viber-channel 0.8.0 → 0.8.2

package/lib/agent_tools.ts

@@ -17,7 +17,7 @@
  * MCP tool-result shape. It does NOT hold state.
  */
 import { postMessage, parseArtifact, type Artifact } from "./messages.js";
-import { listPeers, openDm, type OpenDmResult } from "./peers.js";
+import { listPeersAuto, openDm, type OpenDmResult } from "./peers.js";
 import { ConversationTokenExpiredError } from "./messages.js";
 
 /** MCP tool-result shape (text content + optional error flag). */
@@ -66,22 +66,36 @@ function errorText(s: string): AgentToolResult {
 }
 
 /**
- * list_agents — return this project's other agents so the model can pick one to
- * message. Guards the startup window: an empty instance token means "channel not
- * ready" rather than hitting the peers endpoint with no credential.
+ * list_agents — return the other agents so the model can pick one to message.
+ * Guards the startup window: an empty instance token means "channel not ready"
+ * rather than hitting the peers endpoint with no credential.
+ *
+ * #307: the listing runs at the widest allowed scope (listPeersAuto) — an
+ * ORCHESTRATOR instance sees the agents of ALL its owner's projects (each
+ * entry then carries a `project` field); a regular instance transparently
+ * falls back to its own project (unchanged behaviour, no `project` field).
  */
 export async function listAgents(ctx: AgentToolsContext): Promise<AgentToolResult> {
   if (!ctx.instanceToken()) {
     return errorText("Channel not ready: no instance identity yet.");
   }
   try {
-    const peers = await listPeers(ctx.baseUrl(), ctx.instanceToken());
+    const { peers, scope } = await listPeersAuto(ctx.baseUrl(), ctx.instanceToken());
     // Project only what the model needs to pick a peer (drop last_seen /
     // active_conversation_id — available over the wire if a future tool needs them).
-    const summary = peers.map((p) => ({ id: p.id, label: p.label, kind: p.kind, online: p.online }));
+    const summary = peers.map((p) => ({
+      id: p.id,
+      label: p.label,
+      kind: p.kind,
+      online: p.online,
+      // Present only in the user-scoped (orchestrator) listing.
+      ...(p.project_name !== undefined ? { project: p.project_name } : {}),
+    }));
     const body =
       summary.length === 0
-        ? "No other agents are currently registered in this project."
+        ? scope === "user"
+          ? "No other agents are currently registered in any of your projects."
+          : "No other agents are currently registered in this project."
         : JSON.stringify(summary, null, 2);
     return text(body);
   } catch (err) {

package/lib/bridge_tool_host.ts

@@ -68,16 +68,20 @@ const TOOL_DEFS = [
   {
     name: "list_agents",
     description:
-      "List the OTHER agents (instances) in this project you can DM. Returns each agent's id, " +
-      "label, runtime kind, and whether it is online. Use it to find an id before message_agent.",
+      "List the OTHER agents (instances) you can DM. Returns each agent's id, " +
+      "label, runtime kind, and whether it is online. Use it to find an id before message_agent. " +
+      "Normally project-scoped; an ORCHESTRATOR instance (#307) sees all the owner's projects, " +
+      "each entry tagged with a `project` field.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
   },
   {
     name: "message_agent",
     description:
-      "Send a direct message to another agent in this project. Pass the target agent's instance id " +
+      "Send a direct message to another agent. Pass the target agent's instance id " +
       "(from list_agents) and the text. Opens or reuses a private 1:1 DM and posts your message; " +
-      "the agent's reply arrives back on this channel. Fails if the target agent is offline.",
+      "the agent's reply arrives back on this channel. Targets are normally same-project; an " +
+      "ORCHESTRATOR instance (#307) can also message agents of the owner's other projects. " +
+      "Fails if the target agent is offline.",
     inputSchema: {
       type: "object",
       properties: {

