@abide/abide 0.105.0 → 0.106.0

package/src/server/answerRpc.ts

@@ -99,6 +99,8 @@ export type Mount = {
     defaults: Defaults | undefined
     /** The JSON Schema the handler's args annotation derives, where it takes a record. 19.9. */
     args: JsonValue | undefined
+    /** The JSON Schema of what it answers, where its type says one. 19.21. */
+    result: JsonValue | undefined
 }
 
 /**
@@ -166,6 +168,7 @@ export function mountedOwn(
             copy: undefined,
             defaults: undefined,
             args: undefined,
+            result: undefined,
             handler: handler as Mounted['handler'],
             argsDocument: undefined,
             wireArgs: undefined,
@@ -250,14 +253,7 @@ export async function answerRpc(
     // 16.13 — A MUTATION FROM ANOTHER ORIGIN IS REFUSED unless the handler declared it may come.
     if (closed && !inUrl)
         return answered(crossingRefusal(crossing, found.method))
-    // 16.54 — THE BODY CEILING, none where neither the handler nor the environment names one; 16.55 —
-    // read off the declared length before a byte of the body is.
-    const ceiling =
-        handler.maxBodySize ??
-        positiveSetting('ABIDE_MAX_REQUEST_BODY_SIZE', Number.POSITIVE_INFINITY)
-    if (!inUrl && Number(request.headers.get('content-length') ?? 0) > ceiling)
-        return answered(overCeiling(ceiling))
-    const raw = await argsOf(request, url, inUrl, form, ceiling)
+    const raw = await argsOf(request, url, inUrl, form, handler.maxBodySize)
     if (isFailed(raw)) return answered(raw)
     const sent = withParameters(raw, params, inUrl || form, found)
     if (isFailed(sent)) return answered(sent)
@@ -442,16 +438,14 @@ async function argsOf(
     url: URL,
     inUrl: boolean,
     form: boolean,
-    ceiling: number,
+    maxBodySize: number | undefined,
 ): Promise<unknown | Failed<'HttpError', undefined>> {
     if (inUrl) {
         const query = url.searchParams
         if (query.size === 0) return undefined
         return collapsed(query)
     }
-    const body = Number.isFinite(ceiling)
-        ? await bodyUnder(request, ceiling)
-        : request
+    const body = await bodyWithin(request, maxBodySize)
     if (isFailed(body)) return body
     // 16.38 — a form's fields, a field given more than once a list, as a query's are.
     if (form) {
@@ -504,6 +498,26 @@ function withParameters(
     return isRecord(sent) ? { ...sent, ...fromPath } : { ...fromPath }
 }
 
+/**
+ * The request's body under the ceiling `maxBodySize` sets, or `ABIDE_MAX_REQUEST_BODY_SIZE` where it
+ * is unset, or a 413 refusal past it — the request itself where neither names one.
+ *
+ * 16.54 — NO CEILING BY DEFAULT. 16.55 — read off the declared length before a byte of the body is.
+ * 16.78 — EVERY BODY ABIDE READS, a handler's and `/__abide/mcp`'s and `/__abide/bridge`'s alike.
+ */
+export async function bodyWithin(
+    request: Request,
+    maxBodySize: number | undefined,
+): Promise<Request | Response | Failed<'HttpError', undefined>> {
+    const ceiling =
+        maxBodySize ??
+        positiveSetting('ABIDE_MAX_REQUEST_BODY_SIZE', Number.POSITIVE_INFINITY)
+    if (!Number.isFinite(ceiling)) return request
+    if (Number(request.headers.get('content-length') ?? 0) > ceiling)
+        return overCeiling(ceiling)
+    return bodyUnder(request, ceiling)
+}
+
 /**
  * The request's body read up to `ceiling`, as a `Response`, or a 413 refusal past it.
  *

package/src/server/answerSocket.ts

@@ -25,8 +25,10 @@ import { refuse } from '#shared/refuse.ts'
 import { rpcRequest } from '#shared/rpcRequest.ts'
 import { handlerKey, type Mounted } from './answerRpc.ts'
 import { argsFor } from './argsFor.ts'
+import { positiveSetting } from './config.ts'
 import { closedTo, crossingOrigin, crossingRefusal } from './crossingOrigin.ts'
 import { failureOf } from './hooks.ts'
+import { sendOrClose } from './muxUpgrade.ts'
 import {
     heldByApp,
     inOpenScope,
@@ -50,6 +52,9 @@ export type Socket = {
 
 const ENCODER = new TextEncoder()
 
