allaboard 0.0.0-stage → 0.4.0

package/dist/core/flows/lists.js

@@ -0,0 +1,21 @@
+/**
+ * The words that post a list in a channel, and what follows a pick from one: `!resume` with a
+ * folder's sessions, `!bind` with the folders a session can start in. The core decides what is
+ * offered, which rows the list holds and what a pick does; the chat provider draws the list and
+ * checks that it was the owner who picked.
+ */
+import { binding } from "./bind.js";
+import { resuming } from "./resume.js";
+export function lists(deps, talk) {
+    const bind = binding(deps, talk);
+    const resume = resuming(deps, talk);
+    return {
+        resume: { word: resume.word },
+        bind: { to: bind.to, list: bind.list },
+        picks: {
+            // A failure after the provider's checks reaches the owner in the channel, where the list
+            // was posted. The thread of the guard is the list's own: it names a message of the channel.
+            picked: (pick) => talk.replyOnFailure({ channel: pick.channel, thread: pick.list }, () => (pick.type === "folder" ? bind.picked(pick) : resume.picked(pick)), (told) => talk.inChannel(pick.channel, told)),
+        },
+    };
+}

package/dist/core/flows/messages.js

@@ -0,0 +1,293 @@
+/**
+ * A message the owner wrote: read as a word of the daemon's, a command of the agent's or a
+ * prompt, and sent to its thread's session after the setup and the hold when either is due.
+ *
+ * Ordering. Prompts, messages with files and commands enter a thread's queue in the order they
+ * were sent although files take a while to read. That holds by construction: from the moment a
+ * provider hands over a message (`message` is called) to the moment its place in line is taken
+ * (`Mutex.acquire` inside `arrival`), nothing is awaited except a call to the chat (the
+ * old-folder notice). The stretches are marked `(sync)`; the provider keeps its side of it: it
+ * hands the messages of a thread over in the order its listeners were called, whatever its
+ * checks take, with nothing awaited between its last check and the call.
+ */
+import { hostOnly, parseBang, refusedInThread, } from "../commands.js";
+import { SessionClosed, SessionGone } from "../sessions/errors.js";
+import { Mutex } from "../sessions/tasks.js";
+import * as texts from "../texts.js";
+import { fill, named } from "../texts.js";
+import { wordFlow } from "./words.js";
+/** The first word of a passthrough, as typed: the text up to its first space. */
+function firstWord(command) {
+    return command.text.split(" ", 1)[0] ?? "";
+}
+/**
+ * Whether a passthrough starts a new session under any of the agent's names (`refusedInThread`,
+ * given its `newSession` names and the session's `commands`): refused inside a thread (one thread
+ * is one session), left as an ordinary passthrough everywhere else.
+ */
+export function isClear(command, commands, newSession, agentCommands = true) {
+    return refusedInThread(commands, newSession, agentCommands).has(firstWord(command).toLowerCase());
+}
+export function messages(deps, talk, others) {
+    const { chat, agent, sessions, state, names } = deps;
+    const word = wordFlow(deps, talk, others);
+    // One lock per thread, alive only while someone holds or waits on it (a channel keeps
+    // opening new threads for as long as it runs; a lock kept forever would leak).
+    const arrivalOrder = new Map();
+    const arrivalWaiters = new Map();
+    /** `work` in its turn among the messages of one thread: the turns are taken in call order. */
+    async function arrival(ref, work) {
+        const key = `${ref.channel}\n${ref.thread}`;
+        // (sync) The place in line is taken inside this call, before its first await.
