@ai-ecoverse/slicc-spectrum 1.78.0 → 1.79.0

package/README.md

@@ -157,10 +157,11 @@ Text is Adobe Clean Spectrum VF, falling back to Adobe Clean, and code is Spectr
 | `<slicc-monitor>` | The live monitor: vitals (`.vital[data-id]`), each a meter when it has a `ratio` (budget, fullest context) and otherwise a value, its unit and delta on one line and a sparkline from its `series` (spend, active agents, processes, process memory). Each card keeps its place whatever it shows: the value line never wraps (a unit or delta that doesn't fit is left out whole rather than cut, and stays in the line's `title` and its text; a vital's optional `hint` replaces that tooltip, such as the exact reset time behind "resets in 4 days"), a card without a `series` keeps the sparkline's room, a meter keeps its description's line, and a card left alone on the last row spans it, so short and long values, 0% and 100%, and missing data move nothing below them. Then alerts (an alert's optional `command` shows after its detail, led by its `commandLabel` or "Run", as unwrapped code with **Copy**, `[data-command]` and `data-action="copy-command"`), and the sections (the agent's Tasks, Processes and Recent problems, then terminals, tabs, pending changes and tray followers; cones and sprinkles have their own panels; any other section an agent sends, such as an older agent's `agents` or `sprinkles`, renders the same way). Each section (`li.section[data-id]`) shows its count and an attention badge, and opens its surface with **Open** where one exists; the counts line up in one column whether or not a section has **Open**, and a section without rows keeps its name in line with the others (`agents`, `terminals` and `processes` → terminal, `tabs`, `changes`). A section with rows expands into them with its toggle (`.toggle`, `aria-expanded`; `data-open` on the section): collapsed by default, expanded while a row is `warn` or `error`, until the user toggles it. Each row (`li.row[data-status]`, `data-id` from the row's `id`) shows a status light (blue active, gray idle, orange warn, red error, with the status spoken), the name, the meta line and its badges, indented by `depth` (`data-depth`, up to 6). |
 | `<slicc-freezer>` | Every conversation in the session, from `frozen()`: cones, scoops and agent runs, each with a kind badge, live ones first with a Live light, then the newest first. A live row offers **Open**, which selects that agent; a stopped one offers **Thaw** and **Remove**, which deletes its working folders after a confirmation. A thawed scoop or agent run keeps its row, which says what it was thawed as. **Delete cone**, in the agents list (or <kbd>Delete</kbd> on a cone's row) and the header's cone picker, stops a cone after a confirmation; `/freeze` does it at once. Either way its conversation stays here, and a row without a `kind` counts as a cone. |
 | `<slicc-sprinkle>` | A SLICC sprinkle (`.shtml`), as a panel or, with `inline`, as a dip in the chat that grows to fit, even when it loads out of view (the frame measures itself on load, after icons and fonts arrive, and on every resize). A dip has a tab-like handle: drag it into the dock (or onto a rail, or use its open-as-panel button) and it lives on as a sprinkle panel, with a note in the chat where it was; which dips are out is saved in `slicc-ui.dips`. It runs in a sandboxed frame (`allow-scripts` only) with SLICC's sprinkle theme (the `--s2-*` tokens and `.sprinkle-*` classes), the app's fonts, and Lucide icons (`<i data-lucide>`, `LucideIcons.render()`). It talks back through `slicc.lick({ action, data })`, which reaches the owning cone as a `sprinkle` lick, and, when the port has `call`, reads files and keeps state (see [Sprinkle bridge](#sprinkle-bridge)). Panel sprinkles sit at the top of the right rail with their Lucide icon. |
-| `<slicc-network>` | Network: the route and its health in plain words with the bios `detail`, a line on browser automation (`data-browser`: through the SLICC extension, through slicc on this computer (`proxy`, or a linked device on this computer), through a linked device's browser, that slicc on this computer has no browser to control when it carries the traffic and `via` is `null`, or not available with how to get it) when the status has `browser`, **Check again** (`data-action="check"`) when the port has `check`, an **Internet traffic** picker (`data-action="exit"`, in `[data-exit-picker]` with the exit's kind) when the port has `setExit`, the route line saying where traffic goes, and under the picker a warning that traffic waits while the chosen device isn't connected (`data-exit="device"`, `data-held`, with **Send directly**, `data-action="exit-direct"`, which calls `setExit(null)`) or, when `route` isn't `tailnet`, the Tailscale exit node in use (`data-exit="node"`), a **Tailscale** section (`data-tailnet` with