+// 18.31 — a page follows each value it reads once, so a thousand is a page no one could read.
+const MAX_SUBSCRIPTIONS = 1024
+
 /**
  * One `ServerFrame`, for every follower it is sent to.
  *
@@ -124,7 +129,7 @@ class SocketPeer implements Peer {
         this.socket = socket
     }
     send(id: number, frame: Frame): void {
-        this.socket.send(frame.json(id))
+        sendOrClose(this.socket, frame.json(id))
     }
     close(code: number, reason: string): unknown {
         return this.socket.close(code, reason)
@@ -351,6 +356,26 @@ export class MuxConnection {
             subscriptions.delete(id)
             return
         }
+        // 18.31 — A CONNECTION FOLLOWS AT MOST `ABIDE_MAX_SOCKET_SUBSCRIPTIONS` VALUES; 18.32 — a frame
+        // naming an id it already holds replaces that one rather than adding to them.
+        if (frame.op === 'sub' && !subscriptions.has(id)) {
+            const most = positiveSetting(
+                'ABIDE_MAX_SOCKET_SUBSCRIPTIONS',
+                MAX_SUBSCRIPTIONS,
+            )
+            if (subscriptions.size >= most) {
+                this.peer.send(
+                    id,
+                    refusal(
+                        refuse(
+                            429,
+                            `This connection follows ${most} values already.`,
+                        ),
+                    ),
+                )
+                return
+            }
+        }
         const handler =
             frame.op === 'sub'
                 ? this.mux.handlers.get(handlerKey('GET', address))

package/src/server/argsFor.ts

@@ -16,7 +16,8 @@ import { coerceArgs } from './coerceArgs.ts'
  * 19.7 — the text as the types the handler's `args` declares. 11.27 — then the defaults, ahead of
  * every key taken after it: the seed a render filed and the `global` entry standing were both filed
  * under them (11.29). 19.9 — THE WIRE HELD TO THE ANNOTATION, where no `args` schema is declared to
- * hold it; args that did not come are the handler's to answer.
+ * hold it. Args that did not come are held as an empty record: a schema is only derived where the
+ * handler's args are a required record, so a required member missing is refused, not read off nothing.
  */
 export function argsFor(
     found: Pick<Mounted, 'handler' | 'argsDocument' | 'wireArgs'>,
@@ -32,8 +33,8 @@ export function argsFor(
                   query,
               )
     const args = normalized(found.handler, coerced)
-    if (found.wireArgs !== undefined && args !== undefined) {
-        const issues = validateJson(found.wireArgs, args)
+    if (found.wireArgs !== undefined) {
+        const issues = validateJson(found.wireArgs, args ?? {})
         if (issues !== null) throw validationError(issues)
     }
     return args

package/src/server/assistant.ts

@@ -2,10 +2,10 @@
 // every provider shares: the transcript's check, the app's MCP tools as a `Toolbox`, and the turn cap.
 // A `Provider` runs the conversation — `claudeApi` by looping over the Messages API itself,
 // `claudeCode` by handing it to a Claude Code on the visitor's own machine — and yields the one
-// `AssistantEvent` stream either way (45.2).
+// `AssistantEvent` stream either way (44.2).
 //
-// THE TOOLS ARE THE APP'S OWN MCP SURFACE (45.6), called in process through the app answering this
-// request and carrying the asker's credentials (45.7), so a tool does what the person asking could do
+// THE TOOLS ARE THE APP'S OWN MCP SURFACE (44.6), called in process through the app answering this
+// request and carrying the asker's credentials (44.7), so a tool does what the person asking could do
 // and nothing more. Both are CAPTURED when the conversation starts: a provider may call a tool from
 // another request's scope — `claudeCode` answers one from the bridge's — and the call is still this
 // asker's.
@@ -33,6 +33,12 @@ export type ToolDefinition = {
     name: string
     description: string
     inputSchema: unknown
+    annotations: {
+        readOnlyHint: boolean
+        destructiveHint: boolean
+        idempotentHint: boolean
+    }
+    outputSchema: unknown
 }
 
