pi-roundtable 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -5,6 +5,33 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.26.0] - 2026-10-30
+
+### Added
+
+- `IdentityService.peek(facts, { conversation }?)`: who these facts resolve to now, read only. It never links, claims, admits, records the person as seen or touches a tier, also when it refuses, and its tier is exactly what `resolve` gives (the lasting roles together with what the access rules give the facts), never the tier last recorded. It answers undefined for an unlinked identity, a disabled principal, or no tier. **Breaking** for code: a hand-built `IdentityService` stand-in adds `peek` (`testHost` and `servicePair` already cover tests).
+- `ActorFacts.partial`: a surface that is not the authority on a person's roles marks its facts `partial: true`, and `resolve` records no lower tier and no refusal from them. Optional, not breaking.
+- `PROFILES` (`PersonProfiles`), provided by the `identity` plugin: how the core names a person (D1, D3). A plugin registers a `ProfileSource` per provider (`provider`, `label`, `modelVisible`, `pictureHosts`, `fetch(subject, signal)`); a signed-in session reports the name its identity provider gave with `observed(principalId, provider, name)`; the person chooses which linked account represents them with `choose` (refused for an unlinked provider; `null` returns to the default), else the first provider in the new `profiles.prefer` they have linked; `of(principalId)` gives the name, the source and whether a picture exists, and `picture(principalId)` the picture through the source's allowed hosts only (https, no redirect, PNG/JPEG/GIF/WebP, at most 2 MiB, `nosniff`). Fetched and observed names and picture addresses live in memory for an hour at most and are written to no table; a fetch has two seconds and a miss, failure or timeout is remembered for ten minutes. Only the choice is stored, in the new `principal_profile_choices` table (migration `principal-profile-choices`, additive). Types: `ProfileSource`, `PersonProfiles`, `PersonDisplay`, `ProfileRules`, `ProfilesConfig`.
+- **Breaking** for a host that replaces the `identity` plugin: it now provides `PROFILES` too, so a replacement lists `PROFILES` in `provides` and `replaces`, as it already does for `IDENTITY_LINKS`.
+- `profiles.modelVisible` and `profiles.prefer` in the host's configuration. `Speaker.name` from `IDENTITY.resolve`, `peek` and `speakerFor` becomes the profile name for a provider the host lists in `profiles.modelVisible`; a source's own `modelVisible` flag never widens it. With no source, nothing observed and an empty list, every name is as in 0.25. **Breaking** only for a host that lists a provider: its agents then read that name.
+- `pi-roundtable-line`: `lineProfileSource(api)`, a `ProfileSource` for provider `line` over LINE's `/v2/bot/profile/{userId}`, with the picture hosts `profile.line-scdn.net` and `obs.line-scdn.net` and `modelVisible: false`.
+- `roundtable principal show` prints the profile source a person chose.
+- `pi-roundtable/kit`: `oidcProvider` (`oidcProvider(issuer)`) and `oidcIdentity` (`oidcIdentity(issuer, subject)`), the one writer of `oidc:<base64url issuer>[:<subject>]`. `oidcSpeakerId` of `pi-roundtable-webchat` gives the same strings through it.
+- `agentServer: { tools: "chat-only" }` (config), `HostEnv.agentTools` and `ResolvedConfig.agentTools` (`"full"` by default, `AgentTools`): the configuration form and the value plugins read as `context.env.agentTools`. `RoundtableOptions.environment.agentTools` carries it for hosts that build their options by hand. With it no agent or persona turn is offered `bash`, `read`, `edit` or `write`: the agent team's selection leaves them out, the agent's prompt says it has no shell, file tools or workspace, its sessions get no workspace, and `SessionFactory` refuses any selection naming one of them (`toolsFor`, `taskTools`) with a `ConfigError`, so the turn fails closed and is logged, whatever built the selection. `RoundtablePlugin.hostAccess?: true` marks a plugin whose tools reach the host (`pi-roundtable-coding` declares it): a chat-only host does not start with one, nor with a plugin whose `agentSelection` names a shell tool, and `pi-roundtable-webchat` refuses a persona `selection` that does. `roundtable doctor` gains an `agent tools` check that prints the mode. A host without the key behaves as before. See [Chat-only agents](docs/plugins.md#chat-only-agents-no-shell-file-or-workspace-tools).
+- `conversations: { keepDays: { <kind>: days } }` (config; `ResolvedConfig.conversations`): a daily sweep deletes the recorded conversations of a kind that were last active longer ago, through `ConversationPort.deleteConversation`, skips a busy one until the next sweep and forgets the record with the new optional `ConversationRegistry.remove(key)`. A kind not listed, and a host without the key, keeps its conversations. Type: `ConversationsConfig`. See [Conversation retention](docs/plugins.md#conversation-retention-conversationskeepdays).
+- Events: `EventHandlers.action(event)` and the optional `EventSink.action(event)`: a plugin reports what a person did through its surface (`ActionEvent`: `kind`, `actor`, `principalId`, `channel?`, `ok`, `at`, never content) and every plugin's handler hears it; a handler that throws is logged and never stops the others. The core reports none itself.
+
+- Channel context for any surface. `ChatSurface.channelContext(message, options?)` is the new optional method a surface implements; the new built-in `channel-context` plugin provides `CHANNEL_CONTEXT` (`ChannelContexts`: `read(message, options?)`), which picks the surface by the message's channel key as `THREADS` does and returns what it reads, `undefined` for a surface without the method. `DISCORD.channelContext` is unchanged for callers and is the Discord surface's own answer. `ChannelContextOptions.authors(message)` (`ChannelContextSource` in, `ChannelContextVerdict` `"keep" | "skip" | "end"` or `undefined` out) generalises `foreignWebhook` to any message and surface and wins where it answers; `ChannelContextMessage.external` (and `ChannelContextSource.external`) marks an author outside the people the host serves, never an owner, and the block labels it `role="external"`. `ChannelContextSourceAttachment` is the attachment shape of a fetched message. `formatChannelContext` is now defined with the contract types and re-exported by the Discord entry unchanged.
+
+### Breaking
+
+- `HostEnv.agentTools` is required: code that builds a `HostEnv` by hand sets it (`testHost` and `testPlugin` fill `"full"`).
+
+### Fixed
+
+- A held shell command's sentence on its approval card shows the command's first line, cut at 120 characters, instead of up to 600 characters of every line inside one code span: a multi-line script (a heredoc with `# comments`) broke the card's Markdown into headings. The card's code block still shows the whole command.
+- `agent_create` from an agent's turn in a web room started the new agent's opening task in its Discord channel. It now starts on the surface the caller's turn runs on, as the web app's new-agent form already did; a turn on Discord, or on a surface that hosts no rooms, keeps the Discord channel.
