pi-roundtable 0.25.0 → 0.26.1

package/src/core/identity/profiles-view.ts

@@ -0,0 +1,20 @@
+import type { PersonProfiles } from "./profiles.ts";
+
+/**
+ * The directory as plugins get it: the `PersonProfiles` methods and nothing else, so no plugin
+ * reaches the name the core gives agents. Each answer is a frozen copy.
+ */
+export function profilesView(directory: PersonProfiles): PersonProfiles {
+	return Object.freeze({
+		register: (source) => directory.register(source),
+		sources: () =>
+			Object.freeze(directory.sources().map((s) => Object.freeze({ ...s }))),
+		observed: (principalId, provider, name) =>
+			directory.observed(principalId, provider, name),
+		sourceOf: (principalId) => directory.sourceOf(principalId),
+		choose: (principalId, provider) => directory.choose(principalId, provider),
+		of: async (principalId) =>
+			Object.freeze({ ...(await directory.of(principalId)) }),
+		picture: (principalId) => directory.picture(principalId),
+	} satisfies PersonProfiles);
+}

package/src/core/identity/profiles.ts

@@ -0,0 +1,82 @@
+/**
+ * How the core names a person. A person's accounts each carry a name and maybe a picture; the
+ * person picks which account represents them (or the host's `profiles.prefer` order does), and
+ * the core shows that name where it names the person: the web app, transcripts, and, when the
+ * host lists the provider in `profiles.modelVisible`, the `Speaker.name` the agents read.
+ */
+
+/**
+ * Where a provider's names and pictures come from. Example: a support inbox registers a
+ * `github` source that reads a user's public profile.
+ */
+export interface ProfileSource {
+	/** The identity provider the source reads, an open string such as `line`, `discord` or `github`. */
+	provider: string;
+	/** What the person sees when choosing, such as "LINE". */
+	label: string;
+	/**
+	 * The source's own default. It never widens anything on its own: the names reach
+	 * `Speaker.name` only for a provider the host lists in `profiles.modelVisible`.
+	 */
+	modelVisible: boolean;
+	/** The https hosts its pictures come from; the picture proxy fetches only these. */
+	pictureHosts: readonly string[];
+	/**
+	 * The name and picture address of one account, or undefined when the provider knows none. It
+	 * has two seconds; a miss, a failure or a timeout is remembered for ten minutes.
+	 */
+	fetch(
+		subject: string,
+		signal: AbortSignal,
+	): Promise<{ name?: string; pictureUrl?: string } | undefined>;
+}
+
+/** How one person is shown. */
+export interface PersonDisplay {
+	name: string;
+	/** The provider the name comes from; absent when it is the principal's own display name. */
+	source?: string;
+	/** Whether `picture` has one to give. */
+	picture: boolean;
+}
+
+/**
+ * The names and pictures of the people the host serves, provided as `PROFILES` by the `identity`
+ * plugin. Fetched and observed names and picture addresses live in memory for at most an hour and
+ * are never stored; only a person's choice of source is.
+ */
+export interface PersonProfiles {
+	/** Adds a source; call it from a plugin's `setup`. A second source for one provider throws. */
+	register(source: ProfileSource): void;
+	/** The registered sources. */
+	sources(): readonly { provider: string; label: string }[];
+	/**
+	 * A name a signed-in session reported for one of the person's linked identities, such as an
+	 * OIDC `name` claim. It is held in memory for an hour, renewed by each sign-in, and never
+	 * stored, so an identity provider becomes a source without a fetch.
+	 */
+	observed(principalId: string, provider: string, name: string): void;
+	/**
+	 * The provider that names the person: their stored choice while it stays linked, else the
+	 * first `profiles.prefer` provider they have linked, else undefined.
+	 */
+	sourceOf(principalId: string): Promise<string | undefined>;
+	/** Stores the person's choice; the provider must be linked to them. `null` returns to the default. */
+	choose(principalId: string, provider: string | null): Promise<void>;
+	/** How the person is shown; their display name when no source names them. */
+	of(principalId: string): Promise<PersonDisplay>;
+	/**
+	 * The person's picture, fetched through the source's allowed hosts, or undefined: an address
+	 * on another host, a redirect, anything but PNG, JPEG, GIF or WebP, and a body over 2 MiB are
+	 * all refused. The answer is `nosniff` and cacheable for an hour by the one browser.
+	 */
+	picture(principalId: string): Promise<Response | undefined>;
+}
+
+/** The `profiles` key of the host's configuration, filled. */
+export interface ProfileRules {
+	/** Providers in the order that names a person who has not chosen, such as `["line", "oidc:<base64url issuer>"]`. */
+	prefer: readonly string[];
+	/** Providers whose names may become `Speaker.name`, which agents read. */
+	modelVisible: readonly string[];
+}

