ds-bot 0.0.0-stage → 0.1.1

package/src/host/connectors.js

@@ -0,0 +1,169 @@
+// Connectors: outside services every Bot can use. GitHub is the first one. Its tools come
+// from GitHub's MCP server through DSH's own MCP client, mounted on the plugin context,
+// so every Bot and Session gets them as mcp__github__<tool>.
+//
+// The token is the GITHUB_TOKEN secret (secrets.js keeps it, redacts it, and offers it to
+// the shell). It reaches GitHub only in the MCP request headers, built here in memory,
+// never written to the DSH profile. A new token is shared with no Bot's shell: the tools
+// do not need it there, and a Bot that reads a planted instruction in an issue could
+// send it anywhere. The Secrets page can still share it. Signing in is `signIn` alone, so a browser login can
+// take its place later without touching the mount.
+
+export const GITHUB = 'github'
+export const GITHUB_SECRET = 'GITHUB_TOKEN'
+const MCP_CLIENT = '@deepseek-ai/dsh-mcp-client'
+const DEFAULTS = {
+  url: 'https://api.githubcopilot.com/mcp/',
+  api: 'https://api.github.com',
+  toolsets: 'context,repos,issues,pull_requests',
+}
+const CHECK_TIMEOUT_MS = 15_000
+const INSECURE = 'GitHub addresses must start with https://'
+
+// Asks GitHub who the token belongs to. Any token GitHub accepts passes.
+export async function signIn(token, { api = DEFAULTS.api, fetch: request = fetch } = {}) {
+  let response
+  try {
+    response = await request(`${api.replace(/\/$/, '')}/user`, {
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'User-Agent': 'ds-bot', 'X-GitHub-Api-Version': '2022-11-28' },
+      signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+    })
+  } catch {
+    throw new Error('Could not reach GitHub')
+  }
+  if (response.status === 401) throw new Error('GitHub did not accept this token')
+  if (!response.ok) throw new Error(`GitHub answered ${response.status}`)
+  const user = await response.json().catch(() => ({}))
+  if (typeof user?.login !== 'string') throw new Error('GitHub did not say who this token belongs to')
+  return { login: user.login }
+}
+
+export function install(rt) {
+  const { ctx, state } = rt
+  const options = rt.config.github === false ? null : { ...DEFAULTS, ...rt.config.github }
+  const insecure = options !== null && [options.url, options.api].some(address => !/^https:\/\//i.test(String(address)))
+  // `token` is what the current mount was made with, so a changed secret mounts again.
+  let mount = null
+  let status = { state: 'off' }
+  let queue = Promise.resolve()
+  let stopped = false
+
+  const unmount = async () => {
+    const fiber = mount?.fiber
+    mount = null
+    if (fiber !== undefined) await Promise.resolve().then(() => fiber.dispose()).catch(() => {})
+  }
+
+  // The MCP client wraps the server's answer (a 401, say) as the cause.
+  const reason = (error) => {
+    const text = [error, error?.cause].filter(Boolean).map(part => String(part?.message ?? part)).join(': ')
+    return rt.redactSecrets(text || 'error').slice(0, 300)
+  }
+
+  async function reconcile(force) {
+    const token = options !== null && !stopped ? rt.secretValue(GITHUB_SECRET) : undefined
+    if (!force && mount !== null && mount.token === token) return
+    await unmount()
+    if (token === undefined) {
+      status = { state: 'off' }
+      return
+    }
+    if (insecure) {
+      mount = { token }
+      status = { state: 'error', error: INSECURE }
+      return
+    }
+    status = { state: 'connecting' }
+    const loader = ctx.get?.('loader')
+    if (typeof loader?.import !== 'function' || typeof ctx.plugin !== 'function') {
+      mount = { token }
+      status = { state: 'error', error: 'This DSH cannot load connectors' }
+      return
+    }
+    try {
+      const exports = await loader.import(MCP_CLIENT)
+      const plugin = loader.unwrapExports?.(exports) ?? exports?.default ?? exports
+      const fiber = ctx.plugin(plugin, {
+        transport: 'streamable-http',
+        serverName: GITHUB,
+        url: options.url,
+        headers: { Authorization: `Bearer ${token}`, 'X-MCP-Toolsets': options.toolsets },
+        failOnStartupError: true,
+      })
+      mount = { token, fiber }
+      await fiber.await()
+      if (mount?.fiber !== fiber) return
+      status = { state: 'ready' }
+    } catch (error) {
+      await unmount()
+      mount = { token }
+      status = { state: 'error', error: reason(error) }
+      rt.warn('ds-bot: GitHub connector failed: %s', status.error)
+    }
+  }
+
+  // One change at a time; `force` connects again even when the token is the same.
