pi-roundtable 0.8.0 → 0.9.0

package/src/core/runtime/bridge-guard.ts

@@ -0,0 +1,225 @@
+import type {
+	AgentSession,
+	ContextWithSystemEvent,
+	ModelRuntime,
+	SessionManager,
+} from "@earendil-works/pi-coding-agent";
+import type { AgentSessions } from "../contract/runtime.ts";
+import { AgentRunError, ConfigError } from "../domain/errors.ts";
+import type { AccessRules, AccessTier } from "../identity/access-policy.ts";
+import type { IdentityService } from "../identity/identity-service.ts";
+import { SYSTEM_PRINCIPAL } from "../identity/principal-store.ts";
+import {
+	formatModelRef,
+	type ModelRef,
+	parseModelRef,
+	type ThinkingSetting,
+} from "../models.ts";
+import type { RoundtablePlugin } from "../plugin.ts";
+import { guardHidesPrivateExchange } from "./extensions/private-memory.ts";
+import { bridgeHistoryHidesMemoryFor } from "./reader-history.ts";
+
+/**
+ * The Pi provider pi-claude-bridge registers. Its sessions resume the history Claude Code stored
+ * for a conversation, tool results as they came, rather than each request the core projects, so
+ * the core's per-request hiding of private memory does not reach it.
+ */
+export const CLAUDE_BRIDGE = "claude-bridge";
+
+/** Whether the model runs on claude-bridge, by its provider id. */
+export function onClaudeBridge(model: { provider: string }): boolean {
+	return model.provider === CLAUDE_BRIDGE;
+}
+
+/**
+ * Whether the tier admits someone besides the owners: everyone, a role, which anyone may hold, or
+ * an identity that is not already an owner's, since an owner listed again is still one person.
+ */
+const admits = (
+	tier: AccessTier | undefined,
+	owners: ReadonlySet<string>,
+): boolean => {
+	if (!tier) return false;
+	const { everyone } = tier;
+	if (everyone === true || (Array.isArray(everyone) && everyone.length > 0))
+		return true;
+	return (
+		(tier.identities ?? []).some((identity) => !owners.has(identity)) ||
+		(tier.roles?.length ?? 0) > 0
+	);
+};
+
+/**
+ * Why, by the configuration, a shared conversation of the host may have more than one person
+ * speaking in it; undefined when the one owner alone does. More than one owner, rules that admit
+ * admins or members besides the owner's own identities, or a plugin's identity bound to a
+ * principal other than the primary owner's.
+ */
+export function configuredCrowd(
+	rules: Pick<AccessRules, "owners" | "admins" | "members">,
+	plugins: readonly Pick<RoundtablePlugin, "name" | "identities">[],
+): string | undefined {
+	if (rules.owners.length > 1)
+		return `access.owners names ${rules.owners.length} owners`;
+	const owners = new Set(rules.owners.flatMap((owner) => owner.identities));
+	for (const tier of ["admins", "members"] as const)
+		if (admits(rules[tier], owners))
+			return `access.${tier} admits people besides the owner`;
+	const primary = rules.owners[0]?.principal;
+	for (const plugin of plugins)
+		for (const { identity, principal } of plugin.identities ?? [])
+			if (principal !== undefined && principal !== primary)
+				return `plugin ${plugin.name} binds ${identity} to principal ${principal}, not the owner's`;
+	return undefined;
+}
+
+/**
+ * Why, by the roles the host stores, such as those `roundtable principal grant` gives, a shared
+ * conversation may have more than one person speaking in it; undefined when only the primary
+ * owner holds a lasting role.
+ */
+async function grantedCrowd(
+	identity: Pick<IdentityService, "list" | "tierOf" | "owners">,
+	primary: string,
+): Promise<string | undefined> {
+	const owners = await identity.owners();
+	if (owners.length > 1)
+		return `${owners.length} principals hold the owner role: ${owners.map((owner) => owner.id).join(", ")}`;
+	for (const principal of await identity.list()) {
+		if (principal.id === primary || principal.id === SYSTEM_PRINCIPAL) continue;
+		const tier = await identity.tierOf(principal.id);
+		if (tier) return `principal ${principal.id} holds the ${tier} role`;
+	}
+	return undefined;
+}
+
+/** Why claude-bridge may not serve a host whose shared conversations hold several people's memory. */
+export function bridgeMemoryProblem(model: string, crowd: string): string {
+	return `model ${model} runs on ${CLAUDE_BRIDGE}, and this host keeps each person's private memory while ${crowd}. ${CLAUDE_BRIDGE} resumes the history Claude Code stored for a conversation, unfiltered, so one person's private memory could reach another reader. Shared bridge turns refuse when raw reader records show private memory carried for another reader (including prompt-only memory and reasoning), or an exchange is inaccessible. Turns without private memory stay shareable; malformed memory calls belong to their recorded reader. SYSTEM counts as primary owner and may read that owner's raw exchanges/reasoning; untagged pre-scope legacy memory results keep primary-owner attribution. Public replies, untagged custom tools, and old prompts/reasoning/summaries without reader records remain a risk.`;