package/src/core/modules/host-shell/shell-policy.ts

@@ -33,7 +33,22 @@ export type { PushPolicy } from "./git-push.ts";
 export { simpleCommands } from "./shell-lexer.ts";
 export { YOLO_CARDED_SHELL_CLASSES } from "./shell-programs.ts";
 
-const MAX_SHOWN_COMMAND = 600;
+const MAX_SHOWN_COMMAND = 120;
+
+/**
+ * The command as a card's sentence shows it: its first line, cut to a length, in one code span.
+ * The card shows the whole command beside it; a second line or a backtick here would break the
+ * sentence's Markdown (a `# comment` line reads as a heading).
+ */
+function shownCommand(command: string): string {
+	const [line = ""] = command.trim().split("\n", 1);
+	const cut = line.length > MAX_SHOWN_COMMAND;
+	const more = cut || line.length < command.trim().length;
+	const shown = (cut ? line.slice(0, MAX_SHOWN_COMMAND) : line)
+		.replaceAll("`", "'")
+		.trimEnd();
+	return more ? `${shown} …` : shown;
+}
 
 /** Pi's built-in shell and file tools, which agent sessions activate. */
 export const SHELL_TOOLS = Object.freeze([
@@ -382,7 +397,7 @@ function shellHold(
 		let detail = `the ${toolName} call`;
 		try {
 			if (toolName === "bash" && typeof input.command === "string")
-				detail = `the shell command \`${input.command.slice(0, MAX_SHOWN_COMMAND)}\``;
+				detail = `the shell command \`${shownCommand(input.command)}\``;
 		} catch {
 			// The input itself cannot be read; the call is held without showing it.
 		}
@@ -410,7 +425,7 @@ function judge(
 		const [first] = found;
 		return first
 			? {
-					action: `run the shell command \`${command.slice(0, MAX_SHOWN_COMMAND)}\` on the host (${first.reason})`,
+					action: `run the shell command \`${shownCommand(command)}\` on the host (${first.reason})`,
 					classes: [...new Set(found.map((held) => held.class))],
 				}
 			: undefined;

package/src/core/plugin.ts

@@ -107,10 +107,30 @@ export interface EventHandlers {
 	turnProgress?(event: TurnProgressEvent): Promise<void> | void;
 	/** The team changed: an agent or group was created, edited, arranged, archived, or started over. */
 	changed?(): Promise<void> | void;
+	/**
+	 * Something a person did through a plugin's surface, reported by any plugin through
+	 * `context.events.action`: for example a support inbox's "assign", "reply" or "close". It names
+	 * the kind, who did it and whether it worked, never the content.
+	 */
+	action?(event: ActionEvent): Promise<void> | void;
 	/** The shutdown drain ended, before any service stops; `left` is the work it gave up on. */
 	shutdown?(left: readonly string[]): Promise<void> | void;
 }
 
