
     if (!e) throw fail(403, `To use our agents in your own projects, make @${this.links.status().handle || 'us'} your guest too, with their agents allowed in your projects.`);
     if (!['read', 'edit'].includes(e.theirAgents)) throw fail(403, `You haven’t let @${this.links.status().handle || 'us'}’s agents work in your projects. Turn that on where we’re your guest.`);
-    const r = e.repos.find((x) => norm(x) === norm(repo));
+    const r = e.repos.find((x) => same(x, repo));
     if (!r) throw fail(403, `You haven’t shared ${repo} with @${this.links.status().handle || 'us'}. Add it where we’re your guest.`);
     return { link: e.link, host: e.host, repo: r, access: e.theirAgents };
   }
 
+  // The host changed a guest's limits: open jobs the new ones rule out stop,
+  // and queued ones drop to the clearance and agents now allowed. A running
+  // session can't change its mode, so one above the new clearance stops too.
+  policyChanged(linkId) {
+    const p = this.links.guestPolicy(linkId);
+    for (const job of this.jobsOf(linkId, true)) {
+      const why = !p || p.ourAgents === false ? 'This office stopped lending its agents.'
+        : !job.away && !p.repos.includes(job.repo) ? 'That project isn’t shared with the guest any more.'
+        : job.status === 'working' && this.lowerMode(p, job.mode) !== job.mode ? 'The host lowered what this guest’s jobs may do.'
+        : job.status === 'working' && p.agents && !p.agents.includes(job.agentId) ? 'That agent isn’t lent to this guest any more.'
+        : null;
+      if (why) { this.office.stopJob(job, `Stopped: ${why}`); continue; }
+      job.mode = this.lowerMode(p, job.mode);
+      this.lend(job, p);
+    }
+  }
+
   // Tokens a guest job used: counted against its guest, and a guest over its
   // day's allowance has its running jobs stopped.
   addTokens(job, n) {
@@ -308,11 +345,14 @@ export class Guests {
     const u = this.used[linkId]?.day === day ? this.used[linkId] : { day, tokens: 0 };
     u.tokens += n;
     this.used[linkId] = u;
-    this.save();
     const p = this.links.guestPolicy(linkId);
     if (p && u.tokens >= p.tokensPerDay) {
+      this.save();
       for (const j of this.jobsOf(linkId, true)) this.office.stopJob(j, 'Stopped: the guest used today’s tokens.');
+      return;
     }
+    // This runs on every API call, so the file is written at most every few seconds.
+    if (!this.saveTimer) { this.saveTimer = setTimeout(() => { this.saveTimer = null; this.save(); }, 5000); this.saveTimer.unref?.(); }
   }
 
   save() {
@@ -323,7 +363,7 @@ export class Guests {
       fs.mkdirSync(path.dirname(this.file), { recursive: true });
       const threads = Object.entries(this.asked.threads);
       if (threads.length > MAX_THREADS) this.asked.threads = Object.fromEntries(threads.slice(-MAX_THREADS));
-      fs.writeFileSync(this.file + '.tmp', JSON.stringify({ used: this.used, asked: this.asked }));
+      fs.writeFileSync(this.file + '.tmp', JSON.stringify({ used: this.used, asked: this.asked }), { mode: 0o600 });
       fs.renameSync(this.file + '.tmp', this.file);
     } catch (err) { console.error('[guests] could not save', err.message); }
   }
@@ -611,7 +651,7 @@ export class Guests {
     const offices = this.remoteStatus();
     const find = (name, host) => {
       for (const o of offices) {
-        if (host && norm(o.host) !== norm(host)) continue;
+        if (host && !same(o.host, host)) continue;
         const s = o.staff.find((x) => x.here && norm(x.name) === norm(name));
         if (s) return { link: o.link, host: o.host, staff: s };
       }
@@ -636,14 +676,13 @@ export class Guests {
   // file tools come back to us over the link where the host is our guest
   // (visits.js), so that link must let their agents into this project.
   lentHome(entry, repo) {
-    const norm = (v) => String(v).toLowerCase().replace(/[^a-z0-9]/g, '');
     const h = entry.host;
     if (!entry.home) throw fail(400, `@${h}’s office is on an older version that can only run its agents in its own projects. Ask @${h} to update.`);
-    const back = this.links.links.find((l) => l.kind === 'guest' && l.role === 'host' && norm(l.peer) === norm(h));
+    const back = this.links.links.find((l) => l.kind === 'guest' && l.role === 'host' && same(l.peer, h));
     const p = back && this.links.guestPolicy(back.id);
     if (!p) throw fail(400, `To use @${h}’s agents in #${repo}, make @${h} your guest too, with their agents allowed in your projects.`);
     if (!['read', 'edit'].includes(p.theirAgents)) throw fail(400, `To use @${h}’s agents in #${repo}, let their agents work in your projects: Change, where @${h} is your guest.`);
-    const r = p.repos.find((x) => norm(x) === norm(repo));
+    const r = p.repos.find((x) => same(x, repo));
     if (!r) throw fail(400, `You haven’t shared ${repo} with @${h}. Add it under Change, where @${h} is your guest, and ask again.`);
     return r;
   }
@@ -657,11 +696,11 @@ export class Guests {
     const tags = [...text.matchAll(/(^|\s)#([\w.-]+)/g)];
     // A project of ours, not theirs: their agent would run in their folder
     // and never see ours. Say so, rather than quietly working somewhere else.
-    const ours = tags.find((t) => !repos.some((r) => norm(r) === norm(t[2])) && this.office.repoPath(t[2]));
+    const ours = tags.find((t) => !repos.some((r) => same(r, t[2])) && this.office.repoPath(t[2]));
     if (ours) return { repo: this.lentHome(entry, ours[2]), home: true, text: text.replace(ours[0], ' ').replace(/[ \t]+/g, ' ').trim() };
     if (repos.length === 1) return { repo: repos[0], text };
     for (const t of tags) {
-      const repo = repos.find((r) => norm(r) === norm(t[2]));
+      const repo = repos.find((r) => same(r, t[2]));
       if (repo) return { repo, text: text.replace(t[0], ' ').replace(/[ \t]+/g, ' ').trim() };
     }
     const said = norm(text);
@@ -680,10 +719,9 @@ export class Guests {
 
   // `#web@friend`: a host's project our agents may work in, or null.
   awayFolder(repo, host) {
-    const norm = (v) => String(v).toLowerCase().replace(/[^a-z0-9]/g, '');
     for (const e of this.remote.values()) {
-      if (norm(e.host) !== norm(host) || !['read', 'edit'].includes(e.theirAgents)) continue;
-      const r = e.repos.find((x) => norm(x) === norm(repo));
+      if (!same(e.host, host) || !['read', 'edit'].includes(e.theirAgents)) continue;
+      const r = e.repos.find((x) => same(x, repo));
       if (r) return { link: e.link, host: e.host, repo: r, access: e.theirAgents };
     }
     return null;