pi-roundtable-web 0.27.0 → 0.28.0

package/src/connector-manage-api.ts

@@ -0,0 +1,257 @@
+import type { Logger } from "pi-roundtable";
+import type {
+	ConnectorAddedView,
+	ManagedConnectorView,
+	McpAuthorizeInput,
+	McpChannelView,
+	McpGrantsView,
+	McpUrlView,
+} from "./api-types.ts";
+import type {
+	ConnectorManagement,
+	ConsoleActor,
+	ManagedConnector,
+	McpGrants,
+} from "./features.ts";
+import { ConsoleHttpError as HttpError, json } from "./http.ts";
+
+/** What the routes below `connectors/` need besides the ports. */
+export interface ManageContext {
+	logger: Logger;
+	actor: ConsoleActor;
+	/** Reads the request's JSON body, or undefined when it is not JSON. */
+	body(): Promise<unknown>;
+	/** Tells the open pages that something changed. */
+	changed(): void;
+}
+
+const CONNECTORS_DOWN =
+	"The connector service did not respond. Try again later.";
+const GRANTS_DOWN =
+	"The MCP authorization service did not respond. Try again later.";
+
+/**
+ * Scheme and host only: some servers take their credential in the path, query, or user part.
+ * Undefined for a URL that cannot be parsed.
+ */
+export function displayUrl(url: string): string | undefined {
+	const parsed = URL.parse(url);
+	if (!parsed) return undefined;
+	const hidden =
+		parsed.pathname !== "/" ||
+		parsed.search ||
+		parsed.hash ||
+		parsed.username ||
+		parsed.password;
+	return `${parsed.origin}${hidden ? "/…" : ""}`;
+}
+
+/** Only the fields the page shows, so nothing else the port's object holds can reach a response. */
+function connectorView(connector: ManagedConnector): ManagedConnectorView {
+	const shown = displayUrl(connector.url);
+	return {
+		name: connector.name,
+		...(shown ? { displayUrl: shown } : {}),
+		description: connector.description,
+		...(connector.server ? { tools: connector.server.tools.length } : {}),
+	};
+}
+
+/**
+ * A port's refusal reaches the owner as its message, already in the host's wording; anything
+ * else is logged without the request and answered as the service being down.
+ */
+async function guarded<T>(
+	context: ManageContext,
+	service: "connectors" | "grants",
+	call: () => Promise<T> | T,
+): Promise<T> {
+	try {
+		return await call();
+	} catch (error) {
+		if (error instanceof HttpError) throw error;
+		if (
+			error instanceof Error &&
+			(error as { refusal?: unknown }).refusal === true
+		)
+			throw new HttpError(400, error.message);
+		context.logger.error({ err: error }, "connector management failed");
+		if (service === "grants") throw new HttpError(502, GRANTS_DOWN);
+		throw new HttpError(502, CONNECTORS_DOWN);
+	}
+}
+
+const optional = (value: unknown, max: number): string | undefined => {
+	if (value === undefined || value === null || value === "") return undefined;
+	if (typeof value !== "string" || value.length > max)
+		throw new HttpError(400, "The body is not valid.");
+	return value;
+};
+
+const required = (value: unknown, max: number): string => {
+	if (typeof value !== "string" || value.length > max)
+		throw new HttpError(400, "The body is not valid.");
+	return value;
+};
+
+async function objectBody(
+	context: ManageContext,
+): Promise<Record<string, unknown>> {
+	const body = await context.body();
+	if (typeof body !== "object" || body === null || Array.isArray(body))
+		throw new HttpError(400, "The body is not valid.");
+	return body as Record<string, unknown>;
+}
+
+/** `connectors/managed[/<name>]`: list, add, change the purpose of, and remove connectors. */
+export async function connectorRoutes(
+	manage: ConnectorManagement,
+	method: string,
+	name: string | undefined,
+	context: ManageContext,
+): Promise<Response> {
+	if (!name && method === "GET") {
+		const list = await guarded(context, "connectors", () => manage.list());
+		return json(list.map((c) => connectorView(c)));
+	}
+	if (!name && method === "POST") {
+		const body = await objectBody(context);
+		const header = optional(body.header, 100);
+		const token = optional(body.token, 4000);
+		const input = {
+			name: required(body.name, 100),
+			url: required(body.url, 2000),
+			description: required(body.description, 1000),
+			...(header ? { header } : {}),
+			...(token ? { token } : {}),
+		};
