slotlock 0.5.1 → 0.5.2

package/dashboard.js

@@ -14,7 +14,12 @@
 // keeps these in Postgres, so they hold on every server that shares the database; the resource cap
 // is held in the database too.
 import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { describeSlotlockAgentWrite, invokeSlotlockAgentOperation, slotlockAgentTools, } from './agent-server.js';
+import { SLOTLOCK_ASSISTANT_API_KEY, SLOTLOCK_ASSISTANT_MAX_ACTION_BYTES, SLOTLOCK_ASSISTANT_MAX_MESSAGE, SLOTLOCK_ASSISTANT_MAX_PENDING, SLOTLOCK_ASSISTANT_MODEL_NAME, SLOTLOCK_ASSISTANT_TOOL_USE, boundSlotlockAssistantEntries, createSlotlockAssistantStore, openSlotlockAssistantKey, pendingSlotlockAssistantActions, pruneSlotlockAssistantActions, checkSlotlockAssistantHost, readSlotlockAssistantBaseUrl, slotlockAssistantUrlAllowed, readSlotlockAssistantEntries, runSlotlockAssistantTurn, sealSlotlockAssistantKey, slotlockAssistantProviderMessage, slotlockAssistantSystemPrompt, testSlotlockAssistantModel, } from './assistant.js';
 import { SLOTLOCK_DASHBOARD_NAME_PATTERN } from './config.js';
+import { createSlotlockRateLimiter } from './rate-limit.js';
+import { createSlotlockGuardedFetch } from './webhooks.js';
+import { lookup as dnsLookup } from 'node:dns/promises';
 import { SLOTLOCK_DASHBOARD_FORM_LIMIT } from './ddl.js';
 import { ignoreRejection } from './hooks.js';
 import { SLOTLOCK_BOOKING_RULE_LIMITS } from './booking-rules.js';
@@ -25,6 +30,8 @@ export const SLOTLOCK_DASHBOARD_MAX_RESOURCES = 100;
 const SESSION_TTL_MS = 12 * 3_600_000;
 const SIGN_IN_TTL_MS = 10 * 60_000;
 const MAX_FORM_BYTES = 8_192;
+/** A message to the assistant: 2,000 characters, each up to 9 bytes as a form encodes it. */
+const MAX_ASSISTANT_FORM_BYTES = 24_576;
 /**
  * Sign-ins (record, then GitHub's token and user) one instance runs at once; more are told to retry.
  * This also bounds how fast unauthenticated callbacks can write sign-in records.
@@ -50,6 +57,13 @@ const POST_ROUTES = new Set([
     '/waitlist/leave',
     '/hours',
     '/organization',
+    '/assistant',
+    '/assistant/approve',
+    '/assistant/dismiss',
+    '/assistant/reset',
+    '/settings/assistant',
+    '/settings/assistant/test',
+    '/settings/assistant/remove',
 ]);
 const SIGN_IN_AGAIN = 'That sign-in did not finish here, or took too long. Sign in again.';
 const GITHUB_ERROR_CODE = /^[a-z0-9_]{1,64}$/;
@@ -130,6 +144,7 @@ export function createSlotlockDashboardResources(store) {
             remove: async (tenantRef, id, actor) => (await store.withTenant(tenantRef, (tenant) => tenant.deleteWebhookEndpoint({ tenantRef, id }), by(actor))).deleted,
             enable: (tenantRef, id, actor) => store.withTenant(tenantRef, (tenant) => tenant.enableWebhookEndpoint({ tenantRef, id }), by(actor)),
         },
+        assistant: createSlotlockAssistantStore(store),
     };
 }
 function assertExpiry(expiresAt) {
@@ -315,6 +330,7 @@ const ICONS = Object.freeze({
     keys: icon('<circle cx="8" cy="15" r="4"/><path d="M11 12l9-9M16 7l3 3"/>'),
     waitlist: icon('<path d="M4 6h16M4 12h10M4 18h6"/><circle cx="18" cy="16" r="3"/>'),
     webhooks: icon('<path d="M9 7a3 3 0 1 1 4 2.8L16 15M6.5 13.5A3 3 0 1 0 9 18h6M15 18a3 3 0 1 0 1.5-5.6"/>'),
+    assistant: icon('<path d="M4 5h16v11H9l-5 4z"/><path d="M8 9h8M8 12h5"/>'),
     settings: icon('<path d="M4 7h10M18 7h2M4 17h4M12 17h8"/><circle cx="16" cy="7" r="2"/><circle cx="10" cy="17" r="2"/>'),
     check: icon('<path d="M5 12l5 5L20 7"/>'),
     github: new Html('<svg class="icon" viewBox="0 0 16 16" aria-hidden="true" focusable="false"><path class="fill" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg>'),
@@ -724,6 +740,9 @@ export function createSlotlockDashboard(options) {
         ...(options.resources.webhooks
             ? [{ section: 'webhooks', label: 'Webhooks', path: '/webhooks', icon: ICONS.webhooks }]
             : []),
+        ...(assistantStore()
+            ? [{ section: 'assistant', label: 'Assistant', path: '/assistant', icon: ICONS.assistant }]
+            : []),
         { section: 'settings', label: 'Settings', path: '/settings', icon: ICONS.settings },
     ];
     /** The workspace the session acts in: its organization, or the person themselves. */
@@ -855,7 +874,11 @@ ${served ? html `<td data-label="Created by">${key.createdBy === personOf(sessio
                             ? 'A deleted key'
                             : /^github:\d+$/.test(change.actor)
                                 ? `GitHub user ${change.actor.slice(7)}`
-                                : change.actor.slice(0, 60)));
+                                : /^dashboard-assistant:github:\d+$/.test(change.actor)
+                                    ? change.actor === assistantActor(session)
+                                        ? `Assistant for @${session.login}`
+                                        : `Assistant for GitHub user ${change.actor.slice(27)}`
+                                    : change.actor.slice(0, 60)));
             const where = change.resourceId
                 ? resourceName(byId.get(change.resourceId), change.resourceId)
                 : null;
