samagotchi 0.108.0 → 0.110.0

data/lib/samagotchi/web/link_codes.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+require "openssl"
+require "securerandom"
+require "time"
+require_relative "../atomic_file"
+
+module Samagotchi
+  module Web
+    # One-time link codes (web.public_url): what a link's fragment carries
+    # instead of a token (https://<public url>/#code=chc_…). A fragment
+    # outlives the proxy's sign-in redirects, so the sign-in page sits at
+    # that URL (its scripts can read it) and it lands in the browser's
+    # history: a code works once, then nothing. The page trades it at
+    # POST /api/token for the token's cookie.
+    #
+    # A code is the owner's (10 minutes) or a grant's (until the grant
+    # expires). Nothing secret is kept: the store has each code's digest,
+    # and a grant's token sealed (AES-256-GCM) under a key derived from the
+    # code itself, so only the code's holder can open it. The store is
+    # next to the grants (web-grants/link-codes.json, 0600 in that 0700
+    # folder), written under a lock: chi web and a local chi share both
+    # issue codes.
+    class LinkCodes
+      FILE = "link-codes.json"
+      LOCK = "link-codes.lock"
+      PREFIX = "chc_"
+      OWNER_TTL = 600
+      CODE_RE = /\Achc_[A-Za-z0-9_-]{43}\z/
+
+      # @param grants_path [String] the grants store's path (Grants#path)
+      def self.for_grants(grants_path, clock: -> { Time.now }) = new(File.join(File.dirname(grants_path), FILE), clock: clock)
+
+      def self.code?(value) = value.is_a?(String) && CODE_RE.match?(value)
+
+      attr_reader :path
+
+      def initialize(path, clock: -> { Time.now })
+        @path = path
+        @clock = clock
+      end
+
+      # @param kind [:owner, :grant]
+      # @param token [String, nil] the grant's token (sealed), nil for the owner
+      # @param ttl [Numeric] seconds
+      # @return [String] the code
+      def issue(kind:, ttl:, token: nil)
+        code = "#{PREFIX}#{SecureRandom.urlsafe_base64(32)}"
+        entry = { "digest" => digest(code), "kind" => kind.to_s, "expires_at" => (@clock.call + ttl).utc.iso8601 }
+        entry["sealed"] = seal(code, token) if token
+        update { |entries| entries << entry }
+        code
+      end
+
+      # The code's [kind, token] (token nil for the owner's), once: the code
+      # is gone after. nil for an unknown, used or expired code.
+      def redeem(code)
+        return nil unless LinkCodes.code?(code)
+
+        wanted = digest(code)
+        found = nil
+        update do |entries|
+          entries.reject do |entry|
+            next false unless same_digest?(entry["digest"].to_s, wanted)
+
+            found = entry
+            true
+          end
+        end
+        return nil unless found
+        return nil if Time.iso8601(found["expires_at"]) <= @clock.call
+
+        kind = found["kind"] == "grant" ? :grant : :owner
+        token = found["sealed"] && unseal(code, found["sealed"])
+        return nil if kind == :grant && token.nil?
+
+        [kind, token]
+      rescue ArgumentError
+        nil
+      end
+
+      private
+
+      def digest(code) = Digest::SHA256.hexdigest(code)
+
+      def same_digest?(left, right) = left.bytesize == right.bytesize && OpenSSL.fixed_length_secure_compare(left, right)
+
+      def key(code) = OpenSSL::KDF.hkdf(code, salt: "chi-link-code", info: "seal", length: 32, hash: "SHA256")
+
+      def seal(code, token)
+        cipher = OpenSSL::Cipher.new("aes-256-gcm").encrypt
+        cipher.key = key(code)
+        iv = cipher.random_iv
+        cipher.auth_data = ""
+        sealed = cipher.update(token) + cipher.final
+        [iv + cipher.auth_tag + sealed].pack("m0")
+      end
+
+      def unseal(code, value)
+        raw = value.unpack1("m0")
+        cipher = OpenSSL::Cipher.new("aes-256-gcm").decrypt
+        cipher.key = key(code)
+        cipher.iv = raw[0, 12]
+        cipher.auth_tag = raw[12, 16]
+        cipher.auth_data = ""
+        cipher.update(raw[28..]) + cipher.final
+      rescue OpenSSL::Cipher::CipherError, ArgumentError
+        nil
+      end
+
+      # Read, change and write under the lock; expired codes go. The block
+      # gets the live codes and returns the codes to keep.
+      def update
+        dir = File.dirname(@path)
+        FileUtils.mkdir_p(dir, mode: 0o700)
+        File.open(File.join(dir, LOCK), File::RDWR | File::CREAT, 0o600) do |lock|
+          lock.flock(File::LOCK_EX)
+          now = @clock.call
+          stored = read
+          entries = yield(stored.reject { |entry| expired?(entry, now) })
+          # Written only when it changes: a guessed code costs no write.
+          next if entries == stored
+
+          AtomicFile.write(@path, "#{JSON.generate({ "version" => 1, "codes" => entries })}\n", perm: 0o600)
+        end
+      end
+
+      def expired?(entry, now)
+        Time.iso8601(entry["expires_at"].to_s) <= now
+      rescue ArgumentError
+        true
+      end
+
+      def read
+        data = JSON.parse(File.read(@path))
+        codes = data.is_a?(Hash) ? data["codes"] : nil
+        codes.is_a?(Array) ? codes.select { |entry| entry.is_a?(Hash) } : []
+      rescue Errno::ENOENT, JSON::ParserError
+        []
+      end
+    end
+  end
+end

