mulmoterminal 4.8.4 → 4.9.0

package/README.md

@@ -1365,6 +1365,14 @@ Favorited collections get their own toolbar buttons.
   isn't available yet (Codex writes its rollout only once the turn ends).
 - **Tools pane** — the available GUI tools plus a live tool-call history for the active
   session.
+- **Prompts pane** — the prompts *you* sent the enlarged cell's session, newest first, from
+  `GET /api/transcript/prompts`. The mirror of the Timeline above: that one is what the agent
+  ran, this one is what you asked it for — for when several cells are running and you can no
+  longer remember which one you told what. Read-only; click a long prompt to open it in place.
+  Left open, it keeps up by itself. Claude and Codex; it reads what you TYPED (claude's own
+  prompt history, codex's rollout), so a prompt sent mid-turn is there and text a skill
+  injected is not. A `/clear` draws a line: the pane shows what you have asked *since*, the
+  same way the header, the title and the last reply all stop describing the ended conversation.
 - **Notifications** (🔔) — a toolbar bell with an unread badge and a dropdown of active
   notifications; click a row to jump to its session.
 - **Star MulmoTerminal** — a star button in the grid toolbar that stars the project on GitHub

package/common/promptChannel.ts

@@ -0,0 +1,22 @@
+import { isRecord } from "./isRecord.js";
+
+// The pub/sub channel carrying "the user just submitted a prompt to this session". Both sides
+// decide from it — the server publishes on the hook, the prompts pane listens to know its list
+// grew — so the name and the payload shape live here rather than as a string literal on each side.
+//
+// A channel of its own rather than the `sessions` activity row, which is what a reader would reach
+// for first and which cannot answer this: an activity publish is suppressed when the flag does not
+// MOVE (nextActivity returns null, deliberately, so an unchanged row cannot flood the socket). A
+// prompt sent while the agent is already working leaves `working` true either way, so it publishes
+// nothing — and that prompt, the one interrupting a running turn, is exactly the one the pane
+// exists to show (#1748, found by Codex on #1749).
+export const PROMPT_SUBMITTED_CHANNEL = "prompt-submitted";
+
+/** The session the prompt was typed at — our id, the one a cell holds. */
+export interface PromptSubmittedEvent {
+  sessionId: string;
+}
+
+/** Both sides go through this rather than re-spelling the payload: the publisher pins it with
+ *  `satisfies`, the subscriber narrows an untyped pub/sub frame with it. */
+export const isPromptSubmittedEvent = (data: unknown): data is PromptSubmittedEvent => isRecord(data) && typeof data.sessionId === "string";

package/common/promptHistory.ts

@@ -0,0 +1,19 @@
+// The wire shape of GET /api/transcript/prompts — the prompts the user sent one session (#1748).
+//
+// In `common/` because both sides decide from it: the server builds the window (which log it reads
+// and how it caps is its own business, in server/session/prompt-history.ts), and the pane renders
+// each field. A shape kept twice is the one that drifts.
+
+export interface PromptEntry {
+  /** Epoch ms, or null when the record carried no readable time — a prompt with an odd clock is
+   *  still a prompt, so the TIME is what goes missing rather than the line. */
+  at: number | null;
+  text: string;
+}
+
+export interface PromptWindow {
+  /** Oldest first; the pane reverses for display. */
+  prompts: PromptEntry[];
+  /** Older prompts exist that this does not carry. */
+  truncated: boolean;
+}