+
 ## [0.25.0] - 2026-10-29
 
 ### Added

package/docs/plugins.md

@@ -136,6 +136,7 @@ definePlugin({
 	provides: [],              // optional: keys of the services setup provides to other plugins
 	replaces: [],              // optional: keys of built-in services this plugin takes over
 	identities: [],            // optional: identities the plugin's own credentials stand for
+	hostAccess: true,          // optional: its tools reach the host's machine (shell, files)
 	preflight() {},            // optional: a check that runs before anything starts
 	setup(context) {           // required: returns the parts the plugin adds
 		return { /* parts */ };
@@ -146,6 +147,9 @@ definePlugin({
 `definePlugin` checks the name and the presence of `setup`, then returns the typed object you gave it.
 Errors point to the plugin definition.
 
+`hostAccess: true` marks a plugin whose tools reach the host's machine, such as one whose workers run shells or edit files (`pi-roundtable-coding` declares it).
+A host that gives its agents [no shell](#chat-only-agents-no-shell-file-or-workspace-tools) refuses to start with such a plugin registered.
+
 A plugin whose `setup` returns `{}` and has no migrations, providers, or hooks stops startup (see [Errors](#errors-and-their-fixes)).
 
 `identities` is for a plugin that serves a credential of its own, such as the bearer token of an endpoint, and runs turns for whoever holds it.
@@ -165,7 +169,7 @@ A plugin that replaces `IDENTITY` replaces this too: the declarations are the bu
 | Field | What it is |
 |---|---|
 | `logger` | The host's logger with `plugin: <your name>` on every line; each line is JSON on stdout. Its type is `Logger` (`debug`, `info`, `warn`, `error`, `fatal`, `child(fields)`), which a pino logger satisfies |
-| `env` | The host's own environment for the run: `locale`, `timeZone` (an IANA zone), `now()`, `scratchDir` when the host has one, and `characterSkins`, the six skin tones the host draws its agents with ([host skins](#host-skins-the-charactersskins-option)); read the zone from here rather than from the process, give `scratchDir` to a shell the plugin runs itself, and pass `characterSkins` to `composeSvg` when the plugin draws a character |
+| `env` | The host's own environment for the run: `locale`, `timeZone` (an IANA zone), `now()`, `scratchDir` when the host has one, `characterSkins`, the six skin tones the host draws its agents with ([host skins](#host-skins-the-charactersskins-option)), and `agentTools`, `"full"` or `"chat-only"` ([chat-only agents](#chat-only-agents-no-shell-file-or-workspace-tools)); read the zone from here rather than from the process, give `scratchDir` to a shell the plugin runs itself, and pass `characterSkins` to `composeSvg` when the plugin draws a character |
 | `database()` | The host's one PostgreSQL connection (a Bun `SQL`), already migrated |
 | `toolTiers` | What each tool needs; ask it when a tool is used, not during setup |
 | `events` | Where the core reports turns and team changes to every plugin's handlers |
@@ -235,6 +239,7 @@ The built-in plugins provide these, from the main entry:
 |---|---|---|---|
 | `IDENTITY` | `IdentityService` | `identity` | Who the host serves, read-only: `resolve(facts, { conversation }?)` gives the `Speaker` with its `principalId` behind a surface's `ActorFacts`, or undefined; `principal(id)`, `list()`, `identities(principalId)`, `roles(principalId)`, `tierOf(principalId)` (the lasting roles' tier), `speakerFor(principalId, tier?)` for a turn on someone's behalf, `owners()`, and `principalOf(identity)`, the principal an identity written `<provider>:<subject>` is linked to, such as one a plugin declares in `identities`. Principals are written only by the configuration and `roundtable principal`. `SYSTEM_PRINCIPAL` is the host's own, which no plugin speaks as |
 | `IDENTITY_LINKS` | `IdentityLinks` | `identity`, only with `access.selfLink` | Lets a plugin link a person's own account to their principal, which `IDENTITY` cannot: `link(principalId, identity)` and `unlink(identity)`, identities written `<provider>:<subject>`. See [Self-linking](#self-linking). Absent unless the configuration lists the providers; read it with `find` |
+| `PROFILES` | `PersonProfiles` | `identity` | How the core names a person: `register(source)` a `ProfileSource` for a provider, `observed(principalId, provider, name)` a name a signed-in session reported, `sourceOf`, `choose`, `of(principalId)` (name, source, whether a picture exists) and `picture(principalId)` (the picture through the source's allowed hosts). Always on. See [Naming people: `PROFILES`](#naming-people-profiles) |
 | `CONVERSATIONS` | `ConversationRegistry` | `conversations` | The conversations run through `context.turns`: `register`, `get(key)`, `list({ principal }?)`, `setTitle(key, title)`, and `adopt(key, principalId)` only for migrating a conversation recorded before 0.9; each a `ConversationRecord` of `key`, `surface`, `kind`, `visibility` (`"private"` or `"shared"`), `principalId?`, `title?`, `createdAt`, `lastActiveAt` |
 | `MODES` | `ConversationModes` | `modes` | Each conversation's modes, stored per key and kept across restarts: `peek(channel)` gives its `ConversationMode` (`yolo` and `longRunning`, both off by default; `changedBy?`, `changedAt?`) from memory, `set(channel, { yolo?, longRunning? }, speaker)` changes them and throws `PluginError` unless the speaker is an owner other than `SYSTEM_PRINCIPAL`, `onChange(listener)` hears each change, and `autoApproved(entry)` with `onAutoApproved(listener)` report a held call that yolo mode approved. See [Conversation modes](#conversation-modes-modes) |
 | `RUNTIME` | `AgentRuntime` | `runtime` | The runtime every conversation turn runs on, the agent server's and `context.turns`': the `runtime` slot's when a plugin fills it, Pi's otherwise |
@@ -245,8 +250,14 @@ The built-in plugins provide these, from the main entry:
 | `PRECHECKS` | `PrecheckRegistry` | `prechecks` | The host's named [prechecks](#prechecks-wake-a-schedule-only-when-it-has-work): `register`, `get`, `list`; and the runner of agents' precheck scripts: `useScriptRunner`, `scriptRunner` |
 | `MEMORY` | `MemoryStore` | `memory` (an addon) | `forSpeaker(principalId)` gives that principal's `SpeakerMemory`: `list`, `forPrompt`, `add`, `search`, `update`, `removeById`, `remove`; `MEMORY_KINDS` is `core`, `note`, `event` |
 | `BACKGROUND_TURNS` | `BackgroundTurns` | `modules` | Turns nobody wrote: `runScheduled`, `runDelegated`, `runErrorReport` |
+| `CHANNEL_CONTEXT` | `pi-roundtable` | value |
+| `ChannelContexts` | `pi-roundtable` | type |
+| `ChannelContextSource` | `pi-roundtable` | type |
+| `ChannelContextSourceAttachment` | `pi-roundtable` | type |
+| `ChannelContextVerdict` | `pi-roundtable` | type |
 | `DELEGATION` | `Delegator` | `modules` | `start(request)` a background task, `runningChannels()`, `idle()` |
 | `THREADS` | `DispatchThreads` | `threads` | The threads of background dispatches (coding tasks, delegated tasks, messages between agents), on any surface that hosts them: `open(origin, title, intro?)` opens the thread under the channel `origin` through the `threads` of the surface that serves its prefix and resolves to a `DispatchThread`, or `undefined` when that surface hosts none or the channel cannot. See [Dispatch threads on any surface](#dispatch-threads-on-any-surface) |
+| `CHANNEL_CONTEXT` | `ChannelContexts` | `channel-context` | `read(message, options?)` gives the context of one addressed message, from the surface whose key prefix its channel carries: the messages posted there since the assistant last posted, or `undefined` for a surface without `channelContext`, a channel that is not shared, and when nothing new was said. See [Channel context](#channel-context-what-was-said-around-an-addressed-message) |
 | `WORKER_SESSIONS` | `WorkerSessions` | `worker-sessions` | Fresh Pi sessions for a plugin's own workers, on the host's model login: `delegation` is the host's delegation `model` and `thinking`, and `run({ task, signal, prompt, extensions, toolNames, model?, thinking?, aborted? })` runs the task in a session that has only the tools `extensions` register and `toolNames` names (no built-in tool, skill, context file, memory or agent tool) and returns the worker's final answer; see [Workers of your own](#workers-of-your-own) |
 
 The data types the ports use (`Schedule`, `NewSchedule`, `Agent`, `AgentGroup`, `TeamStatus`, `Memory`, `SkillSet`, `DelegationJob`, and so on) are in the main entry too.