data/lib/samagotchi/web/participant_access.rb

@@ -57,11 +57,18 @@ module Samagotchi
       # request's env for #token_gate's answer (#grant_ended_response). A
       # grant whose session was archived or is gone is revoked here (archive
       # and delete revoke too; this catches retention's prune and a delete
-      # from another process).
+      # from another process). A grant bound to an identity (Grant#identity)
+      # is honoured only on a proxied request with that identity
+      # (ProxyGate): never on the LAN or this machine.
+      # @param identity [String, nil] the proxied request's identity
       # @return [Principal, nil]
-      def participant_principal(req, tokens)
+      def participant_principal(req, tokens, identity: nil, proxied: false)
         tokens.each do |token|
           grant = @grants.lookup(token) or next
+          if grant.identity && !(proxied && identity == grant.identity)
+            req.env[ProxyGate::REFUSED_ENV] = "grant #{grant.id} is bound to another identity than #{identity || "(none)"}"
+            next
+          end
           grant = settle_grant(grant)
           state = grant.state(@grants.now)
           if state == :active

data/lib/samagotchi/web/participant_review.rb

@@ -39,7 +39,7 @@ module Samagotchi
       # paths; the owner's token is never shown.
       def participant_viewer(req, session)
         author = principal(req).owner? ? nil : principal(req).grant.author
-        ParticipantView::Viewer.new(author: author, cwd: session.working_directory, secrets: [@lan && current_token].compact)
+        ParticipantView::Viewer.new(author: author, cwd: session.working_directory, secrets: [(@lan || @public_url) && current_token].compact)
       end
 
       # GET /api/sessions/:id/review: the participant page's data, always

data/lib/samagotchi/web/participant_view.rb

@@ -108,7 +108,7 @@ module Samagotchi
       def turn_started(event, viewer)
         origin = TurnOrigin.of(field(event, :origin))
         author = field(event, :author) || origin.author
-        out = { "type" => "turn_started", **id_fields(event) }
+        out = { "type" => "turn_started", **id_fields(event), **time_field(event) }
         out.merge!(author_fields(author, field(event, :author_name), viewer))
         prompt = field(event, :prompt)
         if field(event, :continue)
@@ -164,8 +164,8 @@ module Samagotchi
       #   analytics records' +automatic+, and the running one's): their
       #   prompt is shown as an automatic turn, without its text
       # @return [Array<Hash>] {role: "user", content, turn_id, author,
-      #   author_name, mine, automatic, images} and {role: "assistant",
-      #   content, tools: [{tool, path}]}; no notes, steers, automatic
+      #   author_name, mine, automatic, images, at} and {role: "assistant",
+      #   content, tools: [{tool, path}], at}; no notes, steers, automatic
       #   input or empty-answer markers. html is added by the caller, from
       #   this (redacted) content.
       def messages(shown, viewer, automatic: [])
@@ -194,7 +194,7 @@ module Samagotchi
         merged = field(message, :merged)
         return nil unless turn_id || merged
 
