pi-roundtable 0.8.0 → 0.9.1

package/src/core/contract/surface.ts

@@ -1,8 +1,8 @@
 import type { OutboundReply } from "../domain/conversation.ts";
 import type { InterimPosts } from "../domain/interim.ts";
-import type { OwnerPrompts } from "../domain/owner-prompts.ts";
 import type { TurnProgress } from "../domain/progress.ts";
 import { PluginError } from "../errors.ts";
+import type { PromptScope, Prompts } from "../interactions/prompts.ts";
 import type { ChannelKey } from "../sessions.ts";
 import type { Speaker } from "../speakers.ts";
 import type { InboundMessage } from "./channels.ts";
@@ -58,6 +58,13 @@ export interface ChatSurface {
 	 * `conversations.stop(channel)` when used. Absent = none shown.
 	 */
 	showStop?(channel: ChannelKey): () => void;
+	/**
+	 * Marks in the channel, publicly, that its conversation just started over, so what a reader of
+	 * the channel's history would take for the conversation's context ends there; called after the
+	 * claim's `startFresh` succeeded. A rejection is logged and the restart still counts. Absent =
+	 * nothing is posted.
+	 */
+	markFresh?(channel: ChannelKey): Promise<void>;
 	/** Adds or removes the bot's reaction on a message; failures are logged, never thrown. */
 	react?(channel: ChannelKey, messageId: string, emoji: string): Promise<void>;
 	unreact?(
@@ -66,10 +73,12 @@ export interface ChatSurface {
 		emoji: string,
 	): Promise<void>;
 	/**
-	 * How the owner approves held actions or answers ask_user in a running turn; undefined, or
-	 * absent, = the action is held until the owner's next message.
+	 * How those the scope names approve held actions or answer ask_user in a running turn: the
+	 * scope's speaker, and in a shared conversation the owners; see `Prompts` and `PromptScope`.
+	 * Without a scope the prompts are the owners'. Undefined, or absent, = the action is held
+	 * until a message approves it.
 	 */
-	prompts?(channel: ChannelKey, speaker?: Speaker): OwnerPrompts | undefined;
+	prompts?(channel: ChannelKey, scope?: PromptScope): Prompts | undefined;
 	/**
 	 * Where a running turn posts the text it writes before its final answer: ordinary messages it
 	 * may edit in place. Absent, or undefined, = only the final reply is posted.
@@ -98,8 +107,15 @@ export interface SurfacePort {
 	showStop(channel: ChannelKey): () => void;
 	react(channel: ChannelKey, messageId: string, emoji: string): Promise<void>;
 	unreact(channel: ChannelKey, messageId: string, emoji: string): Promise<void>;
-	/** The owner's prompts in the channel; undefined when its surface has none. */
-	prompts(channel: ChannelKey, speaker?: Speaker): OwnerPrompts | undefined;
+	/**
+	 * The prompts in the channel for the scope's turn; undefined when its surface has none. A
+	 * `Speaker`, the 0.8 form, is read as theirs in a shared conversation, with a deprecation
+	 * warning, until 1.0.
+	 */
+	prompts(
+		channel: ChannelKey,
+		scope?: PromptScope | Speaker,
+	): Prompts | undefined;
 	/** The channel's interim posts; undefined when its surface has none. */
 	interim(channel: ChannelKey): InterimPosts | undefined;
 	/**

package/src/core/conversations/conversation-registry.ts

@@ -34,6 +34,20 @@ export interface ConversationRegistry {
 	get(key: ChannelKey): Promise<ConversationRecord | undefined>;
 	/** One principal's conversations, or every one; the most recently active first. */
 	list(filter?: { principal?: string }): Promise<ConversationRecord[]>;
+	/**
+	 * Only for migrating a conversation recorded before 0.9, when every turn run without a
+	 * visibility was recorded `shared` with no principal: makes such a conversation private to
+	 * `principalId`, as the plugin that hands over what 0.8 left behind decides, such as remote-mcp
+	 * giving 0.8's sessions to the primary owner. A conversation that is private or names a
+	 * principal never changes, so adopting is safe to repeat and to race: one principal wins.
+	 * Returns what is stored, or undefined when the key is unknown. Adopting a conversation 0.9 or
+	 * later recorded is outside this contract: today it changes one recorded shared like any other,
+	 * and a later version may refuse it.
+	 */
+	adopt(
+		key: ChannelKey,
+		principalId: string,
+	): Promise<ConversationRecord | undefined>;
 	/** Names a conversation, or clears its name; undefined when the key is unknown. */
 	setTitle(
 		key: ChannelKey,

package/src/core/conversations/conversation-store.ts

@@ -100,6 +100,19 @@ export class PgConversationRegistry implements ConversationRegistry {
 		return rows.map(recordOf);
 	}
 