+}
+
+/** How to fix it. */
+export const BRIDGE_MEMORY_FIX =
+	"Use another provider, or start a fresh conversation before sharing incompatible private history. memory: false or persona memory: none prevents future core memory loading, but does not bypass recorded private history.";
+
+/** The refusal of claude-bridge on a host whose shared conversations hold several people's memory. */
+export function bridgeMemoryError(model: string, crowd: string): ConfigError {
+	return new ConfigError(
+		`${bridgeMemoryProblem(model, crowd)} ${BRIDGE_MEMORY_FIX}`,
+	);
+}
+
+export interface AgentModelSettings {
+	model: string;
+	thinking: ThinkingSetting;
+}
+
+/** Copy the turn's selected model/settings once: checking and using separate reads can race a switch. */
+export function chosenAgentModel(
+	agent: string | undefined,
+	options: { agents?: Pick<AgentSessions, "modelOf"> },
+): AgentModelSettings | undefined {
+	return agent !== undefined && options.agents
+		? { ...options.agents.modelOf(agent) }
+		: undefined;
+}
+
+/** Apply exactly the model snapshot the guard checked, never a later live settings read. */
+export async function useChosenAgentModel(
+	session: AgentSession,
+	modelRuntime: Pick<ModelRuntime, "getModel">,
+	name: string,
+	chosen: AgentModelSettings | undefined,
+): Promise<ThinkingSetting> {
+	if (!chosen)
+		throw new ConfigError("agent turns need the runtime's agents option");
+	const { model, thinking } = chosen;
+	const ref = parseModelRef(model);
+	if (
+		session.model?.provider !== ref?.provider ||
+		session.model?.id !== ref?.id
+	) {
+		const resolved = ref && modelRuntime.getModel(ref.provider, ref.id);
+		if (!resolved)
+			throw new AgentRunError(
+				`${name}'s model ${model} is not available on this host`,
+			);
+		await session.setModel(resolved);
+	}
+	return thinking;
+}
+
+interface BridgeHistory {
+	messages: ContextWithSystemEvent["messages"];
+	reader: string | undefined;
+	/** The persisted branch retains exchanges removed from the active context by compaction. */
+	sessionManager?: Pick<SessionManager, "getBranch">;
+}
+
+/** Only results recorded before the first 0.9 scope marker inherit legacy owner attribution. */
+function hidesBridgeHistory(
+	history: BridgeHistory,
+	reader: string | undefined,
+	primary: string,
+): boolean {
+	const view = { shared: true, reader };
+	const branch = history.sessionManager?.getBranch();
+	if (!branch)
+		return guardHidesPrivateExchange(history.messages, {
+			...view,
+			legacyOwner: primary,
+		});
+	return bridgeHistoryHidesMemoryFor(branch, reader, primary);
+}
+
+/**
+ * Why raw private history prevents a shared turn from running on its selected bridge model;
+ * undefined when it may. The model is the agent's own for an agent's turn, the host's otherwise.
+ */
+export async function bridgeTurnRefusal(
+	agent: string | undefined,
+	options: {
+		model: ModelRef;
+		agents?: Pick<AgentSessions, "modelOf"> | undefined;
+		memory?: boolean;
+		owner: { id: string };
+	},
+	history: BridgeHistory,
+	chosen?: AgentModelSettings,
+): Promise<string | undefined> {
+	const model =
+		agent === undefined
+			? options.model
+			: parseModelRef(
+					chosen?.model ?? options.agents?.modelOf(agent).model ?? "",
+				);
+	if (!model || !onClaudeBridge(model)) return undefined;
+	const reader =
+		history.reader === SYSTEM_PRINCIPAL ? options.owner.id : history.reader;
+	if (!hidesBridgeHistory(history, reader, options.owner.id)) return undefined;
+	const why =
+		"this conversation's raw history holds another reader's private memory or a private exchange the current reader may not see";
+	const message = bridgeMemoryError(formatModelRef(model), why).message;
+	return agent === undefined ? message : `${agent}: ${message}`;
+}
+
+/**
+ * Why startup should warn about claude-bridge: the configuration's crowd, or
+ * the roles the host stores as they are now, so one granted after the boot counts at once.
+ * Undefined while one person alone may speak, or the host keeps no memory.
+ */
+export function liveBridgeRefusal(options: {
+	memory: boolean | undefined;
+	crowd: string | undefined;
+	identity: () =>
+		| Pick<IdentityService, "list" | "tierOf" | "owners">
+		| undefined;
+	primary: string;
+}): () => Promise<string | undefined> {
+	return async () => {
+		if (!options.memory) return undefined;
+		if (options.crowd) return options.crowd;
+		const identity = options.identity();
+		return identity && (await grantedCrowd(identity, options.primary));
+	};
+}

