agentic-assistant 0.4.0 → 0.5.1

package/dist/{chunk-YMEM57LX.js → chunk-TOQIHYDH.js}

@@ -4,7 +4,7 @@ import {
   hasScope,
   parseScope,
   runAssistant
-} from "./chunk-C44QT474.js";
+} from "./chunk-JNZPVHNN.js";
 
 // src/api.ts
 import { PRINCIPAL_KINDS } from "agentic-identity";
@@ -14,8 +14,8 @@ var MAX_MESSAGE_CHARS = 1e4;
 var MAX_REASON_CHARS = 500;
 var DEFAULT_MAX_CONCURRENT_RUNS = 4;
 var APPROVER_SCOPE = "assistant:admin";
-async function callerOf(request, auth, origins) {
-  const found = await requirePrincipal(request, auth, { origins });
+async function callerOf(request, auth, origins, scope) {
+  const found = await requirePrincipal(request, auth, { origins, scope });
   if (found instanceof Response) return found.status === 401 ? fail(401, "sign in with a valid key", { "www-authenticate": "Bearer" }) : found;
   return toCaller(found) ?? fail(401, "sign in with a valid key", { "www-authenticate": "Bearer" });
 }
@@ -205,7 +205,7 @@ function createAssistantApi(options) {
       const allowed = route === "chat" || verb !== void 0 ? "POST" : "GET";
       if (request.method !== allowed) return fail(405, "method not allowed", { allow: allowed });
       if (route !== "approvals" && id !== void 0) return fail(404, "not found");
-      const caller = await callerOf(request, options.auth, options.origins);
+      const caller = await callerOf(request, options.auth, options.origins, options.routeScopes?.[route]);
       if (caller instanceof Response) return caller;
       if (route === "tools") {
         const tools = options.registry.list().filter((tool) => hasScope(caller.scopes, tool.scope)).map(({ name, description, scope, risk, inputSchema }) => ({ name, description, scope, risk, inputSchema }));
@@ -248,6 +248,7 @@ function createAssistantApi(options) {
 }
 
 // src/static-auth.ts
+import { createMemoryStore, createStoreAuth } from "agentic-identity";
 var MIN_TOKEN_BYTES = 32;
 var encoder = new TextEncoder();
 async function digest(token) {
@@ -255,7 +256,8 @@ async function digest(token) {
   return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 async function createStaticTokenAuth(tokens) {
-  const byDigest = /* @__PURE__ */ new Map();
+  const store = createMemoryStore();
+  const ids = /* @__PURE__ */ new Set();
   for (const [token, entry] of Object.entries(tokens)) {
     if (encoder.encode(token).length < MIN_TOKEN_BYTES) throw new Error(`tokens must hold at least ${MIN_TOKEN_BYTES} bytes`);
     if (/\s/.test(token)) throw new Error("a token may not hold white space");
@@ -267,20 +269,12 @@ async function createStaticTokenAuth(tokens) {
       throw new Error("each token needs an id and a list of scopes");
     }
     for (const scope of entry.scopes) parseScope(scope);
-    byDigest.set(await digest(token), {
-      principalId: entry.id,
-      kind: "human",
-      chain: [{ id: entry.id, kind: "human" }],
-      scopes: [...entry.scopes]
-    });
+    if (ids.has(entry.id)) throw new Error("each token needs its own id");
+    ids.add(entry.id);
+    await store.put("principals", entry.id, { id: entry.id, kind: "human", scopes: [...entry.scopes] });
+    await store.put("credentials", await digest(token), { principalId: entry.id, kind: "api_key" });
   }
-  return {
-    async authenticate(request) {
-      const match = /^Bearer ([^\s]+)$/.exec(request.headers.get("authorization") ?? "");
-      const context = match ? byDigest.get(await digest(match[1])) : void 0;
-      return context ? { ...context, chain: context.chain.map((step) => ({ ...step })), scopes: [...context.scopes] } : null;
-    }
-  };
+  return createStoreAuth(store);
 }
 
 // src/worker.ts

package/dist/cli.d.ts

@@ -1,14 +1,35 @@
 #!/usr/bin/env node
-import { C as ChatConfig } from './chat-CXbhePC5.js';
-import './loop-D4qWbRu6.js';
+import { C as ChatConfig } from './chat-CGITyrxg.js';
+import './loop-B6aowbyz.js';
 import './types-DGH8FS56.js';
 
