runlight 0.1.7 → 0.1.8

data/lib/runlight/accounts/web.rb

@@ -28,8 +28,8 @@ module Runlight
 
       # options: "runlight" (the Core, or anything with store, mail_settings, send_mail, and client_ip), "secret",
       # "base", "now" (a callable giving milliseconds), "firstAccount", "home" (optional, a callable giving the
-      # install's own origin or nil), "forgot", and "setupWhere" (optional), which says where to find the setup
-      # link with the one-time code, when it is not in a log (HTML).
+      # install's own origin or nil), "forgot", and "setupWhere" (optional, true), which says the setup
+      # link with the one-time code is in the file setup.txt, not in a log.
       def initialize(options)
         @rl = options["runlight"]
         @store = @rl.store
@@ -58,8 +58,6 @@ module Runlight
         # Six-digit codes: five wrong tries an account every fifteen minutes, and five to confirm the first one.
         # Password re-checks in Account: ten.
         @code_tries = Throttle.new(@store, "code", 5)
-        # A decoy ticket's tries count apart, the same way, so someone guessing passwords cannot use up the owner's five.
-        @decoy_tries = Throttle.new(@store, "decoy", 5)
         @confirm_tries = Throttle.new(@store, "confirm", 5)
         @rechecks = Throttle.new(@store, "recheck", 10)
       end
@@ -142,7 +140,7 @@ module Runlight
 
         # The dashboard itself: straight to sign-in, or to setting up the first account.
         if (path == "/" || path == "") && request.method == "GET" && signed_in(request).nil?
-          return @first == "open" || @asks_for_token ? redirect("#{@base}/setup") : setup_locked unless has_account?
+          return @first == "open" || @asks_for_token ? redirect("#{@base}/setup") : setup_locked(Messages.accepted_language(request)) unless has_account?
 
           search = Http::Url.new(request.url).search
           return redirect("#{@base}/login#{search == "" ? "" : "?next=#{Js.encode_uri_component("#{@home_path}#{search}")}"}")
@@ -270,8 +268,15 @@ module Runlight
       end
 
       # Why there is no setup form.
-      def setup_locked
-        html(@first == "locked" ? Pages.setup_needs_token_page(@base) : Pages.setup_locked_page(@base, @setup_where), 403)
+      def setup_locked(lang)
+        html(@first == "locked" ? Pages.setup_needs_token_page(@base, lang) : Pages.setup_locked_page(@base, Js.truthy?(@setup_where), lang), 403)
+      end
+
+      # An account's problem in the visitor's language, where the dashboard has words for it; English as it was raised.
+      def reason(lang, error)
+        key = "error.#{error.is_a?(AccountError) ? error.code : ""}"
+        t = Messages.translator(lang)["t"]
+        lang == "en" || t.call(key) == key ? error.message : t.call(key, error.is_a?(AccountError) ? error.params : {})
       end
 
       # Emails an invite through the mail service when there is one. The link
@@ -340,11 +345,13 @@ module Runlight
         query = url.search_params
         method = request.method
         base = @base
+        lang = Messages.accepted_language(request)
+        t = Messages.translator(lang)["t"]
         if path == "/auth.css"
           return Http::Response.new(Pages::AUTH_CSS, status: 200, headers: { "content-type" => "text/css; charset=utf-8", "cache-control" => "public, max-age=3600" })
         end
         if path == "/auth.js"
-          return Http::Response.new(Pages::AUTH_JS, status: 200, headers: { "content-type" => "application/javascript; charset=utf-8", "cache-control" => "public, max-age=3600" })
+          return Http::Response.new(Pages.auth_js(query.get("lang") || "en"), status: 200, headers: { "content-type" => "application/javascript; charset=utf-8", "cache-control" => "public, max-age=3600" })
         end
 
         if path == "/setup"
@@ -352,43 +359,43 @@ module Runlight
 
           if method == "GET"
             code = query.get("code") || ""
-            return setup_locked if @first == "locked"
+            return setup_locked(lang) if @first == "locked"
             # The app's token is typed in; the server's code comes in the link it printed.
-            return html(Pages.setup_page(base, { "code" => "", "askCode" => @asks_for_token })) if @asks_for_token || @first == "open"
+            return html(Pages.setup_page(base, { "code" => "", "askCode" => @asks_for_token }, lang)) if @asks_for_token || @first == "open"
 