@@ -467,6 +478,21 @@ Owner is granted only through configuration or the principal CLI, never an IdP r
 A map gives the mode per surface, such as `provisioning: { web: "admitted", discord: "linked" }`: with `members.everyone: ["web", "discord"]`, a Discord id someone linked is served at member, an unlinked one is refused and not recorded, and web admits as before. A surface the map leaves out is `linked`, so a misspelled name cannot admit everyone; the one-word form and an omitted field stay `admitted`. `roundtable doctor` warns about a map key that is not a known surface and prints the effective mode.
 A disabled principal is refused, and CLI changes reach a running host within the identity cache's 30 seconds.
 
+### Reading who someone is without recording it: `peek` and `partial`
+
+`IDENTITY.resolve(facts)` is the call for a contact that happens: it links a first contact, may admit a new principal, and records the person as seen at their tier.
+`IDENTITY.peek(facts, { conversation }?)` only reads.
+It never links, claims, admits or records, also when it refuses, and it gives the tier `resolve` would give now: the principal's lasting roles together with what the access rules give these facts, never the tier last recorded.
+It answers undefined for an identity nothing is linked to, for a disabled principal, and when no tier results.
+Use it where a request must be checked again and again, such as a web session, so the check leaves no trace; a first contact still goes through `resolve`.
+A plugin that replaces `IDENTITY` adds `peek` to its service.
+
+A surface that cannot see everything a person holds reports `partial: true` in its `ActorFacts`.
+The facts then show less than the person may hold, so `resolve` never records a lower tier from them and never records them as a refusal, as it does for Discord facts that lack the roles the rules decide by.
+The owner app sets it on every app sign-in, because an identity provider's roles for another application say nothing about this one.
+
+`oidcProvider(issuer)` and `oidcIdentity(issuer, subject)` from `pi-roundtable/kit` write the provider `oidc:<base64url issuer>` and the identity `oidc:<base64url issuer>:<subject>` that `access.owners[].identities`, `selfLink.providers` and `ActorFacts.provider` take.
+
 ### Self-linking
 
 `access: { selfLink: { providers: ["discord"] } }` lets a plugin link the account a person controls to their principal.
@@ -613,6 +639,45 @@ test("an unavailable principal is refused even at owner tier", async () => {
 
 For existing hosts and compatibility aliases, read [Migrating to 0.9](migration-0.9.md).
 
+### Naming people: `PROFILES`
+
+A person's linked accounts each carry a name and maybe a picture, and a host decides which one represents them.
+`PROFILES` (provided by the `identity` plugin, always) holds the sources and the choices:
+
+```ts
+setup: ({ services }) => {
+	services.get(PROFILES).register({
+		provider: "github",
+		label: "GitHub",
+		modelVisible: false,
+		pictureHosts: ["avatars.githubusercontent.com"],
+		fetch: async (login, signal) => {
+			const user = await (await fetch(`https://api.github.com/users/${login}`, { signal })).json();
+			return { name: user.name ?? login, pictureUrl: user.avatar_url };
+		},
+	});
+}
+```
+
+- **Who names a person.** Their stored choice (`choose(principalId, provider)`, which refuses a provider they have not linked; `null` returns to the default), else the first provider in `profiles.prefer` they have linked, else nobody, and `of` falls back to the principal's display name.
+- **Observed names.** A surface that signs a person in reports the name its identity provider gave (`observed`), so an OIDC issuer names people with no fetch. It is held in memory for an hour and renewed by each sign-in.
+- **A fetch** has two seconds. A miss, a failure or a timeout is remembered for ten minutes, so the name on the hot path costs the wait at most once per person per ten minutes. Fetched and observed names and picture addresses stay in memory for an hour at most and are written to no table; only the choice (`principal_profile_choices`) is stored.
+- **What agents read.** `Speaker.name` from `IDENTITY.resolve`, `peek` and `speakerFor` is the profile name only for a provider the host lists in `profiles.modelVisible`; the source's own `modelVisible` flag never decides it. With no source, no observed name and an empty list nothing changes. Names are made safe first: control characters become spaces and at most 80 characters remain.
+- **Pictures.** `picture(principalId)` fetches only an `https` address on the source's `pictureHosts`, follows no redirect, accepts PNG, JPEG, GIF and WebP only (an SVG is refused), at most 2 MiB, and answers `nosniff` and `private, max-age=3600`. The bytes stay in memory for an hour, and a failure is remembered for ten minutes.
+
+```ts
+export default defineRoundtable({
+	// ...
+	profiles: {
+		prefer: ["line"],        // LINE names whoever linked it and has not chosen
+		modelVisible: ["line"],  // and agents read that name
+	},
+});
+```
+
+`pi-roundtable-line` ships `lineProfileSource(services.get(LINE).api)`, a source for provider `line` over LINE's `/v2/bot/profile/{userId}` (picture hosts `profile.line-scdn.net` and `obs.line-scdn.net`, `modelVisible: false`).
+`roundtable principal show` prints the source a person chose.
+
 ## Tiers: who may use what
 
 Every turn has a speaker with a tier: `owner`, `admin`, or `member`, from most to least trusted.
