ec-web 0.0.25 → 0.0.27

package/dist/sources/role-definitions.js

@@ -29,6 +29,7 @@ async function getRolesModule() {
         const resolverMod = await import(toFileUrl(resolverPath));
         const roleServiceMod = await import(toFileUrl(roleServicePath));
         const authMod = await import(toFileUrl(authPath));
+        const schemaMod = await import(toFileUrl(resolveParentDistModule('config', 'role-schema.js')));
         if (!rolesMod.readRolesConfig)
             throw new Error('readRolesConfig not found in roles.js');
         if (!rolesMod.roleExists)
@@ -54,6 +55,8 @@ async function getRolesModule() {
             read: cmMod.read,
             write: cmMod.write,
             ConfigTarget: cmMod.ConfigTarget,
+            resolveEffective: cmMod.resolveEffective,
+            rolePermissionFields: schemaMod.rolePermissionFields,
             resolver: resolverMod,
             buildAuthSubject: authMod.buildAuthSubject,
             authorizeOperation: authMod.authorizeOperation,
@@ -66,10 +69,10 @@ async function getRolesModule() {
     }
 }
 async function getRoleConstraintsModule() {
-    const constraintsPath = resolveParentDistModule('config', 'role-constraints.js');
+    const constraintsPath = resolveParentDistModule('core', 'model', 'model-permission.js');
     const mod = await import(toFileUrl(constraintsPath));
     if (!mod.isModelAllowedByPatterns)
-        throw new Error('isModelAllowedByPatterns not found in role-constraints.js');
+        throw new Error('isModelAllowedByPatterns not found in model-permission.js');
     return {
         isModelAllowedByPatterns: mod.isModelAllowedByPatterns,
     };
@@ -105,8 +108,8 @@ function isReadMethod(method) {
 async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, operation, args) {
     const actor = auth.actorAid || '';
     const processOwners = Array.isArray(processConfig?.owners) ? processConfig.owners.map(String) : [];
-    const syntheticOwner = !!auth.localDirect || (!!actor && processOwners.includes(actor));
-    const actorId = auth.localDirect ? 'local-direct' : actor || undefined;
+    const syntheticOwner = isDaemonOwnerAuth(processConfig, auth);
+    const actorId = auth.localDirect ? 'local-direct' : actor || (syntheticOwner ? 'ecweb-remote' : undefined);
     const subject = modules.buildAuthSubject({
         selfAid: aid,
         actorId,
@@ -116,6 +119,7 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
         chatType: 'private',
         conversationId: actor || 'ecweb',
         processOwners,
+        trustedProcessRole: syntheticOwner ? 'daemon-owner' : undefined,
         ...(syntheticOwner ? {
             roleDetail: {
                 effectiveRole: 'owner',
@@ -123,8 +127,8 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
                 isAuthenticated: true,
                 allowAccess: true,
                 roleExists: true,
-                // buildAuthSubject uses the authenticated actor separately from the
-                // resolved relation role to determine daemon-owner provenance.
+                // Keep the token's actor provenance separate from the management
+                // authority established by the ECWeb authentication gate.
                 actor: {
                     operatorId: actorId || 'ecweb',
                     operatorChannelKey: `ecweb#${aid}`,
@@ -155,7 +159,7 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
     });
 }
 function isDaemonOwnerAuth(processConfig, auth) {
-    if (auth.localDirect)
+    if (auth.daemonOwner === true || auth.localDirect)
         return true;
     const actor = typeof auth.actorAid === 'string' ? auth.actorAid.trim() : '';
     const processOwners = Array.isArray(processConfig?.owners)
@@ -163,8 +167,16 @@ function isDaemonOwnerAuth(processConfig, auth) {
         : [];
     return !!actor && processOwners.includes(actor);
 }
-const MODEL_PERMISSION_FIELD = 'baseagents.claude.model';
-const MODEL_PATTERN_OPTIONS = ['*', 'claude-opus-*', 'claude-sonnet-*', 'claude-haiku-*'];
+function roleModelContext(modules, aid, requested) {
+    const effective = modules.resolveEffective({ self: aid });
+    const baseagent = requested ?? effective.active_baseagent;
+    const field = `baseagents.${baseagent}.model`;
+    const descriptor = modules.rolePermissionFields().find((item) => item.value === field);
+    if (!descriptor) {
+        throw Object.assign(new Error(`Unsupported role model backend: ${String(baseagent)}`), { statusCode: 400 });
+    }
+    return { baseagent, field, patternOptions: descriptor.patterns?.map((item) => item.value) ?? ['*'] };
