libre-webui 0.36.0 → 0.37.1

package/backend/dist/cordis/dsh/session-files.js

@@ -0,0 +1,60 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Local artifact deletion for the pinned JSONL backend's project/session layout. */
+import path from 'node:path';
+import { lstat, readdir, realpath, rename, rm } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+/**
+ * Delete only a bridge-minted session directory after its writer is disposed.
+ * The upstream persistence API has no delete operation. Keep its pinned
+ * two-directory artifact layout in this one adapter, and refuse links rather
+ * than letting an artifact path escape the configured local store.
+ */
+export async function deleteJsonlSession(storePath, header) {
+    if (!/^session-[a-f0-9]{8}-\d+(?:-transient)?$/.test(header.id)) {
+        throw new Error('Only sessions created by the Libre WebUI bridge can be deleted.');
+    }
+    const root = await realpath(storePath);
+    const matches = [];
+    for (const project of await readdir(root, { withFileTypes: true })) {
+        if (!project.isDirectory())
+            continue;
+        const parent = path.join(root, project.name);
+        const target = path.join(parent, header.id);
+        const metadata = await lstat(target).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!metadata)
+            continue;
+        if (!metadata.isDirectory() ||
+            metadata.isSymbolicLink() ||
+            (await realpath(parent)) !== parent ||
+            (await realpath(target)) !== target) {
+            throw new Error('Refusing to delete a linked Cordis session artifact.');
+        }
+        matches.push(target);
+    }
+    if (matches.length !== 1)
+        throw new Error('The Cordis session artifact is missing or ambiguous.');
+    const target = matches[0];
+    const tombstone = path.join(path.dirname(target), `.deleted-${randomUUID()}`);
+    await rename(target, tombstone);
+    await rm(tombstone, { recursive: true, force: false });
+}
+//# sourceMappingURL=session-files.js.map

package/backend/dist/cordis/dsh/session-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-files.js","sourceRoot":"","sources":["../../../src/cordis/dsh/session-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,qFAAqF;AACrF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,MAAqB;IAErB,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,IACE,CAAC,QAAQ,CAAC,WAAW,EAAE;YACvB,QAAQ,CAAC,cAAc,EAAE;YACzB,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM;YACnC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,EACnC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/backend/dist/cordis/dsh/session-settings.d.ts

@@ -0,0 +1,15 @@
+/** Native session settings shared with DSH's session controller. */
+import type { Session } from '@deepseek-ai/dsh-session';
+import type { EngineSessionSettings } from '../contracts.js';
+declare module '@deepseek-ai/dsh-session/types' {
+    interface SessionEventMap {
+        'model/selection': {
+            readonly provider: string;
+            readonly model: string;
+            readonly reasoningEffort?: string;
+        };
+    }
+}
+export declare function sessionSettings(session: Session): EngineSessionSettings;
+export declare function appendSessionSettings(session: Session, settings: Partial<EngineSessionSettings>, provider: string): void;
+//# sourceMappingURL=session-settings.d.ts.map

package/backend/dist/cordis/dsh/session-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-settings.d.ts","sourceRoot":"","sources":["../../../src/cordis/dsh/session-settings.ts"],"names":[],"mappings":"AAiBA,oEAAoE;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAM7D,OAAO,QAAQ,gCAAgC,CAAC;IAC9C,UAAU,eAAe;QACvB,iBAAiB,EAAE;YACjB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;SACnC,CAAC;KACH;CACF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,qBAAqB,CAuBvE;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACxC,QAAQ,EAAE,MAAM,GACf,IAAI,CAKN"}