package/src/core/runtime/compaction-tiers.ts

@@ -164,16 +164,20 @@ export class CompactionTiers {
 	/**
 	 * Wraps a compaction extension so a compaction past the hard ceiling skips it and pi's summary
 	 * runs. pi keeps the last handler result and stops only on cancel, so a handler of the assistant's
-	 * own could not keep the extension from answering; wrapping its registration can.
+	 * own could not keep the extension from answering; wrapping its registration can. `prepare`
+	 * changes what the extension is given before it reads it, such as a shared conversation's
+	 * history without anyone's private memory.
 	 */
 	wrapCompactor(
 		compactor: ExtensionFactory,
 		onBypass: (details: { reason: string; tokensBefore: number }) => void,
+		prepare?: (event: SessionBeforeCompactEvent) => void,
 	): ExtensionFactory {
 		const gate = (event: SessionBeforeCompactEvent): boolean => {
 			const { tokensBefore } = event.preparation;
 			const reason = extensionBypass(tokensBefore, this.latest());
 			if (reason) onBypass({ reason, tokensBefore });
+			else prepare?.(event);
 			return reason === undefined;
 		};
 		type Handler = (event: unknown, ctx: unknown) => unknown;

package/src/core/runtime/conversation-sessions.ts

@@ -1,18 +1,30 @@
 import { mkdirSync } from "node:fs";
-import { SessionManager } from "@earendil-works/pi-coding-agent";
+import type { AgentSession } from "@earendil-works/pi-coding-agent";
 import { ownerAttachmentDir } from "../attachments/attachment-dir.ts";
 import type {
 	ChannelKey,
 	PendingConfirmation,
 } from "../domain/conversation.ts";
-import type { TurnRequest } from "../domain/ports.ts";
+import type { TurnConversation, TurnRequest } from "../domain/ports.ts";
 import type { ThinkingLevel } from "../models.ts";
 import type { ToolTiers } from "../tool-tiers.ts";
-import { ConfirmationGate } from "./extensions/confirmation-gate.ts";
+import { ConfirmationGate, unexpired } from "./extensions/confirmation-gate.ts";
 import { PromptSlot } from "./prompt-slot.ts";
 import type { ChannelSession, PiAgentRuntimeOptions } from "./runtime-types.ts";
 import { revisionsKey, skillsKey } from "./runtime-types.ts";
+import {
+	conversationChanged,
+	namedConversation,
+	sessionConversation,
+} from "./session-conversation.ts";
 import type { SessionFactory } from "./session-factory.ts";
+import {
+	historyMessages,
+	historyScope,
+	scopedHistory,
+} from "./session-scope.ts";
+
+type AgentMessage = AgentSession["messages"][number];
 