+		const added = await guarded(context, "connectors", () => manage.add(input));
+		context.changed();
+		return json(
+			{
+				connector: connectorView(added.connector),
+				skipped: [...added.skipped],
+			} satisfies ConnectorAddedView,
+			201,
+		);
+	}
+	if (name && method === "PATCH") {
+		const description = required((await objectBody(context)).description, 1000);
+		await guarded(context, "connectors", () =>
+			manage.describe(name, description),
+		);
+		context.changed();
+		return json({ name });
+	}
+	if (name && method === "DELETE") {
+		await guarded(context, "connectors", () => manage.remove(name));
+		context.changed();
+		return json({ removed: name });
+	}
+	throw new HttpError(405, "This method is not supported.");
+}
+
+/**
+ * `connectors/grants…`: the bundles with their channels (`GET`), the channels to pick (`GET
+ * channels`), authorize (`POST`), describe (`PATCH <bundle>/<channel>`), revoke (`DELETE
+ * <bundle>/<channel>`) and rotate (`POST <bundle>/rotate`).
+ */
+export async function grantRoutes(
+	grants: McpGrants,
+	method: string,
+	rest: readonly string[],
+	context: ManageContext,
+): Promise<Response> {
+	const [first, second] = rest;
+	if (rest.length === 0 && method === "GET") {
+		const bundles = await guarded(context, "grants", () => grants.bundles());
+		return json({
+			operations: grants.operations.map((o) => ({ id: o.id, label: o.label })),
+			bundles: bundles.map((bundle) => ({
+				name: bundle.name,
+				grants: bundle.grants.map((g) => ({
+					channelId: g.channelId,
+					guildName: g.guildName,
+					channelName: g.channelName,
+					visible: g.visible,
+					displayName: g.displayName,
+					description: g.description,
+					operations: [...g.operations],
+					authorizedAt: g.authorizedAt.toISOString(),
+					audit: g.audit.map((a) => ({
+						tool: a.tool,
+						status: a.status,
+						at: a.createdAt.toISOString(),
+					})),
+				})),
+			})),
+		} satisfies McpGrantsView);
+	}
+	if (rest.length === 1 && first === "channels" && method === "GET") {
+		const channels = await guarded(context, "grants", () =>
+			grants.channels(context.actor),
+		);
+		return json(
+			channels.map(
+				(c): McpChannelView => ({ id: c.id, name: c.name, guild: c.guild }),
+			),
+		);
+	}
+	if (rest.length === 0 && method === "POST") {
+		const body = await objectBody(context);
+		if (
+			!Array.isArray(body.operations) ||
+			body.operations.some((op) => typeof op !== "string")
+		)
+			throw new HttpError(400, "The body is not valid.");
+		const displayName = optional(body.displayName, 100);
+		const description = optional(body.description, 1000);
+		const input: McpAuthorizeInput = {
+			bundle: required(body.bundle, 200),
+			channelId: required(body.channelId, 40),
+			operations: body.operations as string[],
+			...(displayName ? { displayName } : {}),
+			...(description ? { description } : {}),
+		};
+		const done = await guarded(context, "grants", () =>
+			grants.authorize(input, context.actor),
+		);
+		context.changed();
+		return json(
+			{
+				bundle: done.bundle,
+				...(done.url ? { url: done.url } : {}),
+			} satisfies McpUrlView,
+			201,
+		);
+	}
+	if (rest.length === 2 && first && second === "rotate" && method === "POST") {
+		const { url } = await guarded(context, "grants", () =>
+			grants.rotate(first),
+		);
+		context.changed();
+		return json({ bundle: first, url } satisfies McpUrlView);
+	}
+	if (rest.length === 2 && first && second && method === "PATCH") {
+		const body = await objectBody(context);
+		const displayName = optional(body.displayName, 100);
+		const description =
+			body.description === undefined
+				? undefined
+				: required(body.description, 1000);
+		await guarded(context, "grants", () =>
+			grants.describe(first, second, {
+				...(displayName === undefined ? {} : { displayName }),
+				...(description === undefined ? {} : { description }),
+			}),
+		);
+		context.changed();
+		return json({ bundle: first, channelId: second });
+	}
+	if (rest.length === 2 && first && second && method === "DELETE") {
+		await guarded(context, "grants", () => grants.revoke(first, second));
+		context.changed();
+		return json({ bundle: first, channelId: second });
+	}
+	throw new HttpError(405, "This method is not supported.");
+}