@@ -954,10 +977,12 @@ ${resources.length === 0
             : html `<div class="table"><table><thead><tr><th>Reference</th><th>Time zone</th><th>Bookable hours</th><th>Resource id</th></tr></thead><tbody>${resources.map((resource) => html `<tr><td data-label="Reference" class="strong"><span class="cell"><a href="${root}/resources/${resource.id}">${resourceName(resource, resource.id)}</a>${resource.pool ? html `<span class="meta">Pool ${resource.pool}</span>` : html ``}</span></td><td data-label="Time zone">${resource.timezone}</td><td data-label="Bookable hours">${hoursSummary(resource.availabilityRules)} <a href="${root}/hours?resource=${resource.id}">Set hours</a></td><td data-label="Resource id"><code class="muted">${resource.id}</code></td></tr>`)}</tbody></table></div>`}`;
         return respond(status, layout('Resources', content, session, 'resources'));
     }
-    function settingsPage(session) {
+    async function settingsPage(session, status = 200, notice) {
         const rules = options.availability ?? [];
         const current = session.orgs?.find((org) => org.id === session.org);
-        const content = html `${pageHead('Settings')}
+        const content = html `${noticeOf(notice)}
+${pageHead('Settings')}
+${await assistantSettingsPanel(session)}
 <section class="panel">
 <h2>Endpoints</h2>
 ${endpoints()}
@@ -976,7 +1001,7 @@ ${rules.length === 0
             : html `<dt>Workspace</dt><dd>Personal</dd>`}<dt>Session ends</dt><dd>${formatDate(new Date(session.exp))}</dd></dl>
 ${current ? html `<p class="fine">Membership is read from GitHub when you sign in.</p>` : html ``}
 </section>`;
-        return respond(200, layout('Settings', content, session, 'settings'));
+        return respond(status, layout('Settings', content, session, 'settings'));
     }
     /** The tenant's resource with that id and every resource (for names), or null for anything else. */
     async function resourceDetailPage(session, id, status = 200, notice) {
@@ -1244,6 +1269,518 @@ ${entries.length === 0
         }
         return redirect(303, `${root}/waitlist`);
     }
+    // ---- The assistant ----
+    const assistantOptions = options.assistant;
+    /** The assistant's records, when the assistant is on and the adapter keeps them. Per request (Workers). */
+    const assistantStore = () => assistantOptions ? options.resources.assistant : undefined;
+    const privateUrls = assistantOptions?.privateUrls === true;
+    const assistantFetch = assistantOptions?.fetch ?? createSlotlockGuardedFetch({ allowPrivateNetworks: privateUrls });
+    const resolveHost = assistantOptions?.resolve ??
+        (async (hostname) => (await dnsLookup(hostname, { all: true })).map(({ address }) => address));
+    const PRIVATE_URL_REFUSAL = 'That URL is, or resolves to, a local or private network address (loopback, private, link-local, shared, unique-local or cloud metadata), which this server does not reach. For a model on its own machine or network, the server’s operator can allow them with SLOTLOCK_ASSISTANT_PRIVATE_URLS=on.';
+    const assistantTimeout = assistantOptions?.timeoutMs ?? 30_000;
+    const assistantTurnTimeout = assistantOptions?.turnTimeoutMs ?? 90_000;
+    const conversationTtl = assistantOptions?.conversationTtlMs ?? 2 * 3_600_000;
+    if (assistantOptions && Buffer.byteLength(assistantOptions.secret, 'utf8') < 32) {
+        throw new Error('Slotlock dashboard assistant secret must be at least 32 bytes');
+    }
+    if (assistantOptions && assistantOptions.secret === options.sessionSecret) {
+        throw new Error('Slotlock dashboard assistant secret must differ from the session secret');
+    }
+    const memberMessages = createSlotlockRateLimiter(assistantOptions?.rate ?? { perSecond: 10 / 60, burst: 10 }, now);
+    const toolTitles = new Map(slotlockAgentTools().map((tool) => [tool.name, tool.title]));
+    /** The writes that take an idempotency key: the dashboard sets it, from the action's id. */
+    const keyed = new Set(slotlockAgentTools()
+        .filter((tool) => 'idempotency_key' in (tool.inputSchema.properties ?? {}))
+        .map((tool) => tool.name));
+    const ACTION_ID = /^[A-Za-z0-9_-]{16}$/;
+    /** Reads one member message may make, and the resource-days they may cover together. */
+    const MAX_READS_PER_TURN = 16;
+    const MAX_READ_COST_PER_TURN = 400;
+    /** What a read costs the turn: the resources it names times the days its window spans. */
+    const readCostOf = (input) => {
+        if (!isRecord(input))
+            return 1;
+        const ids = Array.isArray(input.resource_ids) ? input.resource_ids.length : 1;
+        const start = typeof input.start === 'string' ? Date.parse(input.start) : Number.NaN;
+        const end = typeof input.end === 'string' ? Date.parse(input.end) : Number.NaN;
+        const days = Number.isFinite(start) && Number.isFinite(end) && end > start ? Math.ceil((end - start) / DAY_MS) : 1;
+        return Math.max(1, ids) * Math.max(1, days);
+    };
+    /**
+     * Who the assistant acts as, for the record and for ownership: the member by GitHub user id,
+     * which a rename does not change. Shown as "Assistant for @login".