package/common/sharedAppPreview.ts

@@ -0,0 +1,159 @@
+// What the preview route sends, decided by BOTH sides.
+//
+// Here rather than in `server/` with a copy in `src/` because that is what this repository's rule
+// says about a wire shape the two ends agree on: a rename or a new field on one side would drift
+// silently until the pane drew nothing, and "nothing drawn" is the failure mode this whole feature
+// exists to remove. The server's own result type extends this with what only it uses.
+//
+// Design: `plans/feat-shared-app-preview.md`.
+import type { Viewer } from "@receptron/sharedapp/view";
+
+/** Who a page was written for. Three audiences, three DOCUMENTS with three sets of rules — never
+ *  one page shown three ways. Reading them as interchangeable is how a page written for the front
+ *  desk gets published to the world. */
+export type PreviewAudience = "public" | "member" | "roster";
+
+/** One page the author can look at. */
+export interface PreviewPage {
+  id: string;
+  html: string;
+  audience: PreviewAudience;
+  /** WHO the author is to this page, and what they may change — the same
+   *  `{ me, can }` mulmoserver posts to the live `/m/` and `/p/`, computed from
+   *  the same projection by the same function.
+   *
+   *  Absent on a public page, which has no reader and no roles: `public.submit`
+   *  is judged from the declaration alone, and a `viewer` there would be an
+   *  answer to a question that page never asks.
+   *
+   *  It comes from the SERVER because the client has neither the projection nor
+   *  the author's verified address. Sending the projection instead and letting
+   *  the pane resolve it would be the second implementation this whole change
+   *  exists to remove. */
+  viewer?: Viewer;
+}
+
+export type PreviewDataset = Record<string, unknown>[];
+
+/** The records ONE page is handed, per collection.
+ *
+ *  Per page rather than one map for the app, and that is the point rather than tidiness: a member
+ *  page may name a collection `public.read` does not open, so a single map is either missing those
+ *  records on the member page or handing them to the public one. The second is worse — it would
+ *  show the author a public page drawing private data, which is the preview being LOOSER than
+ *  production, the one thing it must never be. */
+export type PreviewDatasets = Record<string, Record<string, PreviewDataset>>;
+
+/** The key a page's datasets sit under. Audience-qualified because a view id is unique within its
+ *  tier and not across them. */
+export const previewPageKey = (audience: PreviewAudience, id: string): string => `${audience}:${id}`;
+
+/** One input of a GENERATED public form — an app that declares `public.submit` and publishes no
+ *  page of its own.
+ *
+ *  Already reduced to what a visitor may fill in: `createFields` minus the address (compared to
+ *  their token) and minus the status (pinned to `initialStatus`), in the order the declaration
+ *  lists them. The reduction happens on the SERVER, through the same `writableFields` the published
+ *  site's submit path uses, so the pane draws boxes rather than deciding which boxes exist. */
+export interface PreviewFormField {
+  name: string;
+  label: string;
+  required: boolean;
+  /** The schema's type, so a `enum` draws a select and a `text` draws a textarea. A pane that drew
+   *  every field as a text box would let the author submit values the real form could not produce. */
+  type: string;
+  /** An `enum`'s choices, which travel with it for the same reason they travel to the public page:
+   *  a visitor cannot read the schema. */
+  values?: string[];
+}
+
+/** The generated form, per collection. Empty for an app that publishes a page of its own. */
+export type PreviewForm = Record<string, PreviewFormField[]>;
+
+export interface SharedAppPreview {
+  aid: string;
+  /** What a public create may carry, per collection, exactly as the published config declares it.
+   *
+   *  Carried to the browser because the PARENT judges a submission against it — an unknown cid, a
+   *  value that is not a string, a field outside `createFields` — and those three judgements are
+   *  most of what a preview is for. Handing the parent an empty map instead does not disable the
+   *  check; it makes the check REFUSE EVERYTHING, and it refuses with `unknown-collection`, which
+   *  reads as "your declaration is wrong" about a declaration that is fine. That shipped once
+   *  (2026-08-14) and cost an author a debugging session pointed at the wrong repository. */