@@ -1225,6 +1290,7 @@ export const library = definePlugin({
 | `turnEnded(turn)` | The turn ended; `turn.result` is `"ok"`, `"failed"`, or `"stopped"` |
 | `turnProgress(event)` | A turn run through `context.turns` wrote text or ran a tool, between its start and its end: `event` is the turn's fields and `progress`, a `TurnProgress` (see the surface's `progress` below); a runtime without live progress reports none |
 | `changed()` | The team changed: an agent or group was created, edited, arranged, archived, or started over |
+| `action(event)` | A plugin reported something a person did through its surface with `context.events.action?.(...)`: `event` is `{ kind, actor, principalId, channel?, ok, at }`, with `kind` in the reporting plugin's own words (a support inbox says `"assign"`, `"reply"` or `"close"`), `actor` the `Speaker.id`, and `channel` a `ChannelKey` or a `page:<name>`. It carries no content. The core reports none itself; a plugin hears the others' |
 | `shutdown(left)` | The shutdown drain ended, before any service stops; `left` lists the work it gave up on |
 
 The host logs errors thrown by a handler and continues running the others.
@@ -2117,6 +2183,48 @@ export function alwaysOn(tools: () => string[]) {
 ```
 <!-- /example -->
 
+### Chat-only agents: no shell, file, or workspace tools
+
+By default an agent's turn carries Pi's shell and file tools (`bash`, `read`, `edit`, `write`) and works in a shared workspace on the host.
+A host whose agents only talk, such as one that serves a team through a web app and has no use for a shell, switches them off:
+
+```ts
+export default defineRoundtable({
+	// ...
+	agentServer: { tools: "chat-only" },
+});
+```
+
+The agent server stays, with its team, rooms, memory, schedules and the tools plugins add; `agentServer: false` still leaves it out, and a key left out keeps the full tools.
+Plugins read the mode as `context.env.agentTools` (`"full"` or `"chat-only"`), and `ResolvedConfig.agentTools` and `RoundtableOptions.environment.agentTools` carry it for a host that builds its own options.
+With `"chat-only"`:
+
+- No turn is offered `bash`, `read`, `edit` or `write`: the agent team's selection leaves them out, an agent's system prompt says it has no shell, file tools or workspace, its sessions get no workspace (no `attach_file`, no shell scratch dir) and its held-action gate judges none.
+- The host refuses to start with a plugin that declares `hostAccess: true` (`pi-roundtable-coding` does), with a `ConfigError` that names the plugin, and with a plugin whose `agentSelection` names one of the four tools. `roundtable doctor` prints `agent tools: chat-only (no shell, file or workspace tools)` and fails for a registered `hostAccess` plugin; with the full tools it prints `full`.
+- A selection that names one of the four tools anyway, whatever built it (a turn run through `context.turns` with its own `selection`, a plugin that grants tools at run time), is refused at the one place where `SessionFactory` turns a selection into active tools (`toolsFor` and `taskTools`): the turn fails closed with a `ConfigError`, which is logged as the turn's failure, and no session runs it.
+- `pi-roundtable-webchat` stops at start when a persona's own `selection` names one of the four tools.
+
+The mode is the host's decision, not a permission: it does not change who may use which tool (`toolTiers`), and an MCP server or other plugin that reaches the machine in a way it does not declare is outside what it can see.
+A plugin whose tools reach the host declares `hostAccess`, so that the one flag decides.
+
+### Conversation retention: `conversations.keepDays`
+
+The conversations run through `context.turns` are recorded (`CONVERSATIONS`).
+`conversations.keepDays` deletes the idle ones of a kind after a number of days, so a host that must not keep a kind of conversation for ever, such as support threads, does not:
+
+```ts
+export default defineRoundtable({
+	// ...
+	conversations: { keepDays: { support: 365, chat: 30 } },
+});
+```
+
+The key is a conversation's kind (`ConversationRecord.kind`) and the value a whole number of days from 1 up, counted from the conversation's last activity.
+A sweep runs when the host starts and once a day after: for each recorded conversation of a listed kind past its days, it calls `ConversationPort.deleteConversation`, which its claim carries out, and then forgets the record (`ConversationRegistry.remove`, optional on a hand-built registry).
+A conversation with a turn running or waiting (`"busy"`) is skipped and tried again at the next sweep; one whose claim cannot delete it is logged and kept.
+A kind not listed, and a host without the key, keeps its conversations as before.
+The agents' own channels are not recorded conversations and are not touched.
+
 ### `piPackages`: Pi extensions every session loads
 
 List npm packages whose Pi extensions every conversation session should load, and install them in your project (`bun add pi-web-access`).
@@ -2520,6 +2628,8 @@ Channel context lets the turn for an addressed message also read what was posted
 The agent server reads it for every turn in an agent's channel; a group's round does not, since it already carries what was said since the group's last turn.
 A plugin's claim opts in by calling `DISCORD.channelContext(message, options?)` from `pi-roundtable/discord` inside its turn's `run`, and appending the result with `withChannelContext(text, context, imagesKept?)`, as `withReference` adds the replied-to message.
 
+The same call works on any surface. A chat surface a plugin contributes implements the optional `ChatSurface.channelContext(message, options?)`, and `CHANNEL_CONTEXT.read(message, options?)` (from the main entry) picks the surface by the prefix of the message's channel key, as `THREADS` does, and returns what that surface returns; a surface without the method, a channel no surface serves and a message with nothing new all give `undefined`. A support inbox whose rooms are email threads, say, answers with the customer's messages since the assistant last replied, each marked `external: true` (see below). `DISCORD.channelContext` is the Discord surface's own answer to the same call, so a claim that reads either sees the same context. `ChannelContext`, `ChannelContextOptions`, `ChannelContextMessage`, `withChannelContext`, `withChannelContextImages` and `formatChannelContext` stay in the `pi-roundtable/discord` entry, which a plugin for another surface imports from too; `CHANNEL_CONTEXT`, `ChannelContexts`, `ChannelContextSource`, `ChannelContextSourceAttachment` and `ChannelContextVerdict` are in the main entry.
+
 It reads Discord, not the host's history, so it survives restarts:
 
 - It fetches the `fetch` messages before the addressed one (default 50, at most 100) and keeps those after the assistant's latest post there: its bot user's, or one of its application's webhooks, such as an agent's voice. Any post of the assistant ends the window, including the divider the core posts when a conversation starts over (see `discord.freshMarker`) and a notice that it did; a fresh-start reply must be a public post, not an ephemeral one, to cut the window.
@@ -2529,14 +2639,16 @@ It reads Discord, not the host's history, so it survives restarts:
 - It keeps the newest `keep` (default 15), oldest first. Mentions read as names, and stickers and files as text with their names and links; by default nothing is downloaded or shown to the model as an image (see `attachments` below). A message is cut at `messageChars` (default 500), another bot's at `botMessageChars` (default 80).
 - It never fails the turn over Discord: a Discord error, such as a channel the bot cannot read, is logged and the turn runs without context.