 /** The open sessions of a runtime's conversations and what is held for each of them. */
 export class ConversationSessions {
@@ -21,6 +33,11 @@ export class ConversationSessions {
 	readonly #tiers: ToolTiers;
 	readonly #sessions = new Map<ChannelKey, Promise<ChannelSession>>();
 	readonly #gates = new Map<ChannelKey, ConfirmationGate>();
+	/**
+	 * What the store held for a conversation that has no gate yet, once read: a host asks what is
+	 * pending before the conversation's first turn after a restart, which builds its gate.
+	 */
+	readonly #restored = new Map<ChannelKey, PendingConfirmation | undefined>();
 	/** Each conversation's way to ask the owner during its current turn. */
 	readonly #slots = new Map<ChannelKey, PromptSlot>();
 	/** Each conversation's level the judge picked for its last turn, kept while the judge is unsure. */
@@ -41,9 +58,24 @@ export class ConversationSessions {
 		this.#tiers = tiers;
 	}
 
-	/** The held actions of a conversation whose gate is open. */
+	/** The held actions of a conversation whose gate is open, or that `held` has restored from the store. */
 	pending(channel: ChannelKey): PendingConfirmation | undefined {
-		return this.#gates.get(channel)?.pending();
+		const gate = this.#gates.get(channel);
+		return gate ? gate.pending() : unexpired(this.#restored.get(channel));
+	}
+
+	/**
+	 * The conversation's held actions, restored from the store the first time they are asked for
+	 * after a restart. Builds neither a gate nor a session: a gate's flavour follows the turn that
+	 * first needs it, an agent's or not, and only the turn knows which.
+	 */
+	async held(key: ChannelKey): Promise<PendingConfirmation | undefined> {
+		if (!this.#gates.has(key) && !this.#restored.has(key)) {
+			const stored = await this.#options.confirmations.load(key);
+			// A turn may have built the gate while the store was read; its held actions are the later ones.
+			if (!this.#gates.has(key)) this.#restored.set(key, stored);
+		}
+		return this.pending(key);
 	}
 
 	/** Disposes every open session. */
@@ -77,6 +109,7 @@ export class ConversationSessions {
 				this.#tiers,
 			);
 			this.#gates.set(key, gate);
+			this.#restored.delete(key);
 		}
 		return gate;
 	}
@@ -96,7 +129,7 @@ export class ConversationSessions {
 	 */
 	session(
 		key: ChannelKey,
-		request?: Pick<TurnRequest, "channel" | "agent" | "kind">,
+		request?: Pick<TurnRequest, "channel" | "agent" | "kind" | "conversation">,
 	): Promise<ChannelSession> {
 		let pending = this.#sessions.get(key);
 		if (!pending) {
@@ -104,28 +137,87 @@ export class ConversationSessions {
 			mkdirSync(sessionDir, { recursive: true });
 			const channel = request?.channel ?? key;
 			const agent = request?.agent;
-			pending = (async () =>
-				this.#factory.create(
+			pending = (async () => {
+				const conversation = await sessionConversation(
+					key,
+					request,
+					this.#options,
+				);
+				// A history of another scope is archived, never replayed, and what it held goes with it,
+				// after a restart too: no one approves, or reads, an action held for someone else.
+				const { history, archived } = scopedHistory(
+					sessionDir,
+					this.#factory.cwd(agent),
+					conversation,
+				);
+				if (archived > 0) {
+					this.#options.logger.info(
+						{ channel: key, archived },
+						"the conversation serves someone else now; its earlier history was archived",
+					);
+					this.#gates.delete(key);
+					this.#restored.delete(key);
+					await this.#options.confirmations.save(key, undefined);
+				}
+				return this.#factory.create(
 					agent?.home ?? channel,
-					SessionManager.continueRecent(this.#factory.cwd(agent), sessionDir),
+					history,
 					await this.gate(key, agent !== undefined),
 					this.slot(key),
 					ownerAttachmentDir(this.#options.dataDir, channel),
 					agent,
 					request?.kind ?? "owner",
-				))();
+					conversation,
+				);
+			})();
 			pending.catch(() => this.#sessions.delete(key));
 			this.#sessions.set(key, pending);
 		}
 		return pending;
 	}
 
