hive-am 1.0.0 → 1.2.0

package/server/dist/http/guards.js

@@ -0,0 +1,44 @@
+import { forbidden } from './errors.js';
+const LOOPBACK = ['localhost', '127.0.0.1', '[::1]', '::1'];
+const loop = (h) => LOOPBACK.includes(h.replace(/:\d+$/, '').toLowerCase());
+const hostOf = (origin) => { try {
+    const h = new URL(origin).hostname;
+    return h === '::1' ? '[::1]' : h;
+}
+catch {
+    return null;
+} };
+/** The browser's origin (when it sends one) is this machine, or the same name the request was addressed to. Programs (curl, the MCP) send no origin. */
+export function originIsLocal(req) {
+    const origin = req.headers.origin;
+    if (!origin)
+        return true;
+    const host = hostOf(origin);
+    if (host === null)
+        return false;
+    const own = String(req.headers.host ?? '').replace(/:\d+$/, '');
+    return loop(host) || host === own;
+}
+/**
+ * Only a page or a program of this machine: the Host must be a loopback name (a page that reached us through another name, DNS rebinding,
+ * is refused) and a browser's origin must be loopback too. Used by terminals (REST and WebSocket).
+ */
+export function isLocalRequest(req) {
+    if (!loop(String(req.headers.host ?? '')))
+        return false;
+    const origin = req.headers.origin;
+    if (origin) {
+        const h = hostOf(origin);
+        if (h === null || !loop(h))
+            return false;
+    }
+    return true;
+}
+/**
+ * The single guard for endpoints that act on the machine. The API answers any origin (`*`, it is a local tool), so these check the
+ * request itself. `strict` also pins the Host (terminals); otherwise only the origin is checked, as git actions and resources always did.
+ */
+export function requireLocal(req, message, opts = {}) {
+    if (!(opts.strict ? isLocalRequest(req) : originIsLocal(req)))
+        throw forbidden(message);
+}

package/server/dist/http/router.js

@@ -0,0 +1,24 @@
+import { bad } from './errors.js';
+/** The route table: the modules in ./routes fill it when they are imported (see api.ts for the order). */
+export const routes = [];
+/** `:name` matches one path segment; its decoded text reaches the handler in `params`, in order. */
+export const route = (method, pattern, handler) => {
+    routes.push({ method, pattern, re: new RegExp('^' + pattern.replace(/:[^/]+/g, '([^/]+)') + '$'), handler });
+};
+/** The first route that answers this method and path, with its (decoded) parameters. A malformed %-escape is a 400. */
+export function match(method, pathname) {
+    for (const r of routes) {
+        if (r.method !== method)
+            continue;
+        const m = r.re.exec(pathname);
+        if (!m)
+            continue;
+        try {
+            return { route: r, params: m.slice(1).map(decodeURIComponent) };
+        }
+        catch {
+            throw bad('Malformed URL');
+        }
+    }
+    return null;
+}