 
-A plugin may mirror an outside chat into a channel through a webhook of its own, created by the bot, so that the application owns it; by default such a post counts as the assistant's own, which ends the window and is left out, and the people mirrored never reach a turn. `foreignWebhook(webhookId)` changes that for the webhooks it returns true for: a post through one is another author's, kept like another bot's (`bot: true`, `authorName` the post's username, `authorId` the webhook's id) and no longer ends the window, which then ends only at the assistant's own posts: its bot user's and every webhook `foreignWebhook` returns false for, such as an agent's voice. It may also return `"skip"` for a webhook that is neither, such as one the plugin posts its own status notices through: a post through it is dropped from the context and does not end the window, as if it were not in the channel, so notices between two mirrored posts neither appear as someone's words nor cut the window, and they are not counted among the messages delivered. Any answer other than `true` and `"skip"` reads as false. A skipped post is still one of the `fetch` messages read, so it uses the budget the window is chosen from. The host sets it as `discord.channelContext.foreignWebhook` and a call overrides it for that call; being a function, it can be set only in code. Posts through a webhook that `foreignWebhook` returns true for are merged as near repeats only when the poster's name is the same too, since one webhook carries many people; every other message merges by author alone, as before. An edited message reads as Discord now holds it.
+A plugin may mirror an outside chat into a channel through a webhook of its own, created by the bot, so that the application owns it; by default such a post counts as the assistant's own, which ends the window and is left out, and the people mirrored never reach a turn. `foreignWebhook(webhookId)` changes that for the webhooks it returns true for: a post through one is another author's, kept like another bot's (`bot: true`, `authorName` the post's username, `authorId` the webhook's id) and no longer ends the window, which then ends only at the assistant's own posts: its bot user's and every webhook `foreignWebhook` returns false for, such as an agent's voice. It may also return `"skip"` for a webhook that is neither, such as one the plugin posts its own status notices through: a post through it is dropped from the context and does not end the window, as if it were not in the channel, so notices between two mirrored posts neither appear as someone's words nor cut the window, and they are not counted among the messages delivered. Any answer other than `true` and `"skip"` reads as false. A skipped post is still one of the `fetch` messages read, so it uses the budget the window is chosen from. The host sets it as `discord.channelContext.foreignWebhook` and a call overrides it for that call; being a function, it can be set only in code. `authors(message)` is the same decision for any surface and any message, not only a webhook's: it receives the fetched message (`ChannelContextSource`: `id`, `authorId`, `authorName`, `bot`, `own`, `webhookId?`, `external?`, `attachments?`, `at`, `text`) and answers `"keep"` (another author's, which does not end the window; `foreignWebhook` returning `true`), `"skip"` (dropped as if it were not in the channel, without ending the window; `"skip"` of `foreignWebhook`), `"end"` (the assistant's own, which ends the window and is left out; `foreignWebhook` returning `false` for an application webhook) or `undefined`, which leaves the default: the assistant's own posts end the window and everything else is kept. Where it answers, it wins over `foreignWebhook`; it is a function, so it can be set only in code, as a host default (`discord.channelContext.authors`) or per call. Posts through a webhook that `foreignWebhook` returns true for are merged as near repeats only when the poster's name is the same too, since one webhook carries many people; every other message merges by author alone, as before. An edited message reads as Discord now holds it.
+
+A message a surface knows to come from outside the people the host serves, such as a customer whose email a support inbox mirrors, is marked `external: true` (`ChannelContextMessage.external`, `ChannelContextSource.external`): it is never an owner, and the block labels it `role="external"`, the model's cue that its text is untrusted. Discord marks none.
 
 Every returned message has `attachments` (`ChannelContextAttachment`: `name`, `contentType`, `size`, `url`, `messageId`), whether or not anything was fetched. With `attachments: { images, maxBytes }` (`ChannelContextAttachmentOptions`; default none) a call also fetches up to `images` (at most 4, a turn's limit) PNG, JPEG, GIF or WebP images of the kept messages, the newest first, each at most `maxBytes` (default 10 MiB, at most 25 MiB), and returns them as `context.images`, prepared as a turn's own images are (large ones are scaled down) and kept in memory by this call and never logged; once a turn is given them they are in its session history like the turn's own images, and stay there. Pass them on with `withChannelContextImages(attachments, context)`, which returns `{ attachments, kept }`: the turn's attachments with the context's images after the turn's own, within the four a turn carries, and how many of them fitted (a turn that already carries four keeps none, and an image crowded out is not noted anywhere). Give `kept` to `withChannelContext(text, context, kept)`: above zero it adds a line that pictures are shown among the turn's images, and it adds none otherwise, so the block never claims images the turn does not have. The image is sent as the type its bytes show (PNG, JPEG, GIF or WebP), not as Discord's guess from the file name, and bytes of none of them are skipped as `unsupported type`. Up to two images are downloaded at once, within 20 seconds for the whole call; the images still to be fetched when it passes are skipped as `download failed`. An image that is not a type the model takes, is over `maxBytes`, cannot be downloaded or cannot be decoded is skipped, and its message's text says `[image not attached: <name>: <reason>]`, the reason being `unsupported type` (by Discord's type or by the bytes), `too large`, `download failed` or `could not be decoded`; skipped images do not count toward `images`, but at most twice that many are tried. An image of a message already handed over is not fetched again, since its message is not returned again.
 
 `DISCORD.channelContext` resolves undefined in a direct message, on another surface, when nothing new was said, and when the host's `discord.channelContext` is `false`, which turns it off for the agent server and every claim.
 The configuration's values are the host's defaults, and a call's `options` override them for that call.
 Call it once per answered message: what it returns is remembered as handed over.
-A call's `options` are validated like the configuration (`fetch`, `keep`, `messageChars` and `botMessageChars` positive integers, `similarity` from 0 to 1, `foreignWebhook` a function of a webhook id returning `true`, `false` or `"skip"`, `attachments.images` an integer from 0 to 4, `attachments.maxBytes` an integer from 1 to 25 MiB); an invalid one makes the call reject, a programming error, so `keep: 0` is not "none" (skip the call for that).
+A call's `options` are validated like the configuration (`fetch`, `keep`, `messageChars` and `botMessageChars` positive integers, `similarity` from 0 to 1, `foreignWebhook` a function of a webhook id returning `true`, `false` or `"skip"`, `authors` a function of a message returning `"keep"`, `"skip"`, `"end"` or `undefined`, `attachments.images` an integer from 0 to 4, `attachments.maxBytes` an integer from 1 to 25 MiB); an invalid one makes the call reject, a programming error, so `keep: 0` is not "none" (skip the call for that).
 It remembers what it handed over and what addressed the assistant, not every message that ran a turn: a post a claim answered some other way, such as a webhook report turn or a steered message, can also come in the context of a later turn if the assistant has not posted since.
 
 What it returns is public channel text, visible to everyone in the channel; it is not private memory, carries no `privateTo`, and goes into the turn's text, so it lives in the conversation's history, not in the system prompt.
@@ -2554,10 +2666,10 @@ Discord does not render Markdown tables, so the Discord surface tells the model
 The default says that Markdown renders except tables, that bullet lists or `key: value` lines replace them, that headings, bold, lists, quotes, inline code, fenced code blocks and `-#` small text work, and that a reply over 2,000 characters is split.
 `discord.formatting` replaces the text; `false` tells the model nothing.