+/** One thing a person did through a plugin's surface, as a handler hears of it. */
+export interface ActionEvent {
+	/** What was done, in the reporting plugin's words, such as "assign" or "close". */
+	kind: string;
+	/** The `Speaker.id` of who did it. */
+	actor: string;
+	principalId: string;
+	/** The conversation or page it concerns, when there is one. */
+	channel?: ChannelKey | `page:${string}`;
+	/** Whether it worked. */
+	ok: boolean;
+	at: Date;
+}
+
 /** What the core reports to the plugins' handlers. */
 export interface EventSink {
 	turnStarted(turn: TurnEvent): void;
@@ -118,6 +138,8 @@ export interface EventSink {
 	/** Optional, so a sink of your own written before it still fits. */
 	turnProgress?(event: TurnProgressEvent): void;
 	changed(): void;
+	/** Optional, as `turnProgress` is: a sink of your own written before it still fits. */
+	action?(event: ActionEvent): void;
 }
 
 /** What a prompt section is built for: one agent's turn. */
@@ -265,6 +287,12 @@ export interface LinkedSessions {
 	agentSelection(): ToolSelection;
 }
 
+/**
+ * What the agents' turns may use of the machine: "full" gives them the shell and file tools, and
+ * "chat-only" none of them, as `agentServer: { tools: "chat-only" }` configures.
+ */
+export type AgentTools = "full" | "chat-only";
+
 /** The host's own locale and time zone, as its plugins read them. */
 export interface HostEnv {
 	readonly locale: Locale;
@@ -284,6 +312,12 @@ export interface HostEnv {
 	 * agent wears the same ones.
 	 */
 	readonly characterSkins: readonly Hex[];
+	/**
+	 * Whether the agents' turns carry the shell and file tools. A plugin whose tools reach the host
+	 * checks it before it offers them to agents; under "chat-only" the host refuses to start with a
+	 * plugin that declares `hostAccess`.
+	 */
+	readonly agentTools: AgentTools;
 }
 
 /** What the host gives every plugin. */
@@ -391,6 +425,12 @@ export interface RoundtablePlugin {
 	 * dropped plugin provides a service this one does not replace.
 	 */
 	replaces?: readonly ServiceKey<unknown>[];
+	/**
+	 * Marks a plugin whose tools reach the host's machine, such as one that runs shells or edits
+	 * its files for the agents. A host that configures `agentServer: { tools: "chat-only" }`
+	 * refuses to start with one registered, with a ConfigError that names the plugin.
+	 */
+	hostAccess?: true;
 	setup(context: PluginContext): Promise<Contribution> | Contribution;
 	/**
 	 * Runs once every plugin is set up and linked, before any service starts; a failure stops the

package/src/core/registry/contributions.ts

@@ -25,6 +25,7 @@ import {
 	type DirectChannelProvider,
 	directChannelsPort,
 } from "../presence/direct-channels.ts";
+import { refuseShellTools } from "../runtime/chat-only.ts";
 import {
 	compileSessionPlan,
 	type SessionTool,
@@ -451,8 +452,14 @@ export async function collectContributions(
 				registry.holdRules.push(tool.hold);
 			}
 		}
-		if (contribution.agentSelection)
+		if (contribution.agentSelection) {
+			if (context.env.agentTools === "chat-only")
+				refuseShellTools(
+					contribution.agentSelection().tools,
+					`plugin ${plugin.name}: agentSelection`,
+				);
 			registry.agentSelections.push(contribution.agentSelection);
+		}
 		if (events) registry.handlers.push({ plugin: plugin.name, events });
 		registry.routes.push(...http);
 		registry.holdRules.push(...holdRules);