+        arrivalWaiters.set(key, (arrivalWaiters.get(key) ?? 0) + 1);
+        let lock = arrivalOrder.get(key);
+        if (lock === undefined) {
+            lock = new Mutex();
+            arrivalOrder.set(key, lock);
+        }
+        const turn = lock.acquire();
+        try {
+            const release = await turn;
+            try {
+                await work();
+            }
+            finally {
+                release();
+            }
+        }
+        finally {
+            const left = (arrivalWaiters.get(key) ?? 1) - 1;
+            if (left === 0) {
+                arrivalWaiters.delete(key);
+                arrivalOrder.delete(key);
+            }
+            else {
+                arrivalWaiters.set(key, left);
+            }
+        }
+    }
+    /** What the old-folder notice says of this thread, or null when its folder is the channel's. */
+    function oldFolderText(channel, session) {
+        const record = state.channel(channel);
+        if (record === null || session.directory === record.directory)
+            return null;
+        return fill(named(texts.OLD_THREAD_FOLDER, names), {
+            old: chat.escape(session.directory, "notice"),
+            new: chat.escape(record.directory, "notice"),
+        });
+    }
+    /**
+     * Whether a message for `session` must be refused now: the daemon is draining, or an install
+     * is replacing its copy and the message would start an agent process (a session already
+     * connected goes on).
+     */
+    function refusing(session) {
+        return sessions.draining || (sessions.startsBlocked && !session.connected);
+    }
+    /**
+     * Send a prompt, a message with files or a command to its thread's session, in the order the
+     * thread's messages were sent, after the session's setup and the same-folder hold when either
+     * is due.
+     */
+    async function submitToSession(message, opened, command, options) {
+        const { ref } = message;
+        const { inThread } = options;
+        if (talk.stopped)
+            return;
+        if (inThread &&
+            command !== null &&
+            isClear(command, opened.commands, agent.words.newSession, agent.capabilities.commands)) {
+            await talk.tell(ref, texts.CLEAR_IN_THREAD);
+            return;
+        }
+        // Prompts and commands for the agent enter the queue in the order they were sent, although
+        // files take a while to read. Every reply goes to the thread.
+        await arrival(ref, async () => {
+            let session = opened;
+            let prompt = await message.content();
+            if (prompt === null || talk.stopped)
+                return;
+            // Checked before the hold too: a drain already cancelled every hold open when it
+            // started (`SessionManager.drain`) and will never cancel one opened after, so a message
+            // that arrives once draining has begun must never open a new one (it would wait
+            // forever).
+            if (refusing(session)) {
+                await talk.refuseRestarting(ref);
+                return;
+            }
+            // The same-folder hold: this message would wake `session` (busy just queues behind what
+            // is already running); ask first when another live session, of any channel, is already
+            // busy in the same resolved folder. Later messages of this thread queue behind the wait,
+            // since it runs inside the arrival lock. `held` is the object a Continue's mark was left
+            // standing on (`holdEnd({ continued: true })` bets on the `submit()` below to replace it
+            // with the working one): kept apart from `session`, which a `SessionClosed` retry below
+            // can reassign, so a non-submit exit always restores the mark on the object that
+            // actually shows it.
+            let held = null;
+            let askedSetup = false;
+            if (!inThread || session.neverRan) {
+                // A session's first prompt: its setup comes before anything else, the hold's question
+                // included. A reply in a thread whose setup was cancelled, or whose hold was, is a
+                // first prompt too: nothing was ever sent in it.
+                const ready = await others.setup.beforeSending(ref, session);
+                if (ready === null)
+                    return;
+                session = ready;
+                held = ready;
+                askedSetup = true;
+            }
+            if (!session.busy) {
+                const other = sessions.workingIn({ besides: session });
+                if (other !== null) {
+                    if (!(await others.hold.beforeSending(ref, session, other))) {
+                        // the Start that nothing was sent for
+                        if (askedSetup && !talk.stopped)
+                            await session.forgetSetup();
+                        return;
+                    }
+                    held = session;
+                }
+            }
+            // Retried once against a freshly looked-up session: the one this call was handed can
+            // still close under it (most likely the idle close, though `touch()` at the lookup
+            // already guards the common case) during the read above or the steps below.