+interface RemoteConfig {
+    api: string;
+    apiTokenEnv: string;
+}
+type RemoteCommand = {
+    name: "tools";
+} | {
+    name: "approvals";
+} | {
+    name: "approve";
+    id: string;
+    digest: string;
+} | {
+    name: "deny";
+    id: string;
+    reason?: string;
+};
+
 declare class UsageError extends Error {
     constructor(message: string);
 }
 interface Parsed {
-    command: "chat" | "mcp" | "help" | "version";
+    command: "chat" | "mcp" | "help" | "version" | "remote";
     config?: ChatConfig;
+    remote?: RemoteConfig;
+    allowApprove?: boolean;
+    remoteCommand?: RemoteCommand;
     message?: string;
     json: boolean;
 }

package/dist/cli.js

@@ -2,17 +2,21 @@
 import {
   ConfigError,
   buildSetup,
+  clientFor,
+  describeFailure,
   readTextFile,
-  runChat
-} from "./chunk-MESH6X6N.js";
+  runChat,
+  runRemote
+} from "./chunk-5BZENFYL.js";
 import "./chunk-HYT732TN.js";
-import "./chunk-FQD4OK2R.js";
+import "./chunk-2RRM6OLC.js";
 import {
   TOOL_RISKS,
   VERSION,
   printable,
   provenanceLabel
-} from "./chunk-C44QT474.js";
+} from "./chunk-JNZPVHNN.js";
+import "./chunk-QTIEDY3V.js";
 
 // src/cli.ts
 import { realpathSync } from "fs";
@@ -30,9 +34,22 @@ An AI assistant that acts inside your apps with the user's own permissions.
 
 Usage:
   agentic-assistant chat [flags] [message]   Send a message. Read stdin when there is no message.
-  agentic-assistant mcp [flags]              Start an MCP server with one tool, assistant_chat.
+  agentic-assistant mcp [flags]              Start an MCP server with the tool assistant_chat. With --api it adds three more.
+  agentic-assistant tools [flags]            List the tools of a running assistant API, with scope and risk.
+  agentic-assistant approvals [flags]        List the calls that wait for a person.
+  agentic-assistant approve <id> --digest <d> [flags]   Approve the exact call. Copy the digest from "approvals".
+  agentic-assistant deny <id> [--reason <text>] [flags] Deny the call. A denial is final.
+
+Flags for tools, approvals, approve, and deny:
+  --api <url>               The assistant API origin, like https://assistant.example.com. https, or localhost. Required.
+  --api-token-env <NAME>    Read the bearer token from this environment variable. Required. Tokens never go in arguments.
+  --digest <digest>         approve only: the digest of the pending call.
+  --reason <text>           deny only: why.
+  --json                    Print the result as JSON on stdout.
 