 /** The app's MCP tools, called as the asker. */
@@ -57,7 +63,7 @@ export type Provider = {
 export type AssistantOptions = { mcp?: boolean; maxTurns?: number }
 
 const MAX_TURNS = 10
-// 45.7 — the caller's credentials, and nothing else of their request.
+// 44.7 — the caller's credentials, and nothing else of their request.
 const CARRIED_HEADERS = ['cookie', 'authorization']
 
 /** A conversation over `messages`, run by `provider`, as the events it produces. */
@@ -66,11 +72,11 @@ export async function* assistant(
     provider: Provider,
     options: AssistantOptions = {},
 ): AsyncGenerator<AssistantEvent> {
-    // 45.3 — a transcript a model can answer ends on the asker's turn.
+    // 44.3 — a transcript a model can answer ends on the asker's turn.
     if (messages.at(-1)?.role !== 'user')
         throw refuse(
             400,
-            'The transcript has to end on a user turn for the assistant to answer it. RULEBOOK 45.3.',
+            'The transcript has to end on a user turn for the assistant to answer it. RULEBOOK 44.3.',
         )
     const tools = toolboxOver(
         options.mcp === true ? appSurface() : NO_SURFACE,
@@ -90,7 +96,7 @@ type McpForward = (method: string, params: unknown) => Promise<McpReply>
 // the type rather than on it, since a `Toolbox` is public and this is not.
 const FORWARDS = new WeakMap<Toolbox, McpForward>()
 
-/** Where `tools` sends an MCP request whole. 45.17. */
+/** Where `tools` sends an MCP request whole. 44.17. */
 export function forwardOf(tools: Toolbox): McpForward {
     const forward = FORWARDS.get(tools)
     if (forward === undefined)
@@ -107,23 +113,23 @@ const NO_SURFACE = new McpSurface(
     async () => new Response(null, { status: 404 }),
 )
 
-/** The MCP surface of the app answering this request. 45.6, 45.8. */
+/** The MCP surface of the app answering this request. 44.6, 44.8. */
 function appSurface(): McpSurface {
     // 42.12 — the app answering this request, captured: a later call may come from another's scope.
     const app = within('assistant').app
     if (app === undefined)
         throw new Error(
-            'abide: assistant tools are the app’s MCP surface, and no app is answering this request. RULEBOOK 45.6.',
+            'abide: assistant tools are the app’s MCP surface, and no app is answering this request. RULEBOOK 44.6.',
         )
-    // 45.8, 20.7 — asking for tools where no handler is published to MCP is a mistake to name.
+    // 44.8, 20.7 — asking for tools where no handler is published to MCP is a mistake to name.
     if (!app.mcp.opened)
         throw new Error(
-            'abide: assistant was asked for tools, and this app publishes no handler to MCP. RULEBOOK 45.8.',
+            'abide: assistant was asked for tools, and this app publishes no handler to MCP. RULEBOOK 44.8.',
         )
     return app.mcp
 }
 
-/** The asking request as a tool call is made: its credentials, and nothing else of it. 45.7. */
+/** The asking request as a tool call is made: its credentials, and nothing else of it. 44.7. */
 function askerOf(asked: Request): Request {
     const carried: Record<string, string> = {}
     for (const name of CARRIED_HEADERS) {
@@ -133,7 +139,7 @@ function askerOf(asked: Request): Request {
     return new Request(asked.url, { headers: carried })
 }
 
-/** `surface` as a `Toolbox`, every call made as `asker`. 45.6, 45.7. */
+/** `surface` as a `Toolbox`, every call made as `asker`. 44.6, 44.7. */
 function toolboxOver(surface: McpSurface, asker: Request): Toolbox {
     const tools: Toolbox = {
         list: surface.list(),

package/src/server/bridgeRelay.ts

@@ -1,22 +1,25 @@
-// 45.13 — THE RELAY BETWEEN A PAGE AND THE CLAUDE CODE ON ITS VISITOR'S MACHINE. A browser cannot reach
+// 44.13 — THE RELAY BETWEEN A PAGE AND THE CLAUDE CODE ON ITS VISITOR'S MACHINE. A browser cannot reach
 // a process on its own machine from an https page — Safari refuses it as mixed content, and Chrome
 // asks a local-network permission of every site — so the bridge dials OUT, to this address:
 //
 //   GET  /__abide/bridge?code=…   the pairing, answered by a server-sent stream of what the bridge is
 //                                 to do: the token it posts with, each turn, each tool reply, a cancel.
+//   GET  /__abide/bridge          the same stream, resumed by the token after it dropped (44.26).
 //   POST /__abide/bridge          what the bridge reports, one frame per line: a turn's events, the
 //                                 MCP requests its Claude Code made, the turn's end or failure.
 //
 // A PAIRING IS TO A BROWSER — the `abide-caller` its page carries (26.5) — for as long as the bridge's
-// stream is open. HELD IN THIS PROCESS: an app served by several needs a visitor's requests to reach
+// stream is open, or resumable. HELD IN THIS PROCESS: an app served by several needs a visitor's requests to reach
 // the one its bridge dialed.
 