package/src/core/runtime/chat-only.ts

@@ -0,0 +1,32 @@
+import { ConfigError } from "../domain/errors.ts";
+import { SHELL_TOOLS } from "../modules/host-shell/shell-policy.ts";
+import type { RoundtablePlugin } from "../plugin.ts";
+
+const CHAT_ONLY = 'agentServer: { tools: "chat-only" }';
+
+/** The shell and file tools among these names. */
+export function shellToolsIn(names: Iterable<string>): string[] {
+	const shell: readonly string[] = SHELL_TOOLS;
+	return [...new Set(names)].filter((name) => shell.includes(name));
+}
+
+/**
+ * Refuses names that carry the machine's shell and file tools: the one place a chat-only host
+ * checks, where a selection turns into active tools. `where` says whose selection it is.
+ */
+export function refuseShellTools(names: Iterable<string>, where: string): void {
+	const found = shellToolsIn(names);
+	if (found.length > 0)
+		throw new ConfigError(
+			`${where} names ${found.join(", ")}, which ${CHAT_ONLY} withholds from every turn. Take the tool out of the selection, or remove tools: "chat-only" from agentServer to give the agents the shell.`,
+		);
+}
+
+/** Refuses, at start, a plugin whose tools reach the host: an agent of a chat-only host must not. */
+export function refuseHostAccess(plugins: readonly RoundtablePlugin[]): void {
+	const reaching = plugins.find((plugin) => plugin.hostAccess === true);
+	if (reaching)
+		throw new ConfigError(
+			`plugin ${reaching.name} declares hostAccess: its tools reach the host's machine, and the configuration says ${CHAT_ONLY}. Remove the plugin, or remove tools: "chat-only" from agentServer.`,
+		);
+}

package/src/core/runtime/conversation-sessions.ts

@@ -102,7 +102,8 @@ export class ConversationSessions {
 				this.#factory.link().holds,
 				this.#options.owner,
 				await this.#options.confirmations.load(key),
-				agents
+				// A chat-only host's agents have no shell, so their gate judges no workspace.
+				agents && this.#options.agentTools !== "chat-only"
 					? {
 							workspace: agents.workDir,
 							...(agents.scratchDir ? { scratchDir: agents.scratchDir } : {}),

package/src/core/runtime/extensions/confirmation-gate.ts

@@ -20,7 +20,7 @@ import {
 	approverOf,
 	askSpeaker,
 	awaitingText,
-	declinedText,
+	declinedRefusal,
 	type GateDecision,
 	type Needing,
 	namesOf,
@@ -337,7 +337,7 @@ export class ConfirmationGate {
 				wait: {
 					// A late answer on the card: the text of the turn that tells the model, and the release it earned.
 					late: (late) => {
-						const outcome = lateOutcome(call, late, watch);
+						const outcome = lateOutcome(call, late, watch, needing.onDeclined);
 						if (outcome?.release) this.#lateApproved.push(outcome.release);
 						return outcome?.text;
 					},
@@ -372,13 +372,8 @@ export class ConfirmationGate {
 				reason: awaitingText(this.#addressee, call),
 				refused: "pending",
 			};
-		if (answer === "declined") {
-			watch?.end();
-			return {
-				reason: declinedText(this.#addressee, call),
-				refused: "declined",
-			};
-		}
+		if (answer === "declined")
+			return declinedRefusal(this.#addressee, call, watch, needing.onDeclined);
 		if (answer === "cancelled") {
 			watch?.end();
 			return { reason: "The turn was stopped." };
@@ -449,6 +444,7 @@ export class ConfirmationGate {
 			...(judged.copy ? { copy: judged.copy } : {}),
 			...(judged.supersede ? { supersede: judged.supersede } : {}),
 			...(judged.speakerOnly ? { speakerOnly: judged.speakerOnly } : {}),
+			...(judged.onDeclined ? { onDeclined: judged.onDeclined } : {}),
 		};
 	}
 

package/src/core/runtime/extensions/gate-refusals.ts

@@ -37,6 +37,8 @@ export type Needing =
 			supersede?: AbortSignal;
 			/** The card is the speaker's alone; see `HoldDescription`. */
 			speakerOnly?: true;
+			/** Called when the call's card is declined; see `HoldDescription`. */
+			onDeclined?: () => void | Promise<void>;
 	  }
 	| { released: Release };
 
@@ -76,6 +78,36 @@ export function declinedText(addressee: OwnerIdentity, call: HeldCall): string {
 	return `${o.name} declined this on its approval card: it would ${call.action}. Do not retry it; go on without it, or ask ${o.him} what ${o.he} wants instead.`;
 }
 