package/backend/dist/cordis/dsh/session-settings.js

@@ -0,0 +1,51 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
+import { isProviderModelIdentity } from './model-identity.js';
+export function sessionSettings(session) {
+    let model;
+    let explicitlySelected;
+    let permissionMode = 'read-only';
+    for (const event of session.snapshotEvents()) {
+        if (event.type === 'sandbox/mode') {
+            permissionMode =
+                event.data.mode === 'workspace-write' ? 'workspace-write' : 'read-only';
+        }
+        else if (event.type === 'model/selection') {
+            explicitlySelected = isProviderModelIdentity(event.data.model)
+                ? event.data.model
+                : undefined;
+            model = explicitlySelected;
+        }
+        else if (event.type === 'request/header') {
+            const historical = event.data.header.config.model;
+            // Old builds logged persona/agent selectors as provider models. Ignore
+            // that fallback without changing history or abandoning a real selection.
+            model = isProviderModelIdentity(historical)
+                ? historical
+                : explicitlySelected;
+        }
+    }
+    return { ...(model ? { model } : {}), permissionMode };
+}
+export function appendSessionSettings(session, settings, provider) {
+    if (settings.permissionMode !== undefined)
+        setSandboxMode(session, settings.permissionMode);
+    if (settings.model !== undefined)
+        session.append('model/selection', { provider, model: settings.model });
+}
+//# sourceMappingURL=session-settings.js.map

package/backend/dist/cordis/dsh/session-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-settings.js","sourceRoot":"","sources":["../../../src/cordis/dsh/session-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAe9D,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,IAAI,KAAyB,CAAC;IAC9B,IAAI,kBAAsC,CAAC;IAC3C,IAAI,cAAc,GAA4C,WAAW,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,cAAc;gBACZ,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5E,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,kBAAkB,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC5D,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gBAClB,CAAC,CAAC,SAAS,CAAC;YACd,KAAK,GAAG,kBAAkB,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAClD,uEAAuE;YACvE,yEAAyE;YACzE,KAAK,GAAG,uBAAuB,CAAC,UAAU,CAAC;gBACzC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,kBAAkB,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgB,EAChB,QAAwC,EACxC,QAAgB;IAEhB,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS;QACvC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;QAC9B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/backend/dist/cordis/dsh/work-driver.d.ts

@@ -0,0 +1,12 @@
+import type { OllamaChatRequest, OllamaChatResponse } from '../../types/index.js';
+import type { WorkModelStreamObserver } from '../../services/workModelProviderService.js';
+export interface WorkDshDriver {
+    generate(request: OllamaChatRequest, observer: WorkModelStreamObserver, signal?: AbortSignal): Promise<OllamaChatResponse>;
+    dispose(): Promise<void>;
+}
+export interface WorkDshDriverOptions {
+    generate(request: OllamaChatRequest, observer: WorkModelStreamObserver, signal?: AbortSignal): Promise<OllamaChatResponse>;
+}
+/** Create one in-memory native DSH loop; no host filesystem capabilities mount. */
+export declare function createWorkDshDriver(options: WorkDshDriverOptions): Promise<WorkDshDriver>;
+//# sourceMappingURL=work-driver.d.ts.map

package/backend/dist/cordis/dsh/work-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-driver.d.ts","sourceRoot":"","sources":["../../../src/cordis/dsh/work-driver.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAE1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CACN,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CACN,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAoED,mFAAmF;AACnF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CA8UxB"}