+  const sync = (force = false) => {
+    queue = queue.then(() => reconcile(force)).catch(error => { rt.warn('ds-bot: connectors: %s', reason(error)) })
+    return queue
+  }
+
+  const connectorsView = () => options === null ? [] : [{
+    id: GITHUB,
+    name: 'GitHub',
+    state: status.state,
+    ...(status.error !== undefined ? { error: status.error } : {}),
+    account: rt.secretValue(GITHUB_SECRET) !== undefined ? state.connectors?.[GITHUB]?.login ?? null : null,
+  }]
+
+  const known = id => {
+    if (options === null || id !== GITHUB) throw new Error('No such connector')
+  }
+
+  const endpoints = {
+    async 'connector-connect'(body) {
+      known(body.id)
+      const token = typeof body.token === 'string' ? body.token.trim() : ''
+      if (token === '') throw new Error('Paste a token first')
+      if (insecure) throw new Error(INSECURE)
+      await rt.loadSecrets()
+      const kept = rt.secretValue(GITHUB_SECRET) !== undefined
+      const { login } = await signIn(token, { api: options.api })
+      await rt.secretEndpoint('secret-set', { name: GITHUB_SECRET, value: token, purpose: 'GitHub connector', ...(kept ? {} : { scope: [] }) })
+      state.connectors = { ...state.connectors, [GITHUB]: { login, connectedAt: Date.now() } }
+      await rt.save()
+      await sync()
+      return connectorsView()
+    },
+    async 'connector-disconnect'(body) {
+      known(body.id)
+      await rt.loadSecrets()
+      if (rt.secretValue(GITHUB_SECRET) !== undefined) await rt.secretEndpoint('secret-delete', { name: GITHUB_SECRET })
+      if (state.connectors?.[GITHUB] !== undefined) {
+        delete state.connectors[GITHUB]
+        await rt.save()
+      }
+      await sync()
+      return connectorsView()
+    },
+    async 'connector-retry'(body) {
+      known(body.id)
+      await rt.loadSecrets()
+      await sync(true)
+      return connectorsView()
+    },
+  }
+
+  const connectorEndpoint = (endpoint, body) => endpoints[endpoint](body ?? {})
+
+  ctx.effect(() => {
+    stopped = false
+    void rt.loadSecrets().then(() => sync())
+    return () => {
+      stopped = true
+      void unmount()
+    }
+  }, 'ds-bot: connectors')
+
+  Object.assign(rt, { connectorsView, connectorEndpoint, secretsChanged: () => { void sync() } })
+}

package/src/host/constants.js

@@ -0,0 +1,62 @@
+// Fixed values shared by the host modules: colors, OCR settings, the client route, and
+// the limits on messages, group chats, and chat reads.
+
+// Classic avatar inks, offered as Bot colors.
+export const COLORS = ['deepseek', 'blue', 'violet', 'orange', 'green', 'magenta', 'cyan', 'red', 'yellow', 'brown', 'gray', 'black', 'aurora']
+// Deeper inks, also offered as accent swatches; each is a valid Bot color too.
+export const EXTRA_COLORS = ['charcoal', 'graphite', 'rose', 'sky', 'tangerine', 'cobalt']
+// Renamed color ids, so a Bot saved with an old one keeps its color (LEGACY: old id → new id).
+export const LEGACY_COLORS = { kimi: 'charcoal', zai: 'graphite', minimax: 'rose', stepfun: 'sky', mimo: 'tangerine', qwen: 'cobalt' }
+// Renamed theme ids, so a saved choice keeps its look (LEGACY: old id → new id).
+export const LEGACY_THEMES = { grok: 'mono' }
+
+export const OCR_PROMPT = [
+  'Transcribe all text in this image exactly, in its original language, keeping line breaks and reading order; use Markdown tables for tables.',
+  'Then add a line starting with "Image:" that describes in one to three sentences what is not text (photo, chart, diagram, screen layout).',
+  'Reply with only that. If there is no text, reply with only the "Image:" line.',
+].join(' ')
+export const OCR_TIMEOUT_MS = 120_000
+export const OCR_RETRY_MS = 120_000
+export const OCR_CACHE_MAX = 500
+export const MAX_AVATAR_IMAGE = 160_000
+export const ROUTE = '/api/bot'
+export const MAX_HOPS = 6
+export const MAX_EXCHANGES = 600
+export const ROOM_REPLY_TIMEOUT_MS = 240_000
+export const SOURCE_KIND = 'bot'
+// An answer from a question card, in the shape DSH's own late question replies use.