 Flags for chat and mcp:
+  --api <url> --api-token-env <NAME>   mcp only: also serve assistant_tools, assistant_approvals, assistant_deny.
+  --allow-approve           mcp only, with --api: also serve assistant_approve. Use an agent token (it needs assistant:admin).
   --tools <target>          An https MCP URL, or a command that starts an MCP server on stdio. Required.
   --tools-header-env <h=E>  Send header h with the value of environment variable E (http only). Repeat it.
   --scope <scope>           A scope the assistant may hold, like notes:read. Repeat it. Required.
@@ -82,6 +99,11 @@ var OPTIONS = {
   "max-tokens": { type: "string" },
   "max-cost": { type: "string" },
   "max-tool-calls": { type: "string" },
+  api: { type: "string" },
+  "api-token-env": { type: "string" },
+  "allow-approve": { type: "boolean" },
+  digest: { type: "string" },
+  reason: { type: "string" },
   json: { type: "boolean" },
   message: { type: "string" },
   help: { type: "boolean", short: "h" },
@@ -106,8 +128,27 @@ function parseCli(argv) {
   if (values.version) return { command: "version", json: false };
   const [command, ...rest] = positionals;
   if (values.help || command === void 0) return { command: "help", json: false };
-  if (command !== "chat" && command !== "mcp") throw new UsageError(`unknown command "${command}"`);
-  if (!values.tools) throw new UsageError("--tools is required");
+  const remoteNames = ["tools", "approvals", "approve", "deny"];
+  if (command !== "chat" && command !== "mcp" && !remoteNames.includes(command)) throw new UsageError(`unknown command "${command}"`);
+  if (values.api === "" || values["api-token-env"] === "") throw new UsageError("--api needs a URL, and --api-token-env a variable name");
+  if (values.api === void 0 !== (values["api-token-env"] === void 0)) throw new UsageError("--api and --api-token-env go together");
+  const remote = values.api !== void 0 && values["api-token-env"] !== void 0 ? { api: values.api, apiTokenEnv: values["api-token-env"] } : void 0;
+  if (command !== "mcp" && command !== "chat" && remote === void 0) throw new UsageError("--api and --api-token-env are required");
+  if (command === "chat" && remote !== void 0) throw new UsageError("--api works with mcp and the approval commands, not chat");
+  const wantsId = command === "approve" || command === "deny";
+  if (remoteNames.includes(command) && rest.length !== (wantsId ? 1 : 0)) throw new UsageError(wantsId ? `${command} needs one approval id` : `${command} takes no arguments`);
+  if (values["allow-approve"] && (command !== "mcp" || remote === void 0)) throw new UsageError("--allow-approve works with mcp and --api only");
+  if (command !== "approve" && values.digest !== void 0) throw new UsageError("--digest works with approve only");
+  if (command !== "deny" && values.reason !== void 0) throw new UsageError("--reason works with deny only");
+  if (remoteNames.includes(command)) {
+    const chatOnly = Object.keys(values).filter((key) => !["api", "api-token-env", "digest", "reason", "json", "help", "version"].includes(key));
+    if (chatOnly.length > 0) throw new UsageError(`--${chatOnly[0]} does not work with ${command}`);
+    const id = rest[0];
+    if (command === "approve" && !values.digest) throw new UsageError("approve needs --digest <digest>");
+    const remoteCommand = command === "approve" ? { name: "approve", id, digest: values.digest } : command === "deny" ? { name: "deny", id, ...values.reason !== void 0 ? { reason: values.reason } : {} } : { name: command };
+    return { command: "remote", remote, remoteCommand, json: values.json ?? false };
+  }
+  if (!values.tools) throw new UsageError(`--tools is required for ${command}: an https MCP URL, or a command that starts an MCP server on stdio`);
   if (!values["tool-scope"]) throw new UsageError("--tool-scope is required");
   const risk = values["tool-risk"] ?? "risky";
   if (!TOOL_RISKS.includes(risk)) throw new UsageError(`--tool-risk must be one of ${TOOL_RISKS.join(", ")}`);
@@ -159,7 +200,7 @@ function parseCli(argv) {
     preApproved,
     approve
   };
-  return { command, config, message: values.message ?? (rest.length > 0 ? rest.join(" ") : void 0), json: values.json ?? false };
+  return { command, config, remote, allowApprove: values["allow-approve"] ?? false, message: values.message ?? (rest.length > 0 ? rest.join(" ") : void 0), json: values.json ?? false };
 }
 function defaultIo() {
   return {
@@ -264,16 +305,30 @@ async function runCli(argv, io = defaultIo()) {
 `);
     return 0;
   }
+  if (parsed.command === "remote") {
+    try {
+      const client = clientFor(parsed.remote, io.env);
+      const { data, text } = await runRemote(client, parsed.remoteCommand);
+      io.out(parsed.json ? `${JSON.stringify(data)}
+` : `${text}
+`);
+      return 0;
+    } catch (error) {
+      io.err(error instanceof ConfigError ? `${error.name}: ${oneLine(error.message, 500)}` : describeFailure(error));
+      return error instanceof ConfigError ? 2 : 1;
+    }
+  }
   const config = parsed.config;
   const chatIo = { env: io.env, readFile: io.readFile, ...config.approve === "ask" && io.isTTY ? { ask: io.ask } : {} };
   let setup;
   try {
+    const remote = parsed.command === "mcp" && parsed.remote !== void 0 ? clientFor(parsed.remote, io.env) : void 0;
     setup = await buildSetup(config, chatIo);
     for (const skip of setup.skipped.slice(0, MAX_SKIPPED_LINES)) io.err(`skipped tool ${oneLine(skip.name, 100)}: ${oneLine(skip.reason, 200)}`);
     if (setup.skipped.length > MAX_SKIPPED_LINES) io.err(`skipped ${setup.skipped.length - MAX_SKIPPED_LINES} more tools`);
     if (parsed.command === "mcp") {
-      const { startAssistantMcp } = await import("./mcp-server-LXGWKEHG.js");
-      await startAssistantMcp(setup);
+      const { startAssistantMcp } = await import("./mcp-server-7R5WCSID.js");
+      await startAssistantMcp(setup, remote, { approve: parsed.allowApprove ?? false });
       return 0;
     }
     const text = parsed.message ?? (io.isTTY ? void 0 : (await io.readStdin()).trim());

package/dist/client.d.ts

@@ -1,5 +1,5 @@
-import { A as AssistantEvent, a as ApprovalRequest, b as Actor } from './loop-D4qWbRu6.js';
-export { D as DeniedReason, c as DoneReason, R as RunTotals } from './loop-D4qWbRu6.js';
+import { h as AssistantEvent, e as ApprovalRequest, b as Actor } from './loop-B6aowbyz.js';
+export { j as DeniedReason, k as DoneReason, p as RunTotals } from './loop-B6aowbyz.js';
 import './types-DGH8FS56.js';
 