package/backend/dist/cordis/dsh/work-driver.js

@@ -0,0 +1,402 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * An isolated DSH planning loop for one Work run. Work remains authoritative
+ * for transcripts, authorization, approval, sandbox execution, and durability.
+ * Tool bodies here only wait for results supplied by Work's next model step.
+ */
+import { randomUUID } from 'node:crypto';
+import { Context } from '@deepseek-ai/cordis';
+import LlmRuntime, { LlmAdapter, createUserMessage, } from '@deepseek-ai/dsh-llm';
+import SessionStore from '@deepseek-ai/dsh-session';
+import SessionProjections from '@deepseek-ai/dsh-session-projection';
+import SystemPrompt from '@deepseek-ai/dsh-system-prompt';
+import ToolRuntime from '@deepseek-ai/dsh-tools';
+import Agents from '@deepseek-ai/dsh-agent';
+import AgentLoop from '@deepseek-ai/dsh-agent-loop';
+/** Queue provider deltas without starting another model request. */
+class ChunkQueue {
+    constructor(overflow) {
+        this.overflow = overflow;
+        this.chunks = [];
+        this.ended = false;
+        this.queuedBytes = 0;
+    }
+    push(chunk) {
+        if (this.ended)
+            return;
+        const bytes = Buffer.byteLength(JSON.stringify(chunk));
+        if (this.queuedBytes + bytes > 2 * 1024 * 1024 ||
+            this.chunks.length >= 10000) {
+            const error = new Error('The Work provider exceeded the DSH stream buffer limit.');
+            this.overflow(error);
+            this.finish(error);
+            throw error;
+        }
+        this.chunks.push(chunk);
+        this.queuedBytes += bytes;
+        this.wake?.();
+    }
+    finish(error) {
+        this.failure = error;
+        if (error) {
+            this.chunks.length = 0;
+            this.queuedBytes = 0;
+        }
+        this.ended = true;
+        this.wake?.();
+    }
+    async *read() {
+        while (true) {
+            if (this.chunks.length) {
+                const chunk = this.chunks.shift();
+                this.queuedBytes -= Buffer.byteLength(JSON.stringify(chunk));
+                yield chunk;
+                continue;
+            }
+            if (this.ended) {
+                if (this.failure)
+                    throw this.failure;
+                return;
+            }
+            await new Promise(resolve => {
+                this.wake = resolve;
+            });
+            this.wake = undefined;
+        }
+    }
+}
+/** Create one in-memory native DSH loop; no host filesystem capabilities mount. */
+export async function createWorkDshDriver(options) {
+    const ctx = new Context();
+    let disposed = false;
+    let active;
+    let delivering;
+    let recovery;
+    let agent;
+    let nextModel;
+    const toolResults = new Map();
+    const toolWaiters = new Map();
+    const registered = new Map();
+    const fail = (error, step = active) => {
+        if (!step || active !== step)
+            return;
+        active = undefined;
+        // Provider rejection reaches the caller before DSH records its failure.
+        // Drain that native activity before a retry can become the active step.
+        recovery = agent?.agent.whenIdle().catch(() => undefined);
+        step.detach();
+        step.controller.abort(error);
+        step.reject(error);
+    };
+    class WorkAdapter extends LlmAdapter {
+        async *stream(call) {
+            while (!active && !disposed) {
+                await new Promise((resolve, reject) => {
+                    const cleanup = () => call.signal?.removeEventListener('abort', abortWait);
+                    const abortWait = () => {
+                        cleanup();
+                        nextModel = undefined;
+                        reject(call.signal?.reason);
+                    };
+                    nextModel = () => {
+                        cleanup();
+                        resolve();
+                    };
+                    call.signal?.addEventListener('abort', abortWait, { once: true });
+                    if (call.signal?.aborted)
+                        abortWait();
+                });
+                nextModel = undefined;
+            }
+            if (disposed)
+                throw new Error('The Work DSH driver is disposed.');
+            const step = active;
+            if (step.claimed)
+                throw new Error('A Work model step is already running.');
+            step.claimed = true;
+            delivering = step;
+            const abort = () => step.controller.abort(call.signal?.reason);
+            call.signal?.addEventListener('abort', abort, { once: true });
+            if (call.signal?.aborted)
+                abort();
+            const queue = new ChunkQueue(error => {
+                step.controller.abort(error);
+                fail(error, step);
+            });
+            const blocks = new Map();
+            let nextIndex = 0;
+            const emit = (kind, delta) => {
+                if (!delta || active !== step || step.controller.signal.aborted)
+                    return;
+                let block = blocks.get(kind);
+                if (!block) {
+                    block = { index: nextIndex++, text: '' };
+                    blocks.set(kind, block);
+                    queue.push({
+                        type: 'block-start',
+                        index: block.index,
+                        blockType: kind,
+                    });
+                }
