mirror of
https://github.com/mudler/LocalAI.git
synced 2026-11-03 19:14:56 -05:00
* Store the folder and its mode on a saved agent
A saved agent gets FolderID, the workspace node of its folder, and
FolderMode, read or write. The folder is kept by node so that a rename
or a move is followed. A mode without a node is an agent whose folder
is not chosen yet; Validate accepts it, and refuses a node without a
mode.
The GORM store adds two columns with defaults, so AutoMigrate fills
the rows of existing agents as agents without a folder. The JSON store
reads a file without the keys the same way. Both stores pass the new
contract case.
Assisted-by: Claude:claude-opus-5-5
* Keep on a chat whether its saved agent had a folder
A chat whose agent is deleted runs today without the agent's grants.
When that agent had a folder, nothing is left to say which folder the
chat may read, so the chat must be refused instead of getting the whole
home. ChatRecord.ScopedAgent records that the agent had a folder.
CreateChat writes the flag and SetScopedAgent changes it. UpdateChat
leaves it alone, like the tool switches, so the loop's stale copy of
the record cannot clear it. Both chat stores read chats stored before
the flag as not scoped; the GORM column has a default, so AutoMigrate
is the migration.
Assisted-by: Claude:claude-opus-5-5
* Add the design and plan for agent folder scope
A saved agent works on the whole home folder of its user. The spec
lets the user give an agent one folder and a mode, read only or read
and write, and confines every chat that runs it to that folder.
The workspace store enforces the folder through a fence on the actor,
so a caller that forgets it gets less access, not more. The spec maps
every caller that builds a user actor today, including the host bash,
the sandbox runner and the add-on workspace operations, and how each
is moved to the chat's access.
The plan splits the work into ten lanes; the store fence and the agent
record come first.
Assisted-by: Claude:claude-opus-5-5
* Resolve the folder of a saved agent by node
A person chooses an agent's folder by its path in their home; the
agent keeps the node, so a rename or a move is followed. The new
FolderResolver turns the path into the node and back, always as the
user. A path is refused when it is not a live folder, when it is
LocalAI/ or Chats/ or inside them, or when it names a parent. The
home itself ("/") is allowed.
The workspace stores cannot find a node by its ID yet. PathOf reads
the newest change sets of the home first, checks the path it finds
with Stat, and else lists the folders the user can read. A store that
implements NodeByID is used instead. Nothing is cached, so every
frontend answers the same.
SaveAgent keeps the stored folder when it replaces an agent, so a
caller that knows nothing of folders cannot widen one.
SaveAgentWithFolder sets or clears it. ImportAgent looks the folder of
a file up in the importer's home, and saves a folder that is not there
as unset: the mode without a node, which does not start.
Assisted-by: Claude:claude-opus-5-5
* Add a fence to the workspace actor
A chat whose saved agent has a folder must reach only that folder and
the chat's own folders. The store needs to know which folders those
are on every call, so the actor carries them.
Actor.Fenced returns a copy that reaches only the given folders, by
node ID, each at most at its mode. The fence is an unexported field:
a copy of the actor keeps it, and only Fenced can set it. Fencing a
fenced actor adds a layer, and a node is reached only when every
layer allows it, so a fence never grows.
The helpers in export.go let both store implementations apply the
same rules: the mode a fence allows on a node, its roots, and the
limit of MaxFenceRoots roots per call.
Assisted-by: Claude:claude-opus-5-5
* Show and choose the folder of an agent in the API
The agent routes carry folder. A write takes {path, mode}: the server
turns the path into the folder's node, and refuses with 400 a path
that is not a folder of the user's home, or is LocalAI or Chats. A
write without folder keeps the agent's folder, so a client that does
not know the field cannot widen the agent; {path: ""} clears it. A
read answers the folder's path now, its name, the mode and a state:
ok, missing or unset. The node never leaves the server.
An agent with a folder exports as version 2, with the folder's path
and mode. A server that reads only version 1 refuses that file, so a
scoped agent is never imported elsewhere as one with all the files.
An agent without a folder still exports as version 1. The import
reads both versions and looks the folder up in the importer's home;
a folder that is not there saves the agent as unset, with a warning.
The Swagger spec, the API instructions and the agents docs page show
the field and the new file version.
Assisted-by: Claude:claude-opus-5-5
* Enforce the actor fence in both workspace stores
The store is the one place every file call of a chat goes through, so
it applies the fence: a caller that forgets the agent's folder gets
"not found", never the whole workspace.
- The mode of a fenced actor on a node is the lower of its grants and
the fence. A root in the Trash counts for nothing, and is back after
Undo, because the fence holds the node ID.
- A fenced actor never takes the administrator shortcut, so it cannot
grant, revoke or list grants, and ReadablePrefixes gives only fence
roots or folders inside them.
- A root cannot be deleted, moved or renamed by the fenced actor, by
any path: Move, Delete, Undo, an upper layer, or a delete of a folder
above a nested root.
- A fence with too many roots or a bad root is ErrInvalid.
The shared suite in wstest runs the new specs against the JSON store
and the GORM store (SQLite and PostgreSQL).
Assisted-by: Claude:claude-opus-5-5
* Map the model's paths through the chat's place
A chat's file tools spelled every path as a path in the user's home.
A chat whose agent has a folder sees that folder at /workspace/home and
its own chat folder at /workspace/chat, so the mapping must come from
the mounts of the chat's view, not from the principal.
session.Place maps a path the model writes to a workspace path: "/x",
"x", "home/x" and "/workspace/home/x" are x in the primary mount,
"/workspace/<name>/x" is x in the mount of that exact name, and the
skill layers keep their names. It refuses "..", NUL, control characters
and invalid UTF-8 wherever they point, and a /workspace path that is no
mount. Encoded and look-alike separators stay part of a name. Place is
only a mapping: the store's fence enforces the access.
session.Access holds a turn's actor, view and place. It has no exported
fields and one constructor, so a tool cannot be built from a principal
string. Owner gives the user's own actor without the fence.
Assisted-by: Claude:claude-opus-5-5
* Build a chat's view from its folders and describe it
BuildView took the home of the principal as the folder at
/workspace/home. A chat whose agent has a folder needs that folder
there, at the agent's mode, and its own chat folder beside it.
BuildView now takes the primary folder and the chat folder. The chat
folder is mounted at /workspace/chat, read and write; the name chat is
reserved like the skill layer names. The store caps each mount at the
actor's mode, and a fenced actor gets the shared folders read only.
Every caller passes the home and no chat folder, so an unscoped chat
keeps today's view.
LayoutPrompt takes a ScopedPrompt. A scoped chat hears only of its
folders: the agent's folder by its name and mode, with a line that it
cannot see the user's other files, the chat folder and where its
working files go, and the shared folders. It gets no hint to build a
page, because pages live outside its folder. An unscoped chat keeps
today's text.
Assisted-by: Claude:claude-opus-5-5
* Find a workspace node by its ID
A caller that keeps a node ID, such as the folder of a saved agent,
had no way to ask the store where that node is now. It had to search
the journal and then list folders, which costs one query per folder
in a large home.
Store.NodeByID returns a live node at its current path, so a rename
or a move of the node or of a folder above it is followed. It answers
ErrNotFound when the node or a folder above it is deleted, and when
the actor cannot read it; a fenced actor finds only nodes inside its
fence. Both stores implement it and the shared suite checks it. The
remote store of the Sandbox add-on refuses it, like its other calls.
Assisted-by: Claude:claude-opus-5-5
* Name the work folder of a scoped chat at /workspace/chat
A chat whose agent has a folder keeps its chat folder in the home, but
sees it as a mount of its own at /workspace/chat. Its work folder is
then /workspace/chat/work, not a path under /workspace/home.
workfiles reads /workspace/chat as the chat folder: a helper file under
its work folder is working, a script beside the attachments is a stray
helper, and a folder named chat in the agent's folder is an ordinary
folder. ScopedPrompt steers the model to that work folder and sends the
deliverables to the agent's folder, or to the chat folder when the
agent may only read. It says nothing of pages or of the settings
folder, which are outside the agent's folder. The chat picks the text
by its view.
Assisted-by: Claude:claude-opus-5-5
* Look up the folder of an agent by node
The folder resolver searched the journal of the home and then listed
folders to find where an agent's folder is now. The stores can now
find a node by its ID, so the resolver asks them directly and the
search is gone.