-            return setup_ok(code) ? html(Pages.setup_page(base, { "code" => code })) : setup_locked
+            return setup_ok(code) ? html(Pages.setup_page(base, { "code" => code }, lang)) : setup_locked(lang)
           end
           if method == "POST"
             form = Http::SearchParams.new(request.text)
             code = form.get("code") || ""
             unless setup_ok(code)
               if @asks_for_token
-                return html(Pages.setup_page(base, { "code" => "", "askCode" => true, "error" => "That is not this app's RUNLIGHT_TOKEN.", "email" => form.get("email") || "" }), 403)
+                return html(Pages.setup_page(base, { "code" => "", "askCode" => true, "error" => t.call("auth.tokenWrong"), "email" => form.get("email") || "" }, lang), 403)
               end
 
-              return setup_locked
+              return setup_locked(lang)
             end
             again = ->(error) { { "code" => @asks_for_token ? "" : code, "askCode" => @asks_for_token, "error" => error, "email" => form.get("email") || "" } }
             # Asked twice, since a typo here would lock the first owner out.
-            return html(Pages.setup_page(base, again.call("The two passwords are not the same.")), 400) if (form.get("password") || "") != (form.get("again") || "")
+            return html(Pages.setup_page(base, again.call(t.call("auth.mismatch")), lang), 400) if (form.get("password") || "") != (form.get("again") || "")
 
             begin
               user = @accounts.set_password(form.get("email") || "", form.get("password") || "", now)
               @existing = true
               return redirect(@home_path, { "set-cookie" => session_cookie(request, @accounts.session_for(user, now), Accounts::SESSION_MS / 1000) })
             rescue RangeError => e
-              return html(Pages.setup_page(base, again.call(e.message)), 400)
+              return html(Pages.setup_page(base, again.call(reason(lang, e)), lang), 400)
             end
           end
         end
 
         if path == "/login"
           unless has_account?
-            return setup_locked if @first == "locked"
+            return setup_locked(lang) if @first == "locked"
 
-            return @first == "open" || @asks_for_token ? redirect("#{base}/setup") : setup_locked
+            return @first == "open" || @asks_for_token ? redirect("#{base}/setup") : setup_locked(lang)
           end
-          return html(Pages.login_page(base, { "next" => safe_next(query.get("next")), "forgot" => @forgot })) if method == "GET"
+          return html(Pages.login_page(base, { "next" => safe_next(query.get("next")), "forgot" => @forgot }, lang)) if method == "GET"
           return login(request, context) if method == "POST"
         end
 
@@ -397,9 +404,9 @@ module Runlight
           next_path = safe_next(query.get("next"))
           user = @accounts.from_link(query.get("ticket") || "", now)
           if user.nil?
-            return html(Pages.login_page(base, { "error" => "That sign-in link has run out. Sign in again.", "next" => next_path, "forgot" => @forgot }), 410)
+            return html(Pages.login_page(base, { "error" => t.call("auth.linkExpired"), "next" => next_path, "forgot" => @forgot }, lang), 410)
           end
-          return html(Pages.code_page(base, { "pending" => @accounts.pending_for(user, now), "next" => next_path })) if user["twoFactor"]
+          return html(Pages.code_page(base, { "pending" => @accounts.pending_for(user, now), "next" => next_path }, lang)) if user["twoFactor"]
 
           return signed_in_to(request, user, next_path)
         end
@@ -408,18 +415,16 @@ module Runlight
           ready
           form = Http::SearchParams.new(request.text)
           next_path = safe_next(form.get("next"))
-          pending = @accounts.from_pending(form.get("pending") || "", now)
-          return redirect("#{base}/login?next=#{Js.encode_uri_component(next_path)}") if pending.nil?
+          user = @accounts.from_pending(form.get("pending") || "", now)
+          return redirect("#{base}/login?next=#{Js.encode_uri_component(next_path)}") if user.nil?
 