-        out = { "role" => "user" }
+        out = { "role" => "user", **time_field(message) }
         if turn_id && automatic.include?(turn_id.to_s)
           out.merge!("content" => "", "automatic" => true, "turn_id" => turn_id.to_s)
           return out
@@ -215,7 +215,7 @@ module Samagotchi
         content = field(message, :content).to_s
         return nil if content.strip.empty? && rows.empty?
 
-        out = { "role" => "assistant", "content" => content }
+        out = { "role" => "assistant", "content" => content, **time_field(message) }
         out["tools"] = rows unless rows.empty?
         out
       end
@@ -287,6 +287,13 @@ module Samagotchi
         out
       end
 
+      # When it happened (MessageTime's stamp, a turn's start): the page's
+      # hover and gap dividers. A wall time only, nothing of what was done.
+      def time_field(item)
+        at = field(item, :at)
+        at.is_a?(String) && !at.empty? ? { "at" => at } : {}
+      end
+
       def id_fields(event)
         out = seq(event)
         turn_id = field(event, :turn_id)

data/lib/samagotchi/web/participants_admin.rb

@@ -57,10 +57,10 @@ module Samagotchi
 
         issued = Participants.invite(@grants, session_id: id, name: body["name"], kind: (body["kind"] || "human").to_s,
                                               ttl: ttl, cap: cap, state_dir: default_state_dir)
-        link = participant_link(req, id, issued.token)
+        link = participant_link(req, id, issued.token, expires_at: issued.grant.expires_at)
         warning = ReviewStart.share_warning(Session.load(id, state_dir: default_state_dir))
         json_response(201, { participant: issued.grant.public_h(@grants.now), token: issued.token,
-                             link: link, lan: !@lan.nil?, qr_svg: QR.svg(link), warning: warning })
+                             link: link, lan: !@lan.nil? || !@public_url.nil?, qr_svg: QR.svg(link), warning: warning })
       rescue Grants::Invalid => e
         error_response(400, "invalid_participant", e.message)
       end
@@ -115,10 +115,17 @@ module Samagotchi
         error_response(400, "invalid_participant", e.message)
       end
 
-      # The link a participant opens: this chi web's LAN address when it has
-      # one (the owner may be asking on loopback), else the Host asked; the
-      # token traded for the cookie, the session in the fragment.
-      def participant_link(req, id, token)
+      # The link a participant opens: web.public_url's with a one-time code
+      # for the token in the fragment (LinkCodes, until the grant expires;
+      # the page trades it, POST /api/token); else this chi web's LAN address
+      # when it has one (the owner may be asking on loopback), else the Host
+      # asked; the token traded for the cookie, the session in the fragment.
+      def participant_link(req, id, token, expires_at: nil)
+        if @public_url
+          ttl = expires_at ? [Time.iso8601(expires_at) - @grants.now, 1].max : LinkCodes::OWNER_TTL
+          return @public_url.link(@link_codes.issue(kind: :grant, token: token, ttl: ttl), "s=#{id}")
+        end
+
         host = req.get_header("HTTP_HOST").to_s
         port = host[/:(\d+)\z/, 1] || req.port.to_s
         name = @lan ? @lan[:ip] : host.sub(/:\d*\z/, "")