package/server/dist/http/routes/agents.js

@@ -0,0 +1,103 @@
+import { createReadStream, realpathSync, statSync } from 'node:fs';
+import { basename, extname, sep } from 'node:path';
+import { agents, resolved } from '../../db.js';
+import { inboxDir, saveUploads } from '../../connections/files.js';
+import { uploadsBlock } from '../../connections/prompt.js';
+import { readHistory } from '../../history/index.js';
+import { liveTurn, notifyAgentsChanged, queueDepth, sendTurn, stopAgent } from '../../runtime.js';
+import { sessionStats } from '../../stats.js';
+import { summaryOf } from '../../sessions-summary.js';
+import { emptyUsage } from '../../pricing.js';
+import { agentOrFail, createAgent, removeAgent, resumeSession, sessionToRead, updateAgent } from '../../services/agents.js';
+import { UPLOAD_LIMIT, body } from '../body.js';
+import { HttpError, bad, notFound } from '../errors.js';
+import { route } from '../router.js';
+import { qpath, text, validateAgentInput } from '../validate.js';
+route('GET', '/api/agents', () => agents.list().map((a) => ({ ...a, queued: queueDepth(a.id), live: !!liveTurn(a.id) })));
+route('POST', '/api/agents', async ({ req }) => createAgent(validateAgentInput(await body(req))));
+route('GET', '/api/agents/:id', ({ params }) => agentOrFail(params[0]));
+route('PATCH', '/api/agents/:id', async ({ req, params }) => updateAgent(params[0], validateAgentInput(await body(req), true)));
+route('DELETE', '/api/agents/:id', ({ params }) => { removeAgent(params[0]); return { ok: true }; });
+route('POST', '/api/agents/:id/messages', async ({ req, params }) => {
+    const a = agentOrFail(params[0]);
+    const { prompt, files, images } = await body(req, UPLOAD_LIMIT); // `images` is the name this field had at first
+    let msg = text(prompt);
+    const sent = files ?? images, hasFiles = Array.isArray(sent) && sent.length > 0;
+    if (!msg.trim() && !hasFiles)
+        throw bad('Message is empty');
+    if (hasFiles) {
+        try {
+            const saved = saveUploads(a.id, sent);
+            msg = `${msg.trim() || '(no text)'}${uploadsBlock(saved)}`;
+        }
+        catch (e) {
+            throw bad(e instanceof Error ? e.message : 'The files could not be saved');
+        }
+    }
+    void sendTurn(a.id, msg).catch((e) => console.error('[turn]', e));
+    return { accepted: true, prompt: msg };
+});
+// A file that was sent from the chat, for its thumbnail or download: only from this agent's inbox; pictures inline, anything else only as a download.
+route('GET', '/api/agents/:id/inbox', ({ params, url, res }) => {
+    const a = agentOrFail(params[0]);
+    let root, abs;
+    try {
+        root = realpathSync(inboxDir(a.id));
+        abs = realpathSync(qpath(url));
+    }
+    catch (e) {
+        if (e instanceof HttpError)
+            throw e;
+        throw notFound('File not found');
+    }
+    if (!abs.startsWith(root + sep) || !statSync(abs).isFile())
+        throw notFound('File not found');
+    const image = { '.png': 'image/png', '.jpg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp' }[extname(abs).toLowerCase()];
+    const shown = basename(abs).replace(/^(?:web-)?\d+-\d+-/, '');
+    res.writeHead(200, {
+        'content-type': image ?? 'application/octet-stream', 'content-length': statSync(abs).size, 'cache-control': 'private, max-age=3600', 'x-content-type-options': 'nosniff',
+        'content-security-policy': "sandbox; default-src 'none'; style-src 'unsafe-inline'",
+        ...(image ? {} : { 'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(shown)}` }),
+    });
+    createReadStream(abs).pipe(res);
+});
+route('POST', '/api/agents/:id/stop', ({ params }) => ({ stopped: stopAgent(params[0]) }));
+route('POST', '/api/agents/:id/new-session', ({ params }) => {
+    const a = agentOrFail(params[0]);
+    stopAgent(a.id);
+    agents.setSession(a, null);
+    notifyAgentsChanged();
+    return { ok: true };
+});
+route('POST', '/api/agents/:id/resume-session', async ({ req, params }) => {
+    const a = agentOrFail(params[0]);
+    resumeSession(a, (await body(req)).session_id);
+    return { ok: true };
+});
+route('GET', '/api/agents/:id/history', ({ params, url }) => {
+    const a = agentOrFail(params[0]);
+    const sid = sessionToRead(a, url.searchParams.get('session'));
+    // A long conversation is sent in pieces: `limit` keeps only the newest messages (the browser would freeze rendering thousands).
+    const all = readHistory(resolved(a), sid), limit = Number(url.searchParams.get('limit'));
+    return { session_id: sid, total: all.length, messages: limit > 0 && all.length > limit ? all.slice(-limit) : all };
+});
+route('GET', '/api/agents/:id/stats', ({ params, url }) => {
+    const a = agentOrFail(params[0]);
+    return sessionStats(readHistory(resolved(a), sessionToRead(a, url.searchParams.get('session'))));
+});
+route('GET', '/api/agents/:id/live', ({ params }) => liveTurn(params[0]));
+route('GET', '/api/agents/:id/sessions', ({ params }) => agents.sessions(params[0]));
+// ---- sessions across all managed agents ----
+route('GET', '/api/sessions', () => {
+    const byAgent = new Map(agents.list().map((a) => [a.id, a]));
+    // Never reads a conversation here: sizes and costs come from a cache that fills in the background (`pending` rows are still being read).
+    return agents.allSessions().map((s) => {
+        const a = byAgent.get(s.agent_id);
+        const { summary, fresh } = summaryOf({ provider: s.provider, cwd: s.cwd, session_id: s.session_id });
+        return {
+            ...s, current: a.session_id === s.session_id, pending: !fresh,
+            message_count: summary?.message_count ?? 0, usage: summary?.usage ?? emptyUsage(), cost: summary?.cost ?? null,
+            tool_calls: summary?.tool_calls ?? 0, model: summary?.model ?? null, preview: summary?.preview ?? '',
+        };
+    });
+});

package/server/dist/http/routes/channel.js

@@ -0,0 +1,16 @@
+import { channelMute, channelReact, channelReply, channelSendFile } from '../../connections/manager.js';
+import { scheduleWake } from '../../wake.js';
+import { createWatch } from '../../watch.js';
+import { body } from '../body.js';
+import { route } from '../router.js';
+import { text } from '../validate.js';
+// What an agent does in the chat it is answering, and its timers (`from` is the agent id). The domain errors become 400 in http/errors.ts.
+route('POST', '/api/channel/reply', async ({ req }) => { const { from, text: t } = await body(req); return channelReply(text(from), text(t)); });
+route('POST', '/api/channel/send-file', async ({ req }) => {
+    const { from, path, caption } = await body(req);
+    return channelSendFile(text(from), text(path), caption === undefined ? undefined : String(caption));
+});
+route('POST', '/api/channel/react', async ({ req }) => { const { from, emoji } = await body(req); return channelReact(text(from), emoji); });
+route('POST', '/api/channel/mute', async ({ req }) => { const { from, muted } = await body(req); return channelMute(text(from), muted !== false); });
+route('POST', '/api/wake', async ({ req }) => { const { from, minutes, note } = await body(req); return scheduleWake(text(from), minutes, note); });
+route('POST', '/api/wake-when-done', async ({ req }) => { const b = await body(req); return createWatch(text(b.from), b); });