package/src/console-api.ts

@@ -11,7 +11,13 @@ import type {
 	SpeakerMemory,
 	Tier,
 } from "pi-roundtable";
-import { MemoryError, parseChannelKey, SYSTEM_PRINCIPAL } from "pi-roundtable";
+import {
+	agentRoomKey,
+	groupRoomKey,
+	MemoryError,
+	parseChannelKey,
+	SYSTEM_PRINCIPAL,
+} from "pi-roundtable";
 import { thinkingLabel } from "pi-roundtable/kit";
 import type {
 	ApiError,
@@ -85,6 +91,11 @@ export interface ConsolePorts {
 	sessionsDir: string;
 	/** Present when the overview pane is served, or the agent server is there to classify channels. */
 	team?: Pick<AgentTeam, "status" | "owns" | "guildId">;
+	/**
+	 * The web app's surface, when it hosts the agents' and groups' rooms: the overview then names
+	 * each one's room, which its start-over resets instead of the Discord channel's conversation.
+	 */
+	roomSurface?: string;
 	queue: Pick<QueuePort, "size">;
 	/** Undefined when Discord no longer knows the channel; throws when it cannot be asked. */
 	channelName?: (channelId: string) => Promise<ChannelName | undefined>;
@@ -114,6 +125,7 @@ export interface ConsolePorts {
 }
 
 import { cleanupConversation } from "./cleanup-api.ts";
+import { connectorRoutes, grantRoutes } from "./connector-manage-api.ts";
 import { connectorsView } from "./connectors-api.ts";
 import { ConsoleHttpError as HttpError, json } from "./http.ts";
 import { readLimited } from "./request-body.ts";
@@ -256,6 +268,12 @@ export class ConsoleApi {
 			if (!connectors) throw new HttpError(404, "This pane is not served.");
 			return json(await connectorsView(connectors));
 		}
+		if (
+			head === "connectors" &&
+			(id === "managed" || id === "grants") &&
+			parts.length >= 2
+		)
+			return this.#manage(request, parts.slice(1), visitor);
 		if (head === "notes" && parts.length <= 2) {
 			this.#pane("notes", visitor);
 			return this.#notes(request, id, visitor);
@@ -267,6 +285,35 @@ export class ConsoleApi {
 		throw new HttpError(404, "There is no such API.");
 	}
 