 /** The error code of a failed call. The client derives it from the HTTP status and the error body. */

package/dist/client.js

@@ -1,194 +1,7 @@
-// src/client.ts
-var STATUS_CODES = {
-  400: "INVALID_INPUT",
-  401: "UNAUTHENTICATED",
-  403: "FORBIDDEN",
-  404: "NOT_FOUND",
-  405: "METHOD_NOT_ALLOWED",
-  409: "CONFLICT",
-  429: "RATE_LIMITED"
-};
-var AssistantApiError = class extends Error {
-  code;
-  status;
-  /** Seconds to wait before a new try, from `retry-after` of a 429 reply. */
-  retryAfter;
-  constructor(code, status, message, retryAfter) {
-    super(message);
-    this.name = "AssistantApiError";
-    this.code = code;
-    this.status = status;
-    this.retryAfter = retryAfter;
-  }
-};
-var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var isString = (v) => typeof v === "string";
-var RISKS = ["safe", "risky", "irreversible"];
-var isTool = (v) => isObject(v) && isString(v.name) && isString(v.description) && isString(v.scope) && RISKS.includes(v.risk) && "inputSchema" in v;
-var isPending = (v) => isObject(v) && isString(v.id) && isString(v.tool) && RISKS.includes(v.risk) && isString(v.digest) && isObject(v.input) && isObject(v.proposedBy) && isString(v.requestedBy) && typeof v.canDecide === "boolean";
-var SHAPES = {
-  health: (v) => isObject(v) && typeof v.ok === "boolean" && isString(v.pack) && isString(v.version),
-  tools: (v) => isObject(v) && Array.isArray(v.tools) && v.tools.every(isTool),
-  approvals: (v) => isObject(v) && Array.isArray(v.approvals) && v.approvals.every(isPending),
-  decision: (v) => isObject(v) && isString(v.requestId) && typeof v.approved === "boolean" && isString(v.decidedBy) && typeof v.machineMade === "boolean"
-};
-var MAX_EVENT_CHARS = 4194304;
-var EVENT_TYPES = ["run_start", "turn_start", "text_delta", "tool_call", "approval_request", "approval_decision", "tool_result", "turn_end", "done", "error"];
-var isEvent = (v) => {
-  if (!isObject(v) || typeof v.type !== "string" || !EVENT_TYPES.includes(v.type)) return false;
-  switch (v.type) {
-    case "done":
-      return isString(v.reason) && isObject(v.totals);
-    case "error":
-      return isString(v.error);
-    case "text_delta":
-      return isString(v.text);
-    case "tool_result":
-      return isString(v.id) && isString(v.name) && isString(v.content) && typeof v.isError === "boolean";
-    case "tool_call":
-      return isString(v.id) && isString(v.name);
-    case "approval_request":
-      return isObject(v.request) && isString(v.request.id) && isString(v.request.digest);
-    case "approval_decision":
-      return isString(v.requestId) && typeof v.approved === "boolean";
-    default:
-      return true;
-  }
-};
-function createClient(options) {
-  if (typeof options.baseUrl !== "string" || options.baseUrl === "") throw new TypeError("createClient needs a baseUrl");
-  if (typeof options.token !== "string" || options.token === "") throw new TypeError("createClient needs a token");
-  let origin;
-  try {
-    origin = new URL(options.baseUrl);
-  } catch {
-    throw new TypeError("baseUrl must be an absolute URL");
-  }
-  const local = ["localhost", "127.0.0.1", "[::1]"].includes(origin.hostname);
-  if (origin.protocol !== "https:" && !(origin.protocol === "http:" && local)) {
-    throw new TypeError("baseUrl must be an https URL, or an http URL on localhost, 127.0.0.1, or [::1]");
-  }
-  if (origin.search !== "" || origin.hash !== "" || origin.username !== "" || origin.password !== "") {
-    throw new TypeError("baseUrl must have no query, hash, or credentials");
-  }
-  const prefix = origin.pathname.replace(/\/+$/, "");
-  const root = `${origin.origin}${prefix}/api/v1`;
-  const token = options.token;
-  const send = (input, init) => {
-    const run = options.fetch ?? globalThis.fetch;
-    return run(input, init);
-  };
-  const seg = (value) => {
-    if (typeof value !== "string" || /^(?:\.|%2e){0,2}$/i.test(value)) throw new TypeError("an id must be a non-empty string that is not . or ..");
-    return encodeURIComponent(value);
-  };
-  async function request(url, method, body, callOptions, authed = true) {
-    const headers = authed ? { authorization: `Bearer ${token}` } : {};
-    if (body !== void 0) headers["content-type"] = "application/json";
-    return send(url, {
-      method,
-      headers,
-      body: body === void 0 ? void 0 : JSON.stringify(body),
-      signal: callOptions?.signal,
-      // Never follow a redirect: it would send the token to another host.
-      redirect: "manual"
-    });
-  }
-  async function failure(response) {
-    let parsed;