package/server/dist/http/routes/colonies.js

@@ -0,0 +1,9 @@
+import { colonies } from '../../db.js';
+import { createColony, removeColony, updateColony } from '../../services/colonies.js';
+import { body } from '../body.js';
+import { route } from '../router.js';
+import { validateColony } from '../validate.js';
+route('GET', '/api/colonies', () => colonies.list());
+route('POST', '/api/colonies', async ({ req }) => createColony(validateColony(await body(req))));
+route('PATCH', '/api/colonies/:id', async ({ req, params }) => updateColony(params[0], validateColony(await body(req), true)));
+route('DELETE', '/api/colonies/:id', ({ params }) => { removeColony(params[0]); return { ok: true }; });

package/server/dist/http/routes/connections.js

@@ -0,0 +1,36 @@
+import { connections, threads } from '../../connections/store.js';
+import { publicConnection } from '../../connections/public.js';
+import { testConnection } from '../../connections/manager.js';
+import { createConnection, removeConnection, restartConnection, updateConnection } from '../../services/connections.js';
+import { body } from '../body.js';
+import { bad, notFound } from '../errors.js';
+import { route } from '../router.js';
+route('GET', '/api/connections', () => connections.list().map(publicConnection));
+route('POST', '/api/connections', async ({ req }) => createConnection(await body(req)));
+route('PATCH', '/api/connections/:id', async ({ req, params }) => updateConnection(params[0], await body(req)));
+route('DELETE', '/api/connections/:id', async ({ params }) => { await removeConnection(params[0]); return { ok: true }; });
+route('POST', '/api/connections/:id/restart', ({ params }) => restartConnection(params[0]));
+route('POST', '/api/connections/:id/test', async ({ params }) => {
+    if (!connections.get(params[0]))
+        throw notFound('Connection not found');
+    try {
+        return { ok: true, detail: await testConnection(params[0]) };
+    }
+    catch (e) {
+        throw bad(e instanceof Error ? e.message : String(e));
+    }
+});
+route('PATCH', '/api/connections/:id/threads/:threadId', async ({ req, params }) => {
+    const th = threads.get(params[1]);
+    if (!th || th.connection_id !== params[0])
+        throw notFound('Thread not found');
+    const p = await body(req);
+    if (typeof p.muted === 'boolean')
+        threads.setMuted(th.id, p.muted);
+    return threads.get(th.id);
+});
+route('GET', '/api/connections/:id/threads', ({ params }) => {
+    if (!connections.get(params[0]))
+        throw notFound('Connection not found');
+    return threads.forConnection(params[0]);
+});

package/server/dist/http/routes/fs.js

@@ -0,0 +1,22 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { bad } from '../errors.js';
+import { route } from '../router.js';
+// ---- folder picker ----
+route('GET', '/api/fs/dirs', ({ url }) => {
+    const p = resolve(url.searchParams.get('path') || homedir());
+    if (!existsSync(p) || !statSync(p).isDirectory())
+        throw bad('Not a folder');
+    // `files=yml,yaml` also lists the files with those extensions (to pick a file, e.g. a compose file).
+    const exts = (url.searchParams.get('files') ?? '').split(',').map((x) => x.trim().toLowerCase().replace(/^\./, '')).filter((x) => /^[a-z0-9]{1,8}$/.test(x));
+    let dirs = [], files = [];
+    try {
+        const all = readdirSync(p, { withFileTypes: true });
+        dirs = all.filter((d) => d.isDirectory() && !d.name.startsWith('.') && d.name !== 'node_modules').map((d) => d.name).sort((a, b) => a.localeCompare(b));
+        if (exts.length)
+            files = all.filter((d) => d.isFile() && exts.includes(d.name.split('.').pop().toLowerCase())).map((d) => d.name).sort((a, b) => a.localeCompare(b));
+    }
+    catch { /* unreadable */ }
+    return { path: p, parent: p === '/' ? null : dirname(p), dirs: dirs.map((n) => ({ name: n, path: join(p, n) })), files: files.map((n) => ({ name: n, path: join(p, n) })) };
+});