-	/** The conversation's session, rebuilt with its history when its session tools or skills changed. */
+	/**
+	 * Whom the conversation serves at this turn: as the turn names it, else as the host records it
+	 * now, read at every turn so a record changed while the session is open counts; else as its open
+	 * session was made for, or its history records, so a conversation nothing names carries on as it
+	 * was, after a restart too; else shared.
+	 */
+	async conversation(
+		key: ChannelKey,
+		request: Pick<TurnRequest, "agent" | "conversation">,
+	): Promise<TurnConversation> {
+		const named = await namedConversation(key, request, this.#options);
+		if (named) return named;
+		const open = this.#sessions.get(key);
+		if (open) return (await open).conversation;
+		return (
+			historyScope(
+				this.#factory.sessionDir(key),
+				this.#factory.cwd(request.agent),
+			) ?? { visibility: "shared" }
+		);
+	}
+
+	/**
+	 * The conversation's session for the turn: rebuilt with its history when its session tools or
+	 * skills changed, and made anew, with nothing held for it, when the conversation serves someone
+	 * else than it was made for, its history archived rather than replayed.
+	 */
 	async freshSession(
 		key: ChannelKey,
 		request: TurnRequest,
 	): Promise<ChannelSession> {
 		const channelSession = await this.session(key, request);
+		if (
+			conversationChanged(channelSession.conversation, request.conversation)
+		) {
+			this.#options.logger.info(
+				{ channel: key },
+				"the conversation's scope changed; starting an isolated session",
+			);
+			await this.forget(key);
+			return this.session(key, request);
+		}
 		const stale = this.#staleReason(channelSession, request);
 		if (!stale) return channelSession;
 		this.#options.logger.info(
@@ -137,7 +229,7 @@ export class ConversationSessions {
 		return this.session(key, request);
 	}
 
-	/** Why a cached session must be rebuilt before this turn, or undefined when it is current. */
+	/** Why a cached session must be rebuilt, keeping its history, before this turn; undefined when it is current. */
 	#staleReason(
 		channelSession: ChannelSession,
 		request: TurnRequest,
@@ -151,6 +243,25 @@ export class ConversationSessions {
 		return undefined;
 	}
 
+	/**
+	 * The messages of a conversation's history: its open session's, or else read from its files
+	 * without opening one, so reading them fixes no scope; none when they were recorded, or its open
+	 * session was made, for someone else than the conversation serves now.
+	 */
+	async messages(key: ChannelKey): Promise<readonly AgentMessage[]> {
+		const now = await this.conversation(key, {});
+		const open = this.#sessions.get(key);
+		if (open) {
+			const { conversation, session } = await open;
+			return conversationChanged(conversation, now) ? [] : session.messages;
+		}
+		return historyMessages(
+			this.#factory.sessionDir(key),
+			this.#factory.cwd(undefined),
+			now,
+		);
+	}
+
 	/** Drops the open session and everything held for the conversation, leaving its files. */
 	// pi-lens-ignore: mixed-async-styles — disposal failures of a dropped session are swallowed in a chain on purpose
 	async forget(channel: ChannelKey): Promise<void> {
@@ -160,6 +271,7 @@ export class ConversationSessions {
 			?.then(({ session }) => session.dispose())
 			.catch(() => undefined);
 		this.#gates.delete(channel);
+		this.#restored.delete(channel);
 		this.#slots.delete(channel);
 		this.usage.delete(channel);
 		this.judged.delete(channel);

package/src/core/runtime/extensions/ask-user.ts

@@ -1,8 +1,8 @@
 import type { ExtensionFactory } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
-import type { OwnerAnswer, OwnerQuestion } from "../../domain/owner-prompts.ts";
 import { messages } from "../../i18n/index.ts";
 import { type OwnerIdentity, ownerWords } from "../../identity.ts";
+import type { OwnerAnswer, OwnerQuestion } from "../../interactions/prompts.ts";
 import { toolText } from "../../shared/tool-result.ts";
 import type { PromptSlot } from "../prompt-slot.ts";
 

package/src/core/runtime/extensions/confirmation-gate.ts

@@ -3,10 +3,11 @@ import type {
 	HeldCall,
 	PendingConfirmation,
 } from "../../domain/conversation.ts";
-import type { OwnerPrompts } from "../../domain/owner-prompts.ts";
 import { type HoldCheck, type HoldContext, higherTier } from "../../holds.ts";
 import { messages } from "../../i18n/index.ts";
 import { type OwnerIdentity, ownerWords } from "../../identity.ts";
+import type { Prompts } from "../../interactions/prompts.ts";
+import type { Speaker } from "../../speakers.ts";
 import type { ToolTiers } from "../../tool-tiers.ts";
 import type { PromptSlot } from "../prompt-slot.ts";
 