+            let submitted = false;
+            let failed = false;
+            try {
+                for (let attempt = 0; attempt < 2; attempt += 1) {
+                    try {
+                        if (command !== null) {
+                            await session.ensureConnected();
+                            const known = new Set(session.commands.map((offered) => offered.name));
+                            prompt = known.has(firstWord(command)) ? `/${command.text}` : message.text;
+                        }
+                        // (sync) Checked last, with no await before the submit: a stop can start while the
+                        // files are read. The daemon's words still work meanwhile (`!stop` shortens the
+                        // wait); a new turn would not finish, and the chat does not send this message
+                        // again. A stop that ended meanwhile (the daemon is gone) sends nothing and says
+                        // nothing.
+                        if (talk.stopped)
+                            return;
+                        if (refusing(session)) {
+                            await talk.refuseRestarting(ref);
+                            return;
+                        }
+                        await session.submit(prompt);
+                        submitted = true;
+                        return;
+                    }
+                    catch (error) {
+                        if (!(error instanceof SessionClosed) || attempt > 0)
+                            throw error;
+                        const fresh = sessions.get(ref.channel, ref.thread);
+                        // Not just closed: its thread's own entry is gone too (a `SessionGone` close), so
+                        // a retry would find nothing here again either.
+                        if (fresh === null)
+                            throw new SessionGone(names);
+                        session = fresh;
+                    }
+                }
+            }
+            catch (error) {
+                failed = true;
+                throw error;
+            }
+            finally {
+                // `submitted` alone, not a fixed set of error types: `ensureConnected` can also reject
+                // with the agent's own failure (a logged-out CLI, most likely) or anything a stray bug
+                // throws; none of them may ever leave a Continue's mark standing forever. A failure
+                // gets the mark a turn that reached the queue and then failed gets; a plain return (the
+                // drain notice posted fine) restores a Cancel's own mark instead.
+                if (held !== null && !submitted)
+                    await held.reactHoldAbandoned({ error: failed });
+            }
+        });
+    }
+    /**
+     * Where a word's failure is told: in the channel for a word that acts top-level, under the
+     * owner's message for one typed inside a session's thread.
+     */
+    function wordReport(ref, session) {
+        return async (told) => {
+            if (session === null)
+                await talk.inChannel(ref.channel, told);
+            else
+                await talk.tell(ref, told);
+        };
+    }
+    /**
+     * One message that passed its provider's checks, routed by where it was written: a known
+     * session's thread, a thread that holds none, or the channel.
+     */
+    async function route(message) {
+        const { ref, topLevel } = message;
+        const { channel, thread } = ref;
+        // (sync) From here to the turn `submitToSession` takes, unless a call to the chat is due or
+        // the message opens a thread: that one first asks whether another process updates allaboard
+        // (a read of the lock file), so the thread exists a few milliseconds later than the message
+        // was routed. An event of that thread cannot arrive sooner: it is written under a message
+        // that is already shown. A stop that closes the sessions meanwhile makes `open` throw
+        // `SessionClosed`, which `replyOnFailure` tells.
+        // A message with files is a prompt: no daemon word or command takes a file. A word is a
+        // word however it is formatted: the typed text carries the chat's marks (a backtick before
+        // the `!` of a message in inline code), which `plain` has removed. Nor is a message that
+        // was spoken: what the chat heard never turns bypass on, stops a session or becomes a
+        // command, whatever its first character. Both are `literal`.
+        let command = null;
+        if (!message.literal)
+            command = parseBang(message.text) ?? parseBang(message.plain);
+        // A known session's thread routes a word to it; anywhere else (truly top-level, or a
+        // thread that is not a session) a word acts exactly as a top-level one would.
+        const session = topLevel ? null : sessions.get(channel, thread);
+        if (command !== null && command.kind !== "passthrough") {
+            const typed = command;
+            await talk.replyOnFailure(ref, () => word(ref, message.id, typed, { session, outside: !topLevel && session === null }), wordReport(ref, session));
+            return;
+        }
+        if (command !== null) {
+            const answer = hostOnly(command, names, agent.capabilities.commands);
+            if (answer !== null) {
+                // Answered where a word is: under the owner's message in a session's thread, for the
+                // owner alone, and as a post in the channel anywhere else. No session starts.