-          user = pending["user"]
-          real = pending["real"]
           # Counted before the check, so a burst cannot get past five.
-          unless (real ? @code_tries : @decoy_tries).take(user["id"], now)
-            return html(Pages.code_page(base, { "pending" => form.get("pending") || "", "next" => next_path, "error" => "Too many tries. Wait fifteen minutes and try again." }), 429)
+          unless @code_tries.take(user["id"], now)
+            return html(Pages.code_page(base, { "pending" => form.get("pending") || "", "next" => next_path, "error" => t.call("error.too_many_tries") }, lang), 429)
           end
-          if !real || !@accounts.check_second_factor(user["id"], form.get("code") || "", now)
+          unless @accounts.check_second_factor(user["id"], form.get("code") || "", now)
             return html(Pages.code_page(base, { "pending" => form.get("pending") || "", "next" => next_path,
-                                                "error" => "That code is not right. Check the time on your phone, or use a recovery code." }), 401)
+                                                "error" => t.call("auth.codeWrong") }, lang), 401)
           end
 
           @code_tries.clear(user["id"], now)
@@ -432,29 +437,29 @@ module Runlight
           if method == "GET"
             code = query.get("code") || ""
             invite = @accounts.invite_by_code(code, now)
-            return html(Pages.invite_gone_page(base), 410) if invite.nil?
+            return html(Pages.invite_gone_page(base, lang), 410) if invite.nil?
 
-            return html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host }))
+            return html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host }, lang))
           end
           if method == "POST"
             form = Http::SearchParams.new(request.text)
             code = form.get("code") || ""
             invite = @accounts.invite_by_code(code, now)
-            return html(Pages.invite_gone_page(base), 410) if invite.nil?
+            return html(Pages.invite_gone_page(base, lang), 410) if invite.nil?
 
             again = lambda do |error|
-              html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host, "error" => error }), 400)
+              html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host, "error" => error }, lang), 400)
             end
-            return again.call("The two passwords are not the same.") if (form.get("password") || "") != (form.get("again") || "")
+            return again.call(t.call("auth.mismatch")) if (form.get("password") || "") != (form.get("again") || "")
 
             begin
               user = @accounts.accept_invite(code, form.get("password") || "", now)
               @existing = true
               return redirect(@home_path, { "set-cookie" => session_cookie(request, @accounts.session_for(user, now), Accounts::SESSION_MS / 1000) })
             rescue RangeError => e
-              return html(Pages.invite_gone_page(base), 410) if e.is_a?(AccountError) && e.code == "invite_gone"
+              return html(Pages.invite_gone_page(base, lang), 410) if e.is_a?(AccountError) && e.code == "invite_gone"
 
-              return again.call(e.message)
+              return again.call(reason(lang, e))
             end
           end
         end
@@ -471,8 +476,10 @@ module Runlight
         account = Js.lower(Js.trim(email))
         ip = @rl.client_ip(request, context)
         pair = "#{account}\n#{ip == "" ? "unknown" : ip}"
-        login_page = ->(opts) { Pages.login_page(base, opts.merge("next" => next_path, "forgot" => @forgot) { |_k, mine, _theirs| mine }) }
-        too_many = -> { html(login_page.call({ "error" => "Too many tries. Wait fifteen minutes and try again.", "email" => email }), 429) }
+        lang = Messages.accepted_language(request)
+        t = Messages.translator(lang)["t"]
+        login_page = ->(opts) { Pages.login_page(base, opts.merge("next" => next_path, "forgot" => @forgot) { |_k, mine, _theirs| mine }, lang) }
+        too_many = -> { html(login_page.call({ "error" => t.call("error.too_many_tries"), "email" => email }), 429) }
         return too_many.call if ip != "" && !@per_ip.take(ip, now)
         return too_many.call unless @per_address.take(pair, now)
 
@@ -480,10 +487,11 @@ module Runlight
         known = @accounts.by_email(account)
         trusted = !known.nil? && @accounts.trusts_device(read_cookie(request, DEVICE_COOKIE), known)
         over = !trusted && !@per_account.take(account, now)
-        # Past the account's limit, a right password and a wrong one get the same answer, so guessing from many
-        # addresses learns nothing, and the owner still gets in. With two-factor on, both reach the code step,
-        # where a wrong password's ticket never passes. Without it, a right password emails a sign-in link.
-        if over && !(known && known["twoFactor"])
+        # Past the account's limit, a right password and a wrong one get the same answer, and so does every
+        # account, with two-factor on or not, and an email with no account, so guessing from many addresses
+        # learns nothing about either. The owner still gets in: a right password emails a sign-in link, which
+        # leads to the code step when two-factor is on.
+        if over
           home = home_origin
           return too_many.call if !@rl.mail_settings || home.nil? || home == ""
 