data/lib/samagotchi/web/proxy_gate.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require_relative "link_codes"
+require_relative "principal"
+require_relative "public_url"
+require_relative "../log"
+require_relative "../proxy_trace"
+
+module Samagotchi
+  module Web
+    # chi web behind an auth proxy (web.public_url), mixed into App. With a
+    # PublicUrl every request needs a token (this machine's too: a proxy
+    # with no trace and a rewritten Host looks local). A request is
+    # *proxied* when it carries a proxy trace (ProxyTrace: X-Forwarded-*,
+    # Forwarded, X-Real-IP, a known identity header…), the configured
+    # identity header, or the public Host. A proxied request:
+    # - is the owner with the owner token, and, when web.proxy.identity_header
+    #   is set, only if that header is one clean value equal to
+    #   web.proxy.owner (D-a: identity AND token);
+    # - is a participant with a live grant's token (a grant bound to an
+    #   identity only for that identity, and only proxied);
+    # - else nil: the gate's 401, its reason in the detail (only the
+    #   requester's own identity) and the log.
+    # The identity header is refused when repeated, with a comma, empty, or
+    # sent under two names or with an underscore: WEBrick folds
+    # X_Forwarded_Email into the same Rack key as X-Forwarded-Email, the
+    # last one winning, so the gate reads the raw names (RawHeaderNames,
+    # installed by Server). See docs/configuration.md "Behind an auth proxy".
+    module ProxyGate
+      # The header names a request came with, as WEBrick read them
+      # (lower-cased, "_" kept), in the Rack env. Prepended to
+      # WEBrick::HTTPRequest by Server.
+      module RawHeaderNames
+        def meta_vars
+          super.merge(RAW_NAMES_ENV => header.keys)
+        end
+      end
+
+      RAW_NAMES_ENV = "samagotchi.raw_header_names"
+      # Why the gate refused a proxied request, for the 401's detail.
+      REFUSED_ENV = "samagotchi.proxy_refused"
+      # The token cookie on a proxied (https) request: Secure, Path=/, no
+      # Domain (other host names under the domain, a pod's other ports, don't
+      # get it). Cookies aren't port-scoped: a server on the same host name
+      # and another port does.
+      SECURE_COOKIE = "__Host-chi_token"
+
+      private
+
+      def init_proxy_gate(public_url, token)
+        @public_url = public_url
+        @public_token = token
+        @link_codes = LinkCodes.for_grants(@grants.path)
+        @proxy_hint_mutex = Mutex.new
+        @proxy_hint_logged = false
+      end
+
+      def proxied?(req)
+        return false unless @public_url
+
+        env = req.env
+        return true if @public_url.host?(env["HTTP_HOST"])
+        return true if @public_url.identity_env && env.key?(@public_url.identity_env)
+
+        names = env[RAW_NAMES_ENV] || env.keys.filter_map { |key| ProxyTrace.env_name(key) }
+        names.any? { |name| ProxyTrace.header?(name) }
+      end
+
+      # [:ok, email] | [:none, nil] | [:bad, reason]: the configured identity
+      # header of a proxied request; :none without one configured.
+      def proxy_identity(req)
+        env_key = @public_url.identity_env
+        return [:none, nil] unless env_key
+
+        raw = req.env[RAW_NAMES_ENV]
+        return [:bad, "the server gave no raw header names to check the identity header against"] unless raw
+
+        names = raw.select { |name| PublicUrl.env_key(name) == env_key }.uniq
+        return [:bad, "identity header sent under #{names.size} names (#{names.join(", ")})"] if names.size > 1
+        return [:bad, "identity header sent with an underscore (#{names.first})"] if names.first&.include?("_")
+
+        value = req.env[env_key]
+        return [:none, nil] if value.nil?
+        return [:bad, "identity header not among the raw header names"] if names.empty?
+
+        value = value.strip
+        return [:bad, "identity header empty"] if value.empty?
+        return [:bad, "identity header repeated or with a comma"] if value.include?(",")