+                if (session !== null)
+                    await talk.tell(ref, answer);
+                else
+                    await talk.inChannel(channel, answer);
+                return;
+            }
+        }
+        if (session !== null) {
+            // A prompt sent in a thread whose folder differs from the channel's current one is told
+            // so, on every prompt: a line for the owner alone can vanish on reload, so a once-only
+            // notice could mean never. `tell` never rejects, so a failed notice cannot drop the
+            // prompt that follows it.
+            const moved = oldFolderText(channel, session);
+            if (moved !== null)
+                await talk.tell(ref, moved);
+            await submitToSession(message, session, command, { inThread: true });
+            return;
+        }
+        if (!topLevel) {
+            // Anything but a daemon word, in a thread that holds no session: nowhere to send it.
+            await talk.tell(ref, texts.NOT_A_SESSION);
+            return;
+        }
+        // Before the thread's entry is written: an install under way starts no process, and a message
+        // that would only start one changes nothing.
+        if (state.channel(channel) !== null && (await sessions.refusesStarts())) {
+            await talk.refuseRestarting(ref);
+            return;
+        }
+        const opened = sessions.open(channel, thread);
+        if (opened === null) {
+            await talk.unbound(channel);
+            return;
+        }
+        await submitToSession(message, opened, command, { inThread: false });
+    }
+    return {
+        // A failure of a prompt itself (or of the session it starts) lands in that session's
+        // thread: it is the turn's one push. A word answers where it was typed instead.
+        message: (message) => talk.replyOnFailure(message.ref, () => route(message)),
+    };
+}

package/dist/core/flows/notices.js

@@ -0,0 +1,51 @@
+import { getLogger } from "../../log.js";
+import { errorName } from "../../values.js";
+import * as texts from "../texts.js";
+import { fill } from "../texts.js";
+import { clockTime } from "./update.js";
+export const logger = getLogger("allaboard.core.flows.notices");
+/**
+ * The v1-to-v2 migration notice, once per channel, top-level: not a reply to any message. A
+ * channel whose post failed keeps its flag for the next start.
+ */
+export async function postUpgradeNotices(chat, state, names) {
+    for (const channelId of state.pendingNotices()) {
+        try {
+            await chat.channel(channelId).notice(texts.named(texts.UPGRADE_NOTICE, names));
+        }
+        catch (error) {
+            logger.warning(`could not post the upgrade notice in ${channelId}: ${errorName(error)}`);
+            continue;
+        }
+        state.clearNotice(channelId);
+    }
+}
+/**
+ * The message a restart asked from the chat left (`state.json`'s `restart_notice`), rewritten in
+ * place into what happened: the daemon is back, on the version asked or not. `notice` is what the
+ * file held before the chat could hear the owner (a restart asked since is another's to rewrite),
+ * `installed` the version that runs and `now` the wall-clock seconds. The key is forgotten
+ * whatever the outcome (the message deleted, the chat refusing), so a start never rewrites twice,
+ * and only while it is still `notice`.
+ */
+export async function rewriteRestartNotice(chat, state, notice, installed, now) {
+    if (notice === null)
+        return;
+    const text = notice.version === null
+        ? fill(texts.UPDATE_RESTARTED, { time: clockTime(now) })
+        : notice.version === installed
+            ? fill(texts.UPDATE_DONE, { version: installed })
+            : fill(texts.UPDATE_NOT_TAKEN, { installed, asked: notice.version });
+    try {
+        await chat.channel(notice.channel).rewrite(notice.message, text);
+    }
+    catch (error) {
+        logger.warning(`could not rewrite the restart notice in ${notice.channel}: ${errorName(error)}`);
+    }
+    try {
+        state.clearRestartNotice(notice);
+    }
+    catch (error) {
+        logger.warning(`could not forget the restart notice: ${errorName(error)}`);
+    }
+}

package/dist/core/flows/repair.js

@@ -0,0 +1,106 @@
+import { getLogger } from "../../log.js";
+import { errorName } from "../../values.js";
+import * as texts from "../texts.js";
+export const logger = getLogger("allaboard.core.flows.repair");
+/**
+ * Repair every thread `state` still shows as left open. One thread's failure (a deleted
+ * message, a chat error) is logged and does not stop the others. An entry of a thread's three
+ * fields is cleared when the chat repaired it or said its message is gone, and kept when the
+ * chat did not: the next start asks again, once, and so does every start after it for as long
+ * as the chat keeps refusing and the thread is in the state.