+/**
+ * Tells the plugin that held a call that its card was declined (`HoldDescription.onDeclined`).
+ * The call is refused whatever the plugin does, so what its hook throws or rejects with is ignored.
+ */
+export function notifyDeclined(
+	onDeclined: (() => void | Promise<void>) | undefined,
+): void {
+	if (!onDeclined) return;
+	try {
+		Promise.resolve(onDeclined()).catch(() => undefined);
+	} catch {
+		// A hook that throws changes nothing: the call is refused already.
+	}
+}
+
+/**
+ * The refusal of a call declined on its card the turn was still waiting on: ends the plugin's
+ * watch of the call, tells it through `onDeclined`, and gives the turn the text and the reason.
+ */
+export function declinedRefusal(
+	addressee: OwnerIdentity,
+	call: HeldCall,
+	watch: { end(): void } | undefined,
+	onDeclined: (() => void | Promise<void>) | undefined,
+): { reason: string; refused: "declined" } {
+	watch?.end();
+	notifyDeclined(onDeclined);
+	return { reason: declinedText(addressee, call), refused: "declined" };
+}
+
 /** The text for a held call that the speaker's own message confirms. */
 export function askSpeaker(addressee: OwnerIdentity, call: HeldCall): string {
 	const o = ownerWords(addressee);

package/src/core/runtime/extensions/hold-lookups.ts

@@ -36,6 +36,8 @@ export interface Judgment {
 	speakerOnly?: true;
 	/** The hold classes of the call; see `HoldRule.holdClasses`. Absent when the holds gave none. */
 	classes?: readonly string[] | undefined;
+	/** Called when the call's card is declined; see `HoldDescription`. */
+	onDeclined?: () => void | Promise<void>;
 }
 
 export type Judged = Judgment | undefined | typeof STOPPED;
@@ -59,11 +61,14 @@ function isSignal(value: unknown): value is AbortSignal {
 export function described(
 	answer: HoldDescription,
 	tool: string,
-): Pick<Judgment, "action" | "copy" | "supersede" | "speakerOnly" | "classes"> {
+): Pick<
+	Judgment,
+	"action" | "copy" | "supersede" | "speakerOnly" | "classes" | "onDeclined"
+> {
 	if (typeof answer === "string") return { action: answer };
 	if (typeof answer !== "object" || answer === null)
 		return { action: messages().holdGeneric(tool) };
-	const { text, copy, supersede, approval, classes } = answer;
+	const { text, copy, supersede, approval, classes, onDeclined } = answer;
 	if (typeof text !== "string") return { action: messages().holdGeneric(tool) };
 	const named = Array.isArray(classes)
 		? classes.filter((id): id is string => typeof id === "string" && id !== "")
@@ -72,6 +77,7 @@ export function described(
 		...(isSignal(supersede) ? { supersede } : {}),
 		...(approval === "speaker" ? { speakerOnly: true as const } : {}),
 		...(named.length > 0 ? { classes: named } : {}),
+		...(typeof onDeclined === "function" ? { onDeclined } : {}),
 	};
 	if (
 		!copy ||
@@ -142,6 +148,7 @@ export function joinApprovers(
 			supersede,
 			speakerOnly,
 			classes,
+			onDeclined,
 		} = described(action, tool);
 		const joined = (approvers: readonly string[] | undefined): Judgment => ({
 			action: text,
@@ -149,6 +156,7 @@ export function joinApprovers(
 			...(supersede ? { supersede } : {}),
 			...(speakerOnly ? { speakerOnly } : {}),
 			...(classes ? { classes } : {}),
+			...(onDeclined ? { onDeclined } : {}),
 			...(approvers ? { approvers } : {}),
 		});
 		const controller = new AbortController();

package/src/core/runtime/extensions/late-answer.ts

@@ -1,6 +1,6 @@
 import type { HeldCall } from "../../domain/conversation.ts";
 import type { LateAnswer } from "../../interactions/prompts.ts";
-import type { Release } from "./gate-refusals.ts";
+import { notifyDeclined, type Release } from "./gate-refusals.ts";
 import { namedApprover } from "./held-calls.ts";
 import type { Watch } from "./withdrawals.ts";
 