+export const REPLY_KIND = 'user-question-reply'
+// `everyone`: every member answers a plain message in turn, admin first. `admin`: a
+// plain message goes to the admin, who calls others with @mentions. New groups start
+// in `admin` mode, because every extra speaker re-reads its whole context; a group
+// without an admin still answers as `everyone`.
+export const ROOM_MODES = ['everyone', 'admin']
+export const ROOM_NAME_MAX = 60
+export const ROOM_NOTICE_MAX = 2000
+export const ROOM_MAX_MEMBERS = 12
+
+// A team's one DSH Agent: a plain dsh entry in the sidebar, not a Bot. Its Sessions
+// are ordinary root Sessions, so the team tools must not be offered to them.
+export const AGENT_NAME = 'DSH Agent'
+export const AGENT_SESSION_TITLE_MAX = 80
+// Every tool this plugin registers for Bots. `read_browser` only exists in the
+// Desktop profile, so a restriction filters this list down to registered names.
+export const TEAM_TOOLS = [
+  'list_bots', 'message_bot', 'create_bot', 'update_bot', 'list_models',
+  'create_group', 'update_group', 'delete_group', 'post_to_group', 'ask_user',
+  'request_secret', 'list_secrets', 'group_relay', 'read_own_chat',
+  'read_group_chat', 'remember', 'forget', 'recall', 'read_browser',
+]
+// Rounds Bots may start in one group by posting, before the user speaks there again.
+export const ROOM_BOT_ROUNDS = 3
+
+export const OWN_CHAT_LINE_MAX = 400
+// The message an anchor points at is shown whole (up to this), so a long draft takes
+// one read instead of many searches for its pieces.
+export const ANCHOR_LINE_MAX = 8000
+export const OWN_CHAT_BRIEF = 10
+export const OWN_CHAT_READ = 12
+export const OWN_CHAT_SEARCH = 20
+export const HISTORY_PAGE = 200
+export const HISTORY_PAGES_MAX = 50
+export const HISTORY_TIMEOUT_MS = 20_000

package/src/host/delivery.js

@@ -0,0 +1,59 @@
+// Delivery: how one Bot, the user, or DS Bot itself puts a message into a Bot Session.
+import { randomUUID } from 'node:crypto'
+import { createUserMessage } from '@deepseek-ai/dsh-llm'
+import { SOURCE_KIND } from './constants.js'
+
+export function install(rt) {
+  const { ctx, state } = rt
+
+  const resolveAgent = async (sessionId) => {
+    const resolved = await ctx.sessionController.resolveAgent(sessionId)
+    if ('error' in resolved) throw new Error(resolved.error?.message ?? 'Session unavailable')
+    return resolved.agent
+  }
+
+  const headerFor = (role, fromName, roomName, audience, note = 'new message') => {
+    if (role === 'reply') return `[Reply from ${fromName}]`
+    if (role === 'room') return `[Group chat "${roomName}" · ${note}]`
+    if (role === 'report') return `[Group chat "${roomName}" · replies to your post]`
+    if (role === 'kickoff') return '[Bot team setup]'
+    if (role === 'secret') return '[Secret card]'
+    if (audience === 'user') return `[Message from ${fromName} · the user sees your reply here]`
+    return `[Message from ${fromName}]`
+  }
+
+  // `sessionId` defaults to the recipient's own chat; group turns name its group Session.
+  async function deliver({ fromId, toId, sessionId, text, role, hop = 0, replyTo, roomId, audience, note, exchangeId = randomUUID() }) {
+    const from = rt.botOf(fromId)
+    const to = rt.botOf(toId)
+    if (to === undefined) throw new Error(`Unknown Bot ${toId}`)
+    const fromName = from?.name ?? 'You'
+    const room = rt.roomOf(roomId)
+    // Session events reject `undefined` members, so optional fields are omitted instead.