+	/** Connector and MCP authorization management: the owners' alone, whatever panes another tier has. */
+	async #manage(
+		request: Request,
+		parts: string[],
+		visitor: Visitor,
+	): Promise<Response> {
+		this.#pane("connectors", visitor);
+		if (visitor.tier !== "owner")
+			throw new HttpError(403, "Only an owner may do this.");
+		const [area, ...rest] = parts;
+		const { features, logger } = this.#ports;
+		const context = {
+			logger,
+			actor: {
+				principalId: visitor.principal.id,
+				speakerId: visitor.speakerId,
+			},
+			body: () => readBody(request),
+			changed: () => this.#ports.changed(),
+		};
+		const manage = features?.connectors?.manage;
+		if (area === "managed" && manage && rest.length <= 1)
+			return connectorRoutes(manage, request.method, rest[0], context);
+		const grants = features?.mcpGrants;
+		if (area === "grants" && grants && rest.length <= 2)
+			return grantRoutes(grants, request.method, rest, context);
+		throw new HttpError(404, "There is no such API.");
+	}
+
 	/**
 	 * The page's config for a visitor: the owners' view as it was, and for another tier the panes
 	 * of that tier. Where the app admits more than its owners it also says the visitor's tier, the
@@ -313,6 +360,15 @@ export class ConsoleApi {
 			...(presentation?.messages ? { messages: presentation.messages } : {}),
 			...(features?.cleanup ? { cleanup: true } : {}),
 			...(connectorAdminUrl ? { connectorAdminUrl } : {}),
+			...(features?.connectors || features?.mcpGrants
+				? {
+						connectorParts: {
+							...(features.connectors ? { gateways: true as const } : {}),
+							...(features.connectors?.manage ? { manage: true as const } : {}),
+							...(features.mcpGrants ? { grants: true as const } : {}),
+						},
+					}
+				: {}),
 			look: this.#ports.look ?? "modern",
 			...(this.#ports.characterSkins
 				? { characterSkins: [...this.#ports.characterSkins] }
@@ -328,7 +384,7 @@ export class ConsoleApi {
 		const { team } = this.#ports;
 		if (!team) throw new HttpError(404, "This pane is not served.");
 		const status = await team.status();
-		const { features } = this.#ports;
+		const { features, roomSurface } = this.#ports;
 		const stored = (await this.conversations()).conversations.filter(
 			(c) => c.kind === "owner" || c.kind === "outside",
 		);
@@ -350,6 +406,7 @@ export class ConsoleApi {
 				name: agent.name,
 				displayName: agent.displayName,
 				...(agent.channelId ? { channelId: agent.channelId } : {}),
+				...(roomSurface ? { room: agentRoomKey(roomSurface, agent.name) } : {}),
 				model: agent.model,
 				thinking: thinkingLabel(agent.thinking),
 				...(agent.workingIn ? { workingIn: agent.workingIn } : {}),
@@ -363,6 +420,7 @@ export class ConsoleApi {
 				displayName: group.displayName,
 				// A group of a team without Discord has no channel; the pane then links none.
 				...(group.channelId ? { channelId: group.channelId } : {}),
+				...(roomSurface ? { room: groupRoomKey(roomSurface, group.name) } : {}),
 				members: group.members,
 				host: group.host,
 				busy: group.busy,