+ */
+export async function repair(chat, state) {
+    for (const [channelId, threadId, thread] of state.repairsPending()) {
+        try {
+            const chatThread = chat.thread({ channel: channelId, thread: threadId });
+            // Read before the replies are repaired: a turn with no reply message (a question or an
+            // approval opened it, and a reply starts on its first write) leaves its request as the
+            // only trace in the thread.
+            const hadReply = thread.openReplies.length > 0;
+            for (const messageId of thread.openReplies) {
+                if (await chatThread.endReply(messageId, texts.STOPPED_BEFORE_ANSWER)) {
+                    safe(() => state.replaceOpenReply(channelId, threadId, messageId, null));
+                }
+                else
+                    left(channelId, threadId, "a reply");
+            }
+            // One stopped line per thread: the first request rewritten says it, the others go.
+            let lined = hadReply;
+            for (const messageId of thread.requests) {
+                const asksForLine = !lined && isTurnRequest(thread.requestKinds[messageId]);
+                const outcome = await settleRequest(chatThread, messageId, asksForLine);
+                if (outcome === "kept")
+                    left(channelId, threadId, "a request");
+                else {
+                    if (outcome === "rewritten")
+                        lined = true;
+                    safe(() => state.removeRequest(channelId, threadId, messageId));
+                }
+            }
+            if (thread.status !== null) {
+                const { status } = thread;
+                const ended = endedWord(status);
+                // Shown through a thread object of its own: its first status also strips every other
+                // stray status from the root, more than removing the one name the state recorded.
+                const shown = ended === null || !chat.capabilities.reactions || (await chatThread.showStatus("error"));
+                // Not shown: the word stays for the next start, and the ended one says meanwhile, to
+                // whoever lists the sessions, that this one does not run.
+                safe(() => state.setStatusPending(channelId, threadId, shown ? null : status, ended));
+                if (!shown)
+                    left(channelId, threadId, "the status");
+            }
+        }
+        catch (error) {
+            logger.error(`could not repair a crashed thread's state in ${channelId}/${threadId}: ${errorName(error)}`);
+        }
+    }
+}
+/**
+ * Only a question or an approval stands for a turn the owner's message started; the setup form
+ * and the hold wait before that message is sent, and an entry with no kind (a file written
+ * before the kinds) is taken for neither.
+ */
+function isTurnRequest(kind) {
+    return kind === "question" || kind === "approval";
+}
+/**
+ * A request the crash left open. With `line` the request is rewritten into the stopped line (no
+ * controls, and no notification: an edit); it goes when `line` is false or the chat refuses the
+ * rewrite. "kept" when it still shows.
+ */
+async function settleRequest(chatThread, messageId, line) {
+    if (line) {
+        try {
+            await chatThread.rewrite(messageId, texts.STOPPED_BEFORE_ANSWER);
+            return "rewritten";
+        }
+        catch (error) {
+            logger.warning(`could not rewrite a stale request: ${errorName(error)}`);
+        }
+    }
+    return (await chatThread.withdraw(messageId)) ? "withdrawn" : "kept";
+}
+/** One line for what stays in the state for the next start: ids and the kind only. */
+function left(channelId, threadId, what) {
+    logger.warning(`${what} of ${channelId}/${threadId} was not repaired: the next start tries again`);
+}
+/**
+ * A `StateStore` write is a plain synchronous file write, so it can throw like any other (disk
+ * full, a permission problem): best-effort here, since repair itself must never crash the
+ * daemon's startup over its own bookkeeping. Logged with the error name only.