+  submit: Record<string, { createFields: string[] }>;
+  /** Every page this publish would put live, public first. */
+  pages: PreviewPage[];
+  /** Whether this publish would leave the app open to anonymous visitors. False is normal: an app
+   *  with no `public` block is one only its roster ever sees. */
+  publicOpen: boolean;
+  /** Whether there was a live `apps/{aid}` to project from. Said out loud because the projection
+   *  DEPENDS on it — keys publish does not own are carried forward from the live document, so a
+   *  preview computed without one is the projection of a FIRST publish, not of the next one. */
+  fromLiveApp: boolean;
+  /** The app publishes a GENERATED form rather than a page of its own.
+   *
+   *  Carried as a fact rather than left to be inferred from an empty `pages`: those two states put
+   *  the same empty frame on screen and mean opposite things — "there is nothing to draw" against
+   *  "there is something to draw and this pane cannot draw it yet". */
+  generatedForm: boolean;
+  /** The inputs of that generated form. Carried rather than left to the pane to derive: the pane
+   *  cannot read the schema either, and a form it built from field NAMES alone would ask for
+   *  different things than the published site does — a preview of nothing real. */
+  formInputs: PreviewForm;
+  datasets: PreviewDatasets;
+  /** Collections a page names but whose records could not be read. Reported rather than silently
+   *  empty: "no bookings yet" and "the read was refused" put identical pixels on the screen. */
+  unreadable: string[];
+  /** Pages that will go out but are worth looking at first — see `viewWarnings`. */
+  warnings: string[];
+}
+
+/** The route's answer. Three shapes, and only one of them is a failure:
+ *
+ *  - not declared — most directories are not shared apps, and the pane asks about whichever one a
+ *    cell is open in. An error would make normal operation look like a fault.
+ *  - declared and refused — the author's work in progress, and the reason the pane exists. These
+ *    lines are the answer to the question asked; a status code could not carry them.
+ *  - declared and computed. */
+/** What the author accepted in the confirmation, on its way to the server. */
+export interface PreviewSubmission {
+  cid: string;
+  /** Strings only. The rules compare stored values without coercing, so a number here would write a
+   *  record that differs BY TYPE from the identical-looking one the published page writes. */
+  values: Record<string, string>;
+}
+
+/** One record a preview wrote, and the mirror that travelled with it.
+ *
+ *  Both ends hold this: the server returns it, the pane remembers it, and the pane hands it back to
+ *  have it removed. It is the ONLY place a preview's writes are known — the rules read a public
+ *  create with `hasOnly(createFields)`, so nothing can mark the document itself. */
+export interface PreviewWrittenRecord {
+  cid: string;
+  id: string;
+  mirror?: { cid: string; id: string } | undefined;
+  /** The ONLY thing undo accepts, and the reason it is here rather than the record above.
+   *
+   *  Undo runs through the author's own Firestore handle, so a route that took a cid and an id
+   *  would take ANY cid and id in the app: a caller reaching this server could delete a stranger's
+   *  real booking and put the slot it was holding back to `open`, and every write would be
+   *  perfectly authorized. The cid and the id are still carried, because the author has to be able
+   *  to read what this preview wrote — but they are for the SCREEN. What the server acts on is a
+   *  token it minted itself when it made the write, held in memory and mapped to that exact record.
+   *
+   *  In memory, for the lifetime of the process, which is the same lifetime as the list on screen:
+   *  neither survives a restart, and a preview's writes become ordinary records when it ends. */
+  token: string;
+}
+
+/** A write whose outcome is unknown: the request threw after the server may already have written.
+ *
+ *  Kept because the alternative is worse. Dropping it leaves a real record in the app that nothing
+ *  on this screen can name, so the author cannot remove what they cannot see. */
+export interface PreviewUncertainWrite {
+  cid: string;
+  uncertain: true;
+}
+
+export type SharedAppPreviewResponse =
+  { declared: false } | { declared: true; ok: false; problems: string[] } | { declared: true; ok: true; preview: SharedAppPreview };