package/src/features.ts

@@ -35,7 +35,98 @@ export interface ConsoleFeatures {
 		usedBy(server: string): string[];
 		/** Optional administrator link, limited to HTTP(S) or an absolute local path. */
 		adminUrl?: string;
+		/** The owner's connectors, managed from the page; pi-roundtable-mcp's `CONNECTORS` fits it. */
+		manage?: ConnectorManagement;
 	};
+	/** Which channels outside agents may use through a bundle's MCP URL; absent hides the section. */
+	mcpGrants?: McpGrants;
+}
+
+/**
+ * One connector. `url` may hold a credential in its path or query, so the console shows only its
+ * scheme and host.
+ */
+export interface ManagedConnector {
+	name: string;
+	url: string;
+	description: string;
+	/** Its virtual server; absent when its tools could not be read. */
+	server?: { tools: readonly string[] } | undefined;
+}
+
+/**
+ * Connector management. A rejection whose error carries `refusal: true` is shown to the owner as
+ * its message; any other is logged and answered as the service being unavailable.
+ */
+export interface ConnectorManagement {
+	list(): readonly ManagedConnector[] | Promise<readonly ManagedConnector[]>;
+	/** `token` is write-only: the console never returns or logs it. */
+	add(input: {
+		name: string;
+		url: string;
+		description: string;
+		header?: string;
+		token?: string;
+	}): Promise<{ connector: ManagedConnector; skipped: readonly string[] }>;
+	describe(name: string, description: string): Promise<unknown>;
+	remove(name: string): Promise<void>;
+}
+
+/** The owner acting through the console, for a host that maps them to their Discord identity. */
+export interface ConsoleActor {
+	principalId: string;
+	/** The identity they spoke as, `<provider>:<subject>`. */
+	speakerId: string;
+}
+
+export interface McpGrantChannel {
+	channelId: string;
+	guildName: string;
+	channelName: string;
+	/** False when the bot cannot see the channel now. */
+	visible: boolean;
+	/** The name and purpose an agent sees. */
+	displayName: string;
+	description: string;
+	operations: readonly string[];
+	authorizedAt: Date;
+	audit: readonly { tool: string; status: string; createdAt: Date }[];
+}
+
+/**
+ * The owner's MCP bundles, as `/<root> mcp` manages them; pi-roundtable-mcp's `REMOTE_MCP` fits
+ * it once the host closes over its Discord client and supplies the channels and the actor's
+ * Discord ID. Refusals follow `ConnectorManagement`'s rule.
+ */
+export interface McpGrants {
+	/** Every operation a grant may allow, in order. */
+	operations: readonly { id: string; label: string }[];
+	bundles(): Promise<
+		readonly { name: string; grants: readonly McpGrantChannel[] }[]
+	>;
+	/** The channels the owner may pick to authorize. */
+	channels(
+		actor: ConsoleActor,
+	): Promise<readonly { id: string; name: string; guild: string }[]>;
+	revoke(bundle: string, channelId: string): Promise<void>;
+	describe(
+		bundle: string,
+		channelId: string,
+		change: { displayName?: string; description?: string },
+	): Promise<void>;
+	/** The new URL, returned this once. */
+	rotate(bundle: string): Promise<{ url: string }>;
+	/** Adds a channel to a bundle, creating it when new; a new bundle's URL is returned this once. */
+	authorize(
+		input: {
+			bundle: string;
+			channelId: string;
+			operations: readonly string[];
+			displayName?: string;
+			description?: string;
+		},
+		actor: ConsoleActor,
+	): Promise<{ bundle: string; url?: string | undefined }>;
 }
 
 /** English source strings are keys; a host supplies its own wording without a page fork. */

package/src/host/reads.ts

@@ -1,5 +1,6 @@
 import type { SQL } from "bun";
 import type { Migration } from "pi-roundtable";
+import { START_OVER_TEXT } from "../api-types.ts";
 
 /** Where one person has read a room up to. */
 export interface ReadMark {
@@ -29,7 +30,8 @@ interface MarkRow {
  * The read cursors, one per person and room, kept in `web_room_reads`. A cursor only moves
  * forward: reading an older message again, or a second device that is behind, changes nothing.
  * A message counts as unread for a person when it is newer than their cursor and is not a line the
- * server wrote (a divider, a yolo approval), which is nobody's to read.
+ * server wrote (a divider, a yolo approval), which is nobody's to read, nor older than the room's
+ * latest start-over.
  */
 export class RoomReads {
 	readonly #sql: SQL;
@@ -187,13 +189,20 @@ export class RoomReads {
 					INSERT INTO web_room_reads ${this.#sql(empty)}
 					ON CONFLICT (room, principal_id) DO NOTHING`;
 		}
+		// What a start-over archived is out of the room's view, so none of it is left to read.
 		const rows: { room: string; unread: string | number | bigint }[] =
 			await this.#sql`
+			WITH starts AS (
+				SELECT room, max(id) AS id FROM web_room_messages
+				WHERE room IN ${this.#sql(rooms)} AND kind = 'system' AND text = ${START_OVER_TEXT}
+				GROUP BY room)
 			SELECT m.room, count(*) AS unread
 			FROM web_room_messages m
 			LEFT JOIN web_room_reads r ON r.room = m.room AND r.principal_id = ${principalId}
+			LEFT JOIN starts s ON s.room = m.room
 			WHERE m.room IN ${this.#sql(rooms)} AND m.kind <> 'system'
 				AND m.id > COALESCE(r.last_read_id, 0)
+				AND m.id > COALESCE(s.id, 0)
 			GROUP BY m.room`;
 		for (const row of rows) counts.set(row.room, Number(row.unread));
 		return counts;