+    const source = {
+      kind: SOURCE_KIND,
+      form: 'relay',
+      role,
+      exchangeId,
+      senderName: fromName,
+      hop,
+      ...(fromId ? { senderSessionId: fromId } : {}),
+      ...(replyTo ? { replyTo } : {}),
+      ...(roomId ? { roomId } : {}),
+      ...(audience === 'user' ? { audience } : {}),
+    }
+    if (role === 'request' || role === 'reply') {
+      state.exchanges.push({ id: exchangeId, from: fromId, to: toId, text, role, time: Date.now(), ...(replyTo ? { replyTo } : {}), ...(audience === 'user' ? { audience } : {}) })
+      void rt.save()
+    }
+    const agent = await resolveAgent(sessionId ?? rt.chatOf(toId))
+    agent.followup(createUserMessage({
+      content: [{ type: 'text', text: `${headerFor(role, fromName, room?.name, audience, note)}\n${text}` }],
+      source,
+    }))
+    await ctx.sessions.flush(agent.session)
+    return exchangeId
+  }
+
+  Object.assign(rt, { resolveAgent, deliver })
+}

package/src/host/diagnostics.js

@@ -0,0 +1,247 @@
+// Diagnostics: what went wrong on this host, kept where the user can see it and report it.
+// DSH mounts no exporter for ctx.logger once it has started, so warnings would otherwise
+// reach only stderr. Entries are kept in memory and in <home>/logs/diagnostics.jsonl, so
+// a report written after a restart still has them. Every text is cleaned of saved keys,
+// credential-like strings and the home folder before it is kept and again before it is
+// shown, because the report is meant for a public issue.
+import { readFileSync } from 'node:fs'
+import { appendFile, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises'
+import { arch, homedir, platform, release } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { format } from 'node:util'
+
+export const KEEP = 200
+const LOG_MAX_BYTES = 1 << 20
+const STACK_LINES = 8
+const TEXT_MAX = 2000
+export const REPORT_ENTRIES = 20
+export const ISSUES_URL = 'https://github.com/FeiZhuLulu/DeepSeek-Bot/issues/new'
+
+const quote = value => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+// Shapes of credentials that are not saved keys: provider keys, bearer tokens, and
+// token or key parameters in addresses (the Web login address carries one).
+const CREDENTIALS = [
+  [/\bsk-[A-Za-z0-9_*.-]{6,}/g, 'sk-[hidden]'],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{16,}/g, '[hidden]'],
+  [/\bgithub_pat_[A-Za-z0-9_]{16,}/g, '[hidden]'],
+  [/\bAKIA[0-9A-Z]{16}\b/g, '[hidden]'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{8,}/g, '[hidden]'],
+  [/\bAIza[A-Za-z0-9_-]{20,}/g, '[hidden]'],
+  // JSON web tokens: three base64url parts, the first always starting eyJ.
+  [/\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g, '[hidden]'],
+  [/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=*-]{8,}/gi, '$1 [hidden]'],
+  [/([?&#](?:token|access_token|api_key|apikey|key|secret|password)=)[^&\s"']+/gi, '$1[hidden]'],
+  [/(["']?(?:api[_-]?key|authorization|x-api-key|password|secret)["']?\s*[:=]\s*["']?)[^\s"',}]{6,}/gi, '$1[hidden]'],
+]
+
+export function cleanText(text, { redact = value => value, home = homedir() } = {}) {
+  let out = redact(String(text ?? ''))
+  for (const [pattern, replacement] of CREDENTIALS) out = out.replace(pattern, replacement)
+  if (home && home.length > 1) {
+    out = out.replace(new RegExp(quote(home), 'g'), '~')
+    // JSON and Windows paths spell the same folder with doubled or forward slashes.
+    const slashes = home.replace(/\\/g, '/')
+    if (slashes !== home) out = out.replace(new RegExp(quote(slashes), 'g'), '~')
+    const doubled = home.replace(/\\/g, '\\\\')
+    if (doubled !== home) out = out.replace(new RegExp(quote(doubled), 'g'), '~')
+  }
+  return out.length > TEXT_MAX ? `${out.slice(0, TEXT_MAX)}…` : out
+}
+
+const errorText = error => `${error.name && error.name !== 'Error' ? `${error.name}: ` : ''}${error.message}`
+
+// One log line, as the downloaded log and the report show it.