package/common/sharedAppViewVocabulary.ts

@@ -0,0 +1,83 @@
+// What the parent's own words MEAN, in one place, for everything that explains a view to its author.
+//
+// Two things say these sentences now and they must not say them differently: the headless run an
+// agent starts (`server/backends/sharedApp/headlessReport.ts`) and the log an author copies out of
+// the Collections pane (`src/utils/sharedAppPreviewLog.ts`). Both are read by the same reader —
+// often a language model, sometimes the person — about the same page, and the two arriving in
+// different vocabularies would make an author reconcile two accounts of one failure before they
+// could start on the failure.
+//
+// In `common/` because that is what the rule says (CLAUDE.md): a value BOTH sides decide from lives
+// here rather than mirrored with a comment asking somebody to keep two copies in step.
+//
+// These are the explanations. What each host does with them — a per-page report, a timeline — is
+// its own, and stays there.
+import type { ViewNoticeCode } from "@receptron/sharedapp/view";
+import type { PreviewAudience } from "./sharedAppPreview.js";
+
+/** What the parent's refusals mean.
+ *
+ *  None of these ever reaches a screen: they are answered on the port, into a promise the page
+ *  usually does not await. So this is the only place an author can learn that the page asked for
+ *  something the declaration does not allow — and the page, meanwhile, showed whatever it shows
+ *  when nothing comes back. */
+export const REFUSALS: Record<string, string> = {
+  "unknown-collection": "the page submitted to a collection this app's `public.submit` does not declare",
+  "undeclared-field": "the page sent a field that is not in that collection's `createFields`",
+  "not-a-submission":
+    "the message was not a submission at all — most often a value that is not a string (the rules compare stored values without coercing, so only strings may be sent)",
+  busy: "a confirmation was already open (the page submitted twice)",
+  cancelled: "the confirmation was declined",
+};
+
+/** What a member or participant page is told when it asks for a write.
+ *
+ *  `transition`, `assign` and `withdraw` reach the member parent, which judges them and would
+ *  perform them on the live page — here it has nowhere to write, so it answers `read-only`. That
+ *  is a GOOD outcome and has to read like one: the ask arrived, in the right shape, and was
+ *  declined for the reason every preview declines a write.
+ *
+ *  It replaced a longer note saying the parent answering intents "is not the one running here",
+ *  which was true while the preview had only the public bridge and is not any more. */
+export const READ_ONLY_ON_A_MEMBER_PAGE =
+  "the preview does not write, so it declined. The ask itself was well formed and reached the parent — this line means the control is wired, not that anything is wrong. " +
+  "Whether the deployed rules would accept the write is a different question and is not answered here.";
+
+/** One refusal, in the words that fit the page it happened on. */
+export const explainRefusal = (reason: string, audience: PreviewAudience): string => {
+  if (reason === "read-only" && audience !== "public") return READ_ONLY_ON_A_MEMBER_PAGE;
+  return REFUSALS[reason] ?? reason;
+};
+
+/** What a page that never answered the handshake is doing, and the one thing that causes it. */
+export const READY_DEADLOCK =
+  "It NEVER answered the handshake, so the parent sent it no records at all — this is the page that sits on its loading state forever. " +
+  "`ready()` has to be called OUTSIDE the `onState` callback: inside it, it can never run, because the parent sends no state until `ready` arrives.";
+
+/** Why a `<form>` is a dead control here, in the words of what the browser actually does. */
+export const FORM_BLOCKED =
+  "A form cannot submit here: the frame is sandboxed without `allow-forms`, and the browser blocks the submission BEFORE firing the `submit` event — so an " +
+  '`onsubmit` handler with `e.preventDefault()` as its first line never runs. Use a `<div>` with a `type="button"` button and a click handler.';
+
+/** What the frame reported about ITSELF, and what to do about each.
+ *
+ *  The codes come from `@receptron/sharedapp/view`, which normalises anything it does not know to
+ *  `unknown` — so this map is over a closed set and an entry that goes missing is a type error
+ *  rather than a code printed raw. */
+export const NOTICES: Record<ViewNoticeCode, string> = {
+  error: "the page raised an error nothing caught. Everything after the throw did not run, which is usually why the screen stopped where it did",
+  "unhandled-rejection": "a promise the page made was rejected and nothing handled it. Most often an `await` on a request that was refused",
+  "modal-ignored":
+    "the page called a modal the sandbox IGNORES. `alert`, `confirm` and `prompt` do nothing here and do nothing on the published page either — `confirm` answers " +
+    "false, so the page carries on as though the visitor had said no. Ask with an `<input>`, say things in the page, and confirm by pressing twice",
+  "notices-dropped":
+    "the page reported more of the above than this runtime carries, and the rest were not sent. The ones above are the earliest, which are usually the cause",
+  unknown: "the page reported something under a name this host does not know. The name itself is not repeated here — it is a string the page chose",
+};
+
+/** Page-controlled text, put into a report so it cannot be mistaken for the report's own words.
+ *
+ *  `JSON.stringify` rather than a pair of quotes: a label reading `Save "draft"` or a screen with a
+ *  newline in it would otherwise end a quotation early, and the reader — frequently a model being
+ *  asked what went wrong — cannot tell a quotation mark the page wrote from one a host did. */
+export const quoteForReport = (text: string): string => JSON.stringify(text);