+
+        [:ok, value.downcase]
+      end
+
+      # The principal of a proxied request, or nil (the reason in the env).
+      def proxied_principal(req, given)
+        state, identity = proxy_identity(req)
+        return proxy_refuse(req, identity) if state == :bad
+
+        notice_identity_headers(req) if state == :none
+        shown = identity || "(none)"
+        if owner_token?(given)
+          return Principal::OWNER if @public_url.identity_env.nil?
+          return Principal::OWNER if @public_url.owner && identity == @public_url.owner
+
+          return proxy_refuse(req, "owner token with identity #{shown}#{identity_hint(req)}")
+        end
+        grant_tokens = given.select { |value| Grants.token?(value) }
+        return proxy_refuse(req, "no token (identity #{shown})") if grant_tokens.empty?
+
+        participant_principal(req, grant_tokens, identity: identity, proxied: true)
+      end
+
+      # chi's own probe of a chi web behind a proxy (InfoProbe: a second chi
+      # web, chi share, chi update) sends no token: GET /api/info from this
+      # machine, not through the proxy, with no token at all, gets the
+      # fields it checks (nothing secret), so no probe ever hands the token
+      # to whatever listens on the port.
+      def probe_info?(req)
+        return false unless @public_url && req.get? && req.path_info == "/api/info"
+        return false unless App::LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s) && !proxied?(req)
+
+        req.get_header("HTTP_AUTHORIZATION").nil? && req.get_header("HTTP_COOKIE").nil?
+      end
+
+      def probe_info
+        json_response(200, { app: "chi-web", version: Samagotchi::VERSION, pid: Process.pid, features: App::INFO_FEATURES,
+                             lan: @lan && @lan[:ip] })
+      end
+
+      def proxy_refuse(req, reason)
+        req.env[REFUSED_ENV] = reason
+        nil
+      end
+
+      # The known identity headers (ProxyTrace::IDENTITY_HEADERS) a proxied
+      # request carries other than the configured one.
+      def other_identity_headers(req)
+        ProxyTrace::IDENTITY_HEADERS.select do |name|
+          key = PublicUrl.env_key(name)
+          key != @public_url.identity_env && req.env.key?(key)
+        end
+      end
+
+      def identity_hint(req)
+        return "" if @public_url.identity_env.nil? || req.env.key?(@public_url.identity_env)
+
+        others = other_identity_headers(req)
+        others.empty? ? "" : "; the proxy sends #{others.join(", ")}, not #{@public_url.identity_header}"
+      end
+
+      # Once per start: a proxied request without the configured identity
+      # header (or with none configured) but with a header a known setup
+      # puts the identity in. A wrong header locks the owner out, and one the
+      # proxy doesn't replace is a client-chosen string: the line says which.
+      def notice_identity_headers(req)
+        return if @proxy_hint_logged
+
+        others = other_identity_headers(req)
+        return if others.empty?
+        return unless @proxy_hint_mutex.synchronize { !@proxy_hint_logged && (@proxy_hint_logged = true) }
+
+        if @public_url.identity_env
+          Log.warn(:web, "proxy_identity_header", configured: @public_url.identity_header, sent: others.join(","),
+                                                  echo: "Warning: chi web: the proxy sends #{others.join(", ")}, not " \
+                                                        "web.proxy.identity_header #{@public_url.identity_header}")
+        else
+          Log.info(:web, "proxy_identity_header", configured: "none", sent: others.join(","),
+                                                  echo: "chi web: the proxy sends #{others.join(", ")}; with " \
+                                                        "web.proxy.identity_header and web.proxy.owner it is checked " \
+                                                        "next to the token (only a header the proxy replaces)")
+        end
+      end
+    end
+  end
+end