+import { isFailed } from '#shared/Failed.ts'
 import { refuse } from '#shared/refuse.ts'
 import { answered } from './answerFailure.ts'
-import { raiseTimeout } from './answerRpc.ts'
+import { bodyWithin, raiseTimeout } from './answerRpc.ts'
 import { framed } from './answerValue.ts'
 import { Inbox } from './Inbox.ts'
 import { randomToken } from './randomToken.ts'
+import { EVENT_STREAM_OPENER } from './streamEvent.ts'
 
 /**
  * What a turn hears from the bridge, in the order the bridge posted it: an event, an MCP request, the
@@ -40,22 +43,29 @@ export type Bridge = {
     // Whether a page has watched this pairing: only a watched bridge is sent away when it goes idle.
     watched: boolean
     idle: ReturnType<typeof setTimeout> | undefined
+    // Set while the stream is dropped and the pairing waits to be resumed (44.26).
+    held: ReturnType<typeof setTimeout> | undefined
 }
 
 /** How long a pairing code stands unused. */
 const CODE_LIFETIME = 10 * 60_000
 // How long a bridge outlives the last page watching it, so a reload does not end it.
 const IDLE_GRACE = 30_000
+/** How long a pairing whose stream dropped waits to be resumed. 44.26. */
+export const RESUME_MILLISECONDS = 30_000
+/** How often a pairing's stream carries a comment while it has nothing else to send. 44.27. */
+export const HEARTBEAT_MILLISECONDS = 15_000
+const HEARTBEAT = new TextEncoder().encode(EVENT_STREAM_OPENER)
 
 const CODES = new Map<string, { caller: string; expires: number }>()
 const BY_CALLER = new Map<string, Bridge>()
 const BY_TOKEN = new Map<string, Bridge>()
 const WATCHERS = new Map<string, Set<() => void>>()
 
-// 45.19 — the relay answers once the app has handed out a pairing command, and never before.
+// 44.19 — the relay answers once the app has handed out a pairing command, and never before.
 let minted = false
 
-/** A single-use pairing code for `caller`, and when it stops standing. 45.14. */
+/** A single-use pairing code for `caller`, and when it stops standing. 44.14. */
 export function mintCode(caller: string): { code: string; expires: number } {
     const now = Date.now()
     for (const [code, pairing] of CODES)
@@ -113,7 +123,7 @@ export function openTurn(bridge: Bridge): {
     }
 }
 
-// 45.22 — A BRIDGE A PAGE WATCHED, THAT NO PAGE WATCHES NOW AND THAT IS ANSWERING NO TURN, is sent
+// 44.22 — A BRIDGE A PAGE WATCHED, THAT NO PAGE WATCHES NOW AND THAT IS ANSWERING NO TURN, is sent
 // away once the grace runs.
 function armIdle(caller: string): void {
     const bridge = BY_CALLER.get(caller)
@@ -159,6 +169,8 @@ function dropBridge(bridge: Bridge): void {
     BY_TOKEN.delete(bridge.token)
     if (bridge.idle !== undefined) clearTimeout(bridge.idle)
     bridge.idle = undefined
+    if (bridge.held !== undefined) clearTimeout(bridge.held)
+    bridge.held = undefined
     for (const turn of bridge.turns.values()) {
         turn.push(
             item('fail', { message: 'the Claude Code bridge disconnected' }),
@@ -170,7 +182,7 @@ function dropBridge(bridge: Bridge): void {
     wakeWatchers(bridge.caller)
 }
 