Assisted-by: Claude:claude-opus-5-5
* Resolve the file and media tools through the chat's access
The file tools mapped paths to the user's home and acted as the chat's
actor, and the media tools did the same through files.HomePath. A chat
whose agent has a folder must reach only its folders, and search must
start in the agent's folder, so the count of documents still being
indexed cannot count files elsewhere in the home.
files.Service.Tools and media.Service.Tools take a session.Access. Every
path goes through its place and every call acts as its actor. A write
to a read-only folder is refused before the store sees it. A search
with no path starts at the primary folder, and in a scoped chat also
looks in the chat folder; the pending count is taken below that root.
files.HomePath is removed.
UnscopedAccess builds today's access of a chat (the home and the
shared folders), and the studio service takes the turn's access from
one function, turnAccess, which gives that access until the chat
access resolver replaces it.
The new specs run the paths that try to leave the folder (parents,
absolute and doubled paths, encoded and look-alike separators, NUL,
other cases) through every file tool and the media tools, and check
that nothing outside the folder is read, named or changed, and that
search counts no pending file outside it.
Assisted-by: Claude:claude-opus-5-5
* Resolve the access of a chat at every turn
A chat whose saved agent has a folder must reach only that folder. Up
to now every chat got the user's actor, which reaches the whole home.
The chat's access is now resolved from the stores at every turn
start. With no agent folder it is the actor and the view of today.
With a folder the actor is fenced to the agent's folder at its mode,
the chat's own folder read and write, and the shared folders and the
skill layers read only; the chat's folder is made before the fence,
because a fenced actor cannot make it. A sub-agent takes the folder
of its parent's agent, and its own agent's folder inside it.
A folder that is deleted, unreadable or not chosen refuses the chat
with ErrAgentFolderMissing; it never falls back to the whole home.
A chat records whether its agent had a folder, so a chat whose agent
was deleted is refused too. CreateAs refuses such an agent at once.
session.Access carries the actor and the view, has no exported fields
and one constructor. Open takes it, the turn tools are built from it,
and an open chat compares the fence as well, so an edit of the agent
restarts the harness at the next turn on any frontend. The person's
uploads and renames use the owner's actor, without the fence. The
files a command changed are read as the chat can read them.
Nothing is kept between turns, so frontends cannot disagree.
Assisted-by: Claude:claude-opus-5-5
* List a scoped chat's files by its place in the prompt
The turn prompt lists the chat's files with the paths the model uses.
For a chat whose agent has a folder those paths come from its mounts,
and a file the chat touched outside its folders, for example before
the agent got a folder, must not be named.
Manager.FilesIn is Files with a place. For a scoped place, each file
is named by its mount (/workspace/home for the agent's folder,
/workspace/chat for the chat folder) and a file outside every mount is
left out. Other places give what Files gives. The prompt's file list
uses the turn's place; the chats API keeps the user-wide list.
Assisted-by: Claude:claude-opus-5-5
* Answer 409 when an agent's folder is missing
A chat with a saved agent whose folder is missing or not chosen does
not start. The chat endpoints now say so with 409 and the type
agent_folder_missing, both when the chat is created and when a
message is sent to an open chat, instead of a server error.
The agent docs say what a chat with a folder reaches, when a change
of the folder applies, and that nothing is kept between turns.
Assisted-by: Claude:claude-opus-5-5
* Point a scoped chat at rules and work folders in its own folders
The rules nudge walked from the chat folder up to the home root and
named AGENTS.md files there, and the stray-helper note named the work
folder under /workspace/home. A chat whose agent has a folder must hear
only of its own folders.
The nudge takes the turn's access: it reads paths through the place,
starts at the primary folder (the agent's folder) and stops there, so
it never points above the folder or into the chat folder mount. The
helper note names /workspace/chat/work/ in a scoped chat, and a
sub-agent of a scoped parent gets the scoped work folder text.
Assisted-by: Claude:claude-opus-5-5
* Find workspace actors built outside the chat access
An actor built from a principal has no fence and reaches the whole
home. A spec now parses the studio service, the command runners, the
add-on host operations and the application wiring, and fails on a
workspace.Actor literal, a files.UserActor call or an Actor(principal)
call in a function that is not on the allowlist. Each allowed entry
says why: a host read of the user's settings, a user surface, or a
caller that a later change moves to the chat's access. An entry that
builds no actor any more fails the spec too, so the list stays exact.
Assisted-by: Claude:claude-opus-5-5
* Build the expected view of a chat with the view's folders
The spec of a chat without an agent folder compared its view with
BuildView called with the old arguments, so the test package did not
compile after the merge of the view builder. It now passes the home
as the primary folder and no chat folder, which is the view of an
unscoped chat.
Assisted-by: Claude:claude-opus-5-5
* Give every file tool of a turn the chat's resolved access
The resolver of a chat's access built the view of a scoped chat
itself, with no shared folders, while every other chat got its view
from the session manager. And the file tools, the media tools, the
chat's file list in the prompt, the rules nudge and the work folder
lines each asked for an access of their own, the view of the whole
home. A chat whose agent has a folder therefore had a fenced actor
but home-relative paths: it reached its folder only through paths
such as /Projects/Acme/a.txt, and its prompt named the home.
The session manager now builds every chat's view: UserAccess mounts
the home, and the new ScopedAccess mounts the agent's folder at home,
capped at the fence's mode, the chat folder at chat and the shared
folders read only. It refuses an actor without a fence, and a folder
outside the fence is an error, never a view of the home. The
resolver calls it with the innermost folder, so a sub-agent of a
saved agent still works in its own folder.
The access that the resolver builds once at the start of the turn
now goes down to every consumer. A sub-agent of a saved agent acts
for its parent chat with the same access (Access.ForChat), and a
generic sub-agent gets its tools from the parent's access. The seam
that gave the unscoped access, and the files service's own view
builder, are removed, so a new consumer cannot build a view by
mistake. A turn whose access has no folder gets no tools rather than
the home.
A scoped chat now sees its folder at /workspace/home and its chat
folder at /workspace/chat in its tools, its search, its prompt and
its work folder lines. A chat whose agent has no folder is unchanged.
Assisted-by: Claude:claude-opus-5-5
* Find chat views built outside the chat access
The turn's access is resolved once and handed down, but nothing
stopped new code from building a view of its own, which shows a
scoped chat the whole home. A second scan now parses the same
sources as the actor scan and fails on a call of BuildView,
SkillLayerMounts, NewAccess, UserAccess or ScopedAccess, or on a
store's View, in a function that is not on its allowlist. The
resolver is the one allowed caller; the host bash, the sandbox
runner and the add-on host operations are listed until they take
the chat's access. A stale entry fails the scan too.
Assisted-by: Claude:claude-opus-5-5
* Keep a sub-agent inside its parent's folder
A saved agent started from a scoped chat could name a folder
outside the chat's own, and the child was made before its first
turn failed with a message about a missing folder. spawn_agent now
checks the agent against the chat's agent from the stores before it
makes the child: no folder is fine, the same folder or one inside
it is fine, anything else fails with "this agent works in another
folder than this chat". The child never has more reach than its
parent, in folder or in mode.
The ScopedAgent flag of a sub-agent was reset to what its own
agent had at each turn. A child of a scoped chat with an agent
without a folder lost the mark, so deleting the parent's agent
would have given that child the whole home. The flag now follows
both folders.
New specs cover a generic child, a saved-agent child outside,
inside and at the parent's folder with the lower mode, a child
without a folder, and the work folder wording of a child of a
read-only or read-write parent.
Assisted-by: Claude:claude-sonnet-5-5
* Show agent folders in list_agents and limit them by scope
list_agents gave a scoped chat every saved agent, including ones
that spawn_agent would refuse, and told the model nothing about
where an agent works. Each entry now carries the name of the
agent's folder and its mode, or folder_missing when the folder is
deleted or not chosen. The path is left out, since it would show
the folders above the chat's own. A chat whose agent has a folder
lists only the agents that fit under that folder, by the same check
spawn_agent makes.
The docs for saved agents as sub-agents and for the agent folder
describe both.