@@ -497,27 +505,24 @@ module Runlight
               warn "Runlight: could not send a sign-in link #{e.message}"
             end
           end
-          return html(login_page.call({ "error" => "Too many tries for this account. If the password was right, a link to sign in is on its way to its email address.",
-                                        "email" => email }), 429)
+          return html(login_page.call({ "error" => t.call("auth.tooManyLink"), "email" => email }), 429)
         end
         user = @accounts.sign_in(email, password)
-        if user.nil?
-          return html(Pages.code_page(base, { "pending" => @accounts.decoy_for(known, now), "next" => next_path })) if over && !known.nil?
+        return html(login_page.call({ "error" => t.call("auth.wrongPassword"), "email" => email }), 401) if user.nil?
+
 
-          return html(login_page.call({ "error" => "That email and password do not match an account.", "email" => email }), 401)
-        end
         @per_address.clear(pair, now)
         @per_ip.forgive(ip, now) if ip != ""
-        @per_account.forgive(account, now) if !over && !trusted
+        @per_account.forgive(account, now) unless trusted
         # With two-factor on, the password only earns the second step.
-        return html(Pages.code_page(base, { "pending" => @accounts.pending_for(user, now), "next" => next_path })) if user["twoFactor"]
+        return html(Pages.code_page(base, { "pending" => @accounts.pending_for(user, now), "next" => next_path }, lang)) if user["twoFactor"]
 
         signed_in_to(request, user, next_path)
       rescue AccountError => e
         # Too many password checks already waiting, so this one was never run: try again in a moment.
         raise unless e.code == "busy"
 
-        html(login_page.call({ "error" => e.message, "email" => email }), 503, { "retry-after" => "5" })
+        html(login_page.call({ "error" => reason(lang, e), "email" => email }), 503, { "retry-after" => "5" })
       end
 
       def recheck(user, input, name, wrong)

data/lib/runlight/assistant.rb

@@ -28,6 +28,8 @@ module Runlight
       { "id" => "custom", "name" => "Another OpenAI-compatible service", "protocol" => "openai", "baseUrl" => "", "model" => "", "key" => "optional" },
     ].freeze
 
+    # The most text of earlier turns a question carries, about six thousand tokens.
+    MAX_HISTORY_CHARS = 24_000
     MAX_ROUNDS = 8
     # However many rounds a question takes, the answer comes within this long or the assistant stops.
     DEADLINE_MS = 120_000
@@ -201,6 +203,12 @@ module Runlight
           history << { "role" => m["role"], "content" => content }
         end
       end
+      # The browser sends the history, so its whole length is held too, the oldest turns dropped first: each
+      # tool round sends it again, and the limits on questions are there to keep the owner's AI credit safe.
+      while history.length > 1 && history.sum { |h| Js.length(h["content"]) } > MAX_HISTORY_CHARS
+        history.shift
+        history.shift while history.length > 1 && history[0]["role"] != "user"
+      end
 
       if provider["protocol"] == "anthropic"
         tools = (Mcp.tools + [Json.decode(File.read(File.expand_path("../../assets/assistant-action.json", __dir__)))]).map { |t| { "name" => t["name"], "description" => t["description"], "input_schema" => t["inputSchema"] } }
@@ -412,6 +420,6 @@ module Runlight
     end
 
     private_class_method :provider, :system_prompt, :in_time, :service_message, :post, :tool_text, :clock, :first_message, :unreadable, :blank?,
-                         :locale_compare, :collation_key, :refused
+                         :collation_key, :refused
   end
 end

data/lib/runlight/core.rb

@@ -180,6 +180,8 @@ module Runlight
       @checking = false
       # When planner statistics were last gathered.
       @optimized_at = 0
+      # When statistics were last checked for staleness, which reports do at most hourly.
+      @freshened_at = 0
       @link_domain_cache = nil
       # Each timezone's salts for its current day, so a lookup is a map read until midnight there.
       @salts = {}
@@ -193,6 +195,15 @@ module Runlight
       @managed_sites
     end
 
+    # Gathers planner statistics again if the events have outgrown them, at most once an hour, so an app
+    # that never runs the scheduled check still reads its reports with statistics that fit its data.
+    def freshen_statistics
+      return if now - @freshened_at < 3_600_000
+
+      @freshened_at = now
+      @store.optimize(true)
+    end
+
     # The clock, in milliseconds.
     def now
       @clock.call.to_i
@@ -732,13 +743,15 @@ module Runlight
       months = retention(site)
       return nil if months.nil?
 