package/lib/capabilities.ts

@@ -26,15 +26,25 @@ export function capabilitiesText(): string {
 		"",
 		"Spawn one agent (CLI, non-interactive):",
 		"  vibe-master spawn --permission <read-only|read-write> \\",
-		"                    [--runtime codex|claude|gemma] [--name <id>]",
+		"                    [--runtime codex|claude|gemma] [--name <id>] [--scope <name>]",
 		"  → only --permission is required; --runtime and --name are optional",
 		"    (--name auto-generated if omitted). Prints the agent id; it registers",
 		"    in Viber and comes online.",
 		"",
+		"Multi-scope (#307): spawn into ANOTHER project by name. Register a project",
+		"folder once with `vibe-master scopes add <name> <path>`, then",
+		"`vibe-master spawn --scope <name> …` lands the agent in that project (its own",
+		".viber auth). `--scope` and `--cwd` are exclusive. `vibe-master scopes` lists them.",
+		"",
 		"Interactive: `vibe-master tui` (menu: + Add agent → runtime → permission → name).",
 		"Inspect / stop: `vibe-master list` · `vibe-master kill <id>`.",
 		"",
 		"Talk to a spawned agent from here with list_agents + message_agent.",
+		"Cross-project (#307): by default list_agents/message_agent see only THIS",
+		"project. If the OWNER marks this instance an ORCHESTRATOR (toggle on the web",
+		"project page — server-authorized, never self-declared), list_agents then covers",
+		"ALL the owner's projects (each entry tagged with its project) and message_agent",
+		"can DM an agent in another of those projects.",
 		"Requires vibe-master installed on the machine (see the Install page on the web).",
 		"Run `vibe-master --help` for the full command reference.",
 	].join("\n");

package/lib/control_stream.ts

@@ -297,6 +297,12 @@ export function runPersistentControlStream(
   };
 
   const done = (async () => {
+    // #389 step-02: announce ONCE that the instance control stream actually
+    // connected server-side (the SSE `connected` open-marker arrived) — proof
+    // the agent is ONLINE/reachable, not merely registered. vibe-master's spawn
+    // readiness gate polls the bridge log for this line, so a launch that
+    // registers then fails to connect (CF/401/network) is NOT reported as ready.
+    let announcedOnline = false;
     try {
       while (true) {
         if (signal?.aborted) {
@@ -305,6 +311,13 @@ export function runPersistentControlStream(
         }
         try {
           for await (const ev of subscribeControlStream(opts)) {
+            if (ev.event === "connected") {
+              if (!announcedOnline) {
+                announcedOnline = true;
+                log("[control-stream] online — instance control stream connected\n");
+              }
+              continue;
+            }
             if (ev.event === "stop") {
               settleFirstReject(new ControlStreamStopped());
               handlers.onStop?.("stopped");
@@ -314,7 +327,7 @@ export function runPersistentControlStream(
               handlers.onBeatNow?.();
               continue;
             }
-            if (ev.event !== "join") continue; // connected / ping / unknown
+            if (ev.event !== "join") continue; // ping / unknown (connected handled above)
             const minted = parseJoinPayload(ev.data, log);
             if (!minted) continue;
             handlers.onJoin?.(minted);

package/lib/peers.ts

@@ -11,7 +11,10 @@
 
 import { cfAccessHeaders } from "./cfAccess.js";
 
-/** A peer agent as returned by GET /api/instances/peers. */
+/** A peer agent as returned by GET /api/instances/peers.
+ *  project_id/project_name are present only in the user-scoped listing (#307):
+ *  an orchestrator sees peers across all its owner's projects, each tagged
+ *  with its project. */
 export interface PeerView {
   id: string;
   label: string | null;
@@ -19,17 +22,35 @@ export interface PeerView {
   online: boolean;
   last_seen: number | null;
   active_conversation_id: string | null;
+  project_id?: number;
+  project_name?: string;
+}
+
+/** Error carrying the HTTP status so callers can branch on 403 (#307). */
+export class PeersHttpError extends Error {
+  constructor(
+    message: string,
+    public readonly status: number,
+  ) {
+    super(message);
+    this.name = "PeersHttpError";
+  }
 }
 