+	async adopt(
+		key: ChannelKey,
+		principalId: string,
+	): Promise<ConversationRecord | undefined> {
+		// The row lock makes a racing adopt wait and then find the conversation no longer no one's.
+		const rows: Row[] = await this.#sql`
+			UPDATE conversations SET visibility = 'private', principal_id = ${principalId}
+			WHERE key = ${key} AND visibility = 'shared' AND principal_id IS NULL
+			RETURNING *`;
+		const [row] = rows;
+		return row ? recordOf(row) : this.get(key);
+	}
+
 	async setTitle(
 		key: ChannelKey,
 		title: string | undefined,

package/src/core/define-roundtable.ts

@@ -13,6 +13,7 @@ import {
 	precheckPlugin,
 	scheduleStorePlugin,
 } from "./builtin/stores.ts";
+import { warnDeprecations } from "./config/access.ts";
 import {
 	type ResolvedConfig,
 	type RoundtableConfig,
@@ -23,17 +24,23 @@ import { ConfigError } from "./domain/errors.ts";
 import { JudgeError } from "./errors.ts";
 import type { RoundtableOptions } from "./host.ts";
 import type { ListenerConfig } from "./http/listeners.ts";
+import { identityPlugin } from "./identity/identity-plugin.ts";
 import { type JudgeModel, piJudgeModel } from "./judging/model-judge.ts";
 import { createLogger, type LogEntry, type Logger } from "./log.ts";
 import { formatModelRef, type ModelRef } from "./models.ts";
 import { ErrorReporter } from "./ops/error-reporter.ts";
 import type { RoundtablePlugin } from "./plugin.ts";
+import {
+	BRIDGE_MEMORY_FIX,
+	bridgeMemoryProblem,
+	configuredCrowd,
+	onClaudeBridge,
+} from "./runtime/bridge-guard.ts";
 import {
 	type AgentSessionsSlot,
 	agentSessionsSlot,
 	runtimePlugin,
 } from "./runtime/runtime-plugin.ts";
-import { speakerPolicy } from "./speakers.ts";
 import { toolTiers } from "./tool-tiers.ts";
 
 /** What `defineRoundtable` returns: give both to `new Roundtable(options, plugins)`. */
@@ -111,6 +118,19 @@ function publicListener(
 	};
 }
 