-    try {
-      parsed = JSON.parse(await response.text());
-    } catch {
-      parsed = void 0;
-    }
-    const error = isObject(parsed) ? parsed.error : void 0;
-    const message = isObject(parsed) && typeof parsed.message === "string" ? parsed.message : typeof error === "string" ? error : `HTTP ${response.status}`;
-    let code = STATUS_CODES[response.status] ?? (response.status >= 500 ? "INTERNAL" : "UNKNOWN");
-    if (response.status === 503 && error === "not_configured") code = "NOT_CONFIGURED";
-    if (typeof error !== "string") code = response.status >= 500 ? "INTERNAL" : "UNKNOWN";
-    const after = response.headers.get("retry-after")?.trim() ?? "";
-    return new AssistantApiError(code, response.status, message, /^\d{1,9}$/.test(after) ? Number(after) : void 0);
-  }
-  async function call(url, method, body, callOptions, shape, authed = true) {
-    const response = await request(url, method, body, callOptions, authed);
-    if (!response.ok) throw await failure(response);
-    let parsed;
-    try {
-      parsed = JSON.parse(await response.text());
-    } catch {
-      parsed = void 0;
-    }
-    if (!SHAPES[shape](parsed)) throw new AssistantApiError("UNKNOWN", response.status, `the reply is not a ${shape}`);
-    return parsed;
-  }
-  async function* chat(message, callOptions) {
-    const response = await request(`${root}/chat`, "POST", { message }, callOptions);
-    if (!response.ok) throw await failure(response);
-    if (!(response.headers.get("content-type") ?? "").startsWith("text/event-stream") || response.body === null) {
-      await response.body?.cancel();
-      throw new AssistantApiError("UNKNOWN", response.status, "the reply is not an event stream");
-    }
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
-    let ended = false;
-    function* drain(final) {
-      const text = final ? buffer : buffer.replace(/\r$/, "");
-      const normal = text.replace(/\r\n?/g, "\n");
-      const rest = buffer.slice(text.length);
-      let from = 0;
-      for (let end = normal.indexOf("\n\n", from); end >= 0; end = normal.indexOf("\n\n", from)) {
-        const event = parseBlock(normal.slice(from, end), response.status);
-        from = end + 2;
-        if (event === void 0) continue;
-        if (ended) throw new AssistantApiError("UNKNOWN", response.status, "an event came after the end of the stream");
-        ended = event.type === "done" || event.type === "error";
-        yield event;
-      }
-      buffer = normal.slice(from) + rest;
-    }
-    try {
-      for (; ; ) {
-        const chunk = await reader.read();
-        if (chunk.done) break;
-        buffer += decoder.decode(chunk.value, { stream: true });
-        yield* drain(false);
-        if (buffer.length > MAX_EVENT_CHARS) throw new AssistantApiError("UNKNOWN", response.status, "an event is too long");
-      }
-      buffer += decoder.decode();
-      yield* drain(true);
-      if (!ended || buffer.trim() !== "") throw new AssistantApiError("UNKNOWN", response.status, "the stream ended before a done event");
-    } finally {
-      await reader.cancel().catch(() => void 0);
-    }
-  }
-  function parseBlock(block, status) {
-    const data = block.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, "")).join("\n");
-    if (data === "") return void 0;
-    let parsed;
-    try {
-      parsed = JSON.parse(data);
-    } catch {
-      parsed = void 0;
-    }
-    if (!isEvent(parsed)) throw new AssistantApiError("UNKNOWN", status, "an event is not valid");
-    return parsed;
-  }
-  const decided = (id, decision) => {
-    if (decision.requestId !== id) throw new AssistantApiError("UNKNOWN", 200, "the reply is for another approval");
-    return decision;
-  };
-  const methods = {
-    // /health is outside /api/v1 and needs no token, so the client sends none.
-    health: async (o) => call(`${origin.origin}${prefix}/health`, "GET", void 0, o, "health", false),
-    tools: async (o) => (await call(`${root}/tools`, "GET", void 0, o, "tools")).tools,
-    chat,
-    approvals: async (o) => (await call(`${root}/approvals`, "GET", void 0, o, "approvals")).approvals,
-    approve: async (id, digest, o) => decided(id, await call(`${root}/approvals/${seg(id)}/approve`, "POST", { digest }, o, "decision")),
-    deny: async (id, reason, o) => decided(id, await call(`${root}/approvals/${seg(id)}/deny`, "POST", reason === void 0 ? {} : { reason }, o, "decision"))
-  };
-  return methods;
-}
+import {
+  AssistantApiError,
+  createClient
+} from "./chunk-QTIEDY3V.js";
 export {
   AssistantApiError,
   createClient