 /**
  * List the OTHER active instances of this agent's project (self excluded).
- * Throws on a non-2xx response so the caller can surface a clear tool error.
+ * With scope "user" (#307), an ORCHESTRATOR instance lists the peers of ALL
+ * its owner's projects (the server returns 403 for a non-orchestrator).
+ * Throws PeersHttpError on a non-2xx response so the caller can surface a
+ * clear tool error — or fall back from user scope on a 403.
  */
 export async function listPeers(
   baseUrl: string,
   instanceToken: string,
+  scope?: "user",
 ): Promise<PeerView[]> {
-  const resp = await fetch(`${baseUrl}/api/instances/peers`, {
+  const qs = scope === "user" ? "?scope=user" : "";
+  const resp = await fetch(`${baseUrl}/api/instances/peers${qs}`, {
     method: "GET",
     headers: { Authorization: `Bearer ${instanceToken}`, ...cfAccessHeaders() },
   });
@@ -41,12 +62,33 @@ export async function listPeers(
     } catch {
       /* non-JSON body */
     }
-    throw new Error(`listPeers failed: ${detail}`);
+    throw new PeersHttpError(`listPeers failed: ${detail}`, resp.status);
   }
   const body = (await resp.json()) as { instances?: PeerView[] };
   return Array.isArray(body.instances) ? body.instances : [];
 }
 
+/**
+ * List peers at the WIDEST scope this instance is allowed (#307): try the
+ * user-scoped listing first; a 403 (non-orchestrator) transparently falls
+ * back to the project-scoped listing. Any other failure propagates. Single
+ * tool surface, zero client-side configuration: orchestrators see all their
+ * owner's projects, workers keep seeing their own project only.
+ */
+export async function listPeersAuto(
+  baseUrl: string,
+  instanceToken: string,
+): Promise<{ peers: PeerView[]; scope: "user" | "project" }> {
+  try {
+    return { peers: await listPeers(baseUrl, instanceToken, "user"), scope: "user" };
+  } catch (err) {
+    if (err instanceof PeersHttpError && err.status === 403) {
+      return { peers: await listPeers(baseUrl, instanceToken), scope: "project" };
+    }
+    throw err;
+  }
+}
+
 /** Result of opening (or reusing) a DM with a peer — carries the caller's own
  *  membership conversation_token so it can post into the DM. */
 export interface OpenDmResult {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-channel.ts

@@ -428,10 +428,12 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     {
       name: "list_agents",
       description:
-        "List the OTHER agents (instances) in this project you can talk to directly (#288). " +
+        "List the OTHER agents (instances) you can talk to directly (#288). " +
         "Returns each agent's id, label, runtime kind, and whether it is currently online. " +
         "Use this to find the id of an agent (e.g. 'Codex Review') before calling message_agent. " +
-        "Only agents in the same project are returned; you are never in the list.",
+        "Normally scoped to this project; if the owner designated this instance an ORCHESTRATOR " +
+        "(#307), the list covers ALL the owner's projects and each entry carries a `project` field. " +
+        "You are never in the list.",
       inputSchema: {
         type: "object" as const,
         properties: {},
@@ -442,10 +444,12 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     {
       name: "message_agent",
       description:
-        "Send a direct message to another agent in this project (#288). " +
+        "Send a direct message to another agent (#288). " +
         "Pass the target agent's instance id (from list_agents, or the from_instance_id of a DM you received) " +
         "and the message text. Opens or reuses a private 1:1 DM with that agent and posts your message; " +
         "the agent's reply arrives back on this channel tagged source=agent-dm. " +
+        "Targets are normally same-project; an ORCHESTRATOR instance (#307) can also message agents " +
+        "of the owner's other projects (ids from its cross-project list_agents). " +
         "Fails if the target agent is offline.",
       inputSchema: {
         type: "object" as const,

package/viber-codex-bridge.ts

@@ -356,7 +356,7 @@ function instructionsForTier(tier: AgentTier): string {
     return [
       "You are a bridge-owned Codex agent connected to Viber, in READ-WRITE mode.",
       "You MAY read files, create/modify files within the workspace, and run commands (including state-changing ones) to carry out the user's requests.",
-      "The sandbox is workspace-write: writes are confined to the workspace and network access is blocked at the OS level.",
+      "The sandbox is workspace-write: writes are confined to the workspace, and network access is ENABLED — so you can run git (including `git push`) and open pull requests (e.g. with `gh`).",
       "There is NO human approval step, so be deliberate: make only the changes the user asked for, and avoid destructive commands unless explicitly requested.",
       VOICE_CONCISE_LINE,
       CHANNEL_TOOLS_LINE,
@@ -385,17 +385,43 @@ function instructionsForTier(tier: AgentTier): string {
 // Approval policy per tier. `read`/`write` use "never" so Codex runs its commands
 // WITHOUT a human approver (there is none on the bridge) — the SANDBOX is the real
 // guardrail (read-only blocks writes/network; workspace-write confines writes to
-// the workspace and still blocks network). `chat` keeps "on-request" (no exec anyway).
-function approvalForTier(tier: AgentTier): "never" | "on-request" {
+// the workspace). `chat` keeps "on-request" (no exec anyway).
+export function approvalForTier(tier: AgentTier): "never" | "on-request" {
   return tier === "chat" ? "on-request" : "never";
 }
 