+ */
+function safe(write) {
+    try {
+        write();
+    }
+    catch (error) {
+        logger.warning(`could not update state.json during crash repair: ${errorName(error)}`);
+    }
+}
+/**
+ * The stored word a root left working or waiting ends on, the error one; null for a word that
+ * is neither, which is cleared with nothing shown.
+ */
+function endedWord(stored) {
+    return stored === "working" || stored === "waiting" ? "error" : null;
+}

package/dist/core/flows/resume.js

@@ -0,0 +1,163 @@
+import { errorName } from "../../values.js";
+import { oneLine, TITLE_LIMIT } from "../reply/words.js";
+import * as texts from "../texts.js";
+import { fill, named } from "../texts.js";
+import { isCancelled, logger } from "./talk.js";
+/**
+ * The fewest characters of a session's id that `!resume` reads as an id and not as a name: what
+ * a list shows of each row, so that a short title such as "add" is not read as one.
+ */
+export const ID_PREFIX_MIN = 8;
+// The words that label a link to a thread inside a notice.
+const HOLDER_LABEL = "Session";
+const THIS_THREAD = "this thread";
+/**
+ * The sessions `!resume <target>` names: those whose id is `target` or starts with it, when it
+ * is at least `ID_PREFIX_MIN` characters long, else those whose title (set with a rename or
+ * generated, the agent's `customTitle`) is `target`.
+ */
+export function matching(sessions, target) {
+    const byId = sessions.filter((s) => Array.from(target).length >= ID_PREFIX_MIN && s.id.startsWith(target));
+    return byId.length > 0 ? byId : sessions.filter((s) => s.customTitle === target);
+}
+export function resuming(deps, talk) {
+    const { agent, chat, sessions, state, names } = deps;
+    const inNotice = (text) => chat.escape(text, "notice");
+    /**
+     * The list has done its job once a session is resumed from it. With `remove`, the
+     * confirmation is in the thread and is the one record of what was resumed: the list is
+     * removed (issue #70). Without it, or when the removal fails, the list is rewritten into a
+     * line that says what was resumed and where, so its controls never stay live.
+     */
+    const showResumed = async (ref, list, chosen, options) => {
+        if (list === null || talk.stopped)
+            return;
+        const picker = chat.channel(ref.channel);
+        if (options.remove && (await picker.withdraw(list)))
+            return;
+        const title = inNotice(oneLine(chosen.title, TITLE_LIMIT)) || chosen.id;
+        const link = await talk.noticeLink(ref, THIS_THREAD);
+        try {
+            await picker.rewrite(list, fill(texts.RESUME_LISTED, { title, link }));
+        }
+        catch (error) {
+            if (isCancelled(error))
+                throw error;
+            // The session is resumed either way; a list that keeps its controls only refuses.
+            logger.warning(`could not update the resume list in ${ref.channel}: ${errorName(error)}`);
+        }
+    };
+    /**
+     * Point the thread `ref` at `chosen`, a session read from `directory`; false, after telling
+     * the owner why in the channel, when nothing changed: that thread already holds a session (a
+     * resume is never a swap), `chosen` is already held by some other thread (one session lives
+     * in one thread), or the channel was bound to another folder while `chosen` was read from
+     * `directory`. Every check runs with no `await` before the `resume` they guard, so nothing
+     * can change between the checks and the call they protect. `list`: the list a pick came from,
+     * removed once the confirmation is posted or has failed, so its controls never outlive a
+     * resume.
+     */
+    const resumeInto = async (ref, directory, chosen, list = null) => {
+        const { channel, thread } = ref;
+        // (sync) From here to `sessions.resume`, which opens the thread's entry inside the call:
+        // each refusal below leaves through its own `await`, and nothing is awaited on the way
+        // to the resume itself.