+}
 const COMMAND_PERMISSION_SCOPES = new Set(['relation', 'role', 'agent', 'process', 'filesystem', 'control', 'raw-cli']);
 const COMMAND_CONSTRAINT_KEYS = new Set([
     'ownPeerOnly',
@@ -494,11 +506,11 @@ function normalizeRoleDefinitionForSave(roleDef) {
         return roleDef;
     return { ...roleDef, usageLimits: normalizeRoleUsageLimits(roleDef.usageLimits) };
 }
-function getModelPermission(roleDef) {
+function getModelPermission(roleDef, field) {
     const permissions = roleDef?.permissions;
     if (!permissions || typeof permissions !== 'object')
         return {};
-    const perm = permissions[MODEL_PERMISSION_FIELD];
+    const perm = permissions[field];
     return perm && typeof perm === 'object' ? perm : {};
 }
 function stripSelectionModeFromPermission(perm) {
@@ -543,38 +555,42 @@ async function validateRoleModelPermission(roleDef) {
     const permissions = roleDef?.permissions;
     if (!permissions || typeof permissions !== 'object')
         return { ok: true, errors: [] };
-    const perm = permissions[MODEL_PERMISSION_FIELD];
-    if (!perm || typeof perm !== 'object')
-        return { ok: true, errors: [] };
-    permissions[MODEL_PERMISSION_FIELD] = stripSelectionModeFromPermission(perm);
-    const result = await validateModelPermissionInput({
-        defaultModel: permissions[MODEL_PERMISSION_FIELD].default,
-        allowOverride: permissions[MODEL_PERMISSION_FIELD].allowOverride,
-        allowedModels: permissions[MODEL_PERMISSION_FIELD].allowedModels,
-    });
-    return { ok: result.ok, errors: result.errors };
+    const errors = [];
+    for (const [field, perm] of Object.entries(permissions)) {
+        if (!/^baseagents\.[a-z0-9_-]+\.model$/.test(field))
+            continue;
+        permissions[field] = stripSelectionModeFromPermission(perm);
+        const result = await validateModelPermissionInput({
+            defaultModel: permissions[field]?.default,
+            allowOverride: permissions[field]?.allowOverride,
+            allowedModels: permissions[field]?.allowedModels,
+        });
+        errors.push(...result.errors.map(error => `${field}: ${error}`));
+    }
+    return { ok: errors.length === 0, errors };
 }
 async function filterAllowedCatalogModels(models, allowedModels) {
     const { isModelAllowedByPatterns } = await getRoleConstraintsModule();
     return models.filter(model => !model.isAlias && isModelAllowedByPatterns(model.id, allowedModels));
 }
-async function buildModelPermissionResponse(roleName, roleDef, override, aid) {
-    const currentPerm = getModelPermission(roleDef);
+async function buildModelPermissionResponse(roleName, roleDef, modelContext, override, aid) {
+    const currentPerm = getModelPermission(roleDef, modelContext.field);
     const defaultModel = override?.defaultModel ?? currentPerm.default ?? '';
     const allowOverride = override?.allowOverride ?? currentPerm.allowOverride ?? false;
     const allowedModels = override?.allowedModels ?? (Array.isArray(currentPerm.allowedModels) ? currentPerm.allowedModels : []);
-    const catalog = await getModelCatalogSnapshot('claude', aid);
+    const catalog = await getModelCatalogSnapshot(modelContext.baseagent, aid);
     const matchingModels = await filterAllowedCatalogModels(catalog.models, allowedModels);
     return {
         role: roleName,
-        field: MODEL_PERMISSION_FIELD,
+        baseagent: modelContext.baseagent,
+        field: modelContext.field,
         permission: {
             default: defaultModel,
             allowOverride,
             allowedModels,
         },
         selectionMode: inferSelectionMode(allowedModels),
-        patternOptions: MODEL_PATTERN_OPTIONS,
+        patternOptions: modelContext.patternOptions,
         catalog,
         matchingModels,
         stats: {
@@ -612,10 +628,16 @@ async function buildSnapshot(params = {}, auth = {}) {
             };
         }
         const config = modules.readRolesConfig(aid);
+        const activeBaseagent = modules.resolveEffective({ self: aid }).active_baseagent;
+        const modelContext = activeBaseagent ? roleModelContext(modules, aid, activeBaseagent) : undefined;
         return {
             $schema_version: 1,
             aid,
             self: aid,
+            baseagent: modelContext?.baseagent ?? null,
+            modelPermissionField: modelContext?.field ?? null,
+            modelPatternOptions: modelContext?.patternOptions ?? [],
+            permissionFields: modules.rolePermissionFields(),
             agents: summarizeAgents(agents),