 // Codex OS sandbox per tier. `write` widens to workspace-write (edits confined to
-// the workspace, network still blocked); chat/read stay read-only.
-function sandboxForTier(tier: AgentTier): "read-only" | "workspace-write" {
+// the workspace); chat/read stay read-only.
+export function sandboxForTier(tier: AgentTier): "read-only" | "workspace-write" {
   return tier === "write" ? "workspace-write" : "read-only";
 }
 
+// Network access per tier (#389 step-03). ONLY the trusted `write` tier gets
+// network — so a codex coder can `git push` and open its PR (git-over-https +
+// `gh`). read/chat stay offline. SECURITY: codex's workspace-write sandbox opens
+// ALL network, not git-only (the app-server sandbox has no per-domain allowlist),
+// so this is a TRUST decision scoped to the write tier, which is already
+// operator-authorized-at-launch for unattended command execution. If codex ever
+// exposes an outbound-domain allowlist, tighten here (follow-up issue).
+export function networkForTier(tier: AgentTier): boolean {
+  return tier === "write";
+}
+
+// The EXACT `sandboxPolicy` object sent on every `turn/start` (#389 step-03).
+// Per the codex app-server protocol (generate-ts), `networkAccess` lives ONLY on
+// this per-turn policy object (workspaceWrite/readOnly variants) — NOT on
+// thread/start|resume, which take a bare `sandbox` MODE string. So the turn-level
+// policy is the single lever for network. Exported to unit-test the payload/tier.
+export function buildTurnSandboxPolicy(
+  tier: AgentTier,
+):
+  | { type: "workspaceWrite"; networkAccess: boolean }
+  | { type: "readOnly"; networkAccess: boolean } {
+  return sandboxForTier(tier) === "workspace-write"
+    ? { type: "workspaceWrite", networkAccess: networkForTier(tier) }
+    : { type: "readOnly", networkAccess: false };
+}
+
 const AGENT_TIER: AgentTier = resolveAgentTier();
 // Identity line (#309 step-17) is appended AFTER the tier instructions so the
 // permission rules stay first + strongest; the role is framed as descriptive and
@@ -635,10 +661,7 @@ class CodexAppServer {
       cwd: process.cwd(),
       runtimeWorkspaceRoots: [process.cwd()],
       approvalPolicy: AGENT_APPROVAL_POLICY,
-      sandboxPolicy:
-        AGENT_SANDBOX === "workspace-write"
-          ? { type: "workspaceWrite", networkAccess: false }
-          : { type: "readOnly", networkAccess: false },
+      sandboxPolicy: buildTurnSandboxPolicy(AGENT_TIER),
       developerInstructions: AGENT_INSTRUCTIONS,
       responsesapiClientMetadata: { source: "viber-codex-bridge" },
     });
@@ -1115,7 +1138,7 @@ function setupCodexRuntime(deps: {
 
 function logCodexSafety(): void {
   process.stderr.write(
-    `${LOG_PREFIX} codex safety: tier=${AGENT_TIER}, sandbox=${AGENT_SANDBOX}, approvalPolicy=${AGENT_APPROVAL_POLICY}, network=false, ` +
+    `${LOG_PREFIX} codex safety: tier=${AGENT_TIER}, sandbox=${AGENT_SANDBOX}, approvalPolicy=${AGENT_APPROVAL_POLICY}, network=${networkForTier(AGENT_TIER)}, ` +
       `instructions=${
         AGENT_TIER === "write"
           ? "read+write/run commands (workspace)"