@@ -16,6 +17,17 @@ const CARD_INPUT_CHARS = 1_500;
 /** Held actions older than this cannot be approved any more. */
 export const CONFIRMATION_TTL_MS = 24 * 3_600_000;
 
+/** The held actions when they can still be approved at `now`; expired ones count as none. */
+export function unexpired(
+	pending: PendingConfirmation | undefined,
+	now = new Date(),
+): PendingConfirmation | undefined {
+	if (!pending) return undefined;
+	return now.getTime() - pending.heldAt.getTime() > CONFIRMATION_TTL_MS
+		? undefined
+		: pending;
+}
+
 /** JSON with object keys sorted at every level, so equal inputs compare equal. */
 // pi-lens-ignore: no-unknown-parameters — tool input is untyped model JSON; this is where it is read
 export function canonicalJson(value: unknown): string {
@@ -55,7 +67,7 @@ function byCodeUnit(a: string, b: string): number {
 export class ConfirmationGate {
 	#selectionId: string | undefined;
 	/** The running turn's speaker, whom the actions it holds belong to. */
-	#speakerId: string | undefined;
+	#speaker: Pick<Speaker, "id" | "principalId"> | undefined;
 	#pending: PendingConfirmation | undefined;
 	#approved: HeldCall[] = [];
 	readonly #holds: HoldCheck;
@@ -86,25 +98,22 @@ export class ConfirmationGate {
 
 	/** Held actions awaiting the owner's answer; expired ones count as none. */
 	pending(now = new Date()): PendingConfirmation | undefined {
-		const pending = this.#pending;
-		if (!pending) return undefined;
-		return now.getTime() - pending.heldAt.getTime() > CONFIRMATION_TTL_MS
-			? undefined
-			: pending;
+		return unexpired(this.#pending, now);
 	}
 
 	/**
-	 * `addressee` is who the turn is for; without one, the owner. `speakerId` is who spoke the turn,
-	 * recorded with what it holds; without one, only the owner may approve them.
+	 * `addressee` is who the turn is for; without one, the owner. `speaker` is who spoke the turn,
+	 * recorded with what it holds by their id and principal; without one, only the owners may
+	 * approve them.
 	 */
 	beginTurn(
 		selectionId: string,
 		confirmed: boolean,
 		addressee?: OwnerIdentity,
-		speakerId?: string,
+		speaker?: Pick<Speaker, "id" | "principalId">,
 	): void {
 		this.#selectionId = selectionId;
-		this.#speakerId = speakerId;
+		this.#speaker = speaker;
 		this.#addressee = addressee ?? this.#owner;
 		this.#approved = confirmed ? [...(this.pending()?.calls ?? [])] : [];
 		this.#pending = undefined;
@@ -127,7 +136,7 @@ export class ConfirmationGate {
 	async review(
 		tool: string,
 		input: Record<string, unknown>,
-		ask?: { prompts: OwnerPrompts; asker: string; signal?: AbortSignal },
+		ask?: { prompts: Prompts; asker: string; signal?: AbortSignal },
 	): Promise<string | undefined> {
 		return (await this.decide(tool, input, ask)).reason;
 	}
@@ -139,7 +148,7 @@ export class ConfirmationGate {
 	async decide(
 		tool: string,
 		input: Record<string, unknown>,
-		ask?: { prompts: OwnerPrompts; asker: string; signal?: AbortSignal },
+		ask?: { prompts: Prompts; asker: string; signal?: AbortSignal },
 	): Promise<{ reason?: string; approvedOnCard?: true }> {
 		const call = this.#needing(tool, input);
 		if (!call) return {};
@@ -191,7 +200,12 @@ export class ConfirmationGate {
 			selectionId,
 			heldAt: new Date(),
 			calls: [],
-			...(this.#speakerId === undefined ? {} : { speakerId: this.#speakerId }),
+			...(this.#speaker
+				? {
+						speakerId: this.#speaker.id,
+						principalId: this.#speaker.principalId,
+					}
+				: {}),
 		};
 		if (
 			!pending.calls.some((c) => c.tool === call.tool && c.input === call.input)