Assisted-by: Claude:claude-sonnet-5-5
* Keep the triggers of a scoped agent to its folder
A chat of an agent with a folder reaches only that folder, but its
triggers still worked on the whole home. A file trigger could watch
any folder, the rules of a run were read from the home root down
with the user's actor, the first message named home paths, and a run
whose agent's folder was gone fell through to a failed chat start
after the host had already read the home's rules. The trigger tools
of a scoped chat could also list, change or propose triggers that
reach the whole home.
The agent's folder now bounds every step:
- Saving a file trigger (create, update, edit, confirm) refuses a
folder outside the agent's folder, and a trigger of an agent whose
folder is missing or not chosen.
- Each run checks the agent's folder before it reads anything. A
missing or unset folder skips the run with "the agent's folder is
missing" and switches the trigger off; a watched folder that is not
inside the agent's folder does the same with its own reason. No
chat is made and the owner is told.
- The folder check and the rules are read with an actor fenced to
the agent's folder, read only, so no AGENTS.md above it is read.
The rules of a schedule run start at the agent's folder. The first
message names folders and the file as the chat sees them, under
/workspace/home, and the rules nudge of the run's chat counts those
rules as given.
- In a scoped chat the trigger tools read folders as paths of the
chat's place, refuse one outside the agent's folder, and see only
the triggers of that agent.
The trigger watcher takes the service's administrator actor, made
once next to the change feed's, and the trigger functions leave the
actor scan's allowlist.
Assisted-by: Claude:claude-opus-5-5
* Send connector replies through the chat's access
The files a connector reply sends were listed from every change made
in the chat's name and read with the user's actor, so a reply of an
agent limited to one folder could send a file from anywhere in the
home that some host-side write had attributed to the chat. A message
to an agent whose folder was missing made or reopened a chat, failed
to start it, and answered with a generic error.
A reply now resolves the chat's access once, lists the turn's files
through its place (a file outside the chat's folders is left out)
and reads each one with its fenced actor. A file the access cannot
reach is skipped without being named. Before it makes a chat, a
message checks the bound agent's folder; when it is missing or not
chosen, the sender gets one reply, "This agent cannot work right
now: its folder is missing.", the refusal is logged and the binding
stays on. The same reply covers a folder that goes away between the
check and the turn. readChatFile leaves the actor scan's allowlist.
Assisted-by: Claude:claude-opus-5-5
* Name a read-only refusal of a commit by its guest path
The store names an upper entry that a read-only mount refused by
its path in the view (/home/x), not by its store path. The note
that a command's output ends with took every path but an
outside-view one for a store path, so it told the model that
"/home/x was not saved", a path the guest does not have. A path
that no mount holds but that starts with a mount name is now taken
as a path of the view and gets the /workspace prefix.
Assisted-by: Claude:claude-opus-5-5
* Take the actor and view of command runners from the chat's access
The host bash and the sandbox runner made their own actor and view:
the host bash a user actor from the principal and the view of the
whole home, the sandbox runner a plain actor by default and the view
from its own mount requests. Neither knew the chat's agent folder,
so a command of a scoped chat could reach the whole home.
The runner now has no default actor or view. Options.Actor takes a
context and returns an error, and Options.View returns the view
itself; both are asked at every call. A view of another actor than
the chat's is refused, and a sandbox whose actor or mounts changed
is made again, so an agent's new folder or mode applies from the
next command. A failing resolver fails the call, also with a sandbox
running.
The server wires both hooks to the chat's resolved access: the new
Service.CommandActor and Service.CommandView, the latter refusing an
actor that is no longer the chat's. Access.SandboxView adds the skill
layers to the turn's view, at the names the file tools use. The host
bash refuses a fenced actor, at the tool and again at each call, as a
command on this machine reads what the server can read. The Sandbox
add-on passes a label actor and its home view: the host binds each
workspace operation to the call's chat.
The lane 5 entries leave the actor and view scan allowlists.
Assisted-by: Claude:claude-opus-5-5
* Offer no host bash to a chat whose agent works in one folder
A command of the built-in bash runs on this machine and reads every
file LocalAI can read. No workspace rule confines it, so a chat whose
agent works in one folder cannot have it, whatever chats_host_exec
says. The tool's build now refuses a fenced actor, so the chat gets
no bash, its prompt says nothing runs commands, and the shell group
of the Tools menu gives the reason: the agent works in one folder
and runs commands only in the Sandbox add-on. Sub-agents of such a
chat have the fenced actor too.
The docs of saved agents and of the commands on this machine state
the rule and the Sandbox layout of a scoped chat.
Assisted-by: Claude:claude-opus-5-5
* Tell a scoped chat where its Sandbox commands start and what they keep
The commands block of the prompt told every chat with the Sandbox
that a command starts in /workspace/home, the user's home, and that
what it saves there or in a writable shared folder is kept. In a
chat whose agent works in one folder, /workspace/home is that folder,
the chat folder is /workspace/chat and the shared folders are read
only. The block now says so, and with a read-only folder it names
only /workspace/chat as kept.
Assisted-by: Claude:claude-opus-5-5
* Name a scoped chat's attachments where its commands see them
The model learns of an attached file by its guest path, which was
always /workspace/home/Chats/<chat>/<file>. In a chat whose agent
works in one folder, /workspace/home is that folder: the file and
media tools still found the file through the place's chat alias, but
a command sees the chat folder only at /workspace/chat, so the path
named nothing for it.
The text the model gets now names a file of the chat folder at
/workspace/chat/<file> in a scoped chat, through the chat's place:
when a message is sent, queued or injected, in the summary of the
chat, and in the model state rebuilt after an edit, a regenerate, a
fork or an import. What is stored keeps the home spelling, which
SplitMessage reads back, and an unscoped chat is unchanged.
Assisted-by: Claude:claude-opus-5-5
* Remove the duplicated allowlist entries of the actor scan
Assisted-by: Claude:claude-opus-5-5
* Read and write the folder of an agent in the agent helpers
The agent API now answers an agent's folder with its path, mode and
state, and a write keeps the stored folder unless it names one. The
page helpers learn that shape: the folder field of a save is sent only
when the person changed it, an empty path clears it, a missing or
unset folder that the person did not replace is kept, and the mode is
read unless write was chosen. Small helpers say whether a listing
entry can be chosen (not a folder LocalAI manages, not a shared
folder), which folders agents use for the Files page marker, and
whether a chat error is the missing-folder conflict.
Assisted-by: Claude:claude-opus-5-5
* Move the folder walk of the Move dialog into a folder picker
The agent editor needs the same walk through the person's folders as
the Move dialog, so the breadcrumb and the folder list move into
FolderPicker, with their styles, and the Move dialog draws it. The
picker can show a folder as one that cannot be chosen, with the
reason next to it, and a folder that cannot be read now offers to try
again; a folder still loading says so instead of an empty list.
Assisted-by: Claude:claude-opus-5-5
* Choose the folder of an agent in the agent form
The agent form gets a Files section after the instructions: All my
files, or One folder chosen in the folder picker, and whether the
agent's chats can read the folder or read and change it. The picker
shows the folders LocalAI manages as ones that cannot be chosen, and
Home itself can be chosen. A folder that was deleted, or an imported
agent whose folder was not found, is said in place with an offer to
choose another; the rest of the form still saves and keeps it.
A save sends the folder only when the person changed it, so editing
another field never touches it. Picking One folder and choosing
nothing stops the save, as it would otherwise save an agent on all
the files. The Export section now downloads the file the server
writes, which names the folder, and says so.
Assisted-by: Claude:claude-opus-5-5
* Show the folder of an agent on the agents list and its page
An agent with a folder shows it in the list's line and on its page,
with its access in words and a lock when its chats can only read it.
A folder that is gone, or an agent with no folder chosen yet, shows
a warning that opens the form; the agent's page also says so above
its facts and offers to choose another folder.
Assisted-by: Claude:claude-opus-5-5
* Mark the folders that agents work in on the Files page
A folder that a saved agent works in gets a small marker with the
agent's name, or the number of agents, and a tooltip that names each
one with its access. Inside such a folder, a line over the list says
the same. The page reads the agent list it can already fetch, so the
files API is unchanged, and the page still shows all the files.