+                block.text += delta;
+                queue.push({
+                    type: kind === 'text' ? 'text-delta' : 'reasoning-delta',
+                    index: block.index,
+                    text: delta,
+                });
+            };
+            const run = (async () => {
+                const original = await options.generate(step.request, {
+                    onContent: text => emit('text', text),
+                    onReasoning: text => emit('reasoning', text),
+                    onUsage: usage => {
+                        if (active === step && !step.controller.signal.aborted)
+                            step.observer.onUsage?.(usage);
+                    },
+                }, step.controller.signal);
+                step.controller.signal.throwIfAborted();
+                const rawCalls = original.message.tool_calls ?? [];
+                const calls = rawCalls.map(call => typeof call.id === 'string'
+                    ? call
+                    : { ...call, id: `work-dsh-${randomUUID()}` });
+                step.response = calls.some((call, index) => call !== rawCalls[index])
+                    ? { ...original, message: { ...original.message, tool_calls: calls } }
+                    : original;
+                for (const [kind, full] of [
+                    ['reasoning', original.message.thinking ?? ''],
+                    ['text', original.message.content],
+                ]) {
+                    const streamed = blocks.get(kind)?.text ?? '';
+                    if (full.startsWith(streamed))
+                        emit(kind, full.slice(streamed.length));
+                }
+                for (const [kind, block] of blocks)
+                    queue.push({
+                        type: 'block-end',
+                        index: block.index,
+                        block: { type: kind, text: block.text },
+                    });
+                for (const record of calls) {
+                    const fn = record.function;
+                    if (!fn ||
+                        typeof fn.name !== 'string' ||
+                        typeof record.id !== 'string')
+                        throw new Error('The Work provider returned an invalid tool call.');
+                    const index = nextIndex++;
+                    const args = typeof fn.arguments === 'string'
+                        ? fn.arguments
+                        : JSON.stringify(fn.arguments ?? {});
+                    queue.push({ type: 'block-start', index, blockType: 'tool-call' });
+                    queue.push({
+                        type: 'tool-call-delta',
+                        index,
+                        id: record.id,
+                        name: fn.name,
+                        argumentsDelta: args,
+                    });
+                    queue.push({
+                        type: 'block-end',
+                        index,
+                        block: {
+                            type: 'tool-call',
+                            id: record.id,
+                            name: fn.name,
+                            arguments: args,
+                        },
+                    });
+                }
+                queue.push({
+                    type: 'finish',
+                    reason: { kind: calls.length ? 'tool-calls' : 'stop' },
+                });
+            })();
+            void run.then(() => queue.finish(), error => {
+                fail(error, step);
+                queue.finish(error);
+            });
+            try {
+                yield* queue.read();
+            }
+            finally {
+                call.signal?.removeEventListener('abort', abort);
+                await run.catch(() => undefined);
+            }
+        }
+    }
+    try {
+        await ctx.plugin(LlmRuntime);
+        await ctx.plugin(SessionStore);
+        await ctx.plugin(SessionProjections);
+        await ctx.plugin(SystemPrompt, { personaPrefix: '' });
+        await ctx.plugin(ToolRuntime);
+        await ctx.plugin(Agents);
+        await ctx.plugin(AgentLoop, { agents: [] });
+        ctx.llm.registerAdapter(['libre-work'], new WorkAdapter());
+        ctx.on('agent/assistant-stream', ({ frame }) => {
+            if (frame.type !== 'chunk' || !active || active !== delivering)
+                return;
+            if (frame.chunk.type === 'text-delta')
+                active.observer.onContent?.(frame.chunk.text);
+            if (frame.chunk.type === 'reasoning-delta')
+                active.observer.onReasoning?.(frame.chunk.text);
+        });
+        ctx.on('session/event', (_session, event) => {
+            if (event.type !== 'assistant/message' ||
+                !active?.response ||
+                active !== delivering)
+                return;
+            const step = active;
+            active = undefined;
+            step.detach();
+            step.resolve(step.response);
+        });
+        ctx.on('agent/error', ({ error }) => fail(error, active?.claimed ? delivering : active));
+        agent = await ctx.agents.create({
+            sessionId: `work-${randomUUID()}`,
+            agentOptions: { provider: 'libre-work', model: 'work-model' },
+        });
+    }
+    catch (error) {
+        await ctx.fiber.dispose();
+        throw error;
+    }
+    const driver = {
+        async generate(request, observer, signal) {
+            signal?.throwIfAborted();
+            const draining = recovery;