+        // A thread being deleted still holds its session's entry, and hands out no session.
+        if (sessions.get(channel, thread) !== null || sessions.held(channel, thread)) {
+            await talk.inChannel(channel, texts.RESUME_HELD);
+            return false;
+        }
+        const holder = state.holder(chosen.id);
+        if (holder !== null) {
+            const link = await talk.noticeLink(holder, HOLDER_LABEL);
+            await talk.inChannel(channel, fill(texts.RESUME_ELSEWHERE, { link }));
+            return false;
+        }
+        const record = state.channel(channel);
+        if (record === null || record.directory !== directory) {
+            await talk.inChannel(channel, texts.RESUME_GONE);
+            return false;
+        }
+        const session = await sessions.resume(channel, thread, chosen.id);
+        // just confirmed the channel is bound to `directory`
+        if (session === null)
+            throw new Error("a bound channel resumed no session");
+        // A reference, not a notice: the title is escaped so it cannot close or open the bold.
+        const title = chat.escape(oneLine(chosen.title, TITLE_LIMIT), "reference") || chosen.id;
+        let confirmed = false;
+        try {
+            await talk.say(channel, thread, fill(texts.RESUME_OK, { title }));
+            confirmed = true;
+        }
+        finally {
+            // Independent of the confirmation: a failing one still takes the list's controls away,
+            // and a failure there (swallowed in `showResumed`) never blocks it. With no
+            // confirmation in the thread the list is kept, rewritten, as the record.
+            await showResumed(ref, list, chosen, { remove: confirmed });
+        }
+        return true;
+    };
+    return {
+        async word(ref, target) {
+            const { channel } = ref;
+            const record = state.channel(channel);
+            if (record === null) {
+                await talk.unbound(channel);
+                return;
+            }
+            if (!agent.capabilities.sessionListing) {
+                await talk.inChannel(channel, named(texts.RESUME_UNLISTED, names));
+                return;
+            }
+            const directory = record.directory;
+            const stored = await sessions.sessionsIn(directory);
+            if (!target) {
+                // A session a thread already holds cannot be resumed: it takes no row, so the rows are
+                // the ones the owner can pick (issue #69). Only the list shows dates, and dating reads
+                // files: the sessions left out are not dated.
+                const free = stored.filter((session) => state.holder(session.id) === null);
+                await chat.channel(channel).offer({
+                    type: "sessions",
+                    folder: directory,
+                    sessions: await sessions.dated(directory, free),
+                    held: stored.length - free.length,
+                    thread: ref,
+                }, fill(texts.RESUME_LIST, { directory }));
+                return;
+            }
+            const found = matching(stored, target);
+            const [only] = found;
+            if (found.length !== 1 || only === undefined) {
+                const template = found.length > 0 ? texts.RESUME_AMBIGUOUS : texts.RESUME_NONE;
+                await talk.inChannel(channel, fill(template, { directory: inNotice(directory), target: inNotice(target) }));
+                return;
+            }
+            await resumeInto(ref, directory, only);
+        },
+        async picked(pick) {
+            const { channel } = pick;
+            const record = state.channel(channel);
+            if (record === null) {
+                await talk.unbound(channel);
+                return;
+            }
+            // The pick is not trusted: the session must still belong to the channel's folder, and
+            // the thread it names must be well formed (`resumeInto` refuses one that already holds a
+            // session).
+            if (pick.thread === null) {
+                // A list posted before its controls carried their thread.
+                await talk.inChannel(channel, texts.RESUME_STALE);
+                return;
+            }
+            const stored = await sessions.sessionsIn(record.directory);
+            const chosen = stored.find((session) => session.id === pick.sessionId);
+            if (chosen === undefined) {
+                await talk.inChannel(channel, texts.RESUME_GONE);
+                return;
+            }
+            // The channel is the one checked above: the thread names only where in it.
+            const ref = { channel, thread: pick.thread.thread };
+            await resumeInto(ref, record.directory, chosen, pick.list);
+        },
+    };
+}