 
-The block gives each author as a name, their Discord id and a role (`owner`, `bot` or `member`) in separate attributes, and says the messages were not addressed to the assistant. A name loses the characters `"`, `'`, `=`, `<`, `>`, `(`, `)` and `,`, so it cannot imitate another author, an attribute or a role, and every `<` (also the full-width `＜`) in a message's text is replaced by `‹`, so a message can neither close the block nor open a message of its own.
-`ChannelContext` is `{ messages, text, images? }`: `messages` are `ChannelContextMessage`s (`id`, `authorId`, `authorName`, `bot`, `owner`, `text`, `at`, `attachments`), oldest first, `text` is the block, and `images` the fetched images (see above).
+The block gives each author as a name, their id and a role (`owner`, `bot`, `external` or `member`) in separate attributes, and says the messages were not addressed to the assistant. A name loses the characters `"`, `'`, `=`, `<`, `>`, `(`, `)` and `,`, so it cannot imitate another author, an attribute or a role, and every `<` (also the full-width `＜`) in a message's text is replaced by `‹`, so a message can neither close the block nor open a message of its own.
+`ChannelContext` is `{ messages, text, images? }`: `messages` are `ChannelContextMessage`s (`id`, `authorId`, `authorName`, `bot`, `owner`, `external?`, `text`, `at`, `attachments`), oldest first, `text` is the block, and `images` the fetched images (see above).
 `ChannelContextOptions` holds the options above, and `CHANNEL_CONTEXT_DEFAULTS` their defaults.
-`formatChannelContext(messages)` is the function that writes `ChannelContext.text`, exported so a host can test what the model sees without reaching into the core: it takes `ChannelContextMessage`s (only `authorId`, `authorName`, `bot`, `owner` and `text` are read) and returns the block, headed and delimited by `<channel-context>`. Each message is a `<message from="…" id="…" role="owner|member|bot">` line whose author is in the attributes, never in the text, and every `<` of a name or text (plain or full-width) is replaced by `‹`, so no message can pass as markup. It does not fetch, cut or select anything, and it is the same function the reader calls, so a block it returns is the block a turn carries.
+`formatChannelContext(messages)` is the function that writes `ChannelContext.text`, exported so a host can test what the model sees without reaching into the core: it takes `ChannelContextMessage`s (only `authorId`, `authorName`, `bot`, `owner`, `external` and `text` are read) and returns the block, headed and delimited by `<channel-context>`. Each message is a `<message from="…" id="…" role="owner|member|bot|external">` line whose author is in the attributes, never in the text, and every `<` of a name or text (plain or full-width) is replaced by `‹`, so no message can pass as markup. It does not fetch, cut or select anything, and it is the same function the reader calls, so a block it returns is the block a turn carries.
 In a test, `fakeDiscord({ channelContext })` answers `DISCORD.channelContext` as the test says; by default with no context.
 
 <!-- example: examples/channel-context.ts -->
@@ -4053,6 +4165,7 @@ Import from the entries listed below; source area files are internal.
 | `AccessRules` | `pi-roundtable` | type |
 | `AccessTier` | `pi-roundtable` | type |
 | `AccessTierConfig` | `pi-roundtable` | type |
+| `ActionEvent` | `pi-roundtable` | type |
 | `ActorFacts` | `pi-roundtable` | type |
 | `AGENTS` | `pi-roundtable` | value |
 | `AGENT_SERVER_PLUGIN` | `pi-roundtable` | value |
@@ -4071,6 +4184,7 @@ Import from the entries listed below; source area files are internal.
 | `AgentSessions` | `pi-roundtable` | type |
 | `AgentStatus` | `pi-roundtable` | type |
 | `AgentTeam` | `pi-roundtable` | type |
+| `AgentTools` | `pi-roundtable` | type |
 | `AgentTurnScope` | `pi-roundtable` | type |
 | `Approval` | `pi-roundtable` | type |
 | `ApprovalDetails` | `pi-roundtable` | type |
@@ -4123,6 +4237,7 @@ Import from the entries listed below; source area files are internal.
 | `ConversationRegistration` | `pi-roundtable` | type |
 | `ConversationRegistry` | `pi-roundtable` | type |
 | `ConversationVisibility` | `pi-roundtable` | type |
+| `ConversationsConfig` | `pi-roundtable` | type |
 | `ConversationTurnInput` | `pi-roundtable` | type |
 | `ConversationTurns` | `pi-roundtable` | type |
 | `DELEGATION` | `pi-roundtable` | value |
@@ -4208,11 +4323,16 @@ Import from the entries listed below; source area files are internal.
 | `OwnerQuestion` | `pi-roundtable` | type |
 | `PendingConfirmation` | `pi-roundtable` | type |
 | `PerPrincipalLimits` | `pi-roundtable` | type |
+| `PersonDisplay` | `pi-roundtable` | type |
+| `PersonProfiles` | `pi-roundtable` | type |
 | `Persona` | `pi-roundtable` | type |
 | `PluginContext` | `pi-roundtable` | type |
 | `PluginIdentity` | `pi-roundtable` | type |
 | `PluginError` | `pi-roundtable` | value |
 | `Principal` | `pi-roundtable` | type |
+| `ProfileRules` | `pi-roundtable` | type |
+| `ProfileSource` | `pi-roundtable` | type |
+| `ProfilesConfig` | `pi-roundtable` | type |
 | `PromptDocumentSpec` | `pi-roundtable` | type |
 | `PromptDocuments` | `pi-roundtable` | type |
 | `PromptDocumentView` | `pi-roundtable` | type |
@@ -4252,6 +4372,7 @@ Import from the entries listed below; source area files are internal.
 | `RuntimeFactory` | `pi-roundtable` | type |
 | `SCHEDULES` | `pi-roundtable` | value |
 | `PRECHECKS` | `pi-roundtable` | value |
+| `PROFILES` | `pi-roundtable` | value |
 | `RUNTIME` | `pi-roundtable` | value |
 | `PRECHECK_TIMEOUT_MS` | `pi-roundtable` | value |
 | `Precheck` | `pi-roundtable` | type |
@@ -4541,6 +4662,8 @@ Import from the entries listed below; source area files are internal.
 | `lastAssistant` | `pi-roundtable/kit` | value |
 | `mcpAdapterExtension` | `pi-roundtable/kit` | value |
 | `mcpExtension` | `pi-roundtable/kit` | value |
+| `oidcIdentity` | `pi-roundtable/kit` | value |
+| `oidcProvider` | `pi-roundtable/kit` | value |
 | `outcome` | `pi-roundtable/kit` | value |
 | `ownerAttachmentDir` | `pi-roundtable/kit` | value |
 | `parseModelRef` | `pi-roundtable/kit` | value |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.25.0",
+	"version": "0.26.0",
 	"description": "A plugin-driven Pi agent server for one owner, reached through Discord or the web",
 	"type": "module",
 	"license": "MIT",

package/src/cli/checks/agent-tools.ts

@@ -0,0 +1,23 @@
+import type { Project } from "../project.ts";
+import { fail, ok, type Result, skipped } from "../report.ts";
+
+/**
+ * What the agents' turns may use of the machine: the shell and file tools ("full"), or none
+ * ("chat-only", `agentServer: { tools: "chat-only" }`). Fails for a chat-only host with a plugin
+ * whose tools reach the host, which the host would refuse to start with.