-      # setUTCMonth: the same day and time that many months back, a day past the month's end running on.
+      # Six months before August 31st is February 28th (or 29th), not March 2nd: the day is kept within its month.
       at = now
       ms = at % 1000
       time = Time.at((at - ms) / 1000).utc
       total = (time.year * 12) + (time.month - 1) - months
-      first = Time.utc(total.div(12), (total % 12) + 1, 1, time.hour, time.min, time.sec)
-      ((first.to_i + ((time.day - 1) * 86_400)) * 1000) + ms
+      year = total.div(12)
+      month = (total % 12) + 1
+      last = (Time.utc(month == 12 ? year + 1 : year, month == 12 ? 1 : month + 1, 1) - 86_400).day
+      (Time.utc(year, month, [time.day, last].min, time.hour, time.min, time.sec).to_i * 1000) + ms
     end
 
     def site(id = nil)
@@ -1014,11 +1027,10 @@ module Runlight
       }
     end
 
-    # Sites in name order, as TS sorts them with localeCompare: letters before case, as a collator puts them.
+    # Sites in name order, as TS sorts them with localeCompare, in the order the assistant's collation gives.
     def by_name(sites)
       sites.each_with_index.sort do |(a, i), (b, j)|
-        order = Js.lower(a["name"]) <=> Js.lower(b["name"])
-        order = Js.compare(b["name"], a["name"]) if order.zero?
+        order = Assistant.locale_compare(a["name"], b["name"])
         order.zero? ? i <=> j : order
       end.map(&:first)
     end
@@ -1282,11 +1294,28 @@ module Runlight
       @salts[timezone] = { "day" => day, "today" => today, "yesterday" => yesterday }
     end
 
-    # Deletes salts whose day has ended everywhere. The earliest timezone is a
-    # day behind UTC and still needs its yesterday, so a salt goes two UTC days
-    # after its date.
+    # Deletes every salt no visit can still use. A day's salt counts visitors while it is that day in a
+    # site's timezone, and after midnight only while a visit that began that day there is still going, since
+    # it carries on under the visitor it began with. So a salt lasts its day and the visits that run past it.
     def drop_old_salts(at)
-      @store.drop_salts_before(Time.at((at - (2 * 86_400_000)).div(1000)).utc.strftime("%Y-%m-%d"))
+      zones = {}
+      sites.each { |site| (zones[site["timezone"]] ||= []) << site["id"] }
+      return if zones.empty?
+
+      needed = []
+      zones.each do |timezone, ids|
+        today = Dates.local_date(at, timezone)
+        needed << today
+        yesterday = Dates.add_days(today, -1)
+        if @store.visit_open(ids, Dates.start_of(yesterday, timezone), Dates.start_of(today, timezone), at - SESSION_IDLE_MS)
+          needed << yesterday
+        else
+          # Nor is it kept here: no visit is left for it to find.
+          cached = @salts[timezone]
+          cached["yesterday"] = nil if !cached.nil? && cached["day"] == today
+        end
+      end
+      @store.drop_salts_except(needed)
     end
 
     # The host a proxy says the request was for, read only when proxy headers are trusted, as the client's address is.
@@ -1387,7 +1416,8 @@ module Runlight
         "utmContent" => page["utm"]["content"],
       ).merge(location).merge(parsed).merge("screen" => client["screen"], "language" => client["language"])
       @store.insert_session(row)
-      session
+      # Another process may have opened this visitor's visit at the same moment: both go on with the earlier.
+      @store.settle_open_session(site["id"], candidates, at - SESSION_IDLE_MS, session)
     end
 
     # The link domains, read at most every 30 seconds. Every request to a
@@ -1455,6 +1485,9 @@ module Runlight
       if now - @optimized_at >= 86_400_000
         @optimized_at = now
         @store.optimize
+      else
+        # Between the daily runs, a large import or a busy first day still gets statistics that fit it.
+        @store.optimize(true)
       end
       build_rollups
       { "ok" => true, "reports" => send_reports }

data/lib/runlight/dates.rb

@@ -211,6 +211,14 @@ module Runlight
 
         at += 15 * 60_000
       end
+      # Where clocks fall back across that hour (midnight in Amman in 2019, three hours at Casey station), it
+      # happens twice; the day begins at the first.
+      return at if offset(at - (3 * 3_600_000), timezone) == offset(at, timezone)
+
+      (3 * 60).step(15, -15) do |back|
+        ly, lm, ld, lh = parts(at - (back * 60_000), timezone)
+        return at - (back * 60_000) if utc(ly, lm - 1, ld, lh) == guess
+      end
       at
     end
 

data/lib/runlight/http/fetcher.rb

@@ -26,6 +26,8 @@ module Runlight
       MAX_REDIRECTS = 20
       REDIRECTS = [301, 302, 303, 307, 308].freeze
       TIMED_OUT = "The operation was aborted due to timeout"
+      # Sent only to the origin they were given to.
+      CREDENTIALS = %w[authorization cookie proxy-authorization x-api-key].freeze
 
       def fetch(url, init = {})
         deadline = monotonic + ((init["timeoutMs"] || 30_000).to_i / 1000.0)
@@ -45,6 +47,16 @@ module Runlight
           target = Url.parse(location, url)
           raise FetchError, "fetch failed" if target.nil? || !%w[http: https:].include?(target.protocol)
 