package/server/dist/http/routes/git.js

@@ -0,0 +1,90 @@
+import { createReadStream } from 'node:fs';
+import { agents } from '../../db.js';
+import { gitDiff, gitFile, gitImagePath, gitList, gitStatus, gitTree } from '../../git/repo.js';
+import { listStashes, planSwitch, smartCancel, smartFinish, smartSwitch, stashApply, stashDetail, stashDrop, stashSave } from '../../git/switch.js';
+import { gitCompare, gitCompareDiff, gitGrep, gitImageAt, gitRefs } from '../../git/browse.js';
+import { gitBlame, gitBranchCreate, gitBranchDelete, gitRefFile, gitBranches, gitCommitDetail, gitCommitChanges, gitCommitDiff, gitDiscardAll, gitDiscardFile, gitDiscardHunk, gitDiscardLines, gitFetch, gitLog, gitMerge, gitMergeAbort, gitPull, gitPush, gitRebaseContinue, gitResolveContent, gitResolveSide, gitSwitch, gitTagFile, gitTagTree, gitTags, gitUnresolve } from '../../git/ops.js';
+import { agentCwd, othersInRepo } from '../../services/agents.js';
+import { body } from '../body.js';
+import { requireLocal } from '../guards.js';
+import { route } from '../router.js';
+import { numList, qpath, text } from '../validate.js';
+// Errors from git (GitOpError, PathError) become 400 in http/errors.ts. Everything here is scoped to the agent's effective folder.
+const CSP = "sandbox; default-src 'none'; style-src 'unsafe-inline'";
+const q = (url, key) => url.searchParams.get(key) ?? '';
+const old = (url) => url.searchParams.get('old') ?? undefined;
+// ---- read-only explorer ----
+route('GET', '/api/agents/:id/git/status', ({ params }) => gitStatus(agentCwd(params[0])));
+route('GET', '/api/agents/:id/git/ls', ({ params, url }) => gitList(agentCwd(params[0]), qpath(url)));
+route('GET', '/api/agents/:id/git/tree', ({ params }) => gitTree(agentCwd(params[0])));
+route('GET', '/api/agents/:id/git/diff', ({ params, url }) => gitDiff(agentCwd(params[0]), qpath(url), old(url)));
+route('GET', '/api/agents/:id/git/file', ({ params, url }) => gitFile(agentCwd(params[0]), qpath(url)));
+route('GET', '/api/agents/:id/git/raw', async ({ params, url, res }) => {
+    const img = await gitImagePath(agentCwd(params[0]), qpath(url));
+    // Served only as an inert image: no sniffing, and a sandbox policy so an SVG can never run scripts.
+    res.writeHead(200, { 'content-type': img.type, 'content-length': img.size, 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', 'content-security-policy': CSP });
+    createReadStream(img.abs).pipe(res);
+});
+// ---- history and actions (writes: commit, pull, push, fetch, branches) ----
+/** The API allows any origin (it is a local tool), so writes also check that the request comes from a local page. */
+const gitWrite = (path, fn) => route('POST', `/api/agents/:id/git/${path}`, async ({ req, params }) => {
+    requireLocal(req, 'Git actions are only allowed from the local app');
+    const b = await body(req);
+    return fn(agentCwd(params[0]), b);
+});
+route('GET', '/api/agents/:id/git/log', ({ params, url }) => {
+    const by = url.searchParams.get('by');
+    return gitLog(agentCwd(params[0]), Number(url.searchParams.get('skip') ?? 0), {
+        path: url.searchParams.get('path') ?? undefined, q: url.searchParams.get('q') ?? undefined, ref: url.searchParams.get('ref') ?? undefined,
+        by: by === 'author' || by === 'content' ? by : 'message',
+    });
+});
+route('GET', '/api/agents/:id/git/commit', ({ params, url }) => gitCommitDetail(agentCwd(params[0]), q(url, 'sha')));
+route('GET', '/api/agents/:id/git/commit-diff', ({ params, url }) => gitCommitDiff(agentCwd(params[0]), q(url, 'sha'), qpath(url), old(url)));
+route('GET', '/api/agents/:id/git/blame', ({ params, url }) => gitBlame(agentCwd(params[0]), qpath(url)));
+// Smart switch: what would happen, plus which other agents are working in the same repository right now (a switch moves their files too).
+route('GET', '/api/agents/:id/git/switch-plan', async ({ params, url }) => {
+    const cwd = agentCwd(params[0]);
+    const plan = await planSwitch(cwd, q(url, 'branch'));
+    const others = await othersInRepo(params[0], cwd);
+    return { ...plan, others, selfRunning: agents.get(params[0])?.status === 'running' };
+});
+route('GET', '/api/agents/:id/git/stashes', ({ params }) => listStashes(agentCwd(params[0])));
+route('GET', '/api/agents/:id/git/stash', ({ params, url }) => stashDetail(agentCwd(params[0]), q(url, 'sha')));
+route('GET', '/api/agents/:id/git/refs', ({ params }) => gitRefs(agentCwd(params[0])));
+route('GET', '/api/agents/:id/git/compare', ({ params, url }) => gitCompare(agentCwd(params[0]), q(url, 'base'), q(url, 'head')));
+route('GET', '/api/agents/:id/git/compare-diff', ({ params, url }) => gitCompareDiff(agentCwd(params[0]), q(url, 'base'), q(url, 'head'), qpath(url), old(url)));
+route('GET', '/api/agents/:id/git/grep', ({ params, url }) => gitGrep(agentCwd(params[0]), q(url, 'q'), url.searchParams.get('case') === '1'));
+route('GET', '/api/agents/:id/git/ref-file', ({ params, url }) => gitRefFile(agentCwd(params[0]), q(url, 'ref'), qpath(url)));
+route('GET', '/api/agents/:id/git/raw-at', async ({ params, url, res }) => {
+    const img = await gitImageAt(agentCwd(params[0]), q(url, 'ref'), qpath(url));
+    res.writeHead(200, { 'content-type': img.type, 'content-length': img.bytes.length, 'cache-control': 'private, max-age=3600', 'x-content-type-options': 'nosniff', 'content-security-policy': CSP });
+    res.end(img.bytes);
+});
+route('GET', '/api/agents/:id/git/tags', ({ params }) => gitTags(agentCwd(params[0])));
+route('GET', '/api/agents/:id/git/tag-tree', ({ params, url }) => gitTagTree(agentCwd(params[0]), q(url, 'tag')));
+route('GET', '/api/agents/:id/git/tag-file', ({ params, url }) => gitTagFile(agentCwd(params[0]), q(url, 'tag'), qpath(url)));
+route('GET', '/api/agents/:id/git/branches', ({ params }) => gitBranches(agentCwd(params[0])));
+gitWrite('commit', (cwd, b) => gitCommitChanges(cwd, text(b.message), Array.isArray(b.paths) ? b.paths.map(String) : []));
+gitWrite('fetch', (cwd) => gitFetch(cwd));
+gitWrite('pull', (cwd, b) => gitPull(cwd, (['ff-only', 'merge', 'rebase'].includes(b.mode) ? b.mode : 'ff-only')));
+gitWrite('push', (cwd) => gitPush(cwd));
+gitWrite('switch', (cwd, b) => gitSwitch(cwd, text(b.branch), !!b.create));
+gitWrite('branch-create', (cwd, b) => gitBranchCreate(cwd, text(b.branch), text(b.from)));
+gitWrite('branch-delete', (cwd, b) => gitBranchDelete(cwd, text(b.branch), !!b.force));
+gitWrite('merge', (cwd, b) => gitMerge(cwd, text(b.branch)));
+gitWrite('merge-abort', (cwd) => gitMergeAbort(cwd));
+gitWrite('switch-smart', (cwd, b) => smartSwitch(cwd, text(b.branch)));
+gitWrite('smart-finish', (cwd) => smartFinish(cwd));
+gitWrite('smart-cancel', (cwd) => smartCancel(cwd));
+gitWrite('stash-save', (cwd, b) => stashSave(cwd, text(b.message)));
+gitWrite('stash-apply', (cwd, b) => stashApply(cwd, text(b.sha), !!b.pop));
+gitWrite('stash-drop', (cwd, b) => stashDrop(cwd, text(b.sha)));
+gitWrite('discard', (cwd, b) => gitDiscardFile(cwd, text(b.path), b.oldPath ? String(b.oldPath) : undefined));
+gitWrite('discard-hunk', (cwd, b) => gitDiscardHunk(cwd, text(b.path), Number(b.index), text(b.header)));
+gitWrite('discard-lines', (cwd, b) => gitDiscardLines(cwd, text(b.path), Number(b.index), text(b.header), numList(b.lines)));
+gitWrite('discard-all', (cwd) => gitDiscardAll(cwd));
+gitWrite('rebase-continue', (cwd) => gitRebaseContinue(cwd));
+gitWrite('resolve-side', (cwd, b) => gitResolveSide(cwd, text(b.path), b.side));
+gitWrite('resolve', (cwd, b) => gitResolveContent(cwd, text(b.path), text(b.content), !!b.keepMarkers));
+gitWrite('unresolve', (cwd, b) => gitUnresolve(cwd, text(b.path)));

