eleven / messenger Public

Member bots: ask Eleven for your own scheduled agent (#432 Option B, on main) (#496)

* bot: anthropic client speaks blocks — tool_use/tool_result turns + thinking fields

anthMessage content is now string OR []anthBlock, and anthBlock carries id /
tool_use_id / content plus the extended-thinking fields (thinking, signature,
data). A tool loop echoes the model's assistant turn back verbatim, and the
API requires thinking blocks to come back intact — without these fields every
live thinking+tools run is a hard 400 ('thinking.thinking: Field required')
that scripted test fakes can never surface. Ports the prototype's 37fb7fb,
re-derived against main (issue #432).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* bot: the task engine — a bounded model loop with fetch, feed discovery, budgets

The engine behind autonomous member bots (docs/member-bots.md): execTask runs
a closed-tool agentic loop (system prompt from a standing charter; fetched
content fenced in tool_result blocks, framed as data), fetchURL is HTTPS-only
against a per-charter URL-prefix allowlist with the unfurler's private-address
blocking, and discoverFeeds reads a site's advertised feed URLs out of its own
HTML so members name publications, never URLs. Budgets: max_tool_calls
(default 6, cap 16), truncated tool results, one card per run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web+bot+ios: cards — one declarative message-card schema, rendered per platform

A small, bounded card (think Block Kit, deliberately NOT a mini-app format)
riding on an ordinary chat message, with the message text as its mandatory
plain fallback. Ported near-verbatim from the member-bots prototype (#432/#435):

- web/static/cards.js: normalizeCard (pure, Node-tested) + renderCard
  (textContent only) + themed CSS; chat.js renders a valid card as the
  message body, invalid cards fail closed to the text bubble.
- internal/bot/card.go: the same validator in Go — the task engine's card
  tool bounces malformed cards back as tool_results the model can fix.
- LChatCore Card.swift + CardView.swift: the native third; MessagePayload
  gains card (raw JSON, validated at render, so unknown futures never fail
  the decode).
- test/event-vectors/cards.json is the three-way contract, consumed by
  test/cards.test.mjs, card_test.go, and CardVectorTests.swift.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* server: member_bots — an opaque charter store mirroring member_apps

One table + three routes. A member bot's charter (persona + schedule + task)
is encrypted under the instance key before it reaches us and stored like a
member app: the server learns (random id, author, owner, size, times) —
never the bot's name, schedule, sources, or prompt. Ownership is the
member-app pattern verbatim: an agent may set owner_id to the member it
built for; overwrite is author-or-owner; delete is author-or-owner-or-admin
(moderation without readability). Caps are tighter than apps (100 global,
10 per owner) because every charter is a standing scheduled model run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* bot: member bots — charters, the scheduler, and the create_bot builder (#432 Option B)

The headline: 'make me a bot that sends me a news summary every morning' now
works end to end on main's own grain. A member bot is a CHARTER the member
owns — no new E2EE identity, no minting endpoint, no supervisor:

- charter.go: the data model (persona + schedule + task + thread + owner),
  validation (fail closed per charter), store access via the ordinary
  member endpoints.
- chartersched.go: the alarm clock — one bot.tick per live charter, encrypted
  under the host's SELF-THREAD key and delivered by the server's existing
  scheduled-message sweep. Ticks re-read the charter (edits/deletes take
  effect immediately) and re-arm BEFORE running; reconcile on connect + a
  slow ticker heals lost/stale alarms. The server learns (thread, time).
- botbuild.go: the builder, mirroring appbuild.go — create_bot interviews →
  feeds discovered from the sites the member named → THE DRY RUN IS THE GATE
  (no result → nothing created) → charter stored (agent-sets-owner) → a
  dedicated titled thread (owner + host) → first alarm armed → the dry run
  delivered as the bot's first edition, under its persona name. Updates via
  bot_id (ownership enforced in the sidecar); remove_bot retires.
- runtime.go: the typed-payload chokepoint generalized into handleTyped
  (bot.tick honoured only from the self-thread); member-endpoint helpers
  (schedule/unschedule, self-thread, titled-thread creation) that keep
  r.keys single-goroutine; an instance-key nudge so a keyless host heals
  while any member's tab is open.
- botcmd.go elects exactly ONE charter host per sidecar (Eleven if present).

bot_botbuild_test.go drives both loops against the real router with a
scripted model: the full build pipeline (thinking block echoed intact through
the tool loop — the 400 fix, pinned live-shaped), and tick → task → post →
re-arm. Design + trust model: docs/member-bots.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: member bots — design, trust model, and the local demo runbook

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web+bot: one Eleven — the scripted conversations run inside the live agent's DM

There were two Elevens: the client-side scripted setup/welcome conversations
(app-threads that title themselves Eleven, deliberately keyless so a fresh
instance onboards with no sidecar) and the real sidecar agent. Now, when a
real agent Eleven is on the roster, they are one thread — the script is the
floor, the model is the ceiling. The agent is the UPGRADED built-in helper,
not a second one.