+ */
+export async function checkAgentTools(project: Project): Promise<Result> {
+	const assembled = await project.assembled();
+	if (!assembled.ok) return skipped("the configuration is not valid yet");
+	const { config, defined } = assembled.value;
+	if (!config.agentServer) return skipped("the agent server is off");
+	if (config.agentTools === "full")
+		return ok("full (the agents carry the shell and file tools)");
+	const reaching = defined.plugins.find((plugin) => plugin.hostAccess === true);
+	if (reaching)
+		return fail(
+			`plugin ${reaching.name} declares hostAccess: its tools reach the host's machine, and the configuration says agentServer: { tools: "chat-only" }.`,
+			`Remove the plugin ${reaching.name}, or remove tools: "chat-only" from agentServer.`,
+		);
+	return ok("chat-only (no shell, file or workspace tools)");
+}

package/src/cli/doctor.ts

@@ -1,3 +1,4 @@
+import { checkAgentTools } from "./checks/agent-tools.ts";
 import { type BunFacts, checkBun } from "./checks/bun.ts";
 import { checkCharacters } from "./checks/characters.ts";
 import { checkConfiguration, checkPlugins } from "./checks/configuration.ts";
@@ -67,6 +68,11 @@ export function buildChecks(
 		},
 		{ name: "plugins", offline: true, run: () => checkPlugins(project) },
 		{ name: "access", offline: true, run: () => checkAccess(project) },
+		{
+			name: "agent tools",
+			offline: true,
+			run: () => checkAgentTools(project),
+		},
 		{
 			name: "image provider",
 			offline: true,

package/src/cli/principal.ts

@@ -11,6 +11,7 @@ import {
 	type Pronouns,
 	type RoleGrant,
 } from "../core/identity/principal-store.ts";
+import { chosenProfileSource } from "../core/identity/profile-choices.ts";
 import type { Tier } from "../core/speakers.ts";
 import { CONFIG_FILE } from "./project.ts";
 
@@ -166,6 +167,7 @@ async function list(
 
 async function show(
 	store: PgPrincipalStore,
+	sql: SQL,
 	principal: PrincipalRecord,
 	io: PrincipalIo,
 	configured: Configured,
@@ -178,6 +180,10 @@ async function show(
 		`  last seen: ${principal.lastSeenAt ? `${stamp(principal.lastSeenAt)} as ${principal.lastTier ?? "unknown"}` : "never"}`,
 	);
 	io.out(`  roles: ${rolesText(await store.rolesOf(principal.id))}`);
+	const chosen = await chosenProfileSource(sql, principal.id);
+	io.out(
+		`  profile source: ${chosen ?? "none chosen (the profiles.prefer order, else the display name)"}`,
+	);
 	const links = await store.identitiesOf(principal.id);
 	io.out(`  identities: ${links.length === 0 ? "none" : ""}`.trimEnd());
 	for (const link of links)
@@ -236,6 +242,7 @@ function listedUnder(
 
 async function run(
 	store: PgPrincipalStore,
+	sql: SQL,
 	args: readonly string[],
 	io: PrincipalIo,
 	configured: Configured,
@@ -317,7 +324,7 @@ async function run(
 		return;
 	}
 	const principal = await find(store, rest[0]);
-	if (command === "show") return show(store, principal, io, configured);
+	if (command === "show") return show(store, sql, principal, io, configured);
 	if (command === "link") {
 		const identity = identityArgument(rest[1]);
 		const spends = claimable(principal, await store.rolesOf(principal.id));
@@ -398,7 +405,7 @@ export async function principalCommand(
 			);
 			return 1;
 		}
-		await run(await PgPrincipalStore.attach(sql), args, io, configured);
+		await run(await PgPrincipalStore.attach(sql), sql, args, io, configured);
 		return 0;
 	} catch (error) {
 		if (error instanceof Refusal || error instanceof IdentityError) {

package/src/core/agents/agent-prompt.ts

@@ -1,5 +1,6 @@
 import { messages } from "../i18n/index.ts";
 import { type OwnerIdentity, ownerWords } from "../identity.ts";
+import type { AgentTools } from "../plugin.ts";
 import { addressee, type Speaker } from "../speakers.ts";
 import type { Agent, AgentGroup, Backlog } from "./agent-store.ts";
 
@@ -25,6 +26,8 @@ export function agentSystemPrompt(input: {
 	speaker?: Speaker;
 	/** Whether the session offers generate_image; true only with an image provider. Default false. */
 	images?: boolean;
+	/** "chat-only": the agent has no shell, file tools or workspace, and the prompt says so. Default "full". */
+	agentTools?: AgentTools;
 }): string {
 	const { agent, coordinator, shared, workDir, owner, shellUser, group } =
 		input;
@@ -37,7 +40,9 @@ export function agentSystemPrompt(input: {
 		`You are "${agent.displayName}" (agent name \`${agent.name}\`), one of ${o.name}'s agents in ${o.his} Discord agent server. Each agent owns one channel and one conversation; you all share ${o.his} tools and ${o.his} memory.`,
 		roleText(agent, coordinator, who),
 		`The team: agent_list shows every agent and group; agent_get and agent_update read and improve any agent's prompt, display name, model, and thinking level, yours included; agent_create adds an agent with its own channel; agent_avatar changes an agent's look (class, colors, parts); schedule_list with agent reads another agent's schedules. A message marked as coming from another agent is that agent speaking, not ${w.name}; only ${w.name} approves held actions.`,
-		`Your shell and file tools run on ${o.his} VPS as the user ${shellUser}, in the shared workspace ${workDir}.${input.scratchDir ? ` Write temporary files under the scratch dir ${input.scratchDir} ($TMPDIR), not elsewhere in /tmp; make them with \`mktemp -p "$TMPDIR"\`, since a bare \`mktemp\` ignores $TMPDIR on some systems.` : ""} Commands that are destructive or change the system, and writes outside the workspace${input.scratchDir ? " and the scratch dir" : ""}, are held for ${w.his} confirmation: tell ${w.him} exactly what will run and ask ${w.him} to confirm. To show a file you have, attach it to your reply with attach_file or give its path to discord_send_message; never read an image or base64 a file to send it.${input.images ? " To make a new picture, describe it to generate_image, which saves it and attaches it to your reply." : ""}`,
+		input.agentTools === "chat-only"
+			? `You have no shell or file tools and no workspace on ${o.his} machine: you work through the conversation and the tools listed to you.${input.images ? " To make a new picture, describe it to generate_image, which saves it and attaches it to your reply." : ""}`