package/dist/assets/{abnfDiagram-N423BO3Z-D0pzqjdS-Ddm0Lrd5.js → abnfDiagram-N423BO3Z-D0pzqjdS-tsokipTX.js}

@@ -1 +1 @@
-import{n as e}from"./chunk-Y2CYZVJY-Bdt8pFDJ-DsF7k-Jl.js";import{f as t}from"./src-CvsWqFln-Tc7ZSrRz.js";import{_ as n,g as r}from"./mermaid-parser.core-C1baW7NG-DDDjJ3Iw.js";import"./chunk-I66GZJ75-DSPCVCny-l2HSjV-d.js";import"./chunk-3NCLNEKW-CBztX243-CjPSYONl.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-Cx8nz5_t-B32v5SJA.js";import{t as s}from"./chunk-JWPE2WC7-BQ3zXr2k-DSd3Ct95.js";var c=r().RailroadAbnf.parser.LangiumParser,l=e(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=e(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=e(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=e(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=e(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=e(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=e(e=>{s(e,a),e.title&&a.setTitle(e.title),e.rules.map(e=>a.addRule(m(e)))},`populateDb`),g={parser:{parse:e(e=>{a.clear(),t.debug(`[ABNF Parser] Starting Langium parse`);let r=c.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new n(r);let i=r.value;t.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),t.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:a}},db:a,renderer:o,styles:i};export{g as diagram};
+import{n as e}from"./chunk-Y2CYZVJY-Bdt8pFDJ-DsF7k-Jl.js";import{f as t}from"./src-CvsWqFln-Tc7ZSrRz.js";import{_ as n,g as r}from"./mermaid-parser.core-C1baW7NG-BzDlu5Ub.js";import"./chunk-I66GZJ75-DSPCVCny-CcYhEHb5.js";import"./chunk-3NCLNEKW-CBztX243-DSaECkf1.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-Cx8nz5_t-CzxkXkeW.js";import{t as s}from"./chunk-JWPE2WC7-BQ3zXr2k-DSd3Ct95.js";var c=r().RailroadAbnf.parser.LangiumParser,l=e(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=e(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=e(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=e(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=e(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=e(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=e(e=>{s(e,a),e.title&&a.setTitle(e.title),e.rules.map(e=>a.addRule(m(e)))},`populateDb`),g={parser:{parse:e(e=>{a.clear(),t.debug(`[ABNF Parser] Starting Langium parse`);let r=c.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new n(r);let i=r.value;t.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),t.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:a}},db:a,renderer:o,styles:i};export{g as diagram};

package/dist/assets/architecture-TIHT7OUA-Cqhmai3f-B3dDUaH7.js

@@ -0,0 +1 @@
+import{f as e}from"./mermaid-parser.core-C1baW7NG-BzDlu5Ub.js";export{e as createArchitectureServices};