the state) when the status has `tailnet`, a **Linked devices** section (`data-links`: `linked`, `connecting`, `reconnecting`, `offline`, `none` or `permission`; each device row has a **Prompting** or **Watching** badge, `data-controlling`, while it controls the agent, and **Allow remote control**, `sp-switch[data-action="remote-control"]`, behind a confirm when turned on, or `data-control="fixed"` for a device on this computer; with `access`, an **Allow** group of **View**, **Control** and **Terminal** switches, `data-action="access-view"`, `access-control` and `access-terminal`, each confirmed when turned on, Terminal's saying it gives a root shell, and Control disabled while View is off; a device that asks to follow shows **Asks to follow** and **Allow**, `data-action="allow-follow"`; a **Terminal open** badge, `data-terminals`, counts its terminals; with `followUrl`, the join details add **Open on another device** with a QR code and the link, `data-join="follow"` and `data-copy="follow-url"`) when the status has `links`, **Get the whole web** with the Chrome extension link (`data-action="install-extension"`, when `extensionUrl` is set) and the commands to run slicc, each in a `.command[data-command]` block with a copy button: `curl -fsSL https://get.sliccy.ai/slicc | sh` (its button is `data-action="copy-command"`), `slicc`, and, with Node, `npx sliccy@next`; folded away when the route already reaches the whole web (`proxy`, `extension`, `link` or `tailnet`, whose line names `tailnet.exitNode`) or a linked device is the exit (`exit.kind` `link`: the route line says "Through slicc on this computer" for a `local` device, or names a remote device and its `policy`, or says it's waiting for it, and `data-route` is `link`, whatever `route` says), and recent failures with host, error and time. When the model has a `tray` port, a **Sync** section (`data-sync` with the connection) follows the connection: the tray's state, the float's name, role and runtime, the join link, masked (`…/join/••••••`) until **Show** (`data-action="reveal-tray-join"`, which turns into **Hide**), with **Copy** (`data-action="copy-tray-join"`), the followers (`li[data-follower]`), and **Disconnect** (`data-action="tray-disconnect"`, confirmed) or **Reconnect** (`data-action="tray-reconnect"`). When the status has `leaders`, a **Leaders** section (`section[data-leaders]` with the count) follows Sync, since it's the other direction of the same tray link: Sync is this SLICC's own tray and who follows it, Leaders the SLICCs it follows. Each leader is an `li[data-leader]` (the id) with `data-state`: its name, its hub as a quiet second line and a status light with the state in words (Connecting, Reconnecting, Connected, Disconnected, Failed, Unlinked); `failed` adds its `error` as plain text (`[data-leader-error]`, "Couldn’t reach its hub." without one) and **Retry** (`data-action="retry-leader"`), and `unlinked` says "{name} stopped sharing with this SLICC." (`[data-unlinked]`) without actions. **Disconnect** (`data-action="disconnect-leader"`) runs at once, without a confirm, since it's reversible: the row stays as Disconnected (a neutral light), with **Reconnect** (`data-action="reconnect-leader"`) and **Forget** and no Disconnect or Retry. **Forget** (`data-action="forget-leader"`) asks "Forget {name}?" ("To follow it again, you’ll need a new invite from it.") with a negative confirm, and the row goes. Each shows only when the port has its method; while one runs, the row's buttons are disabled, and a failure shows in the row (`data-error="leader"`). The header's **Network** indicator (`data-network`, `data-health`) opens it: a status light, green for `ok`, yellow for `limited` and red for `failing`, with the state in its text and label and `detail` as its tooltip, which adds "Tailscale is connected." while the tailnet runs; on a phone, a cloud icon for the state. While a linked device asks to follow, controls the agent, watches it or has a terminal open, an indicator (`data-remote`, `ask`, `prompt`, `terminal` or `watch`) sits before it, **{name} asks to follow**, **Controlled by**, **Terminal open from** or **Watched by** the device's name (or the number of devices; in that order of precedence), says who does what in its tooltip and opens the panel too. Offered only when the model has a `network` port. |