+            await draining;
+            if (recovery === draining)
+                recovery = undefined;
+            if (disposed)
+                throw new Error('The Work DSH driver is disposed.');
+            if (active)
+                throw new Error('A Work model step is already running.');
+            signal?.throwIfAborted();
+            for (const dispose of registered.values())
+                dispose();
+            registered.clear();
+            for (const raw of request.tools ?? []) {
+                const fn = raw.function;
+                if (!fn || typeof fn.name !== 'string' || registered.has(fn.name))
+                    continue;
+                registered.set(fn.name, ctx.tools.register({
+                    name: fn.name,
+                    description: typeof fn.description === 'string' ? fn.description : '',
+                    parameters: {
+                        type: 'object',
+                        properties: {},
+                        additionalProperties: true,
+                    },
+                    output: {
+                        schema: { type: 'string' },
+                        render: (_args, value) => [{ type: 'text', text: String(value) }],
+                    },
+                    async execute(_args, exec) {
+                        exec.signal.throwIfAborted();
+                        const immediate = toolResults.get(exec.callId);
+                        if (immediate !== undefined) {
+                            toolResults.delete(exec.callId);
+                            return immediate;
+                        }
+                        return new Promise((resolve, reject) => {
+                            const abort = () => {
+                                toolWaiters.delete(exec.callId);
+                                reject(exec.signal.reason);
+                            };
+                            const finish = (value) => {
+                                exec.signal.removeEventListener('abort', abort);
+                                toolWaiters.delete(exec.callId);
+                                resolve(value);
+                            };
+                            const failWait = (error) => {
+                                exec.signal.removeEventListener('abort', abort);
+                                toolWaiters.delete(exec.callId);
+                                reject(error);
+                            };
+                            toolWaiters.set(exec.callId, {
+                                resolve: finish,
+                                reject: failWait,
+                            });
+                            exec.signal.addEventListener('abort', abort, { once: true });
+                        });
+                    },
+                }));
+            }
+            return new Promise((resolve, reject) => {
+                const controller = new AbortController();
+                const abort = () => {
+                    controller.abort(signal?.reason);
+                    agent?.agent.cancel({ kind: 'user' });
+                    fail(signal?.reason ?? new Error('Work generation aborted.'), step);
+                };
+                const step = {
+                    request,
+                    observer,
+                    controller,
+                    claimed: false,
+                    resolve,
+                    reject,
+                    detach: () => signal?.removeEventListener('abort', abort),
+                };
+                active = step;
+                signal?.addEventListener('abort', abort, { once: true });
+                for (const message of request.messages) {
+                    if (message.role !== 'tool' || !message.tool_call_id)
+                        continue;
+                    const waiter = toolWaiters.get(message.tool_call_id);
+                    if (waiter)
+                        waiter.resolve(message.content);
+                    else
+                        toolResults.set(message.tool_call_id, message.content);
+                }
+                nextModel?.();
+                // Idle follow-ups wake a new DSH turn. A loop still consuming Work tool
+                // results advances itself; checking claimed avoids a duplicate wake.
+                void agent.agent
+                    .whenIdle()
+                    .then(() => {
+                    if (active !== step || step.claimed || disposed)
+                        return;
+                    agent.agent.followup(createUserMessage({
+                        source: { kind: 'user' },
+                        content: [
+                            { type: 'text', text: 'Continue the current Work request.' },
+                        ],
+                    }));
+                })
+                    .catch(error => fail(error, step));
+            });
+        },
+        async dispose() {
+            if (disposed)
+                return;
+            disposed = true;
+            const error = new Error('The Work DSH driver is disposed.');
+            fail(error);
+            nextModel?.();
+            for (const waiter of toolWaiters.values())
+                waiter.reject(error);
+            toolWaiters.clear();
+            toolResults.clear();
+            await agent?.dispose();
+            await ctx.fiber.dispose();
+        },
+    };
+    return driver;
+}
+//# sourceMappingURL=work-driver.js.map