+/**
+ * The owner the Discord parts act for: the primary owner, by the Discord user id among their
+ * identities, until those parts follow each turn's principal.
+ */
+export function discordOwnerOf(
+	config: ResolvedConfig,
+): ResolvedConfig["owner"] {
+	return {
+		...config.owner,
+		id: config.primaryOwner.discordId ?? config.owner.id,
+	};
+}
+
 /** The Discord bot and the agent server that lives there, each in its place in the plugin list. */
 interface DiscordAssembly {
 	discord: RoundtablePlugin;
@@ -129,12 +149,8 @@ function discordAssembly(
 		errorReporter: ErrorReporter | undefined;
 	},
 ): DiscordAssembly {
-	const { name, owner } = config;
-	const speakers = speakerPolicy({
-		owners: [owner.id],
-		...(config.speakers.admins ? { admins: config.speakers.admins } : {}),
-		...(config.speakers.members ? { members: config.speakers.members } : {}),
-	});
+	const { name } = config;
+	const owner = discordOwnerOf(config);
 	const sharedPrompt = config.prompts.shared
 		? readPrompt(config.prompts.shared, "prompts.shared")
 		: readPrompt(join(ASSETS, "prompts", "shared.md"), "prompts.shared");
@@ -147,12 +163,15 @@ function discordAssembly(
 			token: discord.token,
 			ownerId: owner.id,
 			ownerName: owner.name,
-			speakers,
 			rootCommand: discord.rootCommand,
 			dataDir: config.dataDir,
 			...(discord.refusalHint === undefined
 				? {}
 				: { refusalHint: discord.refusalHint }),
+			channelContext: discord.channelContext,
+			...(discord.freshMarker === undefined
+				? {}
+				: { freshMarker: discord.freshMarker }),
 		}),
 		admin: discord.admin ? [discordAdminPlugin({ owner })] : [],
 		skills: config.skills
@@ -170,7 +189,6 @@ function discordAssembly(
 			entryChannelId: discord.entryChannel,
 			owner,
 			assistant: name,
-			speakers,
 			modelRuntime: shared.modelRuntime,
 			dataDir: config.dataDir,
 			model: config.model,
@@ -180,6 +198,7 @@ function discordAssembly(
 			scratchDir: config.scratchDir,
 			shellUser: userInfo().username,
 			prompts: { shared: sharedPrompt, guest },
+			...(discord.agentMemory ? { memory: discord.agentMemory } : {}),
 			avatarListener: "public",
 			// resolveConfig refuses Discord without a public address.
 			avatarUrl: config.http?.publicUrl ?? "",
@@ -207,6 +226,7 @@ export async function defineRoundtable(
 ): Promise<DefinedRoundtable> {
 	const config = resolveConfig(input);
 	const { name, owner, discord } = config;
+	const crowd = configuredCrowd(config.access, config.plugins);
 	// Nothing here touches the process: the host applies the environment when it runs.
 	const modelRuntime =
 		overrides.modelRuntime ??
@@ -219,7 +239,7 @@ export async function defineRoundtable(
 		? new ErrorReporter({ destination: config.ops, app: name })
 		: undefined;
 	const { errorSink } = overrides;
-	const logger =
+	const logger: Logger =
 		overrides.logger ??
 		createLogger(
 			config.slug,
@@ -230,6 +250,12 @@ export async function defineRoundtable(
 					}
 				: undefined,
 		);
+	if (config.memory && crowd && onClaudeBridge(config.model))
+		logger.warn(
+			{},
+			`${bridgeMemoryProblem(formatModelRef(config.model), crowd)} ${BRIDGE_MEMORY_FIX}`,
+		);
+	warnDeprecations(logger, config.deprecations);
 	// The agent server hands the runtime its per-agent settings once it sets up.
 	const agentSessions = agentSessionsSlot();
 	const assembly = discord
@@ -250,16 +276,18 @@ export async function defineRoundtable(
 				agentDir: config.agentDir,
 			},
 			database: { url: config.databaseUrl },
-			toolTiers: toolTiers(config.toolTiers),
+			toolTiers: toolTiers(config.toolTiers, logger),
 			listeners: [
 				...(config.http ? [publicListener(config.http)] : []),
 				...(overrides.listeners ?? []),
 			],
 			judgeModel: judgeThrough(modelRuntime, config.judge.model),
 			apiKey: (provider) => registry.getApiKeyForProvider(provider),
+			drain: { limitMs: config.drainMs },
 			...(overrides.aborted ? { aborted: overrides.aborted } : {}),
 		},
 		plugins: [
+			identityPlugin({ rules: config.access, plugins: config.plugins }),
 			...(config.memory ? [memoryPlugin({ owner })] : []),
 			scheduleStorePlugin(),
 			precheckPlugin(),
@@ -271,6 +299,7 @@ export async function defineRoundtable(
 				agentDir: config.agentDir,
 				dataDir: config.dataDir,
 				delegation: config.delegation,
+				perPrincipal: config.background.perPrincipal,
 				// A conversation's reports are the modules' to deliver.
 				...(errorReporter && "conversation" in errorReporter.destination
 					? { errorReporter }
@@ -290,6 +319,8 @@ export async function defineRoundtable(
 				agents: agentSessions,
 				interimText: config.interimText,
 				interimPrimaryChars: config.interimPrimaryChars,
+				memory: config.memory,
+				...(crowd ? { crowd } : {}),
 			}),
 			...(assembly ? [assembly.agentServer, assembly.seeds] : []),
 			...config.plugins,

package/src/core/discord/agent-panel.ts

@@ -47,7 +47,7 @@ export function agentPanel(options: AgentPanelOptions): AgentPanel {
 				interaction.isButton() &&
 				interaction.customId.startsWith(AGENT_BUTTON_PREFIX)
 			) {
-				if (!guard.isOwner(interaction)) return true;
+				if (!(await guard.allows(interaction))) return true;
 				await guard.run(interaction, () => commands.button(interaction));
 				return true;
 			}
@@ -55,7 +55,7 @@ export function agentPanel(options: AgentPanelOptions): AgentPanel {
 				interaction.isModalSubmit() &&
 				interaction.customId.startsWith(AGENT_MODAL_PREFIX)
 			) {
-				if (!guard.isOwner(interaction)) return true;
+				if (!(await guard.allows(interaction))) return true;
 				await interaction.deferReply({ flags: MessageFlags.Ephemeral });
 				await guard.run(interaction, () => commands.submit(interaction));
 				return true;