- shell.js: maybeStartWelcome AND maybeStartSetup find (or create —
  createThread dedupes) the DM with the agent Eleven and mount the flow THERE;
  the app-thread fallback remains for instances with no sidecar. The
  inviter-DM heuristic skips agent DMs so the Eleven DM can't be mistaken for
  the invite's pending thread. Until someone gives the agent a custom photo it
  wears the app icon — the same face as the scripted conversations.
- Scripted lines persist as ORDINARY chat messages authored "Eleven"
  (uid-less): every client renders them as the bot's bubbles — native included,
  for free — and the sidecar's agent-name rule keeps the real Eleven from
  replying to its own scripted half. A key field inside the payload gives
  resume dedup (makeLiveSay mirrors makeSay's pacing/queue); step records stay
  typed events, seeded on open for reload resume.
- The mute handshake: the client posts flow.state {active} when the script
  takes/cedes the floor; the bot's brain stays quiet in that DM meanwhile —
  with a 15-minute expiry so a client that dies mid-flow can't mute the bot
  forever. Typed traffic (ticks, connect ops) is unaffected.

Re-derived from the prototype's bd6261f (#432/#435) against current main.
Test: while flow.state is active a DM answer gets no reply; after ceding,
/help is answered — exactly one reply, in order.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* join: don't trust a stored session the server no longer recognises

After an instance reset (or this device's removal), a stored session outlives
its account; trusting it routes a valid invite down the "you're already in"
adopt path, which dies with a misleading "invite has been used or is no longer
valid". liveSession() verifies the token against /api/me and drops it ONLY on
a definitive 403 — a network blip keeps the session (dropping keys because
wifi flickered would be catastrophic), and the adopt path then fails loudly as
before. Port of the prototype's 7730b56 (#432), which reproduced this live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* bot+web: the builder settles like a person — plain English, an open-chat chip, www-aware discovery

Paul's canary feedback: the confirmation was a wall of discovery errors and
raw URLs (which also dragged a stray link preview into the chat), plus a
developer-facing bot id.

- The settle message now reads for a PERSON: what the bot does, where it
  lives, when the next edition lands, which sites it reads (bare hosts, no
  URLs), and at most a one-line caveat ('rte.ie doesn't share a feed, so it
  reads the front page instead'). Discovery error detail goes to the log.
- An 'Open <bot>' chip rides the confirmation: new open_thread action in the
  client whitelist (ui.js CHIP_TYPES + shell.js runner) — navigation only, so
  a crafted chip can do no more than a sidebar tap could.
- The opaque bot id moves to the muted breadcrumb line, where the brain can
  still read it back for later updates without cluttering the message.
- Feed discovery now treats apex↔www redirects as the same site (bbc.com,
  npr.org and theguardian.com all bounce to www and were falling back to
  page-reading; sameSiteHost pins the rule) — anything further off-host stays
  blocked.

E2E now asserts: chip present and pointing at the dedicated thread, no URLs
in the settle text, id on the breadcrumb only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* bot+agent: fleet-ready — Node sidecar honours flow.state; 15m interval floor

Two gates between this branch and a fleet deploy, closed:

- agent/runtime.mjs (the Node reference, which the PRODUCTION fleet still
  runs): honour the one-Eleven mute handshake. Without it, a new joiner's
  welcome routing into the live Eleven's DM would have the Node brain
  interjecting mid-script — two voices. Also drop other typed payloads
  before the reply path, mirroring the Go runtime's chokepoint (a DM's
  replyTrigger fires on ANY message, typed included).
- minEvery becomes the production cost valve: 15 minutes (every interval is
  a standing scheduled model run), lowered only via LCHAT_BOT_MIN_EVERY on
  tests and demo canaries — the LCHAT_BOT_ALLOW_PRIVATE_FETCH pattern.
  TestMinEveryDefault pins the floor.

Plus the changelog entry for what members actually receive from a deploy
today (member bots stay dormant until a Go sidecar hosts charters): one
Eleven during onboarding, and invite links that survive a space reset.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* changelog: member bots — ask Eleven for your own scheduled helper

Ships with the deploy now that the fleet sidecars run the Go runtime: the
control-binary swap + sidecar restart that follows the server publish is the
go-live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>