package/backend/dist/cordis/dsh/work-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-driver.js","sourceRoot":"","sources":["../../../src/cordis/dsh/work-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,UAAU,EAAE,EACjB,UAAU,EACV,iBAAiB,GAIlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,YAAgC,MAAM,0BAA0B,CAAC;AACxE,OAAO,kBAAkB,MAAM,qCAAqC,CAAC;AACrE,OAAO,YAAY,MAAM,gCAAgC,CAAC;AAC1D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,MAA4B,MAAM,wBAAwB,CAAC;AAClE,OAAO,SAAS,MAAM,6BAA6B,CAAC;AAmCpD,oEAAoE;AACpE,MAAM,UAAU;IAMd,YAA6B,QAAgC;QAAhC,aAAQ,GAAR,QAAQ,CAAwB;QAL5C,WAAM,GAAkB,EAAE,CAAC;QAEpC,UAAK,GAAG,KAAK,CAAC;QAEd,gBAAW,GAAG,CAAC,CAAC;IACwC,CAAC;IACjE,IAAI,CAAC,KAAkB;QACrB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IACE,IAAI,CAAC,WAAW,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,EAC3B,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,yDAAyD,CAC1D,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,KAAe;QACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,CAAC,IAAI;QACT,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAG,CAAC;gBACnC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7D,MAAM,KAAK,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,CAAC,OAAO,CAAC;gBACrC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;gBAChC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAwB,CAAC;IAC7B,IAAI,UAA4B,CAAC;IACjC,IAAI,QAAmC,CAAC;IACxC,IAAI,KAA8B,CAAC;IACnC,IAAI,SAAmC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEjD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,IAAI,GAAG,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QACrC,MAAM,GAAG,SAAS,CAAC;QACnB,wEAAwE;QACxE,wEAAwE;QACxE,QAAQ,GAAG,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,WAAY,SAAQ,UAAU;QAClC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAqB;YACjC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;oBACvD,MAAM,SAAS,GAAG,GAAG,EAAE;wBACrB,OAAO,EAAE,CAAC;wBACV,SAAS,GAAG,SAAS,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAC9B,CAAC,CAAC;oBACF,SAAS,GAAG,GAAG,EAAE;wBACf,OAAO,EAAE,CAAC;wBACV,OAAO,EAAE,CAAC;oBACZ,CAAC,CAAC;oBACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClE,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;wBAAE,SAAS,EAAE,CAAC;gBACxC,CAAC,CAAC,CAAC;gBACH,SAAS,GAAG,SAAS,CAAC;YACxB,CAAC;YACD,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAO,CAAC;YACrB,IAAI,IAAI,CAAC,OAAO;gBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,UAAU,GAAG,IAAI,CAAC;YAClB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,KAAK,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE;gBACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;YACJ,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,CAAC,IAA0B,EAAE,KAAa,EAAE,EAAE;gBACzD,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;gBACxE,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACzC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,aAAa;wBACnB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,SAAS,EAAE,IAAI;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB;oBACxD,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CACrC,IAAI,CAAC,OAAO,EACZ;oBACE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;oBACrC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;oBAC5C,OAAO,EAAE,KAAK,CAAC,EAAE;wBACf,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;4BACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;oBACnC,CAAC;iBACF,EACD,IAAI,CAAC,UAAU,CAAC,MAAM,CACvB,CAAC;gBACF,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;gBACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAChC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;oBACzB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,YAAY,UAAU,EAAE,EAAE,EAAE,CAChD,CAAC;gBACF,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACnE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;oBACtE,CAAC,CAAC,QAAQ,CAAC;gBACb,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACzB,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;oBAC9C,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;iBAC1B,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;oBAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;wBAC3B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM;oBAChC,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,WAAW;wBACjB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;qBACxC,CAAC,CAAC;gBACL,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,QACmC,CAAC;oBACtD,IACE,CAAC,EAAE;wBACH,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;wBAC3B,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;wBAE7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;oBACtE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;oBAC1B,MAAM,IAAI,GACR,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ;wBAC9B,CAAC,CAAC,EAAE,CAAC,SAAS;wBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;oBACzC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;oBACnE,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,iBAAiB;wBACvB,KAAK;wBACL,EAAE,EAAE,MAAM,CAAC,EAAgB;wBAC3B,IAAI,EAAE,EAAE,CAAC,IAAI;wBACb,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,WAAW;wBACjB,KAAK;wBACL,KAAK,EAAE;4BACL,IAAI,EAAE,WAAW;4BACjB,EAAE,EAAE,MAAM,CAAC,EAAgB;4BAC3B,IAAI,EAAE,EAAE,CAAC,IAAI;4BACb,SAAS,EAAE,IAAI;yBAChB;