package/server/dist/http/routes/meta.js

@@ -0,0 +1,11 @@
+import { listModels } from '../../models.js';
+import { isProvider, providerStatus } from '../../services/providers.js';
+import { notFound } from '../errors.js';
+import { route } from '../router.js';
+route('GET', '/api/health', () => ({ ok: true }));
+route('GET', '/api/providers', () => providerStatus());
+route('GET', '/api/providers/:p/models', async ({ params }) => {
+    if (!isProvider(params[0]))
+        throw notFound('Unknown provider');
+    return listModels(params[0]);
+});

package/server/dist/http/routes/notebook.js

@@ -0,0 +1,34 @@
+import { liveIsDirect } from '../../runtime.js';
+import { notebooks } from '../../skills/notebook.js';
+import { NOTEBOOK_SKILL_ID } from '../../skills/defaults.js';
+import { nbView, noteSource, notebookAgent, notebookEnabled } from '../../services/notebook.js';
+import { agentOrFail } from '../../services/agents.js';
+import { body } from '../body.js';
+import { requireLocal } from '../guards.js';
+import { route } from '../router.js';
+import { text } from '../validate.js';
+// The agent's tools (`from` is its id) and the interface. NotebookError becomes a 400 in http/errors.ts.
+route('POST', '/api/notebook/read', async ({ req }) => { const { from } = await body(req); return nbView(notebooks.get(notebookAgent(from).id)); });
+route('POST', '/api/notebook/add', async ({ req }) => {
+    const { from, section, note } = await body(req);
+    const a = notebookAgent(from);
+    const r = notebooks.add(a.id, text(section), text(note), noteSource(a.id), liveIsDirect(a.id));
+    return { added: r.added, note: r.note, ...nbView(r.notebook) };
+});
+route('POST', '/api/notebook/rewrite', async ({ req }) => {
+    const { from, content, version } = await body(req);
+    const a = notebookAgent(from);
+    return { added: true, ...nbView(notebooks.rewrite(a.id, text(content), Number(version), liveIsDirect(a.id))) };
+});
+route('GET', '/api/agents/:id/notebook', ({ params }) => {
+    const a = agentOrFail(params[0]);
+    const n = notebooks.get(a.id);
+    return { ...nbView(n), updated_at: n.updated_at, updated_by: n.updated_by, enabled: notebookEnabled(a), skill_id: NOTEBOOK_SKILL_ID };
+});
+route('PUT', '/api/agents/:id/notebook', async ({ req, params }) => {
+    requireLocal(req, 'The notebook can only be edited from the local app');
+    const a = agentOrFail(params[0]);
+    const p = await body(req);
+    const n = notebooks.edit(a.id, text(p.content), typeof p.version === 'number' ? p.version : undefined);
+    return { ...nbView(n), updated_at: n.updated_at, updated_by: n.updated_by };
+});