+          here = Url.parse(url)
+          # Never from an encrypted address to a plain one, where anything still sent could be read on the way.
+          raise FetchError, "fetch failed: a redirect from https to http" if here.protocol == "https:" && target.protocol == "http:"
+
+          # Credentials are for the address they were given to, so they go no further than its origin, as
+          # fetch() drops them.
+          if target.origin != here.origin
+            headers = headers.dup
+            CREDENTIALS.each { |name| headers.delete(name) }
+          end
           url = target.href
           next unless response.status == 303 || ([301, 302].include?(response.status) && method == "POST")
 

data/lib/runlight/http/request.rb

@@ -32,6 +32,9 @@ module Runlight
       # the path's limit raises TooLarge once one byte past it has been read.
       def self.from_rack(env, read_body: true)
         scheme = env["rack.url_scheme"] || "http"
+        # The first X-Forwarded-Proto of http or https names the scheme, as the Node server reads it.
+        proto = env["HTTP_X_FORWARDED_PROTO"].to_s.split(",", -1)[0].to_s.strip.downcase
+        scheme = proto if %w[http https].include?(proto)
         # A Host header no URL can hold (a space, a bad port, a userinfo @) is read as the server's own name, as
         # an absent one is, so the request still has a URL; the header itself is kept as it came.
         host = env["HTTP_HOST"].to_s

data/lib/runlight/http/url.rb

@@ -273,12 +273,17 @@ module Runlight
       def ipv4(host)
         parts = host.split(".", -1)
         parts.pop if parts.last == ""
-        return nil if parts.empty? || parts.length > 4
+        return nil if parts.empty?
         return nil unless parts.last.match?(/\A(0x[0-9a-f]*|[0-9]+)\z/)
 
+        # A host ending in a number is an address, so too many parts, or a digit past 7 in a part that starts with
+        # a 0 (octal), is no host at all, as new URL() finds.
+        raise Invalid, "Invalid URL" if parts.length > 4
+
         numbers = parts.map do |part|
           if (m = part.match(/\A0x([0-9a-f]*)\z/)) then m[1].empty? ? 0 : m[1].to_i(16)
           elsif part.match?(/\A0[0-7]+\z/) then part.to_i(8)
+          elsif part.match?(/\A0[0-9]+\z/) then raise Invalid, "Invalid URL"
           elsif part.match?(/\A[0-9]+\z/) then part.to_i
           else raise Invalid, "Invalid URL"
           end

data/lib/runlight/messages.rb

@@ -43,7 +43,21 @@ module Runlight
         own = table(code)["#{key}_#{form}"] || table(code)["#{key}_other"]
         !own.nil? && own != "" ? fill.call(own, vars) : t.call("#{key}_other", vars)
       end
-      { "t" => t, "tn" => tn, "lang" => code }
+      # A message for a page: its own text escaped, then each {name} filled with HTML the caller made safe.
+      html = lambda do |key, vars = {}|
+        t.call(key).gsub(/[&<>]/, "&" => "&amp;", "<" => "&lt;", ">" => "&gt;")
+                   .gsub(/\{(\w+)\}/) { vars.key?(Regexp.last_match(1)) ? vars[Regexp.last_match(1)] : Regexp.last_match(0) }
+      end
+      { "t" => t, "tn" => tn, "html" => html, "lang" => code }
+    end
+
+    # The first language a browser asks for that the dashboard speaks, else English.
+    def accepted_language(request)
+      (request.headers.get("accept-language") || "").split(",", -1).each do |part|
+        code = Js.lower(Js.slice(Js.trim(part.split(";", -1).first.to_s), 0, 2))
+        return code if languages.include?(code)
+      end
+      "en"
     end
 
     # Intl.PluralRules(lang).select(n) for the dashboard's languages, by CLDR's cardinal rules. As there, the