package/src/core/discord/card-audience.ts

@@ -0,0 +1,148 @@
+import { messages } from "../i18n/index.ts";
+import type { PromptScope } from "../interactions/prompts.ts";
+import { type Tier, tierAtLeast } from "../speakers.ts";
+import type {
+	DiscordOwners,
+	DiscordOwnersOptions,
+	DiscordUser,
+} from "./discord-owners.ts";
+
+/** The people a card is for. */
+export interface Audience {
+	/** Whether this user may answer, as they are when they press. */
+	allows(user: DiscordUser): Promise<boolean>;
+	/** The users the card mentions in a thread, in order. */
+	mentions: readonly string[];
+	/** Shown on the card; empty for none. */
+	note: string;
+	/** What someone else who presses it is told. */
+	refusal: string;
+}
+
+/** The primary owner, who answers every card the owners may, and who else holds a tier. */
+export type CardAudienceOptions = DiscordOwnersOptions;
+
+/**
+ * Whom a card is for, by the prompt scope of the turn that asks. The speaker's principal answers
+ * their own card on any of their Discord identities that is still theirs when they press when,
+ * for an approval, they hold its tier, checked again then, and, for an owner-tier one, they are
+ * an owner; the card mentions the identity that spoke where it is one of those, or else all of
+ * them. Where the scope
+ * escalates to the owners, every owner with a Discord identity answers it too, and a card the
+ * speaker cannot answer, or whose principal has no Discord identity, is theirs alone; where it
+ * escalates to no one, that card goes to no one. Without a scope, a card is the owners'.
+ */
+export class CardAudiences {
+	readonly #options: CardAudienceOptions;
+	readonly #owners: DiscordOwners;
+
+	constructor(options: CardAudienceOptions, owners: DiscordOwners) {
+		this.#options = options;
+		this.#owners = owners;
+	}
+
+	/** Who may approve a call held at `minTier`; undefined when no one may. */
+	approval(
+		scope: PromptScope | undefined,
+		minTier: Tier,
+	): Promise<Audience | undefined> {
+		return this.#audience(scope, minTier, {
+			note: messages().cardApproversNote,
+			refusal: messages().cardApproversRefusal,
+		});
+	}
+
+	/** Who may answer a question; undefined when no one may. */
+	question(scope: PromptScope | undefined): Promise<Audience | undefined> {
+		return this.#audience(scope, undefined, {
+			note: messages().cardAskerNote,
+			refusal: messages().cardAskerRefusal,
+		});
+	}
+
+	async #audience(
+		scope: PromptScope | undefined,
+		minTier: Tier | undefined,
+		words: { note(...userIds: string[]): string; refusal: string },
+	): Promise<Audience | undefined> {
+		const { ownerId } = this.#options;
+		const escalates = scope?.escalate !== "none";
+		const own = scope && (await this.#ownIdentities(scope, minTier));
+		if (scope && own) {
+			const primary = own.includes(ownerId);
+			const mentions = own.includes(scope.speakerId) ? [scope.speakerId] : own;
+			return {
+				allows: async (user) => {
+					// Read the links again: one moved or unlinked since the card was posted is no longer theirs.
+					if (
+						own.includes(user.id) &&
+						(await this.#stillOwn(scope.principalId, user.id))
+					)
+						return (
+							(primary && user.id === ownerId) ||
+							this.#owners.holds(user, minTier, scope.principalId)
+						);
+					return escalates && this.#owners.isOwner(user);
+				},
+				mentions,
+				note: primary ? "" : words.note(...mentions),
+				refusal: primary ? messages().cardOwnerOnly : words.refusal,
+			};
+		}
+		if (!escalates) return undefined;
+		return {
+			allows: (user) => this.#owners.isOwner(user),
+			mentions: await this.#owners.ids(),
+			note: "",
+			refusal: messages().cardOwnerOnly,
+		};
+	}
+
+	/** Whether the Discord user is still one of the principal's identities; false when that cannot be read. */
+	async #stillOwn(principalId: string, userId: string): Promise<boolean> {
+		return (
+			(await this.#discordIdentities(principalId))?.includes(userId) ?? false
+		);
+	}
+
+	/** The principal's Discord user ids; undefined, and logged, when they cannot be read. */
+	async #discordIdentities(principalId: string): Promise<string[] | undefined> {
+		const { identity, logger } = this.#options;
+		if (!identity) return undefined;
+		try {
+			return (await identity.identities(principalId))
+				.filter((link) => link.provider === "discord")
+				.map((link) => link.subject);
+		} catch (error) {
+			logger.warn(
+				{ principal: principalId, err: error },
+				"could not read the speaker's identities; none counts as theirs, so their card is the owners'",
+			);
+			return undefined;
+		}
+	}
+
+	/**
+	 * The Discord identities of the scope's principal when they may answer their own card: at the
+	 * tier it needs and, for an owner-tier call, an owner; undefined when they may not, or have
+	 * none.
+	 */
+	async #ownIdentities(
+		scope: PromptScope,
+		minTier: Tier | undefined,
+	): Promise<string[] | undefined> {
+		if (
+			!this.#options.identity ||
+			(minTier && !tierAtLeast(scope.tier, minTier))
+		)
+			return undefined;
+		// A turn whose tier defaulted to owner is not an owner's: its owner-tier call is the owners'.
+		if (
+			minTier === "owner" &&
+			!(await this.#owners.isOwnerPrincipal(scope.principalId))
+		)
+			return undefined;
+		const own = await this.#discordIdentities(scope.principalId);
+		return own && own.length > 0 ? own : undefined;
+	}
+}