+     */
+    const assistantActor = (session) => `dashboard-assistant:github:${session.uid}`;
+    const CONFIRMED_WRITES = new Set([
+        'slotlock_create_event',
+        'slotlock_update_event',
+        'slotlock_delete_event',
+        'slotlock_book_together',
+        'slotlock_book_pool',
+    ]);
+    /**
+     * The sentence a proposed change's card leads with: the agent server's confirmation question
+     * (the resource by name, the times in its zone, an event as it stands: its title, resource and
+     * time), or for holds the slots by resource. Read as the member's assistant, under `authorize`.
+     */
+    async function summarize(session, operation, input) {
+        const assistant = assistantOptions;
+        let text;
+        if (CONFIRMED_WRITES.has(operation)) {
+            text = await describeSlotlockAgentWrite({
+                backend: assistant.backend,
+                authorize: assistantAuthorize,
+                principal: assistantPrincipal(session),
+                operation: operation,
+                input,
+                signal: AbortSignal.timeout(assistantTimeout),
+            }).catch(() => '');
+        }
+        else if (operation === 'slotlock_hold_slots' && Array.isArray(input.slots)) {
+            const names = new Map((await options.resources.list(tenantOf(session))).map((resource) => [resource.id, resourceName(resource, resource.id)]));
+            const slots = input.slots.map((slot) => `${names.get(String(slot.resource_id)) ?? `resource ${String(slot.resource_id)}`} ${String(slot.start)} to ${String(slot.end)}`);
+            text = `Hold ${slots.join('; ')} for ${String(input.ttl_seconds ?? '')} seconds, as alternatives.`;
+        }
+        else if (operation === 'slotlock_release_slots') {
+            text = `Release the hold ${String(input.hold_id)} and every slot held with it.`;
+        }
+        else {
+            text = '';
+        }
+        // At most 1,500 UTF-8 bytes, so four waiting changes stay within the conversation's bound.
+        return text.length > 500 ? `${text.slice(0, 500)}…` : text;
+    }
+    /** Owners of the organization in use may change its assistant; a person always may their own. */
+    const isAdmin = (session) => !served || session.orgs?.find((org) => org.id === session.org)?.role === 'admin';
+    const assistantPrincipal = (session) => ({
+        subject: assistantActor(session),
+        tenantRef: tenantOf(session),
+        scopes: ['read', 'write'],
+    });
+    /** The fixed list, then the embedder's check: nothing the model sends adds to it. */
+    const assistantAuthorize = async (args) => SLOTLOCK_ASSISTANT_TOOL_USE[args.operation] !== 'excluded' &&
+        (assistantOptions?.authorize ? await assistantOptions.authorize(args) : true);
+    /**
+     * One agent operation as the member's assistant. A `propose` call is checked as an agent's is
+     * (arguments, scopes, authorize) and halted by `confirm` before it runs; it takes no admission
+     * slot and no rate token, which the write takes when it runs, approved (`run`).
+     */
+    function dispatch(session, operation, input, mode, confirm) {
+        const assistant = assistantOptions;
+        const principal = assistantPrincipal(session);
+        return invokeSlotlockAgentOperation({
+            operation,
+            input,
+            request: new Request(`${origin}${root}/assistant`, {
+                signal: AbortSignal.timeout(assistantTimeout),
+            }),
+            options: {
+                backend: assistant.backend,
+                authenticate: async () => principal,
+                authorize: async (args) => {
+                    if (!(await assistantAuthorize(args)))
+                        return false;
+                    if (mode === 'run')
+                        await assistant.admit?.(args);
+                    return true;
+                },
+                ...(assistant.consumeRateLimit && mode === 'run'
+                    ? { consumeRateLimit: assistant.consumeRateLimit }
+                    : {}),
+                ...(confirm ? { confirm } : {}),
+                onError: (error) => {
+                    try {
+                        ignoreRejection(options.onError?.(error));
+                    }
+                    catch {
+                        // A failing reporter must not change the answer.
+                    }
+                },
+            },
+        });
+    }
+    async function assistantModel(session) {
+        const store = assistantStore();
+        const settings = store ? await store.getSettings(tenantOf(session)) : null;
+        if (!settings || !assistantOptions)
+            return null;
+        if (!slotlockAssistantUrlAllowed(settings.baseUrl, privateUrls) ||
+            !(await checkSlotlockAssistantHost(settings.baseUrl, { privateUrls, resolve: resolveHost }))) {
+            return { problem: PRIVATE_URL_REFUSAL };
+        }
+        let apiKey = null;
+        if (settings.sealedKey !== null) {
+            apiKey = await openSlotlockAssistantKey(assistantOptions.secret, tenantOf(session), settings.sealedKey);
+            if (apiKey === null) {
+                return {
+                    problem: 'The stored API key cannot be opened: the server’s assistant secret changed. An admin can enter the key again in Settings.',
+                };
+            }
+        }
+        return {
+            model: { provider: settings.provider, baseUrl: settings.baseUrl, model: settings.model, apiKey },
+        };
+    }
+    /**
+     * A field of a proposed change, as the card shows it: all of it, wrapped, never cut (the
+     * proposal is bounded instead). A resource is named, with its id beside the name.