package/server/dist/http/routes/orchestration.js

@@ -0,0 +1,32 @@
+import { agents, dispatches } from '../../db.js';
+import { dispatch, liveTurn, notifyAgentsChanged } from '../../runtime.js';
+import { agentOrFail } from '../../services/agents.js';
+import { body } from '../body.js';
+import { bad } from '../errors.js';
+import { route } from '../router.js';
+import { strList } from '../validate.js';
+route('GET', '/api/orchestrators/:id/workers', ({ params }) => {
+    const o = agentOrFail(params[0]);
+    return o.worker_ids.map((id) => agents.get(id)).filter((w) => !!w).map((w) => ({ name: w.name, role: w.role, description: w.description, provider: w.provider, busy: !!liveTurn(w.id) }));
+});
+route('PUT', '/api/orchestrators/:id/workers', async ({ req, params }) => {
+    const o = agentOrFail(params[0]);
+    if (o.role !== 'orchestrator')
+        throw bad('Only orchestrators can have subagents');
+    const { worker_ids } = await body(req);
+    agents.setWorkers(o.id, worker_ids === undefined || worker_ids === null ? [] : strList(worker_ids));
+    notifyAgentsChanged();
+    return agents.get(o.id);
+});
+route('POST', '/api/dispatch', async ({ req }) => {
+    const { from, agent, task } = await body(req);
+    if (!from || !agent || !task)
+        throw bad('from, agent and task are required');
+    try {
+        return await dispatch(from, agent, task);
+    }
+    catch (e) {
+        throw bad(e instanceof Error ? e.message : String(e));
+    }
+});
+route('GET', '/api/dispatches', () => dispatches.recent());