package/dist/demo.js

@@ -1,14 +1,15 @@
 import {
   createStaticTokenAuth,
   createWorker
-} from "./chunk-YMEM57LX.js";
+} from "./chunk-TOQIHYDH.js";
 import {
   AnthropicProvider
-} from "./chunk-FQD4OK2R.js";
+} from "./chunk-2RRM6OLC.js";
 import {
   ToolRegistry,
-  VERSION
-} from "./chunk-C44QT474.js";
+  VERSION,
+  hasScope
+} from "./chunk-JNZPVHNN.js";
 
 // src/demo-page.ts
 var DEMO_CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
@@ -19,13 +20,13 @@ var DEMO_PAGE = `<!doctype html>
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>agentic-assistant demo</title>
 <style>
-body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:2rem auto;padding:0 1rem;color:#1a1a1a;background:#fff}
+body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:2rem auto;padding:0 1rem;color:var(--ad-color-text,CanvasText);background:var(--ad-color-surface,Canvas)}
 label{display:block;margin-top:1rem;font-weight:600}
 input,textarea,button{font:inherit;padding:.5rem;width:100%;box-sizing:border-box}
 button{width:auto;min-height:2.5rem;margin-top:1rem;cursor:pointer}
-:focus-visible{outline:3px solid #0b57d0;outline-offset:2px}
-#out{white-space:pre-wrap;border:1px solid #767676;padding:1rem;margin-top:1rem;min-height:4rem}
-.badge{display:inline-block;border:1px solid #1a1a1a;padding:0 .5rem;font-size:.875rem}
+:focus-visible{outline:3px solid var(--ad-color-focus,LinkText);outline-offset:2px}
+#out{white-space:pre-wrap;border:1px solid var(--ad-color-border-strong,CanvasText);padding:1rem;margin-top:1rem;min-height:4rem}
+.badge{display:inline-block;border:1px solid var(--ad-color-text,CanvasText);padding:0 .5rem;font-size:.875rem}
 </style>
 </head>
 <body>
@@ -103,6 +104,7 @@ var demoRegistry = () => new ToolRegistry().register({
   risk: "safe",
   handler: () => ({ now: (/* @__PURE__ */ new Date()).toISOString() })
 });
+var DEMO_SCOPE = "demo:read";
 var DEMO_SYSTEM = "You are a demo assistant. You may use the demo_time tool. Answer in short, plain text.";
 function modelOptions(env) {
   if (!env.MODEL_KEY) return void 0;
@@ -117,6 +119,8 @@ async function buildDemo(env) {
   const auth = await createStaticTokenAuth(tokens);
   const worker = createWorker({
     auth,
+    // A token without `demo:read` signs in but may use no route.
+    routeScopes: { tools: DEMO_SCOPE, chat: DEMO_SCOPE, approvals: DEMO_SCOPE },
     registry: demoRegistry(),
     system: DEMO_SYSTEM,
     limits: { maxTurns: 4, maxTotalTokens: 2e4, maxOutputTokensPerTurn: 1024 },
@@ -148,7 +152,8 @@ var demo_default = {
       return notConfigured("this demo is not set up");
     }
     if (request.method === "POST" && url.pathname.replace(/\/$/, "") === "/api/v1/chat" && modelOptions(env) === void 0) {
-      if (await demo.auth.authenticate(request.clone()) !== null) return notConfigured("this demo has no model key or model endpoint set");
+      const who = await demo.auth.authenticate(request.clone());
+      if (who !== null && hasScope(who.scopes, DEMO_SCOPE)) return notConfigured("this demo has no model key or model endpoint set");
     }
     return demo.worker.fetch(request, env);
   }