+     */
+    function fieldValue(name, value, names) {
+        const named = (id) => (names.has(id) ? `${names.get(id)} (${id})` : id);
+        if (typeof value === 'string') {
+            return html `<span class="wrap">${name === 'resource_id' ? named(value) : value}</span>`;
+        }
+        if (Array.isArray(value) && value.every((item) => typeof item === 'string')) {
+            return html `<span class="wrap">${value.map((item) => (name === 'resource_ids' ? named(item) : item)).join(', ')}</span>`;
+        }
+        if (typeof value === 'number' || typeof value === 'boolean' || value === null) {
+            return html `${String(value)}`;
+        }
+        return html `<pre class="wrap">${JSON.stringify(value, null, 2)}</pre>`;
+    }
+    function actionCard(session, action, names) {
+        const token = csrfToken(session);
+        const fields = Object.entries(action.input).filter(([name]) => name !== 'idempotency_key');
+        const summary = action.summary ? html `<p class="action-summary">${action.summary}</p>` : html ``;
+        const state = {
+            pending: { text: 'Waiting for you', tone: 'held' },
+            approved: { text: 'Running', tone: 'held' },
+            dismissed: { text: 'Dismissed', tone: 'revoked' },
+            done: { text: 'Done', tone: 'active' },
+            failed: { text: 'Failed', tone: 'revoked' },
+        }[action.status] ?? { text: action.status, tone: 'revoked' };
+        const buttons = action.status === 'pending'
+            ? html `<div class="action-buttons"><form class="inline" method="post" action="${root}/assistant/approve"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="action" value="${action.id}"><button class="primary" type="submit">Approve</button></form><form class="inline" method="post" action="${root}/assistant/dismiss"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="action" value="${action.id}"><button type="submit">Dismiss</button></form></div>`
+            : html ``;
+        return html `<li class="action-card" id="action-${action.id}"><div class="action-head"><span class="title">${toolTitles.get(action.operation) ?? action.operation}</span><span class="pill ${state.tone}">${state.text}</span></div>${summary}<dl class="facts">${fields.map(([name, value]) => html `<dt>${name.replaceAll('_', ' ')}</dt><dd>${fieldValue(name, value, names)}</dd>`)}</dl>${action.status === 'failed' && action.outcome ? html `<p class="fine">Refused: <code>${action.outcome}</code></p>` : html ``}${buttons}</li>`;
+    }
+    function readAction(id, value) {
+        if (!isRecord(value) || typeof value.operation !== 'string')
+            return null;
+        return {
+            id,
+            operation: value.operation,
+            input: isRecord(value.input) ? value.input : {},
+            ...(typeof value.summary === 'string' ? { summary: value.summary } : {}),
+            status: (typeof value.status === 'string' ? value.status : 'failed'),
+            ...(typeof value.outcome === 'string' ? { outcome: value.outcome } : {}),
+        };
+    }
+    async function assistantPage(session, status = 200, notice) {
+        const store = assistantStore();
+        if (!store)
+            return notFound(session);
+        const tenantRef = tenantOf(session);
+        const [settings, conversation] = await Promise.all([
+            store.getSettings(tenantRef),
+            store.getConversation(tenantRef, personOf(session)),
+        ]);
+        const entries = readSlotlockAssistantEntries(conversation?.messages);
+        const actions = conversation?.actions ?? {};
+        const names = new Map();
+        if (Object.keys(actions).length > 0) {
+            for (const resource of await options.resources.list(tenantRef)) {
+                names.set(resource.id, resourceName(resource, resource.id));
+            }
+        }
+        const token = csrfToken(session);
+        const items = [];
+        for (const entry of entries) {
+            if (entry.role === 'user')
+                items.push(html `<li class="msg mine"><p>${entry.text}</p></li>`);
+            else if (entry.role === 'assistant' && entry.text.trim() !== '') {
+                items.push(html `<li class="msg bot"><p>${entry.text}</p></li>`);
+            }
+            else if (entry.role === 'note')
+                items.push(html `<li class="notice">${entry.text}</li>`);
+            else if (entry.role === 'tool') {
+                for (const result of entry.results) {
+                    const action = result.action ? readAction(result.action, actions[result.action]) : null;
+                    if (action)
+                        items.push(actionCard(session, action, names));
+                    else {
+                        items.push(html `<li class="tool-line">${result.error ? 'Could not run' : 'Read'}: ${toolTitles.get(result.name) ?? result.name}</li>`);
+                    }
+                }
+            }
+        }
+        const composer = html `<form class="composer" method="post" action="${root}/assistant"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><label class="visually-hidden" for="message">Message</label><textarea id="message" name="message" rows="3" maxlength="${String(SLOTLOCK_ASSISTANT_MAX_MESSAGE)}" required placeholder="Find a free van tomorrow morning and book it for Ana"></textarea><button class="primary" type="submit">Send</button></form>`;
+        const reset = entries.length > 0
+            ? html `<form class="inline" method="post" action="${root}/assistant/reset"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><button type="submit">New conversation</button></form>`
+            : undefined;
+        const content = html `${noticeOf(notice)}
+${pageHead('Assistant', reset)}
+${settings