             defaultRoles: config.defaultRoles ?? { private: null, group: null },
             policyRevision: JSON.stringify(config),
@@ -865,7 +887,8 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                 sendJson(res, 404, { success: false, error: 'Role not found' });
                 return;
             }
-            const data = await buildModelPermissionResponse(roleName, roleDef, undefined, aid || undefined);
+            const modelContext = roleModelContext(modules, aid, parsedUrl.query.baseagent);
+            const data = await buildModelPermissionResponse(roleName, roleDef, modelContext, undefined, aid || undefined);
             sendJson(res, 200, { success: true, data });
             return;
         }
@@ -878,13 +901,14 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                 return;
             }
             const payload = await readJsonBody(req);
-            const currentPerm = getModelPermission(roleDef);
+            const modelContext = roleModelContext(modules, aid, parsedUrl.query.baseagent);
+            const currentPerm = getModelPermission(roleDef, modelContext.field);
             const validation = await validateModelPermissionInput(extractModelPermissionPayload(payload, currentPerm));
             if (!validation.ok || !validation.value) {
                 sendJson(res, 400, { success: false, error: 'Invalid model permissions', errors: validation.errors });
                 return;
             }
-            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value, aid || undefined);
+            const data = await buildModelPermissionResponse(roleName, roleDef, modelContext, validation.value, aid || undefined);
             sendJson(res, 200, { success: true, data });
             return;
         }
@@ -897,7 +921,8 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                 return;
             }
             const payload = await readJsonBody(req);
-            const currentPerm = getModelPermission(roleDef);
+            const modelContext = roleModelContext(modules, aid, parsedUrl.query.baseagent);
+            const currentPerm = getModelPermission(roleDef, modelContext.field);
             const validation = await validateModelPermissionInput(extractModelPermissionPayload(payload, currentPerm));
             if (!validation.ok || !validation.value) {
                 sendJson(res, 400, { success: false, error: 'Invalid model permissions', errors: validation.errors });
@@ -906,15 +931,15 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
             roleDef.permissions = roleDef.permissions && typeof roleDef.permissions === 'object'
                 ? roleDef.permissions
                 : {};
-            const existingPerm = stripSelectionModeFromPermission(getModelPermission(roleDef));
-            roleDef.permissions[MODEL_PERMISSION_FIELD] = {
+            const existingPerm = stripSelectionModeFromPermission(getModelPermission(roleDef, modelContext.field));
+            roleDef.permissions[modelContext.field] = {
                 ...existingPerm,
                 default: validation.value.defaultModel,
                 allowOverride: validation.value.allowOverride,
                 allowedModels: validation.value.allowedModels,
             };
             modules.roleService.writeRoleDefinition(aid, roleName, roleDef);
-            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value, aid || undefined);
+            const data = await buildModelPermissionResponse(roleName, roleDef, modelContext, validation.value, aid || undefined);
             sendJson(res, 200, { success: true, data });
             return;
         }
@@ -1028,6 +1053,6 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
     }
     catch (err) {
         console.error('[role-definitions] API error:', err);
-        sendJson(res, 500, { error: err.message });
+        sendJson(res, err.statusCode ?? 500, { error: err.message });
     }
 }

package/dist/sources/session-codex.js

@@ -15,7 +15,7 @@ import { resolvePaths } from '../paths.js';
 import { encodePath } from '../fs-utils.js';
 import { getAgentSelfNames } from './msg.js';
 import { parseTranscriptResultKey, previewLargeToolResults, windowTranscriptTurns } from './transcript-window.js';
-import { buildSessionBindMap, classifyTranscriptSource, isEvolcoreRoutedMessage, isSyntheticCliPrompt, resolveSessionBindSelfName, } from './session-origin.js';
+import { buildSessionBindMap, readRunnerTaskTurns, classifyTranscriptSource, isEvolcoreRoutedMessage, isSyntheticCliPrompt, resolveSessionBindSelfName, } from './session-origin.js';