@@ -8,12 +8,14 @@ import type { Watch } from "./withdrawals.ts";
  * What a card answered after its turn stopped waiting comes to: the text of the turn that tells
  * the model, and, for an approval that stands, the release that lets the identical call run once
  * in whichever turn makes it next. Undefined when the answer changes nothing: a question's, a
- * card its plugin withdrew, or an approval by someone the call does not name.
+ * card its plugin withdrew, or an approval by someone the call does not name. A card declined
+ * tells the plugin through `onDeclined`.
  */
 export function lateOutcome(
 	call: HeldCall,
 	late: LateAnswer,
 	watch: Watch | undefined,
+	onDeclined?: () => void | Promise<void>,
 ): { text: string; release?: Release } | undefined {
 	// A card the plugin withdrew answers nothing, whatever a surface that kept it open reports.
 	if (watch?.withdrawn || late.kind !== "approval") return undefined;
@@ -21,6 +23,7 @@ export function lateOutcome(
 	if (late.approved && !namedApprover(call, late.approvedBy)) return undefined;
 	if (!late.approved) {
 		watch?.end();
+		notifyDeclined(onDeclined);
 		return {
 			text: `(${late.by} declined on its card the action you were waiting on: it would ${call.action}. It did not run; do not make the call again. Go on without it, or ask what ${late.by} wants instead.)`,
 		};

package/src/core/runtime/runtime-plugin.ts

@@ -199,6 +199,7 @@ export function runtimePlugin(
 						},
 						...turnPolicy(options),
 						sessions: context.sessions,
+						agentTools: context.env.agentTools,
 						agentDir: options.agentDir,
 						modelRuntime: options.modelRuntime,
 						dataDir: options.dataDir,

package/src/core/runtime/runtime-types.ts

@@ -16,7 +16,7 @@ import type { Logger } from "../log.ts";
 import type { EffortPolicy, ThinkingLevel, ThinkingPicker } from "../models.ts";
 import type { Autonomy } from "../modes/autonomy.ts";
 import type { ConversationModes } from "../modes/conversation-modes.ts";
-import type { LinkedSessions } from "../plugin.ts";
+import type { AgentTools, LinkedSessions } from "../plugin.ts";
 import {
 	planOrder,
 	type SessionContext,
@@ -75,6 +75,8 @@ export interface PiAgentRuntimeOptions {
 	sessions: () => LinkedSessions;
 	/** The agent server's sessions: their shared workspace, model, and skills. */
 	agents?: AgentSessions;
+	/** "chat-only": no turn carries the shell and file tools, and agent sessions have no workspace; default "full". */
+	agentTools?: AgentTools;
 	/**
 	 * The prompts of a channel for an interactive turn's scope, made from its speaker and its
 	 * conversation's visibility; undefined for a channel that cannot show them. Without it every