+            ? html `<section class="panel chat">${items.length === 0
+                ? html `<p class="empty">Ask about bookings and free time. Changes wait for your approval.</p>`
+                : html `<ol class="thread">${items}</ol>`}<span id="latest"></span>${composer}</section>`
+            : html `<p class="empty">${isAdmin(session)
+                ? html `No model is connected. <a href="${root}/settings#assistant">Connect one in Settings</a>.`
+                : 'No model is connected. An admin of this organization can connect one in Settings.'}</p>`}`;
+        return respond(status, layout('Assistant', content, session, 'assistant'));
+    }
+    async function assistantSettingsPanel(session) {
+        const store = assistantStore();
+        if (!store)
+            return html ``;
+        const settings = await store.getSettings(tenantOf(session));
+        const sentTo = html `<p class="fine">Members' messages, and the bookings and resources the assistant reads for them, are sent to this provider.</p>`;
+        if (!isAdmin(session)) {
+            return html `<section class="panel" id="assistant"><h2>Assistant</h2>${settings
+                ? html `<dl class="facts"><dt>Provider</dt><dd>${settings.provider === 'anthropic' ? 'Anthropic' : 'OpenAI-compatible'}</dd><dt>Model</dt><dd>${settings.model}</dd></dl>${sentTo}`
+                : html `<p class="empty">No model is connected. An admin can connect one.</p>`}</section>`;
+        }
+        const token = csrfToken(session);
+        const selected = (provider) => (settings?.provider === provider ? html ` selected` : html ``);
+        return html `<section class="panel" id="assistant">
+<h2>Assistant</h2>
+<form method="post" action="${root}/settings/assistant">
+<input type="hidden" name="csrf" value="${token}">
+<input type="hidden" name="once" value="${formNonce(session)}">
+<div class="grid-form">
+<label>Provider<select name="provider"><option value="anthropic"${selected('anthropic')}>Anthropic Messages API</option><option value="openai"${selected('openai')}>OpenAI-compatible</option></select></label>
+<label>Base URL<input name="base_url" required maxlength="2048" value="${settings?.baseUrl ?? ''}" placeholder="https://api.anthropic.com"></label>
+<label>Model<input name="model" required maxlength="200" value="${settings?.model ?? ''}" placeholder="your-model"></label>
+<label>API key<input name="api_key" type="password" autocomplete="off" maxlength="4096" placeholder="${settings?.keyHint ? 'Leave empty to keep it' : 'Optional for a local model'}"></label>
+</div>
+<p class="fine">Key: ${settings?.keyHint ? html `set, ending in <code>${settings.keyHint}</code>` : 'none'}. OpenAI-compatible covers OpenAI, OpenRouter, vLLM, Ollama and LM Studio; give the URL that ends in <code>/v1</code>.</p>
+${settings?.keyHint ? html `<label class="choice"><input type="checkbox" name="clear_key" value="1"> Remove the key</label>` : html ``}
+<button class="primary" type="submit">Save</button>
+</form>
+${sentTo}
+${settings
+            ? html `<div class="row-actions"><form class="inline" method="post" action="${root}/settings/assistant/test"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><button type="submit">Test connection</button></form><details class="act danger"><summary>Disconnect</summary><div class="pop"><p>Members can no longer chat. The key is deleted.</p><form method="post" action="${root}/settings/assistant/remove"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><button class="danger" type="submit">Disconnect</button></form></div></details></div>`
+            : html ``}
+</section>`;
+    }
+    const adminOnly = (session) => settingsPage(session, 403, 'Only an owner of this organization can change the assistant.');
+    async function saveAssistantSettings(session, form) {
+        const store = assistantStore();
+        if (!store || !assistantOptions)
+            return notFound(session);
+        if (!isAdmin(session))
+            return adminOnly(session);
+        const provider = form.get('provider');
+        const checkedUrl = readSlotlockAssistantBaseUrl(form.get('base_url') ?? '', { privateUrls });
+        const model = (form.get('model') ?? '').trim();
+        const apiKey = (form.get('api_key') ?? '').trim();
+        if (provider !== 'anthropic' && provider !== 'openai') {
+            return settingsPage(session, 400, 'Choose a provider from the list.');
+        }
+        if (!checkedUrl.ok) {
+            return settingsPage(session, 400, checkedUrl.reason === 'private'
+                ? PRIVATE_URL_REFUSAL
+                : 'Give an https base URL (http only for localhost or 127.0.0.1), with no user name, query or #fragment.');
+        }
+        const baseUrl = checkedUrl.url;
+        if (!(await checkSlotlockAssistantHost(baseUrl, { privateUrls, resolve: resolveHost }))) {
+            return settingsPage(session, 400, PRIVATE_URL_REFUSAL);
+        }
+        if (!SLOTLOCK_ASSISTANT_MODEL_NAME.test(model)) {
+            return settingsPage(session, 400, 'Give the model name, 1 to 200 characters without spaces.');
+        }
+        if (apiKey !== '' && !SLOTLOCK_ASSISTANT_API_KEY.test(apiKey)) {
+            return settingsPage(session, 400, 'An API key is up to 4,096 characters without spaces.');
+        }
+        const tenantRef = tenantOf(session);
+        const key = apiKey !== ''
+            ? { sealed: await sealSlotlockAssistantKey(assistantOptions.secret, tenantRef, apiKey), hint: apiKey.slice(-4) }
+            : form.get('clear_key') === '1'
+                ? null
+                : 'keep';
+        // The stored key is only kept for the provider and URL it was entered for: the store decides
+        // that in the write itself, so an owner cannot send it elsewhere, however saves race.