data/lib/samagotchi/web/public/app.js

@@ -24,7 +24,10 @@ import {
   addContext,
   renderText,
   getWorkingSet,
+  onAuthLost,
 } from "./data.js";
+import { authProbe, createAuthLost } from "./auth_lost.js";
+import { REPLACE_SESSION_TEXT, fragmentCode, tradeFragmentCode } from "./token_fragment.js";
 import { createContextChips } from "./context_chips.js";
 import { createLlmContextControl } from "./llm_context_chip.js";
 import { createParticipantsControl } from "./participants_panel.js";
@@ -43,6 +46,7 @@ import { createCardsPlace } from "./cards_place.js";
 import { createStageView } from "./stage_view.js";
 import { createWorkingSet, groupItems } from "./working_set_view.js";
 import { turnGroups } from "./timing.js";
+import { createGapClock, lastActivity } from "./time_gaps.js";
 import { createMarkdownPlace } from "./markdown_place.js";
 import { openerFill, openTitle, restoredComposer } from "./chains.js";
 import { createTaskStopper } from "./task_stop.js";
@@ -96,6 +100,16 @@ import { createSessionActions } from "./session_actions.js";
 import { createRename } from "./session_rename.js";
 import { createSendTurn } from "./send_turn.js";
 
+// A link's #code= (behind an auth proxy): traded for the cookie before
+// anything else runs; the page reloads without it.
+// This page has a session already: the trade would replace it (a link
+// someone sent to swap this browser's session for theirs), so ask first.
+if (fragmentCode(globalThis.location?.hash)
+    && await tradeFragmentCode({ ask: () => globalThis.confirm(REPLACE_SESSION_TEXT) })) await new Promise(() => {});
+// Signed out (the proxy's session or chi's token): a banner, or one reload.
+const authLost = createAuthLost();
+onAuthLost(authLost);
+
 const $ = (s) => document.querySelector(s);
 const topStripEl = $("#topStrip");
 const allListEl = $("#allList");
@@ -358,8 +372,11 @@ const bubbles = createBubbles({
 });
 const {
   removeHintIfEmpty, appendChunk, addEndBubble, makeUserBubble, bubbleById, applyPromptOps, showRecap, markRecapStale,
-  showGuardrailWarning, showSteers, showHookNotice, addCommandBubble, commandBubble, addNoteBubble,
+  showGuardrailWarning, showSteers, showHookNotice, addCommandBubble, commandBubble, addNoteBubble, addTimeGap,
 } = bubbles;
+// The open session's last activity, for the live gap dividers
+// (time_gaps.js): renderHistory seeds it, the stream moves it.
+const gapClock = createGapClock();
 // The plugin cards and a snapshot's notices in the history (cards_place.js).
 const cards = createCardsPlace({
   historyEl,
@@ -449,9 +466,20 @@ function openSessionEvents() {
       eventsControl = null;
       refresh();
     },
+    // The browser gave up after frames: signed out (the proxy's sign-in
+    // page answered the reconnect), or chi web went away for a while.
+    onClosed: () => {
+      eventsControl = null;
+      authProbe().then((state) => {
+        if (state === "lost") authLost("events");
+        else setTimeout(openSessionEvents, EVENTS_REOPEN_MS);
+      });
+    },
   });
 }
 
+const EVENTS_REOPEN_MS = 3000;
+
 // Which chi serves this page now and which is the newest installed (the
 // events snapshot, and `chi` frames when that changes). A toast says when
 // chi web was upgraded while this tab stayed open (offering the reload,
@@ -923,7 +951,7 @@ function renderSessionView(data, { kept = [] } = {}) {
   if (!loadWarned("plugins")) showGuardrailWarning(data.plugin_warning, "plugins");
   // The recap saved with the session (also a stopped one's), else a live
   // worker's from before saved_recap existed.
-  if (data.saved_recap) showRecap(data.saved_recap.text, data.saved_recap.turns_since);
+  if (data.saved_recap) showRecap(data.saved_recap.text, data.saved_recap.turns_since, data.saved_recap.created_at || null);
   else showRecap(data.recap);
   // A live worker's last cards and between-turns notices, where they
   // arrived; the running turn's go into its step once it is drawn.
@@ -980,12 +1008,15 @@ function seedWorkingSet(data) {
 }
 
 function renderHistory(items) {
+  gapClock.seed(null);
   if (!items.length) {
     historyEl.replaceChildren(hintEl("No output yet. Send a message."));
     return;
   }
   if (typeof items[0] === "object" && items[0].role) {
     historyEl.replaceChildren(turnHistoryNodes(items, current.timing, { thumbs: (images) => thumbsTemplate(selected, images), workingSet: !!workingSet }));
+    // The live dividers count from the history's last activity.
+    gapClock.seed(lastActivity(turnGroups(items, current.timing), items));
     linkTextRefs();
   } else {
     historyEl.replaceChildren(...items.map((c) => elementOf(outputBubbleTemplate(c))));
@@ -1392,7 +1423,8 @@ const streamHandlers = createStreamHandlers({
   setUsedMemories, onInitEvent, findInTurnRoots, applyFinalMarkdown,
   // bubbles.js
   applyPromptOps, showSteers, markRecapStale, appendChunk, makeUserBubble, addEndBubble, commandBubble,
-  addCommandBubble, addNoteBubble, showRecap, showGuardrailWarning, showHookNotice,
+  addCommandBubble, addNoteBubble, showRecap, showGuardrailWarning, showHookNotice, addTimeGap,
+  gapClock,
   // cards_place.js
   upsertCard, refreshCardBodies,
   syncModelPick: startPage.commandRan,