package/dist/index.d.ts

@@ -1,10 +1,11 @@
-export { d as ACTIONS, e as Action, b as Actor, f as ApprovalDecision, g as ApprovalGate, a as ApprovalRequest, h as Approver, i as ApproverKind, A as AssistantEvent, j as AssistantPrincipal, k as DATA_NOTICE, D as DeniedReason, c as DoneReason, P as PrincipalError, l as PrincipalInput, m as Provenance, n as ProvenanceInput, Q as QueueApprovalGate, o as RunLimits, p as RunOptions, R as RunTotals, S as Scope, T as TOOL_RISKS, q as TRAINED_ALGORITHMIC_MEDIA, r as ToolContext, s as ToolDefinition, t as ToolRegistry, u as ToolRisk, v as actorOf, w as assertPrincipal, x as canonicalJson, y as createPrincipal, z as createProvenance, B as defineTool, C as digestCall, E as hasScope, F as parseScope, G as provenanceLabel, H as provenanceMarker, I as runAssistant, J as scopeCovers } from './loop-D4qWbRu6.js';
-import { S as Setup } from './chat-CXbhePC5.js';
-export { C as ChatConfig, a as ChatIo, b as ConfigError, c as ConnectMcpOptions, M as McpToolInfo, d as McpTools, e as McpTransportConfig, f as buildSetup, g as connectMcpTools, p as parseTarget, r as runChat } from './chat-CXbhePC5.js';
+export { A as ACTIONS, a as Action, b as Actor, c as ApprovalDecision, d as ApprovalGate, e as ApprovalRequest, f as Approver, g as ApproverKind, h as AssistantEvent, i as AssistantPrincipal, D as DATA_NOTICE, j as DeniedReason, k as DoneReason, P as PrincipalError, l as PrincipalInput, m as Provenance, n as ProvenanceInput, Q as QueueApprovalGate, R as RunLimits, o as RunOptions, p as RunTotals, S as Scope, T as TOOL_RISKS, q as TRAINED_ALGORITHMIC_MEDIA, r as ToolContext, s as ToolDefinition, t as ToolRegistry, u as ToolRisk, v as actorOf, w as assertPrincipal, x as canonicalJson, y as createPrincipal, z as createProvenance, B as defineTool, C as digestCall, E as hasScope, F as parseScope, G as provenanceLabel, H as provenanceMarker, I as runAssistant, J as scopeCovers } from './loop-B6aowbyz.js';
+import { S as Setup } from './chat-CGITyrxg.js';
+export { C as ChatConfig, a as ChatIo, b as ConfigError, c as ConnectMcpOptions, M as McpToolInfo, d as McpTools, e as McpTransportConfig, f as buildSetup, g as connectMcpTools, p as parseTarget, r as runChat } from './chat-CGITyrxg.js';
 import Anthropic from '@anthropic-ai/sdk';
 import { M as ModelProvider, P as Pricing, a as ModelRequest, b as ModelEvent } from './types-DGH8FS56.js';
 export { A as AnsweredBy, C as ContentBlock, J as JsonSchema, c as Message, d as ProviderError, S as StopReason, T as ToolSpec, U as Usage } from './types-DGH8FS56.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { AssistantClient } from './client.js';
 
 declare const VERSION: string;
 
@@ -81,9 +82,16 @@ declare class FallbackProvider implements ModelProvider {
     stream(request: ModelRequest): AsyncGenerator<ModelEvent>;
 }
 
-/** An MCP server with one tool, `assistant_chat`. Each call starts a new conversation. */
-declare function createAssistantMcpServer(setup: Setup, shutdown?: AbortSignal): Server;
+/**
+ * An MCP server with the tool `assistant_chat`. Each call starts a new conversation. With a `remote` client it
+ * also serves `assistant_tools`, `assistant_approvals`, and `assistant_deny`. `assistant_approve` needs `allow.approve`.
+ */
+declare function createAssistantMcpServer(setup: Setup, shutdown?: AbortSignal, remote?: AssistantClient, allow?: {
+    approve?: boolean;
+}): Server;
 /** Serves on stdio. Resolves when the client closes its input, or the transport closes. */
-declare function startAssistantMcp(setup: Setup): Promise<void>;
+declare function startAssistantMcp(setup: Setup, remote?: AssistantClient, allow?: {
+    approve?: boolean;
+}): Promise<void>;
 