+        const { saved } = await store.putSettings(tenantRef, { provider, baseUrl, model, key }, personOf(session));
+        if (!saved) {
+            return settingsPage(session, 400, 'Enter the API key again: the provider or the base URL changed, and the stored key is only sent where it was entered for. Or remove the key.');
+        }
+        return redirect(303, `${root}/settings#assistant`);
+    }
+    async function removeAssistantSettings(session) {
+        const store = assistantStore();
+        if (!store)
+            return notFound(session);
+        if (!isAdmin(session))
+            return adminOnly(session);
+        await store.deleteSettings(tenantOf(session), personOf(session));
+        return redirect(303, `${root}/settings#assistant`);
+    }
+    const tooManyMessages = (session, page) => page(session, 429, 'You have sent the assistant a lot in the last minute. Wait a moment and try again.');
+    async function testAssistant(session) {
+        if (!assistantStore())
+            return notFound(session);
+        if (!isAdmin(session))
+            return adminOnly(session);
+        if (!memberMessages.take(`${tenantOf(session)}\0${session.uid}`)) {
+            return tooManyMessages(session, settingsPage);
+        }
+        const found = await assistantModel(session);
+        if (found === null)
+            return settingsPage(session, 409, 'Connect a model first.');
+        if ('problem' in found)
+            return settingsPage(session, 409, found.problem);
+        try {
+            const ok = await testSlotlockAssistantModel({
+                model: found.model,
+                fetch: assistantFetch,
+                timeoutMs: assistantTimeout,
+            });
+            return settingsPage(session, ok ? 200 : 502, ok
+                ? `Connected: ${found.model.model} answered and called a tool correctly.`
+                : `${found.model.model} answered, but did not call the tool it was given. Choose a model that supports tool calls.`);
+        }
+        catch (error) {
+            report(error instanceof Error ? error.message : 'assistant connection test failed');
+            return settingsPage(session, 502, slotlockAssistantProviderMessage(error));
+        }
+    }
+    async function sendToAssistant(session, form) {
+        const store = assistantStore();
+        if (!store || !assistantOptions)
+            return notFound(session);
+        const text = (form.get('message') ?? '').trim();
+        if (text === '' || text.length > SLOTLOCK_ASSISTANT_MAX_MESSAGE) {
+            return assistantPage(session, 400, `Write a message of 1 to ${SLOTLOCK_ASSISTANT_MAX_MESSAGE.toLocaleString('en')} characters.`);
+        }
+        if (!memberMessages.take(`${tenantOf(session)}\0${session.uid}`)) {
+            return tooManyMessages(session, assistantPage);
+        }
+        const found = await assistantModel(session);
+        if (found === null)
+            return assistantPage(session, 409, 'No model is connected.');
+        if ('problem' in found)
+            return assistantPage(session, 409, found.problem);
+        const tenantRef = tenantOf(session);
+        const member = personOf(session);
+        const stored = await store.getConversation(tenantRef, member);
+        const entries = boundSlotlockAssistantEntries([
+            ...readSlotlockAssistantEntries(stored?.messages),
+            { role: 'user', text },
+        ]);
+        const proposed = {};
+        const pendingBefore = pendingSlotlockAssistantActions(stored?.actions ?? {});
+        let reads = 0;
+        let readCost = 0;
+        const current = session.orgs?.find((org) => org.id === session.org);
+        const turn = await runSlotlockAssistantTurn({
+            model: found.model,
+            system: slotlockAssistantSystemPrompt({
+                brand: brandName,
+                workspace: current?.login ?? session.login,
+                login: session.login,
+                now: new Date(now()),
+            }),
+            entries,
+            fetch: assistantFetch,
+            timeoutMs: assistantTimeout,
+            turnTimeoutMs: assistantTurnTimeout,
+            ...(assistantOptions.maxSteps !== undefined ? { maxSteps: assistantOptions.maxSteps } : {}),
+            read: async (operation, input) => {
+                // A turn's reads share one budget of resource-days, so 8 steps of wide reads cannot each
+                // scan a hundred resources over years.
+                reads += 1;
+                readCost += readCostOf(input);
+                if (reads > MAX_READS_PER_TURN || readCost > MAX_READ_COST_PER_TURN) {
+                    return { ok: false, code: 'turn_read_budget_exceeded' };
+                }
+                const outcome = await dispatch(session, operation, input, 'run');
+                return outcome.ok
+                    ? outcome
+                    : { ok: false, code: outcome.code, ...(outcome.details ? { details: outcome.details } : {}) };
+            },
+            propose: async (operation, input) => {
+                if (pendingBefore + Object.keys(proposed).length >= SLOTLOCK_ASSISTANT_MAX_PENDING) {
+                    return { ok: false, code: 'too_many_pending_changes' };
+                }
+                const id = randomBytes(12).toString('base64url');
+                const prepared = isRecord(input) && keyed.has(operation)
+                    ? { ...input, idempotency_key: `dashboard-assistant.${id}` }
+                    : input;
+                let checked;
+                // Every check an agent's call passes (arguments, scopes, authorize, rate limit), then halted
+                // here: it runs only when the member approves it.