Assisted-by: Claude:claude-opus-5-5
* Show a chat's folder and say when its agent's folder is missing
A chat with an agent that has a folder shows the folder next to the
agent in the message box, with a lock for read only, and the Tools
menu says which files the chat's tools reach. When the folder is
gone, the chip says so and opens the agent's form.
A chat whose agent's folder is missing does not start, and the server
answers with a conflict. The message box now says that in plain words,
keeps the message, and offers Edit agent, instead of the server's
text.
Assisted-by: Claude:claude-opus-5-5
* Test the folder of an agent across the web interface
The agent stubs now list folders by path, read a written folder back
as the server does, export a version 2 file for an agent with a
folder, import one whose folder is not found as unset, and refuse to
start a chat whose agent's folder is missing.
The specs choose a folder and see it on the list, switch the access,
leave an unchanged folder out of the save, clear it, keep and replace
a missing folder, keep Chats and LocalAI out of the picker, retry a
folder that cannot be read, see the Files marker, the chat's chip and
Tools line, the missing-folder chat error with Edit agent, and the
import warning. A render smoke opens the picker on the real server,
and one spec checks that the copy names no internal path.
Assisted-by: Claude:claude-opus-5-5
* Describe the agent's folder in the web interface
The agent docs said what the folder field does in the API. They now
also say where the web interface sets it, how the agents pages, the
Files page and a chat show it, and what a chat whose folder is
missing offers.
Assisted-by: Claude:claude-opus-5-5
* Record the chat an add-on call was made for
An add-on's workspace operations run as the user of the live request,
with no idea which chat made it. Only an action carries a chat, and
only as a key in its resource ID; a read tool such as the Office
add-on's read-docx carries none. So a chat that should reach only one
folder could reach the whole home through an add-on.
The in-flight record of a request now keeps, next to the envelope, a
binding to the chat the request was made for: the user's principal
and the chat ID. It is host-side only and never a field of the
envelope, which installed add-ons decode with unknown fields refused.
A context carries the binding from the chat turn to the place that
records the request. The broker gives each host operation the chat
and the scope of its live request. An operation ID that requests of
two chats share is not live, so neither chat is trusted.
Assisted-by: Claude:claude-opus-5-5
* Keep the chat binding of a runtime call on the host
The runtime client records each call's envelope for the host operation
channel. It now records the chat binding too when the call's context
carries one, so the add-on's host operations know which chat made the
request. The envelope sent to the add-on is the same bytes with or
without a binding: a spec checks that the body of a bound call equals
the body of an unbound one and still decodes with unknown fields
refused.
Assisted-by: Claude:claude-opus-5-5
* Carry the chat binding in a forwarded add-on request
A frontend that is not the add-on owner forwards an add-on call in a
signed request. The chat the call was made for now rides in that
request as a signed field, chat, and the owner puts it back on the
context of the call it serves, where the runtime client records it.
A changed, added or removed binding fails the signature check, and a
signed but incomplete one is refused. A request that no chat made has
no chat field and signs as before.
An owner that does not know the field refuses a forwarded call that a
chat made, so the owner must be upgraded before the frontends.
Assisted-by: Claude:claude-opus-5-5
* Bind every add-on tool call of a chat to the chat
The chats consumer ran an add-on tool with the conversation ID only,
which the owner used to resolve a selection and, for an action, as the
key of the add-on's state. Nothing told the host which chat a read
tool or a change came from.
The tool adapter now has ExecuteChat, which takes a ChatCall (the
chat's user and ID, from the chat turn's own record) and binds the
call to the chat on the host side for every tool kind: a read with no
resource, an action, and a change made at once. The chats adapter
refuses a call that names a conversation without that binding, so a
chat's call cannot be made unbound by mistake. Other consumers, such
as the OpenAI-compatible route, keep calling without a binding.
Assisted-by: Claude:claude-opus-5-5
* Run add-on workspace operations with the chat's access
The workspace operations of add-ons (materialize, commit, changes,
export and import) worked on the whole home of the request's user. A
chat whose agent has a folder could therefore read and write any file
through the Office or Sandbox add-on.
They now resolve their access from the chat binding of the live
request, through a new Access hook that the chats service answers
(Service.AddonAccess). A chat's call gets the chat's access, as its
file tools do: in a chat whose agent has a folder, the add-on's "/" is
that folder, /workspace/chat names the chat folder, the agent's mode
applies, and paths resolve through the chat's place, so a parent
reference is refused and an encoded separator is part of a name. The
mounts go through Access.SubView, which builds a view only inside the
access, for its fenced actor. When an add-on mounts its "/" at home,
the host adds the chat folder at chat, so the Sandbox sees the chat's
layout without a change. Changes list only what the access may read,
and a commit entry outside the view is a conflict.
A call whose chat cannot be resolved is refused and never runs
user-wide. An action request without a binding is resolved by its
chat key, as before, and refused when it names no chat. A call that
no chat made (an add-on page, the OpenAI-compatible route) still works
on the whole home, through Manager.PersonAccess.
The four lane 6 entries leave the actor scan and the view scan.
PersonAccess joins the view scan's matcher, with AddonAccess as its
one allowed caller. An end-to-end spec runs the real Office and
Sandbox add-ons in a scoped chat.
Assisted-by: Claude:claude-opus-5-5
* Build the chat access of the file index route test
files.Service.Tools takes a session.Access since the chat access
change, so the route test of the text index passed a bare actor and
its package did not compile under the auth tag.
The test now builds the access as the chats service does for a chat
whose agent has no folder: the user's home as the primary folder of
the view, then session.NewAccess. The assertions are unchanged.
Assisted-by: Claude:claude-opus-5-5
* Test the folder of an agent through every surface of a chat
The specs of the folder feature each test one surface. This suite
runs one chat of an agent limited to a folder through all of them at
once, on an indexed SQL workspace: the file and media tools, the search
and its pending count, a command of the Sandbox in a fake sandbox, a
read call and an action call of an add-on through the real workspace
operations bound to the chat, a generic and a saved sub-agent, the
trigger tools, a file trigger run, a connector reply, a renamed folder,
a mode change, an edit that narrows the folder (also seen by a second
frontend) and a deleted folder.
The files outside the folder hold a token that the scripted model never
writes. After each spec the suite collects every text a person or a
model can see: tool results and errors, prompts, messages, transcripts
with their cards, live events, chat file lists, tool panels,
notifications, connector replies and files, the add-on's data directory
and the connector log. The token must be in none of them, and the files
outside must be unchanged.
A control spec runs the same probes from an agent without a folder and
checks that they do find the token, so the probes and the collection
cannot pass by seeing nothing.
Assisted-by: Claude:claude-opus-5-5
* Complete the docs of the folder of an agent
Each change of the folder feature documented its own part. This
makes the pages one account of it:
- Saved agents: the missing and unset states in one bullet, what the
folder does not limit (MCP servers, web tools, collections, pages),
that the Files page stays user-wide, when an edit applies, the
downgrade caveat, and the folder as a stateless row of the cluster
table. The Sandbox of a scoped chat mounts the agent's folder and the
chat folder only, as the add-on asks for them; the page said it also
had the shared folders and skills.
- Chats: the chat folder at /workspace/chat for the model, sub-agents
of a scoped chat, and commands only in the Sandbox.
- Add-ons: the Sandbox and Office sections say what / is in a chat whose
agent has a folder.
- First agent: the optional folder step and the "Folder missing" case.
Assisted-by: Claude:claude-opus-5-5
* Draft the PR description and release note of agent folders
No release notes file exists for the next release yet, so the draft
text lives next to the spec and the plan. It carries the release note
paragraph with the downgrade caveat and the upgrade order of a cluster.
Assisted-by: Claude:claude-opus-5-5
* List the chat binding specs in the per-report add-on inventories
The chat binding change added five specs to the gateway and runtime
packages and named them in the case lists of the gateway, artifacts and
apps suites. These three suites also keep one case list per Ginkgo
report, and the verifier compares each report with its own list. The
new names were missing there, so the three suites failed with an
inventory mismatch.
A dry run of every Ginkgo suite's commands now lists the same It names
as each report's inventory, in both directions.
Assisted-by: Claude:claude-opus-5-5
* Hide stale paths from a fenced actor's history
A folder moved into a fence makes its parent identities readable.
Their historical paths can still name locations outside the fence.