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;YACL,KAAK,GAAG,CAAC,IAAI,CACX,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EACpB,KAAK,CAAC,EAAE;gBACN,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAClB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,CACF,CAAC;YACF,IAAI,CAAC;gBACH,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjD,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;KACF;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9B,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,UAAU;gBAAE,OAAO;YACvE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY;gBACnC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBACxC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC1C,IACE,KAAK,CAAC,IAAI,KAAK,mBAAmB;gBAClC,CAAC,MAAM,EAAE,QAAQ;gBACjB,MAAM,KAAK,UAAU;gBAErB,OAAO;YACT,MAAM,IAAI,GAAG,MAAM,CAAC;YACpB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CACnD,CAAC;QACF,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,QAAQ,UAAU,EAAE,EAAe;YAC9C,YAAY,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAkB;QAC5B,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM;YACtC,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC;YAC1B,MAAM,QAAQ,CAAC;YACf,IAAI,QAAQ,KAAK,QAAQ;gBAAE,QAAQ,GAAG,SAAS,CAAC;YAChD,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClE,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACrE,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE;gBAAE,OAAO,EAAE,CAAC;YACrD,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,GAAG,CAAC,QACwC,CAAC;gBACxD,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;oBAC/D,SAAS;gBACX,UAAU,CAAC,GAAG,CACZ,EAAE,CAAC,IAAI,EACP,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,WAAW,EACT,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;oBAC1D,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE;wBACd,oBAAoB,EAAE,IAAI;qBAC3B;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;qBAClE;oBACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;wBACvB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;wBAC7B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;4BAC5B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;4BAChC,OAAO,SAAS,CAAC;wBACnB,CAAC;wBACD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;4BAC7C,MAAM,KAAK,GAAG,GAAG,EAAE;gCACjB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gCAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;4BAC7B,CAAC,CAAC;4BACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;gCAC/B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gCAChD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gCAChC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACjB,CAAC,CAAC;4BACF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,EAAE;gCAClC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gCAChD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gCAChC,MAAM,CAAC,KAAK,CAAC,CAAC;4BAChB,CAAC,CAAC;4BACF,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;gCAC3B,OAAO,EAAE,MAAM;gCACf,MAAM,EAAE,QAAQ;6BACjB,CAAC,CAAC;4BACH,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC/D,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACzD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,GAAG,EAAE;oBACjB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACjC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBACtC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC,CAAC;gBACtE,CAAC,CAAC;gBACF,MAAM,IAAI,GAAS;oBACjB,OAAO;oBACP,QAAQ;oBACR,UAAU;oBACV,OAAO,EAAE,KAAK;oBACd,OAAO;oBACP,MAAM;oBACN,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC;iBAC1D,CAAC;gBACF,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACvC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY;wBAAE,SAAS;oBAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBACrD,IAAI,MAAM;wBAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;;wBACvC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,SAAS,EAAE,EAAE,CAAC;gBACd,wEAAwE;gBACxE,qEAAqE;gBACrE,KAAK,KAAM,CAAC,KAAK;qBACd,QAAQ,EAAE;qBACV,IAAI,CAAC,GAAG,EAAE;oBACT,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ;wBAAE,OAAO;oBACxD,KAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,iBAAiB,CAAC;wBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACxB,OAAO,EAAE;4BACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,EAAE;yBAC7D;qBACF,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC;qBACD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO;YACX,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,CAAC;YACZ,SAAS,EAAE,EAAE,CAAC;YACd,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,EAAE,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/backend/dist/cordis/dsh/workspace-policy.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { FileSystem } from '@deepseek-ai/dsh-fs';
+/**
+ * Check using the filesystem provider's canonical identities, including symlink
+ * ancestors and physical `..` traversal, exactly as its tool implementation does.
+ */
+export declare function assertWorkspaceToolPath(fs: FileSystem, workspacePath: string, cwd: string, requestedPath: string, signal?: AbortSignal): Promise<void>;
+/** Add read confinement to the shipped filesystem backend's mutation policy. */
+export declare function installWorkspaceToolPolicy(ctx: Context, workspacePath: string): void;
+//# sourceMappingURL=workspace-policy.d.ts.map