+export function entryLine(entry) {
+  const where = [entry.bot, entry.where].filter(Boolean).join(' · ')
+  const code = entry.code ? ` [${entry.code}${entry.status ? ` ${entry.status}` : ''}]` : ''
+  return `${new Date(entry.time).toISOString()} ${entry.level.toUpperCase()} ${entry.source}${where ? ` (${where})` : ''}${code} ${entry.text}`
+}
+
+// The Markdown block for an issue. `facts` come from this host, `client` from the
+// browser that asked; `entries` are already cleaned.
+export function reportMarkdown({ facts, client = {}, entries = [], clientEntries = [] }) {
+  const row = (label, value) => (value === undefined || value === null || value === '' ? null : `| ${label} | ${String(value).replace(/\|/g, '\\|')} |`)
+  const lines = [
+    '| | |',
+    '|---|---|',
+    row('DS Bot', facts.botVersion),
+    row('DSH', facts.dshVersion),
+    row('Surface', client.surface),
+    row('OS', facts.os),
+    row('Node', facts.node),
+    row('Browser', client.userAgent),
+    row('Language', client.language),
+    row('Team', facts.team),
+    row('Models', facts.models),
+    row('Read-only', facts.readOnly),
+  ].filter(Boolean)
+  const recent = entries.slice(-REPORT_ENTRIES)
+  const out = [...lines, '']
+  out.push(recent.length === 0 ? 'No host errors recorded.' : `Recent host errors (${recent.length} of ${entries.length}, oldest first):`)
+  if (recent.length > 0) out.push('```', ...recent.map(entryLine), '```')
+  const stacks = recent.filter(entry => entry.stack).slice(-3)
+  for (const entry of stacks) out.push('', `<details><summary>Stack: ${entry.text.slice(0, 80).replace(/</g, '&lt;')}</summary>`, '', '```', entry.stack, '```', '</details>')
+  if (clientEntries.length > 0) {
+    out.push('', `Recent browser errors (${Math.min(clientEntries.length, 10)}):`, '```', ...clientEntries.slice(-10).map(entryLine), '```')
+  }
+  return out.join('\n')
+}
+
+const ownVersion = () => {
+  try {
+    return JSON.parse(readFileSync(fileURLToPath(new URL('../../package.json', import.meta.url)), 'utf8')).version
+  } catch {
+    return undefined
+  }
+}
+
+// DSH packages share one version; the LLM package is always beside the plugin.
+const dshVersion = () => {
+  try {
+    let dir = dirname(fileURLToPath(import.meta.resolve('@deepseek-ai/dsh-llm')))
+    for (let depth = 0; depth < 5; depth += 1, dir = dirname(dir)) {
+      try {
+        const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'))
+        if (manifest.name === '@deepseek-ai/dsh-llm') return manifest.version
+      } catch {}
+    }
+  } catch {}
+  return undefined
+}
+
+export function install(rt) {
+  const { ctx, home, config } = rt
+  const logPath = join(home, 'logs', 'diagnostics.jsonl')
+  const toFile = config.diagnosticsFile !== false
+  let fresh = []
+  let writing = Promise.resolve()
+  let fileFailed = false
+
+  const clean = text => cleanText(text, { redact: rt.redactSecrets })
+
+  // Entries from earlier runs, read once; new ones are kept apart until then.
+  const earlier = toFile
+    ? readFile(logPath, 'utf8').then(text => text.split('\n').filter(Boolean).slice(-KEEP).flatMap((line) => {
+        try {
+          const entry = JSON.parse(line)
+          return typeof entry?.time === 'number' && typeof entry.text === 'string' ? [entry] : []
+        } catch {
+          return []
+        }
+      }), () => [])
+    : Promise.resolve([])
+  let cleared = 0
+
+  const append = (entry) => {
+    if (!toFile) return
+    writing = writing.then(async () => {
+      await mkdir(dirname(logPath), { recursive: true })
+      const size = await stat(logPath).then(info => info.size, () => 0)
+      if (size > LOG_MAX_BYTES) await rename(logPath, `${logPath}.1`)
+      await appendFile(logPath, `${JSON.stringify(entry)}\n`, 'utf8')
+    }).catch((error) => {
+      if (fileFailed) return
+      fileFailed = true
+      console.error('[ds-bot] diagnostics log not written:', error?.code ?? error?.message ?? error)
+    })
+  }
+
+  // `fields`: source ('host', 'turn', 'api'), level, code, status, bot, where, sessionId, stack.