package/src/core/runtime/session-factory.ts

@@ -3,14 +3,11 @@ import { join } from "node:path";
 import {
 	type AgentSession,
 	createAgentSession,
-	createBashToolDefinition,
 	DefaultResourceLoader,
 	type ModelRuntime,
 	type SessionManager,
-	type ToolDefinition,
 } from "@earendil-works/pi-coding-agent";
 import { channelSegment } from "../attachments/attachment-dir.ts";
-import type { ImageDrawer } from "../contract/providers.ts";
 import type { ClientPort } from "../domain/client.ts";
 import type { ChannelKey } from "../domain/conversation.ts";
 import { ConfigError } from "../domain/errors.ts";
@@ -29,16 +26,13 @@ import {
 	ATTACH_FILE_TOOL,
 	attachFileExtension,
 } from "../shared/attach-file-tool.ts";
-import {
-	GENERATE_IMAGE_TOOL,
-	generateImageExtension,
-} from "../shared/generate-image-tool.ts";
+import { GENERATE_IMAGE_TOOL } from "../shared/generate-image-tool.ts";
 import { packageDir } from "../shared/package-dir.ts";
 import { readAttachmentExtension } from "../shared/read-attachment-tool.ts";
-import type { WorkspaceRoots } from "../shared/workspace-files.ts";
 import { type Speaker, THE_SPEAKER } from "../speakers.ts";
 import { currentToolNames } from "../tool-tiers.ts";
 import { toolTurn } from "../tool-turn.ts";
+import { refuseShellTools } from "./chat-only.ts";
 import {
 	CompactionTiers,
 	compactionEngine,
@@ -64,7 +58,6 @@ import type { PromptSlot } from "./prompt-slot.ts";
 import type {
 	ChannelSession,
 	CompactionEnd,
-	CoreExtensions,
 	PiAgentRuntimeOptions,
 } from "./runtime-types.ts";
 import {
@@ -78,6 +71,9 @@ import {
 	sessionAddressee,
 	turnAddressee,
 } from "./session-conversation.ts";
+import { imageTools, scratchBash } from "./session-helpers.ts";
+
+export { imageTools, scratchBash };
 
 /** What a session factory asks of the runtime that owns the turns. */
 export interface SessionFactoryDeps {
@@ -139,11 +135,22 @@ export class SessionFactory {
 		);
 	}
 
+	/** Whether the host's agents carry no shell or file tools. */
+	get chatOnly(): boolean {
+		return this.#options.agentTools === "chat-only";
+	}
+
 	get plan(): SessionPlan {
 		return this.link().plan;
 	}
 
+	/**
+	 * The tools a selection turns into. A chat-only host refuses a selection that names a shell or
+	 * file tool, whatever built it (the agent team, `context.turns`, a plugin), so the turn fails
+	 * closed before any session runs it.
+	 */
 	toolsFor(selection: ToolSelection): string[] {
+		if (this.chatOnly) refuseShellTools(selection.tools, "a tool selection");
 		const groups = planOrder(this.plan).flatMap(
 			(tool) => tool.snapshot().groups ?? [],
 		);
@@ -360,7 +367,8 @@ export class SessionFactory {
 			},
 			conversation,
 			addressee,
-			...(agents
+			// A chat-only host's agents work in no workspace.
+			...(agents && !this.chatOnly
 				? {
 						workspace: {
 							workspace: cwd,
@@ -450,7 +458,7 @@ export class SessionFactory {
 			cwd,
 			agentDir,
 			// Pi's bash under its own name, run with TMPDIR at the agents' scratch dir.
-			...(agents?.scratchDir
+			...(agents?.scratchDir && !this.chatOnly
 				? { customTools: [scratchBash(cwd, agents.scratchDir)] }
 				: {}),
 			thinkingLevel: thinking,
@@ -479,22 +487,3 @@ export class SessionFactory {
 		return Object.assign(state, { session });
 	}
 }
-
-/** `generate_image` for a session of a host with an image provider; nothing without one. */
-export function imageTools(
-	images: ImageDrawer | undefined,
-	roots: WorkspaceRoots,
-): Pick<CoreExtensions, "generateImage"> {
-	return images ? { generateImage: generateImageExtension(images, roots) } : {};
-}
-
-/** Pi's bash tool with TMPDIR set to `scratchDir`, so tools that read TMPDIR and GNU `mktemp` write there (BSD `mktemp` needs `-p "$TMPDIR"`). */
-export function scratchBash(cwd: string, scratchDir: string): ToolDefinition {
-	// SAFETY: Pi's bash definition is a ToolDefinition typed by its own parameter schema, which the session takes as any custom tool.
-	return createBashToolDefinition(cwd, {
-		spawnHook: (context) => ({
-			...context,
-			env: { ...context.env, TMPDIR: scratchDir },
-		}),
-	}) as unknown as ToolDefinition;
-}