package/backend/dist/cordis/dsh/workspace-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-policy.d.ts","sourceRoot":"","sources":["../../../src/cordis/dsh/workspace-policy.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAQtD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CASf;AAED,gFAAgF;AAChF,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,aAAa,EAAE,MAAM,GACpB,IAAI,CAyBN"}

package/backend/dist/cordis/dsh/workspace-policy.js

@@ -0,0 +1,44 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const FILESYSTEM_TOOLS = new Set(['read', 'read_image', 'write', 'edit']);
+/**
+ * Check using the filesystem provider's canonical identities, including symlink
+ * ancestors and physical `..` traversal, exactly as its tool implementation does.
+ */
+export async function assertWorkspaceToolPath(fs, workspacePath, cwd, requestedPath, signal) {
+    const root = await fs.resolve(workspacePath, { signal });
+    const directory = await fs.resolve(cwd, { signal });
+    const target = await fs.resolve(requestedPath, { cwd, signal });
+    if (!fs.contains(root, directory) || !fs.contains(root, target)) {
+        throw new Error('Filesystem tools are restricted to the configured Cordis workspace.');
+    }
+}
+/** Add read confinement to the shipped filesystem backend's mutation policy. */
+export function installWorkspaceToolPolicy(ctx, workspacePath) {
+    ctx.on('tools/execute', async (exec, next) => {
+        if (!FILESYSTEM_TOOLS.has(exec.name))
+            return next();
+        const fs = ctx.get('fs');
+        const args = exec.arguments;
+        if (!fs || typeof args?.file_path !== 'string') {
+            throw new Error('A filesystem tool requires a valid path and filesystem provider.');
+        }
+        await assertWorkspaceToolPath(fs, workspacePath, exec.agent?.session.header.cwd ?? workspacePath, args.file_path, exec.signal);
+        return next();
+    });
+}
+//# sourceMappingURL=workspace-policy.js.map

package/backend/dist/cordis/dsh/workspace-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-policy.js","sourceRoot":"","sources":["../../../src/cordis/dsh/workspace-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAc,EACd,aAAqB,EACrB,GAAW,EACX,aAAqB,EACrB,MAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,GAAY,EACZ,aAAqB;IAErB,GAAG,CAAC,EAAE,CACJ,eAAe,EACf,KAAK,EACH,IAA2B,EAC3B,IAAwC,EACxC,EAAE;QACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACpD,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAA2C,CAAC;QAC9D,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,CAC3B,EAAE,EACF,aAAa,EACb,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,aAAa,EAC/C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC"}