package/server/dist/http/routes/resources.js

@@ -0,0 +1,68 @@
+import { notifyAgentsChanged } from '../../runtime.js';
+import { DRIVER_PROPS } from '../../objects/driver-props.js';
+import { composeServices, listContainers, listImages } from '../../objects/docker-info.js';
+import { agentObjectAction, agentObjectLogs, agentObjects } from '../../objects/agent.js';
+import { dbColumnsOf, dbHistory, dbHistoryClear, dbRun, dbSavedAdd, dbSavedList, dbSavedRemove, dbSavedUpdate, dbSchemaOf, dbTestConfig, createObject, statsOf, httpDescribe, httpSession, httpSessionClear, httpSessionSet, httpInspect, httpExport, httpFileRead, httpFileWrite, httpFileCreate, httpRun, httpHistory, httpDocs, httpHistoryClear, httpScan, listObjects, setObjectManager, setAgentObjects, objectAction, objectServiceAction, listTemplates, createFromTemplate, objectInspect, objectLogs, removeObject, updateObject } from '../../objects/index.js';
+import { body } from '../body.js';
+import { notFound } from '../errors.js';
+import { requireLocal } from '../guards.js';
+import { route } from '../router.js';
+import { text } from '../validate.js';
+// ObjectError becomes a 400 in http/errors.ts. "Object" is the old name of "resource": the paths keep it.
+const p = (url, key) => url.searchParams.get(key) ?? undefined;
+/** Resources run commands and open connections with saved passwords, so, like the git actions, they only accept requests from the local app. */
+const local = (req) => requireLocal(req, 'Resources can only be changed from the local app');
+/** A route that changes things: local app only, with the JSON body already read. */
+const write = (method, path, fn) => route(method, path, async (ctx) => { local(ctx.req); return fn(await body(ctx.req), ctx); });
+/** A route that answers from a resource but is still local only (it reaches a database with its saved password). */
+const guarded = (path, fn, method = 'GET') => route(method, path, (ctx) => { local(ctx.req); return fn(ctx); });
+// The agents' side (tools `object_list`, `object_action`, `object_logs`): `from` is the agent; scope and permission are checked in objects/agent.ts.
+route('POST', '/api/agent-objects/list', async ({ req }) => { const b = await body(req); return { objects: agentObjects(b.from) }; });
+route('POST', '/api/agent-objects/action', async ({ req }) => { const b = await body(req); return agentObjectAction(b.from, b.name, b.action); });
+route('POST', '/api/agent-objects/logs', async ({ req }) => { const b = await body(req); return agentObjectLogs(b.from, b.name, b.tail); });
+route('GET', '/api/objects', () => listObjects());
+write('POST', '/api/objects', (b) => createObject(b));
+write('PATCH', '/api/objects/:id', (b, { params }) => updateObject(params[0], b));
+route('DELETE', '/api/objects/:id', async ({ req, params }) => { local(req); if (!(await removeObject(params[0])))
+    throw notFound('Object not found'); return { ok: true }; });
+route('GET', '/api/object-templates', () => listTemplates());
+write('PUT', '/api/objects/:id/manager', (b, { params }) => { const r = setObjectManager(params[0], b.agent_id); if (r.skillAdded)
+    notifyAgentsChanged(); return r; });
+write('PUT', '/api/agents/:id/resources', (b, { params }) => { const r = setAgentObjects(params[0], b.object_ids); if (r.skillAdded)
+    notifyAgentsChanged(); return r; });
+write('POST', '/api/objects/from-template', (b) => createFromTemplate(b));
+route('GET', '/api/objects/:id/inspect', ({ params, url }) => objectInspect(params[0], p(url, 'service')));
+write('POST', '/api/objects/:id/service', (b, { params }) => objectServiceAction(params[0], b.service, b.action));
+write('POST', '/api/objects/:id/action', (b, { params }) => objectAction(params[0], b.action));
+// What Docker knows, to suggest in the forms (containers, images, the services of a compose file).
+route('GET', '/api/docker/containers', () => listContainers());
+route('GET', '/api/docker/images', () => listImages());
+route('GET', '/api/docker/compose-services', ({ url }) => composeServices(url.searchParams.get('file') ?? ''));
+route('GET', '/api/objects/:id/stats', ({ params }) => statsOf(params[0]));
+route('GET', '/api/objects/:id/http', ({ params }) => httpScan(params[0]));
+route('GET', '/api/objects/:id/http/export', ({ params, url }) => httpExport(params[0], url.searchParams.get('file') ?? '', Number(url.searchParams.get('index')), (url.searchParams.get('format') ?? 'curl'), p(url, 'env'), url.searchParams.get('redact') === '1'));
+route('GET', '/api/objects/:id/http/variables', ({ params, url }) => httpInspect(params[0], p(url, 'file'), url.searchParams.has('index') ? Number(url.searchParams.get('index')) : undefined, p(url, 'env')));
+route('GET', '/api/objects/:id/http/file', ({ params, url }) => httpFileRead(params[0], url.searchParams.get('file') ?? ''));
+write('POST', '/api/objects/:id/http/file', (b, { params }) => httpFileCreate(params[0], text(b.file), text(b.content)));
+write('PUT', '/api/objects/:id/http/file', (b, { params }) => httpFileWrite(params[0], text(b.file), text(b.content)));
+route('GET', '/api/objects/:id/http/session', ({ params }) => httpSession(params[0]));
+write('POST', '/api/objects/:id/http/session', (b, { params }) => httpSessionSet(params[0], text(b.name), text(b.value)));
+guarded('/api/objects/:id/http/session', ({ params, url }) => httpSessionClear(params[0], p(url, 'name')), 'DELETE');
+route('GET', '/api/objects/:id/http/describe', ({ params, url }) => httpDescribe(params[0], url.searchParams.get('file') ?? '', Number(url.searchParams.get('index') ?? 0), p(url, 'env')));
+route('GET', '/api/objects/:id/http/docs', ({ params, url }) => httpDocs(params[0], url.searchParams.get('format') === 'postman' ? 'postman' : 'markdown', p(url, 'file')));
+route('GET', '/api/objects/:id/http/history', ({ params }) => httpHistory(params[0]));
+guarded('/api/objects/:id/http/history', ({ params }) => httpHistoryClear(params[0]), 'DELETE');
+write('POST', '/api/objects/:id/http/run', (b, { params }) => httpRun(params[0], text(b.file), Number(b.index ?? 0), b.env ? String(b.env) : undefined));
+// ---- database resources (a connection opens per request; local app only, because it uses the saved password) ----
+route('GET', '/api/object-db/props', () => DRIVER_PROPS);
+write('POST', '/api/object-db/test', (b) => dbTestConfig(b));
+guarded('/api/objects/:id/db/schema', ({ params, url }) => dbSchemaOf(params[0], p(url, 'database')));
+guarded('/api/objects/:id/db/columns', ({ params, url }) => dbColumnsOf(params[0], { database: p(url, 'database'), schema: url.searchParams.get('schema') ?? '', table: url.searchParams.get('table') ?? '' }));
+write('POST', '/api/objects/:id/db/query', (b, { params }) => dbRun(params[0], { sql: text(b.sql), database: b.database ? String(b.database) : undefined }));
+guarded('/api/objects/:id/db/history', ({ params }) => dbHistory(params[0]));
+guarded('/api/objects/:id/db/history', ({ params }) => dbHistoryClear(params[0]), 'DELETE');
+guarded('/api/objects/:id/db/saved', ({ params }) => dbSavedList(params[0]));
+write('POST', '/api/objects/:id/db/saved', (b, { params }) => dbSavedAdd(params[0], b));
+write('PATCH', '/api/objects/:id/db/saved/:sid', (b, { params }) => dbSavedUpdate(params[0], params[1], b));
+guarded('/api/objects/:id/db/saved/:sid', ({ params }) => dbSavedRemove(params[0], params[1]), 'DELETE');
+route('GET', '/api/objects/:id/logs', ({ params, url }) => objectLogs(params[0], { tail: url.searchParams.get('tail') ? Number(url.searchParams.get('tail')) : undefined, after: p(url, 'after') }));