Hide each historical side when its readable parent's current path
differs. Reuse the generic title when filtering hides a side. Keep
the journal and unfenced history unchanged so Undo uses identities.
Assisted-by: nib:gpt-6.1-sol
* List the chat binding cases in Tables tools
The Tables tools runner includes every adapter spec in its output.
List the four chat binding cases so the exact inventory accepts them.
Assisted-by: nib:gpt-6.1-sol
* Keep shared agent folders unset in exports
A followed folder outside the home cannot round-trip through a home path.
Export its mode with an empty path so import warns and stays fail-closed.
Responses keep public shared paths without exposing other internal paths.
Distinguish deleted scoped agents from unscoped agents in the guidance.
Assisted-by: nib:gpt-6.1-sol
* Refuse scoped chats over the folder limit
Keep every required shared root in each intersecting fence. Refuse
creation and turn access when the complete set exceeds 32 roots.
Reserve a chat root before its folder exists and fence listings empty
on refusal. Propagate shared enumeration failures instead of omitting
roots.
Map capacity refusals to a fixed 409 response and give connectors a
safe capacity message. Check boundaries, retries, background access,
and HTTP handlers with focused regressions.
Assisted-by: nib:gpt-6.1-sol
* Verify unset imports refuse chat startup
Assert the folder-specific refusal without a harness start or saved chat.
Clarify public response paths and unset exports in the API metadata.
Assisted-by: nib:gpt-6.1-sol
* Keep the folder retry test under user control
A background refresh consumes the one-shot successful response before
this test observes its load error. Isolate the mocked Files page from
the live workspace stream and agents list. Keep reads failing until
the error assertions pass, then allow the actual Retry click to recover.
Check that Retry reads again and removes the error, without changing
the existing assertions or their timeouts.
Assisted-by: nib:gpt-6.1-sol
* Test and document folder capacity refusals
Use the existing Ginkgo suites for capacity regressions. Exercise a
successful turn, refusal after shares change, and a retry through a
second service on the same stores. Check that refusal leaves no claim
or pending message.
Verify that connectors send one fixed refusal and that triggers stay
enabled after capacity failures. Document the 32-root budget and the
all-required-roots-or-refuse contract.
Assisted-by: nib:gpt-6.1-sol
* Control crashes in the restart budget test
The crash fixture exits after 100 ms, before startup necessarily finishes.
A busy runner can fail the readiness handshake instead of testing restarts.
Start a normal fixture and kill each published incarnation explicitly.
Keep the exact restart count and persistent failed-state assertions.
Assisted-by: nib:gpt-6.1-sol
* Check capacity test cleanup errors
Assert service and workspace cleanup through Ginkgo. Keep service cleanup before workspace cleanup and report close failures instead of discarding them.
Assisted-by: nib:gpt-6.1-sol
---------
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
647 lines
24 KiB
Go
647 lines
24 KiB
Go
package studio
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/mudler/LocalAI/core/services/studio/agents"
|
|
"github.com/mudler/LocalAI/core/services/studio/session"
|
|
"github.com/mudler/LocalAI/core/services/studio/store"
|
|
"github.com/mudler/LocalAI/core/services/studio/workspace"
|
|
)
|
|
|
|
// maxBackgroundChildren is how many sub-agents one conversation may run in the
|
|
// background at once.
|
|
const maxBackgroundChildren = 4
|
|
|
|
// Sub-agent errors, returned to the model as the result of the tool call.
|
|
var (
|
|
// ErrSubAgentDepth means a sub-agent tried to start another. Sub-agents
|
|
// nest one level only.
|
|
ErrSubAgentDepth = errors.New("a sub-agent cannot start another sub-agent")
|
|
// ErrSubAgentLimit means the conversation already runs the most background
|
|
// sub-agents it may.
|
|
ErrSubAgentLimit = errors.New("the limit of background sub-agents for this conversation is reached; wait for one to finish")
|
|
// errNoTurnAccess means the hook got an access that has no folder: the
|
|
// chat's access was not resolved, so it gets no tools.
|
|
// ErrAgentOutsideFolder means spawn_agent named a saved agent whose folder
|
|
// is not the folder of the chat's own agent or inside it. A sub-agent never
|
|
// has more reach than its parent, so the agent is refused, not widened.
|
|
ErrAgentOutsideFolder = errors.New("this agent works in another folder than this chat")
|
|
errNoTurnAccess = errors.New("studio: the chat's access was not resolved; no tools this turn")
|
|
)
|
|
|
|
type child struct {
|
|
id string
|
|
title string
|
|
background bool
|
|
}
|
|
|
|
// chatTools is the hook that gives every chat its host tools. A conversation
|
|
// gets the host tools plus spawn_agent; a sub-agent gets only the tools its
|
|
// parent chose and never spawn_agent. A sub-agent started from a saved agent
|
|
// gets what the agent grants instead, read from the store like any chat with
|
|
// an agent, so it needs no tool list in memory. Every tool is built from the
|
|
// chat's access for the turn: its actor is fenced when the chat's agent has a
|
|
// folder.
|
|
func (s *Service) chatTools(ctx context.Context, x session.Access) (session.TurnTools, error) {
|
|
a := x.Actor()
|
|
if s.d.Files.Available() && x.Place().Primary() == "" {
|
|
// An access without a folder was never resolved for this chat
|
|
// (chatAccess gives every chat at least its home or its agent's
|
|
// folder). Refuse the tools rather than build them on a guess.
|
|
return session.TurnTools{}, errNoTurnAccess
|
|
}
|
|
rec, err := s.d.Store.GetChat(ctx, a.Principal, a.ChatID)
|
|
if err != nil {
|
|
return session.TurnTools{}, err
|
|
}
|
|
sub := rec.Kind == session.KindSubAgent
|
|
if sub && rec.AgentID == "" {
|
|
s.mu.Lock()
|
|
tools := s.allowed[key(a.Principal, a.ChatID)]
|
|
s.mu.Unlock()
|
|
var prompt, work string
|
|
cmds := s.withHostBash(s.commandsOf(ctx, a.Principal, tools, nil, nil), tools)
|
|
if cmds.State != CommandsAvailable {
|
|
prompt = subAgentCommandsBlock
|
|
}
|
|
if canWriteFiles(tools, cmds) {
|
|
work = s.subWorkBlock(ctx, rec, x)
|
|
}
|
|
prompt = joinBlocks(prompt, webBlock(tools), work)
|
|
return session.TurnTools{Tools: tools, Prompt: prompt}, nil
|
|
}
|
|
tools, missing, err := s.scopedHostTools(ctx, a)
|
|
if err != nil {
|
|
s.log.Warn("studio: host tools unavailable", "chat", a.ChatID, "error", err)
|
|
}
|
|
sc := s.scopeOf(ctx, rec)
|
|
// The tools the chat's switches take away (a sub-agent follows its
|
|
// parent's): scopedHostTools dropped the add-on ones already.
|
|
hidden := s.hiddenFor(ctx, rec)
|
|
cmds := s.commandsOf(ctx, a.Principal, tools, rec.AddonsOff, sc)
|
|
// The built-in tools no add-on serves: bash on this machine when the
|
|
// Sandbox does not serve it and the setting allows it.
|
|
tools = s.applyBuiltins(tools, s.builtinsFor(ctx, a, rec, sub))
|
|
cmds = shellSwitched(s.withHostBash(cmds, tools), hidden)
|
|
// The file tools are the one file toolset of the chat. A sub-agent gets
|
|
// them from subset, built for the parent chat; one from a saved agent gets
|
|
// them here, built for the parent chat too, so the parent's Files pane
|
|
// sees its changes.
|
|
// Every file and media tool takes the access of this turn, resolved
|
|
// once by chatAccess: none builds a view of its own.
|
|
fx := x
|
|
if sub {
|
|
if fx, err = x.ForChat(rec.ParentID); err != nil {
|
|
return session.TurnTools{}, err
|
|
}
|
|
}
|
|
fa := fx.Actor()
|
|
nudge := s.newRulesNudge(ctx, x, rec)
|
|
tools = append(tools, nudge.wrap(s.fileNudgeTools(fx, s.announceFileChanges(fa, s.skillHintTools(fa, dropHidden(s.d.Files.Tools(fx), hidden)))))...)