-/** Answers `/__abide/bridge`, or `undefined` until a pairing code has been minted. 45.19. */
+/** Answers `/__abide/bridge`, or `undefined` until a pairing code has been minted. 44.19. */
 export async function answerBridge(request: Request): Promise<unknown> {
     if (!minted) return undefined
     if (request.method === 'GET') return pair(request)
@@ -179,9 +191,10 @@ export async function answerBridge(request: Request): Promise<unknown> {
 }
 
 function pair(request: Request): Response {
-    const code = new URL(request.url).searchParams.get('code') ?? ''
+    const code = new URL(request.url).searchParams.get('code')
+    if (code === null) return resume(request)
     const pairing = CODES.get(code)
-    // 45.14 — a code pairs once.
+    // 44.14 — a code pairs once.
     CODES.delete(code)
     if (pairing === undefined || pairing.expires <= Date.now())
         return answered(
@@ -202,20 +215,87 @@ function pair(request: Request): Response {
         turns: new Map(),
         watched: WATCHERS.has(pairing.caller),
         idle: undefined,
+        held: undefined,
     }
     BY_CALLER.set(bridge.caller, bridge)
     BY_TOKEN.set(bridge.token, bridge)
     bridge.frames.push({ type: 'paired', token: bridge.token })
+    wakeWatchers(bridge.caller)
+    return attach(bridge, request)
+}
+
+/** The bridge the request's bearer token was handed when it paired. */
+function pairedBy(request: Request): Bridge | undefined {
+    return BY_TOKEN.get(
+        (request.headers.get('authorization') ?? '').replace(/^Bearer /, ''),
+    )
+}
+
+// 44.26 — A DROPPED STREAM IS RESUMED BY ITS TOKEN, with every frame it had not sent: the stream it
+// replaces, still open where the drop went unnoticed here, is ended.
+function resume(request: Request): Response {
+    const bridge = pairedBy(request)
+    if (bridge === undefined)
+        return answered(refuse(401, 'No bridge is paired with this token.'))
+    if (bridge.held !== undefined) clearTimeout(bridge.held)
+    else bridge.frames = bridge.frames.handOff()
+    bridge.held = undefined
+    return attach(bridge, request)
+}
+
+/** `bridge`'s frames as this request's stream, held for `RESUME_MILLISECONDS` once it drops. */
+function attach(bridge: Bridge, request: Request): Response {
+    const frames = bridge.frames
     // 16.57 — a pairing stays open for as long as the bridge holds it.
     raiseTimeout(Number.POSITIVE_INFINITY)
-    request.signal.addEventListener('abort', () => dropBridge(bridge))
-    wakeWatchers(bridge.caller)
-    return framed(
-        bridge.frames[Symbol.asyncIterator](),
+    request.signal.addEventListener('abort', () => {
+        if (bridge.frames !== frames || !BY_TOKEN.has(bridge.token)) return
+        bridge.frames = frames.handOff()
+        bridge.held = setTimeout(() => dropBridge(bridge), RESUME_MILLISECONDS)
+    })
+    const answer = framed(
+        frames[Symbol.asyncIterator](),
         'sse',
         new Headers(),
         200,
     )
+    return new Response(
+        withHeartbeat(answer.body as ReadableStream<Uint8Array>),
+        answer,
+    )
+}
+
+// 44.27 — A COMMENT EVERY HEARTBEAT, so a bridge can tell a connection that went silent without
+// ending from a quiet one. A comment rather than a frame: a bridge reads only `data:` lines, and a
+// frame would sit in the pairing's inbox through a drop.
+function withHeartbeat(
+    body: ReadableStream<Uint8Array>,
+): ReadableStream<Uint8Array> {
+    const reader = body.getReader()
+    let beat: ReturnType<typeof setInterval> | undefined
+    return new ReadableStream<Uint8Array>({
+        start(controller) {
+            beat = setInterval(
+                () => controller.enqueue(HEARTBEAT),
+                HEARTBEAT_MILLISECONDS,
+            )
+        },
+        async pull(controller) {
+            try {
+                const next = await reader.read()
+                if (!next.done) return controller.enqueue(next.value)
+                clearInterval(beat)
+                controller.close()
+            } catch (thrown) {
+                clearInterval(beat)
+                controller.error(thrown)
+            }
+        },
+        cancel(reason) {
+            clearInterval(beat)
+            return reader.cancel(reason)
+        },
+    })
 }
 