 const requireFromHere = createRequire(import.meta.url);
 let _dlog = null;
 export function setDebugLog(log) { _dlog = log; }
@@ -205,12 +205,12 @@ function listProjects() {
     if (!db)
         return [];
     try {
-        const rows = db.prepare(`
-      SELECT cwd, COUNT(*) as count, MAX(updated_at) as lastActivity
-      FROM threads
-      WHERE archived = 0
-      GROUP BY cwd
-      ORDER BY lastActivity DESC
+        const rows = db.prepare(`
+      SELECT cwd, COUNT(*) as count, MAX(updated_at) as lastActivity
+      FROM threads
+      WHERE archived = 0
+      GROUP BY cwd
+      ORDER BY lastActivity DESC
     `).all();
         const projects = rows.map(r => {
             const cwd = r.cwd || '';
@@ -382,11 +382,11 @@ function listTranscripts(encoded, cwd) {
     if (!db)
         return [];
     try {
-        const rows = db.prepare(`
-      SELECT id, title, first_user_message, updated_at, rollout_path, source, thread_source
-      FROM threads
-      WHERE cwd = ? AND archived = 0
-      ORDER BY updated_at DESC
+        const rows = db.prepare(`
+      SELECT id, title, first_user_message, updated_at, rollout_path, source, thread_source
+      FROM threads
+      WHERE cwd = ? AND archived = 0
+      ORDER BY updated_at DESC
     `).all(cwd);
         const out = [];
         let parsed = 0, hitMem = 0, hitDisk = 0;
@@ -817,7 +817,7 @@ function readTranscriptFile(threadId, cwd, readStats) {
     cacheTranscriptDetail(rolloutPath, stat.mtimeMs, stat.size, detail);
     return detail;
 }
-export function readCodexSessionResult(params) {
+export async function readCodexSessionResult(params) {
     const projects = listProjects();
     const project = resolveProject(params, projects);
     const sessionId = typeof params.sessionId === 'string' ? params.sessionId : '';
@@ -825,7 +825,10 @@ export function readCodexSessionResult(params) {
     if (!project || !sessionId || !key || !/^[A-Za-z0-9-]+$/.test(sessionId))
         return null;
     const detail = readTranscriptFile(sessionId, project.cwd);
-    const block = detail.turns[key[0]]?.blocks?.[key[1]];
+    const bind = buildBindMap().get(sessionId);
+    const taskTurns = bind?.evolSessionId ? await readRunnerTaskTurns(resolvePaths().logs, bind.evolSessionId) : [];
+    const turns = detail.turns.concat(taskTurns).sort((a, b) => (a.ts || 0) - (b.ts || 0));
+    const block = turns[key[0]]?.blocks?.[key[1]];
     return block?.kind === 'tool_result' && typeof block.text === 'string' ? block.text : null;
 }
 // ── Snapshot ──
@@ -899,8 +902,11 @@ async function buildSnapshot(params) {
     const detailStartedAt = Date.now();
     const detail = readTranscriptFile(sessionId, project.cwd, metrics);
     metrics.detailMs = Date.now() - detailStartedAt;
-    const page = windowTranscriptTurns(detail.turns, params.turnLimit, params.turnBefore);
     const bind = bindMap.get(sessionId);
+    const taskTurns = bind?.evolSessionId ? await readRunnerTaskTurns(resolvePaths().logs, bind.evolSessionId) : [];
+    const turns = detail.turns.concat(taskTurns).sort((a, b) => (a.ts || 0) - (b.ts || 0));
+    const page = windowTranscriptTurns(turns, params.turnLimit, params.turnBefore);
+    const counts = { ...detail.counts, subtask: taskTurns.length };
     const transcript = metas.find(meta => meta.id === sessionId);
     const header = {
         sessionId,
@@ -912,7 +918,7 @@ async function buildSnapshot(params) {
         totalTurns: detail.totalTurns,
         userMsgs: detail.userMsgs,
         totalMsgs: detail.totalMsgs,
-        counts: detail.counts,
+        counts,
         inputTokens: detail.inputTokens,
         outputTokens: detail.outputTokens,
         contextTokens: detail.contextTokens,
@@ -944,6 +950,7 @@ export function subscribeCodex(params, push) {
     const p = resolvePaths();
     let dbWatcher = null;
     let sessionWatcher = null;
+    let logWatcher = null;
     let debounce = null;
     const fire = () => {
         if (debounce)
@@ -971,11 +978,22 @@ export function subscribeCodex(params, push) {
         });
     }
     catch { }
+    if (params.sessionId) {
+        try {
+            logWatcher = fs.watch(p.logs, (_evt, filename) => {
+                if (!filename || /^events(?:-.+)?\.log$/.test(String(filename)))
+                    fire();
+            });
+        }
+        catch { }
+    }
     return () => {
         if (dbWatcher)
             dbWatcher.close();
         if (sessionWatcher)
             sessionWatcher.close();
+        if (logWatcher)
+            logWatcher.close();
         if (debounce)
             clearTimeout(debounce);
     };