|
|
if s.d.Media != nil {
|
|
tools = append(tools, s.skillHintTools(fa, dropHidden(s.d.Media.Tools(s.d.Files, x, rec.Model), hidden))...)
|
|
}
|
|
// What the prompt may tell the model to do with the files follows the
|
|
// tools it has now: a chat with the file tools switched off hears of none.
|
|
canRead, canWrite := canReadFiles(tools, cmds), canWriteFiles(tools, cmds)
|
|
skillsOff := 0
|
|
prompt, note, key, fallback := s.skillTurn(ctx, a.Principal, rec.SkillsOff, rec.AddonsOff, sc, execGate(cmds, &skillsOff))
|
|
if !canWrite {
|
|
prompt = withoutWriteHint(prompt)
|
|
}
|
|
// The persona and the facts about the user come after the chat's prompt
|
|
// and the agent's instructions, which take precedence, and before the
|
|
// index of skills. A change to either file restarts the harness at the
|
|
// next turn, because the prompt changes.
|
|
var persona, personaKey string
|
|
if !sub {
|
|
persona, personaKey = s.WellKnown().TurnPrompt(ctx, a.Principal)
|
|
}
|
|
if persona != "" {
|
|
prompt = strings.TrimSpace(persona + "\n\n" + prompt)
|
|
}
|
|
if sc != nil {
|
|
// Granted skills the user lacks come back from skillTurn as a note of
|
|
// their own; fold all the missing grants into one line.
|
|
var skillMissing []string
|
|
if note != "" {
|
|
skillMissing = strings.Split(note, "; ")
|
|
}
|
|
note = unavailable(missing, skillMissing)
|
|
if sc.instructions != "" {
|
|
// The instructions go first: the prompt is cut at its end.
|
|
prompt = strings.TrimSpace(sc.instructions + "\n\n" + prompt)
|
|
}
|
|
}
|
|
if fallback != "" {
|
|
note = strings.TrimSpace(note + " " + fallback)
|
|
}
|
|
if !sub && !hidden[spawnAgentName] {
|
|
// The agent argument is offered only when list_agents is: the chat
|
|
// switched the saved agents on and its user may use them.
|
|
tools = append(tools, s.spawnTool(x, hasTool(tools, listAgentsName)))
|
|
}
|
|
// The assistant tools are not part of hostTools, so a sub-agent never gets
|
|
// them, whatever its parent names.
|
|
aTools, aPrompt, aNote := s.assistantTurn(ctx, rec)
|
|
tools = append(tools, aTools...)
|
|
// The tools of a self-paced loop, while the chat has one.
|
|
tools = append(tools, s.loopTools(ctx, a, rec)...)
|
|
if aPrompt != "" {
|
|
prompt = strings.TrimSpace(aPrompt + "\n\n" + prompt)
|
|
}
|
|
if aNote != "" {
|
|
note = strings.TrimSpace(note + " " + aNote)
|
|
}
|
|
// What the user did with the triggers this chat proposed: the tool result
|
|
// said they were waiting, so a later turn must hear how they ended.
|
|
if s.triggers != nil {
|
|
if line := s.triggers.ProposalNote(ctx, a.Principal, a.ChatID); line != "" {
|
|
note = strings.TrimSpace(note + " " + line)
|
|
}
|
|
}
|
|
// An offer from the assistant is allowed in few turns (see hintsvc.go); the
|
|
// model learns it from one line of the note, so other turns cost nothing.
|
|
if line := s.hintLine(ctx, a, rec); line != "" {
|
|
note = strings.TrimSpace(line + " " + note)
|
|
}
|
|
// The network of the Sandbox commands, in one line: it follows the
|
|
// chat's preset at each turn and needs no restart of the harness.
|
|
if cmds.State == CommandsAvailable && cmds.Isolation == "isolated" && cmds.Provider != BuiltinProvider {
|
|
note = strings.TrimSpace(s.egressLine(ctx, rec, hasTool(tools, webSearchName) || hasTool(tools, webFetchName)) + " " + note)
|
|
}
|
|
// The AGENTS.md files of the chat's folder and the home: a pointer, first,
|
|
// so the cut of a long note keeps it. A chat that cannot read them is
|
|
// not told to.
|
|
if canRead {
|
|
if line := nudge.turnLine(ctx, rec); line != "" {
|
|
note = strings.TrimSpace(line + " " + note)
|
|
}
|
|
}
|
|
// What the chat can run comes before the other blocks: the prompt is cut at
|
|
// its end, and this block must reach the model.
|
|
// What the chat can see follows it, for the same reason. Images reach a
|
|
// chat only as files, so a chat without files has no such block.
|
|
head := commandsBlock(cmds, hasTool(tools, "write_file"), hasTool(tools, "read_file"), skillsOff > 0, x.Place())
|
|
if s.d.Files.Available() {
|
|
sees := s.d.Modalities != nil && s.d.Modalities(rec.Model).Vision
|
|
head += "\n\n" + imagesBlock(sees, s.d.Media.VisionModel(rec.Model), hasTool(tools, "describe_image"))
|
|
}
|
|
var goal string
|
|
if !sub && goalActive(rec) {
|
|
// The goal comes right after what the chat can run: the prompt is cut
|
|
// at its end, and the model must not lose the goal.
|
|
goal = goalBlock(rec.Goal)
|
|
}
|
|
prompt = joinBlocks(head, goal, webBlock(tools), prompt)
|
|
if sp := strings.TrimSpace(rec.Settings.SystemPrompt); sp != "" {
|
|
// The chat's own instructions come first: the prompt is cut at its end.
|
|
prompt = strings.TrimSpace(sp + "\n\n" + prompt)
|
|
}
|
|
// The files go last: the prompt is cut at its end, and a block that
|
|
// changes between turns leaves the start of the prompt as it was.
|
|
if fp := s.filesPrompt(ctx, x); fp != "" {
|
|
if !canRead {
|
|
fp += "\n" + filesNote
|
|
}
|
|
prompt = strings.TrimSpace(prompt + "\n\n" + fp)
|
|
}
|
|
// A conversation names its own work folder (the session takes the folder
|
|
// name); a sub-agent saves in its parent's files, so it names the parent's.
|
|
// A chat that cannot save a file has no use for one.
|
|
work := !sub && s.workFolderOn() && s.d.Files.Available() && canWrite
|
|
if sub && canWrite {
|
|
prompt = joinBlocks(prompt, s.subWorkBlock(ctx, rec, x))
|
|
}
|
|
// load_skill learns from the final list whether the chat can read a
|
|
// skill's files and run what a skill needs.
|
|
tools = s.fitLoadSkill(a, tools)
|
|
return session.TurnTools{Tools: tools, Prompt: prompt, Note: note, WorkFolder: work, RefreshKey: key + "\x00" + rec.Settings.SystemPrompt + "\x00" + personaKey}, nil
|
|
}
|
|
|
|
// spawnTool is spawn_agent for the chat of x: a generic sub-agent gets
|
|
// tools built from x, so it reaches what the parent's turn reaches.
|
|
func (s *Service) spawnTool(x session.Access, savedAgents bool) session.Tool {
|
|
desc := "Start a sub-agent that works on a task and reports back. Use it for a self-contained piece of work. " +
|
|
"By default you wait for its answer. With wait=false it runs in the background and its result arrives later as a message."
|
|
agent := ""
|
|
if savedAgents {
|
|
desc += " With agent, the sub-agent is one of the user's saved agents (see " + listAgentsName + "): it works with that agent's instructions, model and tools."