 type BridgeReport = {
@@ -229,16 +309,24 @@ type BridgeReport = {
 }
 
 async function relay(request: Request): Promise<Response> {
-    const token = (request.headers.get('authorization') ?? '').replace(
-        /^Bearer /,
-        '',
-    )
-    const bridge = BY_TOKEN.get(token)
+    const bridge = pairedBy(request)
     if (bridge === undefined)
         return answered(refuse(401, 'No bridge is paired with this token.'))
-    for (const line of (await request.text()).split('\n')) {
+    // 16.78 — under the environment's body ceiling, as a handler's body is.
+    const body = await bodyWithin(request, undefined)
+    if (isFailed(body)) return answered(body)
+    // 44.23 — EVERY LINE PARSED BEFORE ANY IS RELAYED, so a post with one that is not JSON is refused
+    // whole rather than relayed in part.
+    const reports: BridgeReport[] = []
+    for (const line of (await body.text()).split('\n')) {
         if (line === '') continue
-        const report = JSON.parse(line) as BridgeReport
+        try {
+            reports.push(JSON.parse(line) as BridgeReport)
+        } catch {
+            return answered(refuse(400, 'A reported line is not JSON.'))
+        }
+    }
+    for (const report of reports) {
         const turn = bridge.turns.get(report.turn)
         if (turn === undefined) continue
         turn.push(item(report.type, report))

package/src/server/claudeApi.ts

@@ -1,4 +1,4 @@
-// 45.9 — THE MESSAGES API AS A `Provider`, configured the way Anthropic documents it: the request
+// 44.9 — THE MESSAGES API AS A `Provider`, configured the way Anthropic documents it: the request
 // body's own fields, snake_case, beside the client's `apiKey` and `baseURL`. abide owns `messages`
 // and `stream`; every other field is laid on the body as written, and the `tools` written there —
 // a server tool like web search — are sent beside the app's own.
@@ -64,10 +64,10 @@ type ApiEvent = {
 
 /** The Messages API, streamed, looping while Claude asks for tools. */
 export function claudeApi(config: ClaudeApiConfig): Provider {
-    // 45.10 — the key is the app's to hand over, and nothing reads one from the environment.
+    // 44.10 — the key is the app's to hand over, and nothing reads one from the environment.
     if (typeof config.apiKey !== 'string' || config.apiKey === '')
         throw new Error(
-            'abide: claudeApi was handed no apiKey. RULEBOOK 45.10.',
+            'abide: claudeApi was handed no apiKey. RULEBOOK 44.10.',
         )
     const { apiKey, baseURL, tools: ownTools, ...body } = config
     return {
@@ -102,7 +102,7 @@ export function claudeApi(config: ClaudeApiConfig): Provider {
                         }),
                     },
                 )
-                // 45.21 — the API's own failure, answered before the first event where it comes first.
+                // 44.21 — the API's own failure, answered before the first event where it comes first.
                 if (!answered.ok || answered.body === null)
                     throw refuse(
                         502,
@@ -143,7 +143,7 @@ export function claudeApi(config: ClaudeApiConfig): Provider {
                             if (block.type !== 'tool_use') break
                             const partial = partials[event.index] as string
                             // Cut short at `max_tokens`, a call's input is not JSON — and that turn did
-                            // not stop for `tool_use`, so it is never run (45.9).
+                            // not stop for `tool_use`, so it is never run (44.9).
                             try {
                                 block.input =
                                     partial === '' ? {} : JSON.parse(partial)
@@ -165,7 +165,7 @@ export function claudeApi(config: ClaudeApiConfig): Provider {
                             usage.output += event.usage?.output_tokens ?? 0
                             break
                         case 'error':
-                            // 45.21.
+                            // 44.21.
                             throw refuse(
                                 502,
                                 `The Claude API failed: ${event.error.message}`,
@@ -205,7 +205,7 @@ export function claudeApi(config: ClaudeApiConfig): Provider {
                         is_error: result.failed,
                     })
                 }
-                // 45.12 — every result of one turn in one message.
+                // 44.12 — every result of one turn in one message.
                 history.push({ role: 'user', content })
             }
         },