package/server/dist/http/routes/schedules.js

@@ -0,0 +1,40 @@
+import { cancelFor, createSchedule, listFor, removeSchedule, runsOf, setEnabled } from '../../schedules.js';
+import { removeWakeup } from '../../wake.js';
+import { WatchError, cancelWatchFor, removeWatch } from '../../watch.js';
+import { allSchedules } from '../../services/schedules.js';
+import { body } from '../body.js';
+import { notFound } from '../errors.js';
+import { route } from '../router.js';
+import { text } from '../validate.js';
+// Recurring schedules and pending wake-ups: the agent's tools (`from` is its id) and the interface. ScheduleError becomes a 400 in http/errors.ts.
+route('POST', '/api/schedules/create', async ({ req }) => {
+    const b = await body(req);
+    const r = createSchedule(text(b.from), b);
+    return { id: r.schedule.id, schedule: r.schedule.kind === 'every' ? `every ${r.schedule.expr} min` : `${r.schedule.expr} (${r.schedule.tz})`, next: r.next, where: r.where };
+});
+route('POST', '/api/schedules/list', async ({ req }) => { const b = await body(req); return { schedules: listFor(text(b.from)) }; });
+route('POST', '/api/schedules/cancel', async ({ req }) => {
+    const b = await body(req);
+    const from = text(b.from), id = text(b.id);
+    try {
+        cancelWatchFor(from, id);
+        return { cancelled: true };
+    }
+    catch (e) {
+        if (!(e instanceof WatchError))
+            throw e;
+    } // not one of its watches: a schedule then
+    cancelFor(from, id);
+    return { cancelled: true };
+});
+route('GET', '/api/schedules', () => allSchedules());
+route('GET', '/api/schedules/:id/runs', ({ params }) => runsOf(params[0]));
+route('PATCH', '/api/schedules/:id', async ({ req, params }) => {
+    const b = await body(req);
+    return setEnabled(params[0], !!b.enabled) ?? (() => { throw notFound('Schedule not found'); })();
+});
+route('DELETE', '/api/schedules/:id', ({ params }) => {
+    if (!removeSchedule(params[0]) && !removeWakeup(params[0]) && !removeWatch(params[0]))
+        throw notFound('Schedule not found');
+    return { ok: true };
+});

package/server/dist/http/routes/skills.js

@@ -0,0 +1,47 @@
+import { agents, resolved, skills } from '../../db.js';
+import { body } from '../body.js';
+import { HttpError, bad, notFound } from '../errors.js';
+import { route } from '../router.js';
+import { requireName, text, trimmed } from '../validate.js';
+const checkLoad = (v) => { if (v !== undefined && v !== 'always' && v !== 'on_demand')
+    throw bad('load must be always or on_demand'); };
+route('GET', '/api/skills', () => skills.list());
+route('GET', '/api/skills/usage', () => skills.usage());
+route('POST', '/api/skills', async ({ req }) => {
+    const p = await body(req);
+    const name = requireName(p.name);
+    checkLoad(p.load);
+    try {
+        return skills.create({ name, description: p.description ?? '', content: p.content ?? '', load: p.load });
+    }
+    catch {
+        throw bad(`A skill named "${text(p.name)}" already exists`);
+    } // the name is unique: that is what the insert refuses
+});
+route('PATCH', '/api/skills/:id', async ({ req, params }) => {
+    const p = await body(req);
+    checkLoad(p.load);
+    try {
+        return skills.update(params[0], p) ?? (() => { throw notFound('Skill not found'); })();
+    }
+    catch (e) {
+        if (e instanceof HttpError)
+            throw e;
+        throw bad(`A skill named "${text(p.name)}" already exists`);
+    }
+});
+route('DELETE', '/api/skills/:id', ({ params }) => { if (!skills.remove(params[0]))
+    throw notFound('Skill not found'); return { ok: true }; });
+// `skill_read`: the text of one of the skills the agent has, loaded when it needs it.
+route('POST', '/api/skills/read', async ({ req }) => {
+    const { from, name } = await body(req);
+    const agent = agents.get(text(from));
+    if (!agent)
+        throw bad('Unknown agent');
+    const mine = resolved(agent).skill_ids.map((id) => skills.get(id)).filter((s) => !!s);
+    const want = trimmed(name).toLowerCase();
+    const s = mine.find((x) => x.name.toLowerCase() === want);
+    if (!s)
+        throw bad(`No skill named "${text(name)}". Your skills: ${mine.map((x) => x.name).join(', ') || '(none)'}.`);
+    return { name: s.name, content: s.content.trim() };
+});

package/server/dist/http/routes/terminals.js

@@ -0,0 +1,18 @@
+import { closeTerminal, createTerminal, listTerminals, terminalsEnabled } from '../../terminals.js';
+import { body } from '../body.js';
+import { notFound } from '../errors.js';
+import { requireLocal } from '../guards.js';
+import { route } from '../router.js';
+// Real shells shown in the bottom panel (see terminals.ts). Strict: the Host must be loopback too. TerminalError becomes a 400 in http/errors.ts.
+const MSG = 'Terminals can only be used from this machine';
+route('GET', '/api/terminals', ({ req }) => { requireLocal(req, MSG, { strict: true }); return { enabled: terminalsEnabled(), terminals: listTerminals() }; });
+route('POST', '/api/terminals', async ({ req }) => {
+    requireLocal(req, MSG, { strict: true });
+    return createTerminal(await body(req));
+});
+route('DELETE', '/api/terminals/:id', ({ req, params }) => {
+    requireLocal(req, MSG, { strict: true });
+    if (!closeTerminal(params[0]))
+        throw notFound('Terminal not found');
+    return { ok: true };
+});