|
|
agent = `"agent":{"type":"string","description":"The id or name of a saved agent from ` + listAgentsName + `. Omit for a plain sub-agent with your tools. Cannot be combined with tools."},`
|
|
}
|
|
return session.Tool{
|
|
Name: "spawn_agent",
|
|
Description: desc,
|
|
Schema: json.RawMessage(`{"type":"object","properties":{` +
|
|
`"task":{"type":"string","description":"What the sub-agent should do, with everything it needs to know."},` +
|
|
agent +
|
|
`"tools":{"type":"array","items":{"type":"string"},"description":"Names of your tools the sub-agent may use. Omit to give it all of them; [] gives it none."},` +
|
|
`"wait":{"type":"boolean","description":"true (default): wait for the answer. false: carry on now."}},` +
|
|
`"required":["task"]}`),
|
|
Run: func(ctx context.Context, raw json.RawMessage) (string, error) { return s.spawn(ctx, x, raw) },
|
|
}
|
|
}
|
|
|
|
func (s *Service) spawn(ctx context.Context, x session.Access, raw json.RawMessage) (string, error) {
|
|
a := x.Actor()
|
|
var args struct {
|
|
Task string `json:"task"`
|
|
Agent string `json:"agent"`
|
|
Tools *[]string `json:"tools"`
|
|
Wait *bool `json:"wait"`
|
|
}
|
|
if err := json.Unmarshal(raw, &args); err != nil {
|
|
return "", fmt.Errorf("bad arguments: %w", err)
|
|
}
|
|
task := strings.TrimSpace(args.Task)
|
|
if task == "" {
|
|
return "", errors.New("task is required")
|
|
}
|
|
wait := args.Wait == nil || *args.Wait
|
|
parent, err := s.d.Store.GetChat(ctx, a.Principal, a.ChatID)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if parent.Kind == session.KindSubAgent {
|
|
return "", ErrSubAgentDepth
|
|
}
|
|
if s.hiddenFor(ctx, parent)[spawnAgentName] {
|
|
return "", ErrSubAgentsOff
|
|
}
|
|
|
|
var (
|
|
subset []session.Tool
|
|
agent agents.Agent
|
|
)
|
|
if ref := strings.TrimSpace(args.Agent); ref != "" {
|
|
// A saved agent: the permission is checked again at the call, since
|
|
// the setting, the chat's switch or the user's feature may have
|
|
// changed since the turn started.
|
|
if args.Tools != nil {
|
|
return "", ErrSavedAgentWithTools
|
|
}
|
|
if err := s.savedAgentsAllowed(ctx, parent); err != nil {
|
|
return "", err
|
|
}
|
|
if agent, err = s.resolveAgent(ctx, a.Principal, ref); err != nil {
|
|
return "", err
|
|
}
|
|
if err := s.agentFitsChat(ctx, parent, agent); err != nil {
|
|
return "", err
|
|
}
|
|
} else {
|
|
if subset, err = s.subset(ctx, x, args.Tools); err != nil {
|
|
return "", err
|
|
}
|
|
// A sub-agent has the parent's tools or fewer: when none of them runs
|
|
// commands, a task that asks to run something cannot work. Say so now
|
|
// instead of spending a turn of the sub-agent on it.
|
|
if !s.runsCommands(subset) && asksToRun(task) {
|
|
return "", ErrSubAgentCannotRun
|
|
}
|
|
}
|
|
if again, err := s.repeatedTask(ctx, a, task); err != nil {
|
|
return "", err
|
|
} else if again {
|
|
return "", ErrSubAgentRepeat
|
|
}
|
|
|
|
parentKey := key(a.Principal, a.ChatID)
|
|
childID := newID()
|
|
title := "Sub-agent: " + truncate(task, 60)
|
|
model := parent.Model
|
|
if agent.ID != "" {
|
|
title = "Sub-agent " + agent.Name + ": " + truncate(task, 60)
|
|
if agent.Model != "" {
|
|
model = agent.Model
|
|
}
|
|
}
|
|
if err := s.registerChild(ctx, a.Principal, a.ChatID, &child{id: childID, title: title, background: !wait}); err != nil {
|
|
return "", err
|
|
}
|
|
now := parent.Updated
|
|
rec := session.ChatRecord{ID: childID, Principal: a.Principal, Title: title, Created: now, Updated: now,
|
|
Kind: session.KindSubAgent, ParentID: a.ChatID, Model: model, AgentID: agent.ID,
|
|
// The child is refused, never given the whole home, when the folder
|
|
// it works in can no longer be found (chatScopes).
|
|
ScopedAgent: parent.ScopedAgent || agent.HasFolder()}
|
|
if err := s.d.Store.CreateChat(ctx, rec); err != nil {
|
|
s.forgetChild(parentKey, childID)
|
|
return "", err
|
|
}
|
|
s.bus.Publish(parentKey, session.Event{Kind: session.KindSubAgentStarted, IDs: []string{childID}, Text: title})
|
|
childKey := key(a.Principal, childID)
|
|
if agent.ID == "" {
|
|
s.mu.Lock()
|
|
s.allowed[childKey] = s.fitLoadSkill(a, subset)
|
|
s.mu.Unlock()
|
|
}
|
|
done := s.waitFor(childKey)
|
|
if _, err := s.send(context.WithoutCancel(ctx), a.Principal, childID, session.Message{Text: task}); err != nil {
|
|
// The child never ran: drop what was set up for it, or the waiter and
|
|
// an empty sub-agent conversation would stay behind.
|
|
s.forgetWaiter(childKey, done)
|
|
s.forgetChild(parentKey, childID)
|
|
if derr := s.d.Store.DeleteChat(context.WithoutCancel(ctx), a.Principal, childID); derr != nil {
|
|
s.log.Warn("studio: could not remove a sub-agent that did not start", "chat", childID, "error", derr)
|
|
}
|
|
return "", err
|
|
}
|
|
|
|
if !wait {
|
|
go s.reportBack(a, childID, title, done) // #nosec G118 -- a background sub-agent reports after the request ended
|
|
return fmt.Sprintf("Started sub-agent %s in the background. Its result will arrive as a message.", childID), nil
|
|
}
|
|
select {
|
|
case st := <-done:
|
|
s.forgetChild(parentKey, childID)
|
|
return s.childResult(ctx, a, childID, st)
|
|
case <-ctx.Done():
|
|
_ = s.Stop(context.WithoutCancel(ctx), a.Principal, childID)
|
|
s.forgetChild(parentKey, childID)
|
|
return "", ctx.Err()
|
|
}
|
|
}
|
|
|
|
// agentFitsChat checks that a saved agent may run as a sub-agent of the
|
|
// chat: when the chat's own agent has a folder, the agent has none or has one
|
|
// that is the same or inside it. The check is made from the stores at the
|
|
// call, before any chat is made for the child.
|
|
func (s *Service) agentFitsChat(ctx context.Context, chat session.ChatRecord, ag agents.Agent) error {
|
|
outer, err := s.agentFolderScope(ctx, chat, false)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !s.agentFitsScope(ctx, chat.Principal, outer, ag) {
|
|
return ErrAgentOutsideFolder
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// agentFitsScope says whether ag may work under outer, the folder of the
|
|
// chat's agent (nil for a chat with none). An agent whose folder cannot be
|
|
// found does not fit a folder: nothing says it is inside.
|
|
func (s *Service) agentFitsScope(ctx context.Context, p string, outer *folderScope, ag agents.Agent) bool {
|
|
if outer == nil || !ag.HasFolder() {
|
|
return true
|
|
}
|
|
inner, err := s.liveFolder(ctx, p, ag)
|
|
return err == nil && workspace.Within(inner.path, outer.path)
|
|
}
|
|
|
|
// subset picks the tools a sub-agent gets from the parent's host tools and
|
|
// file tools, built from x, the parent's access for this turn. Nil asks for
|
|
// all of them but the named-only ones; a name the parent does not have is an
|
|
// error.
|
|
func (s *Service) subset(ctx context.Context, x session.Access, names *[]string) ([]session.Tool, error) {
|
|
a := x.Actor()
|
|
have, err := s.hostTools(ctx, a)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not list your tools: %w", err)
|
|
}
|
|
// The built-in file tools act for the parent chat: what a sub-agent changes
|
|
// is an agent change of the parent, and the parent's Files pane refreshes.
|
|
parent, perr := s.d.Store.GetChat(ctx, a.Principal, a.ChatID)
|
|
fileTools := s.d.Files.Tools(x)
|
|
if perr == nil {
|
|
// A sub-agent never gets a tool its parent switched off.
|
|
fileTools = dropHidden(fileTools, s.hiddenFor(ctx, parent))
|
|
}
|
|
have = append(have, s.fileNudgeTools(x, s.announceFileChanges(a, s.skillHintTools(a, fileTools)))...)
|
|
if perr == nil {
|
|
// Built for a sub-agent: bash on this machine only when no card is
|
|
// needed, since nobody watches the sub-agent's chat.