package/src/server/claudeCode.ts

@@ -1,11 +1,11 @@
-// 45.13 — THE CLAUDE CODE ON THE VISITOR'S OWN MACHINE AS A `Provider`, reached through the bridge they
+// 44.13 — THE CLAUDE CODE ON THE VISITOR'S OWN MACHINE AS A `Provider`, reached through the bridge they
 // paired (`bridgeRelay.ts`). Claude Code runs its own loop there; what this side does is hand it the
 // turn and answer the MCP requests it makes from the `Toolbox` — in this request's scope, as this
-// asker (45.7) — so its tools are the site's and nothing of the visitor's machine is one.
+// asker (44.7) — so its tools are the site's and nothing of the visitor's machine is one.
 //
 // CONFIGURED BY CLAUDE CODE'S OWN OPTION NAMES, and only the ones that shape the answer. What would give
 // a site power over the visitor's machine — its own tools, permissions, directory, settings — is not an
-// option here at all: the bridge decides it (45.15, 45.16).
+// option here at all: the bridge decides it (44.15, 44.16).
 
 import { mounted } from '#shared/mount.ts'
 import { refuse } from '#shared/refuse.ts'
@@ -45,7 +45,7 @@ function claudeCodeProvider(config: ClaudeCodeConfig = {}): Provider {
     return {
         async *run(messages, tools, { maxTurns, signal }) {
             const bridge = pairedBridge(askingCaller())
-            // 45.13 — nothing paired is the page's cue to show the command.
+            // 44.13 — nothing paired is the page's cue to show the command.
             if (bridge === undefined)
                 throw refuse(
                     409,
@@ -59,7 +59,7 @@ function claudeCodeProvider(config: ClaudeCodeConfig = {}): Provider {
                 config,
                 maxTurns,
             })
-            // 45.18 — a caller hanging up ends the run on the bridge.
+            // 44.18 — a caller hanging up ends the run on the bridge.
             const cancel = (): void => {
                 bridge.frames.push({ type: 'cancel', turn: turn.id })
             }
@@ -69,7 +69,7 @@ function claudeCodeProvider(config: ClaudeCodeConfig = {}): Provider {
                     if (item.kind === 'event')
                         yield item.event as AssistantEvent
                     else if (item.kind === 'mcp')
-                        // 45.17 — answered by the app's own MCP surface, through the turn's `Toolbox`.
+                        // 44.17 — answered by the app's own MCP surface, through the turn's `Toolbox`.
                         void forwardOf(tools)(item.method, item.params)
                             .catch((thrown: unknown) =>
                                 mcpFailure(-32603, String(thrown)),
@@ -83,7 +83,7 @@ function claudeCodeProvider(config: ClaudeCodeConfig = {}): Provider {
                                 })
                             })
                     else if (item.kind === 'end') return
-                    // 45.21.
+                    // 44.21.
                     else
                         throw refuse(502, `Claude Code failed: ${item.message}`)
                 }
@@ -95,7 +95,7 @@ function claudeCodeProvider(config: ClaudeCodeConfig = {}): Provider {
     }
 }
 
-/** The transcript as the one message Claude Code is sent: earlier turns folded above the last. 45.5. */
+/** The transcript as the one message Claude Code is sent: earlier turns folded above the last. 44.5. */
 function foldedPrompt(messages: AssistantMessage[]): string {
     const last = (messages.at(-1) as AssistantMessage).content
     if (messages.length === 1) return last
@@ -107,7 +107,7 @@ function foldedPrompt(messages: AssistantMessage[]): string {
     return `<conversation>\n${earlier}</conversation>\n\n${last}`
 }
 
-/** The browser asking, which a pairing is to. 45.13. */
+/** The browser asking, which a pairing is to. 44.13. */
 function askingCaller(): string {
     const caller = callerOf()
     if (caller === undefined)
@@ -118,7 +118,7 @@ function askingCaller(): string {
     return caller
 }
 
-/** The command that pairs a bridge with this browser, and when its code stops standing. 45.14. */
+/** The command that pairs a bridge with this browser, and when its code stops standing. 44.14. */
 function bridgeCommand(): { command: string; expires: number } {
     const { code, expires } = mintCode(askingCaller())
     const site = `${appOrigin() ?? new URL(request().url).origin}${mounted('')}`
@@ -130,7 +130,7 @@ function bridgeCommand(): { command: string; expires: number } {
 
 /**
  * This browser's pairing as it changes: unpaired with the command to run, then paired the moment a
- * bridge connects, and unpaired again if it goes. 45.20.
+ * bridge connects, and unpaired again if it goes. 44.20.
  */
 async function* bridge(): AsyncGenerator<BridgeStatus> {
     const caller = askingCaller()