 export { AnthropicProvider, type AnthropicProviderOptions, DEFAULT_ANTHROPIC_MODEL, FallbackProvider, ModelEvent, ModelProvider, ModelRequest, type OpenAICompatibleOptions, OpenAICompatibleProvider, PRICING_CHECKED_ON, Pricing, Setup, VERSION, createAssistantMcpServer, startAssistantMcp };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createAssistantMcpServer,
   startAssistantMcp
-} from "./chunk-KNUEYFX2.js";
+} from "./chunk-E7TFMM2Z.js";
 import {
   ConfigError,
   FallbackProvider,
@@ -10,13 +10,13 @@ import {
   connectMcpTools,
   parseTarget,
   runChat
-} from "./chunk-MESH6X6N.js";
+} from "./chunk-5BZENFYL.js";
 import "./chunk-HYT732TN.js";
 import {
   AnthropicProvider,
   DEFAULT_ANTHROPIC_MODEL,
   PRICING_CHECKED_ON
-} from "./chunk-FQD4OK2R.js";
+} from "./chunk-2RRM6OLC.js";
 import {
   ACTIONS,
   DATA_NOTICE,
@@ -40,7 +40,8 @@ import {
   provenanceMarker,
   runAssistant,
   scopeCovers
-} from "./chunk-C44QT474.js";
+} from "./chunk-JNZPVHNN.js";
+import "./chunk-QTIEDY3V.js";
 export {
   ACTIONS,
   AnthropicProvider,

package/dist/{loop-D4qWbRu6.d.ts → loop-B6aowbyz.d.ts}

@@ -287,4 +287,4 @@ declare const DATA_NOTICE: string;
  */
 declare function runAssistant(options: RunOptions): AsyncGenerator<AssistantEvent>;
 
-export { type AssistantEvent as A, defineTool as B, digestCall as C, type DeniedReason as D, hasScope as E, parseScope as F, provenanceLabel as G, provenanceMarker as H, runAssistant as I, scopeCovers as J, PrincipalError as P, QueueApprovalGate as Q, type RunTotals as R, type Scope as S, TOOL_RISKS as T, type ApprovalRequest as a, type Actor as b, type DoneReason as c, ACTIONS as d, type Action as e, type ApprovalDecision as f, type ApprovalGate as g, type Approver as h, type ApproverKind as i, type AssistantPrincipal as j, DATA_NOTICE as k, type PrincipalInput as l, type Provenance as m, type ProvenanceInput as n, type RunLimits as o, type RunOptions as p, TRAINED_ALGORITHMIC_MEDIA as q, type ToolContext as r, type ToolDefinition as s, ToolRegistry as t, type ToolRisk as u, actorOf as v, assertPrincipal as w, canonicalJson as x, createPrincipal as y, createProvenance as z };
+export { ACTIONS as A, defineTool as B, digestCall as C, DATA_NOTICE as D, hasScope as E, parseScope as F, provenanceLabel as G, provenanceMarker as H, runAssistant as I, scopeCovers as J, PrincipalError as P, QueueApprovalGate as Q, type RunLimits as R, type Scope as S, TOOL_RISKS as T, type Action as a, type Actor as b, type ApprovalDecision as c, type ApprovalGate as d, type ApprovalRequest as e, type Approver as f, type ApproverKind as g, type AssistantEvent as h, type AssistantPrincipal as i, type DeniedReason as j, type DoneReason as k, type PrincipalInput as l, type Provenance as m, type ProvenanceInput as n, type RunOptions as o, type RunTotals as p, TRAINED_ALGORITHMIC_MEDIA as q, type ToolContext as r, type ToolDefinition as s, ToolRegistry as t, type ToolRisk as u, actorOf as v, assertPrincipal as w, canonicalJson as x, createPrincipal as y, createProvenance as z };

package/dist/mcp-server-7R5WCSID.js

@@ -0,0 +1,13 @@
+import {
+  createAssistantMcpServer,
+  startAssistantMcp
+} from "./chunk-E7TFMM2Z.js";
+import "./chunk-5BZENFYL.js";
+import "./chunk-HYT732TN.js";
+import "./chunk-2RRM6OLC.js";
+import "./chunk-JNZPVHNN.js";
+import "./chunk-QTIEDY3V.js";
+export {
+  createAssistantMcpServer,
+  startAssistantMcp
+};