+                const outcome = await dispatch(session, operation, prepared, 'propose', async ({ input: parsed }) => {
+                    checked = parsed;
+                    return { status: 409, code: 'approval_required' };
+                });
+                if (checked === undefined || outcome.ok || outcome.code !== 'approval_required') {
+                    return { ok: false, code: outcome.ok ? 'internal_error' : outcome.code };
+                }
+                // The card shows every argument: one too large to show is not proposed.
+                if (Buffer.byteLength(JSON.stringify(checked), 'utf8') > SLOTLOCK_ASSISTANT_MAX_ACTION_BYTES) {
+                    return { ok: false, code: 'change_too_large_to_show' };
+                }
+                proposed[id] = {
+                    operation,
+                    input: checked,
+                    status: 'pending',
+                    summary: await summarize(session, operation, checked),
+                };
+                return { ok: true, actionId: id };
+            },
+        });
+        if (turn.failure !== undefined) {
+            report(turn.failure instanceof Error ? turn.failure.message : 'assistant provider failed');
+        }
+        const messages = boundSlotlockAssistantEntries([...entries, ...turn.added]);
+        // Only this turn's proposals are added; the rest are kept as the row holds them now, so one
+        // approved (or a conversation reset) while the turn ran is never put back as it stood.
+        const kept = pruneSlotlockAssistantActions(messages, { ...(stored?.actions ?? {}), ...proposed });
+        await store.putConversation(tenantRef, member, {
+            messages,
+            added: Object.fromEntries(Object.entries(proposed).filter(([id]) => id in kept)),
+            keep: Object.keys(kept),
+        }, conversationTtl);
+        return redirect(303, `${root}/assistant#latest`);
+    }
+    async function settleAction(session, form, decision) {
+        const store = assistantStore();
+        if (!store || !assistantOptions)
+            return notFound(session);
+        const id = form.get('action') ?? '';
+        const tenantRef = tenantOf(session);
+        const member = personOf(session);
+        const claimed = ACTION_ID.test(id)
+            ? await store.settleAction(tenantRef, member, id, 'pending', decision === 'approve' ? { status: 'approved' } : { status: 'dismissed', input: {} })
+            : null;
+        const action = claimed ? readAction(id, claimed) : null;
+        if (!action)
+            return assistantPage(session, 409, 'That change was already approved or dismissed.');
+        const title = toolTitles.get(action.operation) ?? action.operation;
+        let event;
+        if (decision === 'dismiss') {
+            event = `The member dismissed the proposed change ${id} (${title}); it did not run.`;
+        }
+        else if (SLOTLOCK_ASSISTANT_TOOL_USE[action.operation] !== 'propose') {
+            await store.settleAction(tenantRef, member, id, 'approved', { status: 'failed', outcome: 'tool_not_available', input: {} });
+            event = `The proposed change ${id} (${title}) could not run: tool_not_available.`;
+        }
+        else {
+            const outcome = await dispatch(session, action.operation, action.input, 'run');
+            // Settled, the card keeps what it said, not the arguments: the actions stay small.
+            await store.settleAction(tenantRef, member, id, 'approved', outcome.ok ? { status: 'done', input: {} } : { status: 'failed', outcome: outcome.code, input: {} });
+            const result = JSON.stringify(outcome.ok ? outcome.data : { error: { code: outcome.code } });
+            event = `The member approved the proposed change ${id} (${title}). ${outcome.ok ? 'It ran' : 'It was refused'}: ${result.length > 4_000 ? `${result.slice(0, 4_000)} …[truncated]` : result}`;
+        }
+        const stored = await store.getConversation(tenantRef, member);
+        if (stored) {
+            const entries = [
+                ...readSlotlockAssistantEntries(stored.messages),
+                { role: 'event', text: event },
+            ];
+            const messages = boundSlotlockAssistantEntries(entries);
+            await store.putConversation(tenantRef, member, { messages, added: {}, keep: Object.keys(pruneSlotlockAssistantActions(messages, stored.actions)) }, conversationTtl);
+        }
+        return redirect(303, `${root}/assistant#action-${id}`);
+    }
+    async function resetAssistant(session) {
+        const store = assistantStore();
+        if (!store)
+            return notFound(session);
+        await store.deleteConversation(tenantOf(session), personOf(session));
+        return redirect(303, `${root}/assistant`);
+    }
     /** The page a form was sent from, to show what went wrong with it. */
     function pageFor(route) {
         if (route.startsWith('/keys'))
@@ -1254,6 +1791,10 @@ ${entries.length === 0
             return waitlistPage;
         if (route.startsWith('/resources') || route === '/hours')
             return resourcesPage;
+        if (route.startsWith('/assistant') && assistantStore())
+            return assistantPage;
+        if (route.startsWith('/settings'))
+            return settingsPage;
         return overviewPage;
     }
     function hoursPage(session, state) {
@@ -1523,8 +2064,9 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
                 continue;
             }
             const id = String(organization.id);
-            if (served?.has(id))
-                found.set(id, { id, login: organization.login });
+            if (served?.has(id)) {
+                found.set(id, { id, login: organization.login, role: membership.role === 'admin' ? 'admin' : 'member' });
+            }
         }
         return [...found.values()]
             .sort((a, b) => a.login.localeCompare(b.login))
@@ -1615,12 +2157,12 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