+  const note = ({ level = 'error', source = 'host', text, stack, ...fields }) => {
+    const entry = { time: Date.now(), level, source, text: clean(text) }
+    for (const [key, value] of Object.entries(fields)) {
+      if (value !== undefined && value !== null && value !== '') entry[key] = typeof value === 'string' ? clean(value) : value
+    }
+    // Frames only: the first line repeats the message, which is already the text.
+    const frames = typeof stack === 'string' ? stack.split('\n').filter(line => /^\s+at /.test(line)).slice(0, STACK_LINES).map(line => line.trim()) : []
+    if (frames.length > 0) entry.stack = clean(frames.join('\n'))
+    fresh.push(entry)
+    if (fresh.length > KEEP) fresh = fresh.slice(-KEEP)
+    append(entry)
+    return entry
+  }
+
+  const warn = (template, ...args) => {
+    ctx.logger.warn(template, ...args)
+    console.error(`[ds-bot] ${template}`, ...args.map(arg => arg?.stack ?? arg))
+    const error = args.find(arg => arg instanceof Error)
+    note({
+      level: 'warn',
+      source: 'host',
+      text: format(template, ...args.map(arg => (arg instanceof Error ? errorText(arg) : arg))).replace(/^ds-bot: /, ''),
+      code: typeof error?.code === 'string' ? error.code : undefined,
+      stack: error?.stack,
+    })
+  }
+
+  const entries = async () => {
+    const old = (await earlier).filter(entry => entry.time > cleared)
+    return [...old, ...fresh].slice(-KEEP).map(entry => ({
+      ...entry,
+      text: clean(entry.text),
+      ...(entry.stack ? { stack: clean(entry.stack) } : {}),
+    }))
+  }
+
+  const facts = () => {
+    const bots = Object.values(rt.state.bots)
+    const models = [...new Set(bots.map(bot => bot.model ?? bot.appliedModel).filter(Boolean))]
+    const count = (n, one, many) => `${n} ${n === 1 ? one : many}`
+    const groups = Object.keys(rt.state.rooms).length
+    return {
+      botVersion: ownVersion(),
+      dshVersion: dshVersion(),
+      os: `${platform()} ${release()} ${arch()}`,
+      node: process.version,
+      team: `${count(bots.length, 'Bot', 'Bots')}, ${rt.state.mainBotIds.length} Main, ${count(groups, 'group chat', 'group chats')}`,
+      models: models.length > 0 ? models.join(', ') : undefined,
+      readOnly: rt.readOnly?.() ? 'yes, another dsh holds the team' : undefined,
+    }
+  }
+
+  const sanitizeClient = (client) => {
+    const pick = (value, max) => (typeof value === 'string' ? clean(value.slice(0, max)) : undefined)
+    return {
+      surface: pick(client?.surface, 40),
+      language: pick(client?.language, 20),
+      userAgent: pick(client?.userAgent, 200),
+    }
+  }
+  const sanitizeClientEntries = list => (Array.isArray(list) ? list : []).slice(-20).flatMap((item) => {
+    if (typeof item?.text !== 'string' || typeof item.time !== 'number') return []
+    return [{ time: item.time, level: item.level === 'warn' ? 'warn' : 'error', source: 'browser', text: clean(item.text.slice(0, 500)), ...(typeof item.code === 'string' ? { code: clean(item.code.slice(0, 40)) } : {}) }]
+  })
+
+  async function report(body = {}) {
+    await rt.loadSecrets?.().catch(() => {})
+    const list = await entries()
+    const client = sanitizeClient(body.client)
+    const clientEntries = sanitizeClientEntries(body.clientErrors)
+    const hostFacts = facts()
+    return {
+      facts: hostFacts,
+      entries: list.slice(-50).reverse(),
+      total: list.length,
+      markdown: reportMarkdown({ facts: hostFacts, client, entries: list, clientEntries }),
+      issuesUrl: ISSUES_URL,
+    }
+  }
+
+  async function logText() {
+    await rt.loadSecrets?.().catch(() => {})
+    const list = await entries()
+    return list.map(entry => (entry.stack ? `${entryLine(entry)}\n${entry.stack.replace(/^/gm, '    ')}` : entryLine(entry))).join('\n')
+  }
+
+  async function clear() {
+    cleared = Date.now()
+    fresh = []
+    if (!toFile) return
+    writing = writing.then(() => writeFile(logPath, '', 'utf8')).catch(() => {})
+    await writing
+  }
+
+  Object.assign(rt, { warn, noteFailure: note, diagnostics: { report, logText, clear, entries } })
+}