+			: `Your shell and file tools run on ${o.his} VPS as the user ${shellUser}, in the shared workspace ${workDir}.${input.scratchDir ? ` Write temporary files under the scratch dir ${input.scratchDir} ($TMPDIR), not elsewhere in /tmp; make them with \`mktemp -p "$TMPDIR"\`, since a bare \`mktemp\` ignores $TMPDIR on some systems.` : ""} Commands that are destructive or change the system, and writes outside the workspace${input.scratchDir ? " and the scratch dir" : ""}, are held for ${w.his} confirmation: tell ${w.him} exactly what will run and ask ${w.him} to confirm. To show a file you have, attach it to your reply with attach_file or give its path to discord_send_message; never read an image or base64 a file to send it.${input.images ? " To make a new picture, describe it to generate_image, which saves it and attaches it to your reply." : ""}`,
 	];
 	if (group) {
 		const others = group.members

package/src/core/agents/agent-team.ts

@@ -149,6 +149,7 @@ export class DiscordAgentTeam implements AgentOps, AgentTeam {
 			owner,
 			shellUser,
 			scratchDir,
+			agentTools,
 		} = this.#options;
 		const agent = store.agent(scope.name);
 		if (!agent) throw new AgentError(`no agent ${scope.name}`);
@@ -170,6 +171,7 @@ export class DiscordAgentTeam implements AgentOps, AgentTeam {
 			shellUser,
 			...(scratchDir ? { scratchDir } : {}),
 			images: this.#images(),
+			...(agentTools ? { agentTools } : {}),
 			...(group
 				? {
 						group: {

package/src/core/agents/team-editing.ts

@@ -5,6 +5,7 @@ import {
 	resolveCharacter,
 	suggestCharacter,
 } from "../../characters/index.ts";
+import { parseChannelKey } from "../contract/surface.ts";
 import { AgentError } from "../domain/errors.ts";
 import type { AgentTurnScope } from "../domain/ports.ts";
 import type { AgentChange } from "../services.ts";
@@ -102,11 +103,14 @@ export class TeamEditing {
 			throw new AgentError(
 				"agent_create can only be used during an agent turn.",
 			);
+		// The opening task starts on the surface the caller's turn runs on, as the web form's does.
+		const working = this.#ctx.turns.workingIn(caller.name);
 		const made = await this.#create(
 			{
 				speaker,
 				by: caller.name,
 				creator: this.#ctx.options.store.agent(caller.name),
+				openIn: working ? parseChannelKey(working).surface : undefined,
 			},
 			input,
 		);

package/src/core/agents/team-options.ts

@@ -1,6 +1,6 @@
 import type { ChannelKey } from "../domain/conversation.ts";
 import type { ThinkingSetting } from "../models.ts";
-import type { PromptSection } from "../plugin.ts";
+import type { AgentTools, PromptSection } from "../plugin.ts";
 import type { AvatarStudio, SkillRegistry } from "../services.ts";
 import type { ToolSelection } from "../sessions.ts";
 import type { AgentChannels, AgentModels } from "./agent-ports.ts";
@@ -18,6 +18,8 @@ export interface AgentTeamOptions
 	seeds: () => readonly AgentSeed[];
 	/** Sections the plugins add to every agent turn's system prompt, read before each run. */
 	promptSections?: () => readonly PromptSection[];
+	/** "chat-only": agent turns carry no shell or file tools, and the prompt says so; default "full". */
+	agentTools?: AgentTools;
 	/** The tools plugins defined for agents, read before each agent turn. */
 	pluginTools?: () => readonly string[];
 	/**

package/src/core/agents/team-selection.ts

@@ -6,7 +6,10 @@ import type { AgentTeamOptions } from "./team-options.ts";
 
 /** The tools every agent turn runs with: the plugins', plus the shell and agent tools. */
 export function teamSelection(
-	options: Pick<AgentTeamOptions, "pluginSelection" | "pluginTools">,
+	options: Pick<
+		AgentTeamOptions,
+		"pluginSelection" | "pluginTools" | "agentTools"
+	>,
 	scope?: AgentTurnScope,
 ): TurnSelection {
 	const plugged = options.pluginSelection();
@@ -15,7 +18,8 @@ export function teamSelection(
 		tools: [
 			...new Set([
 				...plugged.tools,
-				...SHELL_TOOLS,
+				// A chat-only host's agents carry no shell and no file tools.
+				...(options.agentTools === "chat-only" ? [] : SHELL_TOOLS),
 				// Group members hand off by mentioning each other, so a group seat has no message_agent.
 				...AGENT_TOOLS.filter(
 					(tool) => !(scope?.group && tool === MESSAGE_AGENT_TOOL),

package/src/core/builtin/agent-server.ts

@@ -273,6 +273,7 @@ export function agentServerPlugin(
 					: {}),
 				seeds: () => context.sessions().seeds,
 				promptSections: () => context.sessions().prompt,
+				agentTools: context.env.agentTools,
 				pluginTools: () => context.sessions().agentTools,
 				pluginSelection: () => context.sessions().agentSelection(),
 				events: context.events,

package/src/core/builtin/channel-context.ts

@@ -0,0 +1,21 @@
+import type { RoundtablePlugin } from "../plugin.ts";
+import { CHANNEL_CONTEXT } from "../services.ts";
+
+/**
+ * The channel context of every surface that reads it. The plugin provides one `CHANNEL_CONTEXT`
+ * service that picks the surface by the message's channel key, as the `threads` plugin does for
+ * dispatch threads, and asks its `channelContext`; a surface without one answers undefined.
+ */
+export function channelContextPlugin(): RoundtablePlugin {
+	return {
+		name: "channel-context",
+		provides: [CHANNEL_CONTEXT],
+		setup: ({ surfaces, services }) => {
+			services.provide(CHANNEL_CONTEXT, {
+				read: async (message, options) =>
+					surfaces.of(message.channel)?.channelContext?.(message, options),
+			});
+			return {};
+		},
+	};
+}

package/src/core/builtin/discord.ts

@@ -142,6 +142,8 @@ export function discordPlugin(options: DiscordOptions): RoundtablePlugin {
 				ownerId: options.ownerId,
 				ownerName: options.ownerName,
 				prompts: (channel, scope) => cards.prompts(channel, scope),
+				// Built below, once the surface can read messages; called only after setup.
+				channelContext: (message, given) => context.of(message, given),
 				logger,
 				...(options.freshMarker === undefined
 					? {}
@@ -189,7 +191,8 @@ export function discordPlugin(options: DiscordOptions): RoundtablePlugin {
 				threads,
 				// Built over the client's REST queue and sends nothing until a plugin calls it.
 				poster: restPoster(restOf(connected.rest())),
-				channelContext: (message, given) => context.of(message, given),
+				channelContext: (message, given) =>
+					connected.channelContext(message, given),
 			});
 			return {
 				// The host starts the surface first; it registers the composed commands as it connects.