data/lib/samagotchi/web/public/auth_lost.js

@@ -0,0 +1,76 @@
+// Signed out: the auth proxy's session (Okta…) or chi's token is gone. An
+// /api answer says so in one of these ways: a 401 (chi's unauthorized, or
+// the proxy's own 401 {} for Accept: application/json), a fetch that was
+// redirected or came back as HTML (a sign-in page), or, from the probe,
+// a redirect fetch can't follow (real IdPs send no CORS: a TypeError, so
+// the probe asks with redirect: "manual"). The page then says so in a
+// banner with Reload, and reloads by itself at most once a minute (the
+// proxy's sign-in brings the user back), never when it can't keep the time.
+
+export const AUTH_RELOAD_KEY = "chi.authReloadAt";
+export const AUTH_RELOAD_MS = 60_000;
+
+// Whether a fetch Response says the sign-in is gone.
+export function lostAnswer(res) {
+  if (!res) return false;
+  if (res.status === 401 || res.redirected || res.type === "opaqueredirect") return true;
+  const type = res.headers?.get?.("content-type") || "";
+  return type.includes("text/html");
+}
+
+// "lost" | "ok" | "down" (chi web unreachable: no banner, the page's own
+// retries go on).
+export async function authProbe(fetchImpl = globalThis.fetch) {
+  try {
+    const res = await fetchImpl("/api/info", {
+      credentials: "same-origin", redirect: "manual", headers: { Accept: "application/json" },
+    });
+    return lostAnswer(res) ? "lost" : "ok";
+  } catch (_) {
+    return "down";
+  }
+}
+
+export const AUTH_LOST_TEXT = "Signed out (the proxy's sign-in or chi's token ended).";
+
+// The page's authLost(reason): once, a banner (doc) and, unless one ran in
+// the last minute, a reload. storage: sessionStorage (may be missing or throw).
+export function createAuthLost({
+  doc = globalThis.document, storage = () => globalThis.sessionStorage, reload = () => globalThis.location.reload(),
+  now = () => Date.now(), log = (reason) => console.warn("chi: signed out", reason),
+} = {}) {
+  let shown = false;
+  return function authLost(reason) {
+    if (shown) return;
+    shown = true;
+    log(reason);
+    // The reload only when its stamp can be kept: without storage (a
+    // private window) a page that keeps losing its sign-in would reload
+    // forever, so it gets the banner.
+    let due = false;
+    try {
+      due = now() - (Number(storage().getItem(AUTH_RELOAD_KEY)) || 0) >= AUTH_RELOAD_MS;
+      if (due) storage().setItem(AUTH_RELOAD_KEY, String(now()));
+    } catch (_) {
+      due = false;
+    }
+    if (due) {
+      reload();
+      return;
+    }
+    const bar = doc.createElement("div");
+    bar.id = "authLost";
+    bar.setAttribute("role", "alert");
+    bar.style.cssText = "position:fixed;top:0;left:0;right:0;z-index:10000;padding:8px 16px;font-size:14px;"
+      + "color:var(--warn-text);background:var(--warn-bg);border-bottom:1px solid var(--warn-border);"
+      + "display:flex;gap:12px;align-items:center;justify-content:center";
+    const text = doc.createElement("span");
+    text.textContent = AUTH_LOST_TEXT;
+    const button = doc.createElement("button");
+    button.type = "button";
+    button.textContent = "Reload";
+    button.addEventListener("click", () => reload());
+    bar.append(text, button);
+    doc.body.append(bar);
+  };
+}