         ]);
     }
     /** The form, `'too_large'` past MAX_FORM_BYTES (read no further), or null for another type. */
-    async function readForm(request) {
+    async function readForm(request, maxBytes = MAX_FORM_BYTES) {
         const type = request.headers.get('content-type')?.split(';')[0]?.trim();
         if (type !== 'application/x-www-form-urlencoded')
             return null;
         const declared = Number(request.headers.get('content-length'));
-        if (Number.isFinite(declared) && declared > MAX_FORM_BYTES)
+        if (Number.isFinite(declared) && declared > maxBytes)
             return 'too_large';
         if (!request.body)
             return new URLSearchParams();
@@ -1632,7 +2174,7 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
             if (done)
                 break;
             size += value.byteLength;
-            if (size > MAX_FORM_BYTES) {
+            if (size > maxBytes) {
                 await reader.cancel().catch(() => undefined);
                 return 'too_large';
             }
@@ -1715,7 +2257,7 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
         const session = await readSession(request);
         if (!session)
             return redirect(303, root);
-        const form = await readForm(request);
+        const form = await readForm(request, route === '/assistant' ? MAX_ASSISTANT_FORM_BYTES : MAX_FORM_BYTES);
         if (form === 'too_large') {
             return respond(413, layout('Refused', html `<p class="notice">That form is too large.</p>`, session));
         }
@@ -1784,6 +2326,20 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
                 return changeWebhook(session, form, 'enable');
             case '/waitlist/leave':
                 return leaveWaitlist(session, form);
+            case '/assistant':
+                return sendToAssistant(session, form);
+            case '/assistant/approve':
+                return settleAction(session, form, 'approve');
+            case '/assistant/dismiss':
+                return settleAction(session, form, 'dismiss');
+            case '/assistant/reset':
+                return resetAssistant(session);
+            case '/settings/assistant':
+                return saveAssistantSettings(session, form);
+            case '/settings/assistant/test':
+                return testAssistant(session);
+            case '/settings/assistant/remove':
+                return removeAssistantSettings(session);
             default:
                 return respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, session));
         }
@@ -1807,6 +2363,7 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
                         case '/resources':
                         case '/webhooks':
                         case '/waitlist':
+                        case '/assistant':
                         case '/settings': {
                             const session = await readSession(request);
                             if (!session)
@@ -1819,7 +2376,9 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
                                 return await webhooksPage(session);
                             if (route === '/waitlist')
                                 return await waitlistPage(session);
-                            return settingsPage(session);
+                            if (route === '/assistant')
+                                return await assistantPage(session);
+                            return await settingsPage(session);
                         }
                         case '/style.css':
                             return asset(DASHBOARD_CSS, 'text/css; charset=utf-8', url, ASSET_VERSIONS.css);
@@ -2039,6 +2598,23 @@ td[data-label] > .pill { justify-self: start; }
 td.wrap, .wrap { white-space: normal; overflow-wrap: anywhere; }
 form.inline { display: inline; margin: 0; }
 form > label { margin-bottom: 4px; }
+.chat { display: grid; gap: 16px; }
+.thread { list-style: none; margin: 0; padding: 0; display: grid; gap: 10px; }
+.msg { max-width: 78%; padding: 10px 14px; border-radius: 12px; background: var(--wash); border: 1px solid var(--line); }
+.msg p { margin: 0; color: var(--ink); white-space: pre-wrap; overflow-wrap: anywhere; }
+.msg.mine { justify-self: end; background: var(--accent-wash); border-color: transparent; }
+.msg.bot { justify-self: start; }
+.tool-line { font-size: 12.5px; color: var(--ink-3); padding-left: 4px; }
+.action-card { justify-self: start; width: min(100%, 520px); padding: 14px 16px; border: 1px solid var(--line); border-radius: 12px; background: var(--paper); box-shadow: var(--shadow); display: grid; gap: 10px; }
+.action-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.action-card .facts { font-size: 13px; }
+.action-card .facts dd { overflow-wrap: anywhere; }
+.action-card pre.wrap { white-space: pre-wrap; margin: 0; padding: 8px; font-size: 12px; }
+.action-summary { margin: 0; color: var(--ink); font-weight: 500; overflow-wrap: anywhere; }
+.action-buttons, .row-actions { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+.composer { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 10px; align-items: end; margin: 0; }
+textarea { font: inherit; padding: 8px 10px; border: 1px solid var(--line); border-radius: 8px; background: var(--paper); color: var(--ink); resize: vertical; min-height: 64px; min-width: 0; }
+textarea:focus { border-color: var(--accent); outline: none; box-shadow: 0 0 0 3px var(--accent-wash); }
 .visually-hidden { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
 @media (max-width: 1000px) {
   .split { grid-template-columns: minmax(0, 1fr); }
@@ -2066,6 +2642,8 @@ form > label { margin-bottom: 4px; }
   .actions { text-align: left; }
   .act { margin: 4px 12px 0 0; }
   .pop { left: 0; right: auto; }
+  .msg { max-width: 92%; }
+  .composer { grid-template-columns: minmax(0, 1fr); }
 }
 `;
 const ASSET_VERSIONS = Object.freeze({