|
|
have = s.applyBuiltins(have, s.builtinsFor(ctx, a, parent, true))
|
|
}
|
|
if names == nil {
|
|
kept := have[:0:0]
|
|
for _, t := range have {
|
|
if !namedOnlyTools[t.Name] {
|
|
kept = append(kept, t)
|
|
}
|
|
}
|
|
return kept, nil
|
|
}
|
|
byName := make(map[string]session.Tool, len(have))
|
|
for _, t := range have {
|
|
byName[t.Name] = t
|
|
}
|
|
out := make([]session.Tool, 0, len(*names))
|
|
for _, n := range *names {
|
|
t, ok := byName[n]
|
|
if !ok {
|
|
return nil, fmt.Errorf("the tool %q is not one of your tools, so a sub-agent cannot have it", n)
|
|
}
|
|
out = append(out, t)
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
// registerChild records a running sub-agent, refusing a background one past
|
|
// the limit. The limit counts the parent's running sub-agents in the store, so
|
|
// it holds across frontends: a sub-agent that a turn on another frontend
|
|
// started still counts. Children registered here but not yet running count too.
|
|
func (s *Service) registerChild(ctx context.Context, p, conv string, c *child) error {
|
|
parentKey := key(p, conv)
|
|
running := map[string]bool{}
|
|
if c.background {
|
|
kids, err := s.runningChildren(ctx, p, conv)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
for _, k := range kids {
|
|
running[k.ID] = true
|
|
}
|
|
}
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
if c.background {
|
|
n := len(running)
|
|
for id, k := range s.children[parentKey] {
|
|
if k.background && !running[id] {
|
|
n++
|
|
}
|
|
}
|
|
if n >= maxBackgroundChildren {
|
|
return ErrSubAgentLimit
|
|
}
|
|
}
|
|
if s.children[parentKey] == nil {
|
|
s.children[parentKey] = map[string]*child{}
|
|
}
|
|
s.children[parentKey][c.id] = c
|
|
return nil
|
|
}
|
|
|
|
// runningChildren returns the sub-agent chats of a conversation whose turn
|
|
// runs now, on any frontend.
|
|
func (s *Service) runningChildren(ctx context.Context, p, conv string) ([]session.ChatRecord, error) {
|
|
kids, err := s.d.Store.ListChildren(ctx, p, conv)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var out []session.ChatRecord
|
|
for _, k := range kids {
|
|
info, err := s.d.Store.Turn(ctx, p, k.ID)
|
|
if err != nil {
|
|
if errors.Is(err, session.ErrNotFound) {
|
|
continue // deleted meanwhile
|
|
}
|
|
return nil, err
|
|
}
|
|
if info.Running {
|
|
out = append(out, k)
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func (s *Service) forgetChild(parentKey, id string) {
|
|
s.mu.Lock()
|
|
// The child's tool list is needed only while its turn runs.
|
|
if p, _, ok := strings.Cut(parentKey, "\x00"); ok {
|
|
delete(s.allowed, key(p, id))
|
|
}
|
|
delete(s.children[parentKey], id)
|
|
if len(s.children[parentKey]) == 0 {
|
|
delete(s.children, parentKey)
|
|
}
|
|
s.mu.Unlock()
|
|
}
|
|
|
|
// waitFor returns a channel that receives how the next turn of the
|
|
// conversation ends. Register it before starting the turn.
|
|
func (s *Service) waitFor(k string) <-chan store.TurnStatus {
|
|
ch := make(chan store.TurnStatus, 1)
|
|
s.mu.Lock()
|
|
s.waiters[k] = append(s.waiters[k], ch)
|
|
s.mu.Unlock()
|
|
return ch
|
|
}
|
|
|
|
// forgetWaiter removes a channel that waitFor returned and nobody will read.
|
|
func (s *Service) forgetWaiter(k string, ch <-chan store.TurnStatus) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
ws := s.waiters[k]
|
|
for i, w := range ws {
|
|
if (<-chan store.TurnStatus)(w) == ch {
|
|
s.waiters[k] = append(ws[:i:i], ws[i+1:]...)
|
|
break
|
|
}
|
|
}
|
|
if len(s.waiters[k]) == 0 {
|
|
delete(s.waiters, k)
|
|
}
|
|
}
|
|
|
|
func (s *Service) notifyWaiters(k string, status store.TurnStatus) {
|
|
s.mu.Lock()
|
|
ws := s.waiters[k]
|
|
delete(s.waiters, k)
|
|
s.mu.Unlock()
|
|
for _, w := range ws {
|
|
w <- status
|
|
}
|
|
}
|
|
|
|
// childResult is what the parent's tool call returns for a finished sub-agent.
|
|
func (s *Service) childResult(ctx context.Context, a workspace.Actor, childID string, st store.TurnStatus) (string, error) {
|
|
switch st {
|
|
case store.TurnDone, store.TurnPaused:
|
|
return s.finalText(ctx, childID), nil
|
|
case store.TurnStopped:
|
|
return "", errors.New("the sub-agent was stopped")
|
|
default:
|
|
return "", errors.New("the sub-agent failed")
|
|
}
|
|
}
|
|
|
|
// finalText is the last thing the sub-agent said. A long run has more entries
|
|
// than one page, so it reads to the end.
|
|
func (s *Service) finalText(ctx context.Context, convID string) string {
|
|
const page = 1000
|
|
var after int64
|
|
last := ""
|
|
for {
|
|
entries, err := s.d.Store.Entries(ctx, convID, after, page)
|
|
if err != nil {
|
|
return last
|
|
}
|
|
for _, e := range entries {
|
|
if e.Role == session.RoleAssistant {
|
|
last = e.Text
|
|
}
|
|
}
|
|
if len(entries) < page {
|
|
return last
|
|
}
|
|
after = entries[len(entries)-1].Seq
|
|
}
|
|
}
|
|
|
|
// reportBack waits for a background sub-agent and tells the parent. A finished
|
|
// one reaches the parent as a message, which starts a turn when the parent is
|
|
// idle. One that was stopped or failed only raises the event.
|
|
func (s *Service) reportBack(a workspace.Actor, childID, title string, done <-chan store.TurnStatus) {
|
|
var st store.TurnStatus
|
|
select {
|
|
case st = <-done:
|
|
case <-s.closed:
|
|
return
|
|
}
|
|
ctx := context.Background()
|
|
parentKey := key(a.Principal, a.ChatID)
|
|
s.forgetChild(parentKey, childID)
|
|
s.bus.Publish(parentKey, session.Event{Kind: session.KindSubAgentDone, IDs: []string{childID}, Text: title})
|
|
if !st.Finished() {
|
|
return
|
|
}
|
|
msg := fmt.Sprintf("[Sub-agent finished: %s]\n%s", title, s.finalText(ctx, childID))
|
|
if _, err := s.send(ctx, a.Principal, a.ChatID, session.Message{Text: msg}); err != nil {
|
|
s.log.Warn("studio: could not tell the parent that a sub-agent finished", "chat", a.ChatID, "error", err)
|
|
}
|
|
}
|
|
|
|
// stopChildren stops every running sub-agent of a conversation, wherever its
|
|
// turn runs: the store knows the children, and Stop reaches a turn on another
|
|
// frontend over the bus.
|
|
func (s *Service) stopChildren(p, conv string) {
|
|
go func() {
|
|
ctx := context.Background()
|
|
kids, err := s.runningChildren(ctx, p, conv)
|
|
if err != nil {
|
|
s.log.Warn("studio: could not list the sub-agents to stop", "chat", conv, "error", err)
|
|
return
|
|
}
|
|
for _, k := range kids {
|
|
if err := s.Stop(ctx, p, k.ID); err != nil {
|
|
s.log.Warn("studio: could not stop a sub-agent", "chat", k.ID, "error", err)
|
|
}
|
|
}
|
|
}()
|
|
}
|
|
|
|
func truncate(s string, n int) string {
|
|
s = strings.Join(strings.Fields(s), " ")
|
|
if len(s) <= n {
|
|
return s
|
|
}
|
|
return s[:n] + "…"
|
|
}
|
|
|
|
// hasTool says whether the list has a tool of that name.
|
|
func hasTool(tools []session.Tool, name string) bool {
|
|
for _, t := range tools {
|
|
if t.Name == name {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|