package/src/core/runtime/session-helpers.ts

@@ -0,0 +1,27 @@
+import {
+	createBashToolDefinition,
+	type ToolDefinition,
+} from "@earendil-works/pi-coding-agent";
+import type { ImageDrawer } from "../contract/providers.ts";
+import { generateImageExtension } from "../shared/generate-image-tool.ts";
+import type { WorkspaceRoots } from "../shared/workspace-files.ts";
+import type { CoreExtensions } from "./runtime-types.ts";
+
+/** `generate_image` for a session of a host with an image provider; nothing without one. */
+export function imageTools(
+	images: ImageDrawer | undefined,
+	roots: WorkspaceRoots,
+): Pick<CoreExtensions, "generateImage"> {
+	return images ? { generateImage: generateImageExtension(images, roots) } : {};
+}
+
+/** Pi's bash tool with TMPDIR set to `scratchDir`, so tools that read TMPDIR and GNU `mktemp` write there (BSD `mktemp` needs `-p "$TMPDIR"`). */
+export function scratchBash(cwd: string, scratchDir: string): ToolDefinition {
+	// SAFETY: Pi's bash definition is a ToolDefinition typed by its own parameter schema, which the session takes as any custom tool.
+	return createBashToolDefinition(cwd, {
+		spawnHook: (context) => ({
+			...context,
+			env: { ...context.env, TMPDIR: scratchDir },
+		}),
+	}) as unknown as ToolDefinition;
+}

package/src/core/services.ts

@@ -3,6 +3,7 @@ import type { CharacterInput, CharacterSpec } from "../characters/index.ts";
 import type { Agent, AgentGroup } from "./agents/agent-rules.ts";
 import type { AvatarMode } from "./agents/agent-tools.ts";
 import type { TeamStatus } from "./agents/team-status.ts";
+import type { ChannelContexts } from "./contract/channel-context.ts";
 import type {
 	BackgroundRunsAs,
 	ScheduledOutcome,
@@ -14,6 +15,7 @@ import type { PendingConfirmation } from "./domain/conversation.ts";
 import type { HttpRoute } from "./http/listeners.ts";
 import type { IdentityLinks } from "./identity/identity-links.ts";
 import type { IdentityService } from "./identity/identity-service.ts";
+import type { PersonProfiles } from "./identity/profiles.ts";
 import type { ThinkingLevel, ThinkingSetting } from "./models.ts";
 import type { ConversationModes } from "./modes/conversation-modes.ts";
 import type {
@@ -53,6 +55,10 @@ import type { DispatchThreads } from "./threads/dispatch-threads.ts";
  */
 export const IDENTITY: ServiceKey<IdentityService> =
 	serviceKey<IdentityService>("roundtable.identity");
+/** How the core names a person (linked accounts' names and pictures, the chosen one, plugin sources); from the `identity` plugin. */
+export const PROFILES: ServiceKey<PersonProfiles> = serviceKey<PersonProfiles>(
+	"roundtable.profiles",
+);
 /**
  * Links a person's own account to their principal, which `IDENTITY` cannot. Provided by the
  * `identity` plugin only when the configuration lists providers in `access.selfLink`; read it with
@@ -92,6 +98,9 @@ export const MODES: ServiceKey<ConversationModes> =
  */
 export const THREADS: ServiceKey<DispatchThreads> =
 	serviceKey<DispatchThreads>("roundtable.threads");
+/** The channel context of any surface, chosen by the message's channel key as `THREADS` is; provided by the `channel-context` plugin, which every host registers. */
+export const CHANNEL_CONTEXT: ServiceKey<ChannelContexts> =
+	serviceKey<ChannelContexts>("roundtable.channel-context");
 /** The agent server: its team, its directory, the runtime that runs every agent turn. Provided by the agent-server plugin. */
 export const AGENTS: ServiceKey<AgentServer> = serviceKey<AgentServer>(
 	"roundtable.agents",