+| `<slicc-network>` | Network: the route and its health in plain words with the bios `detail`, a line on browser automation (`data-browser`: through the SLICC extension, through slicc on this computer (`proxy`, or a linked device on this computer), through a linked device's browser, that slicc on this computer has no browser to control when it carries the traffic and `via` is `null`, or not available with how to get it) when the status has `browser`, **Check again** (`data-action="check"`) when the port has `check`, an **Internet traffic** picker (`data-action="exit"`, in `[data-exit-picker]` with the exit's kind) when the port has `setExit`, the route line saying where traffic goes, and under the picker a warning that traffic waits while the chosen device isn't connected (`data-exit="device"`, `data-held`, with **Send directly**, `data-action="exit-direct"`, which calls `setExit(null)`) or, when `route` isn't `tailnet`, the Tailscale exit node in use (`data-exit="node"`), a **Tailscale** section (`data-tailnet` with the state) when the status has `tailnet`, a **Linked devices** section (`data-links`: `linked`, `connecting`, `reconnecting`, `offline`, `none` or `permission`; each device row has a **Prompting** or **Watching** badge, `data-controlling`, while it controls the agent, and **Allow remote control**, `sp-switch[data-action="remote-control"]`, behind a confirm when turned on, or `data-control="fixed"` for a device on this computer; with `access`, an **Allow** group of **View**, **Control** and **Terminal** switches, `data-action="access-view"`, `access-control` and `access-terminal`, each confirmed when turned on, Terminal's saying it gives a root shell, and Control disabled while View is off; a device that asks to follow shows **Asks to follow** and **Allow**, `data-action="allow-follow"`; a **Terminal open** badge, `data-terminals`, counts its terminals; with `followUrl`, the join details add **Open on another device** with a QR code and the link, `data-join="follow"` and `data-copy="follow-url"`) when the status has `links`, **Get the whole web** with the Chrome extension link (`data-action="install-extension"`, when `extensionUrl` is set) and the commands to run slicc, each in a `.command[data-command]` block with a copy button: `curl -fsSL https://get.sliccy.ai/slicc | sh` (its button is `data-action="copy-command"`), `slicc`, and, with Node, `npx sliccy@next`; folded away when the route already reaches the whole web (`proxy`, `extension`, `link` or `tailnet`, whose line names `tailnet.exitNode`) or a linked device is the exit (`exit.kind` `link`: the route line says "Through slicc on this computer" for a `local` device, or names a remote device and its `policy`, or says it's waiting for it, and `data-route` is `link`, whatever `route` says), and recent failures with host, error and time. When the model has a `tray` port, a **Sync** section (`data-sync` with the connection) follows the connection: the tray's state, the float's name, role and runtime, the join link, masked (`…/join/••••••`) until **Show** (`data-action="reveal-tray-join"`, which turns into **Hide**), with **Copy** (`data-action="copy-tray-join"`), the followers (`li[data-follower]`), and **Disconnect** (`data-action="tray-disconnect"`, confirmed) or **Reconnect** (`data-action="tray-reconnect"`). When the status has `leaders`, a **Leaders** section (`section[data-leaders]` with the count) follows Sync, since it's the other direction of the same tray link: Sync is this SLICC's own tray and who follows it, Leaders the SLICCs it follows. Each leader is an `li[data-leader]` (the id) with `data-state`: its name, its hub as a quiet second line and a status light with the state in words (Connecting, Reconnecting, Connected, Disconnected, Failed, Unlinked); `failed` adds its `error` as plain text (`[data-leader-error]`, "Couldn’t reach its hub." without one) and **Retry** (`data-action="retry-leader"`), and `unlinked` says "{name} stopped sharing with this SLICC." (`[data-unlinked]`) without actions. **Disconnect** (`data-action="disconnect-leader"`) runs at once, without a confirm, since it's reversible: the row stays as Disconnected (a neutral light), with **Reconnect** (`data-action="reconnect-leader"`) and **Forget** and no Disconnect or Retry. **Forget** (`data-action="forget-leader"`) asks "Forget {name}?" ("To follow it again, you’ll need a new invite from it.") with a negative confirm, and the row goes. Each shows only when the port has its method; while one runs, the row's buttons are disabled, and a failure shows in the row (`data-error="leader"`). When the model has a `guests` port, a **Guests** section (`section[data-guests]` with the count) follows Leaders: **Invite a guest** (`data-action="invite-guest"`, accent, disabled while no cone is live; frozen cones are left out of the invite too), or, while `unavailable()` (or the last `unavailable` event, when the port has no method) is a sentence, that sentence instead, subdued (`[data-guests-unavailable]`). Each seat is an `li[data-seat]` (the id) with `data-connected` (`true` or `false`): its label, the cone's name as a quiet second line (`[data-seat-cone]`), "Expires in {n} hours" under a day, "Expires in {n} days" after, or "No expiry" (`[data-expiry]`), a status light with **Connected** or **Not connected**, a count badge (`data-pending`) reading "{n} waiting", whose accessible name is "{n} waiting for review" when `pending` is above 0, and **Revoke** (`data-action="revoke-guest"`), which asks "Revoke {label}?" ("Their link stops working at once. To let them back in, invite them again.") with a negative confirm; while it runs, the rows' buttons are disabled, and a failure shows in the row (`data-error="guest"`). With no seats it says "No guests yet." (`[data-guests-empty]`). Invite opens `<slicc-guest-invite>`, a modal: **Cone** (`#guest-cone`, the active cone, or a selected scoop's cone, else the first), **Name** (`#guest-name`, required, trimmed, at most 40 characters, "Shown to you and in the cone, never set by the guest."), **Link expires** (`#guest-expiry`: 1 hour, 1 day, 7 days by default, or 30 days), **Their messages** (`#guest-messages`: You approve each one, The automatic check decides, {cone} decides, {scoop} decides for each of the cone's scoops, or No review, which are `user`, `agent`, `cone`, `scoop:<name>` and `off`) and **Their tool calls** (`#guest-tools`: `user`, `agent` and `scoop:<name>` only), both `user` by default, each with the chosen option's meaning under it. **Create link** (`data-action="create-guest-link"`) calls `mint(cone, { label, expiresAt, gates })`; while it runs the form is busy and Escape does nothing, and a rejection shows its message inline (`data-error="guest"`). On success the dialog shows the URL once (`[data-guest-invite="link"]`): a read-only field (`data-copy="guest-url"`) with **Copy** (`data-action="copy-guest-url"`), "This link is shown only once. Copy it now." and **Done** (`data-action="done-guest"`). The URL is never stored or shown again: closing the dialog drops it. The header's **Network** indicator (`data-network`, `data-health`) opens it: a status light, green for `ok`, yellow for `limited` and red for `failing`, with the state in its text and label and `detail` as its tooltip, which adds "Tailscale is connected." while the tailnet runs; on a phone, a cloud icon for the state. While a linked device asks to follow, controls the agent, watches it or has a terminal open, an indicator (`data-remote`, `ask`, `prompt`, `terminal` or `watch`) sits before it, **{name} asks to follow**, **Controlled by**, **Terminal open from** or **Watched by** the device's name (or the number of devices; in that order of precedence), says who does what in its tooltip and opens the panel too. Offered only when the model has a `network` port. |
 | `<slicc-tray>` | The tray items in the header, each opening a panel when that panel is in `panels`: the connection (`#chip`, a status light with the float's name and followers, `data-surface="network"`) opens Network at its **Sync** section, and the budget (`#usage`, `data-surface="monitor"`) opens the Monitor. Without the panel an item is a plain status with its label. |
 | `<slicc-confirm>` | The confirmation dialog `confirm()` opens. Not for direct use. |
 | `<slicc-prompt>` | The name dialog `prompt()` opens. Not for direct use. |
+| `<slicc-guest-invite>` | The invite dialog of the Network panel's Guests section. Not for direct use. |
 | `<slicc-file-tree>` | Generic. [`@pierre/trees`](https://www.npmjs.com/package/@pierre/trees) through its `web-components` entry: `paths` (folders end in `/`), `gitStatus`, `expanded`, `query` (shows only the paths that match it; empty shows all), `reveal(path, focus)`. It has no search field of its own. Fires `file-open` on click and on <kbd>Enter</kbd>, and `tree-search` (`detail.key`) when a letter or digit is typed in it, for the panel's search field. |
 | `<slicc-code-view>` | Generic. A highlighted file through [`@pierre/diffs`](https://www.npmjs.com/package/@pierre/diffs): `path`, `contents`, `color`. |
 | `<slicc-diff-view>` | Generic. A diff through `@pierre/diffs`: `path`, `oldText`, `newText` (`null` for an added or deleted file), `color`, `diff-style` (`unified` or `split`). |
@@ -253,9 +254,10 @@ With an `agentId` or a `cone`, the caller reaches the shared surfaces, the chats
 | `tabs` (optional) | BIOS | `state()` returns this tab's `TabsState`: `role` (`owner` runs SLICC; `follower` shows the owner tab's SLICC; `connecting` while the owner boots or hands over; `alone` without SharedWorker), `stalled` (the owner stopped answering) and `skew` (`newer` or `older` when the owner runs another SLICC version, else `null`). Emit `tabs` when it changes. An owner shows nothing. A follower gets a quiet header light, "Another tab" (`[data-tabs][data-role]`, with `data-stalled` and `data-skew`; a dot on phones), info while connecting, and a notice while stalled or skewed, with its explanation as the tooltip. While connecting, an empty chat says "Connecting to the tab running SLICC…" (`[data-connecting]`). Skew, or else a stall, shows a warning banner at the top of every chat panel (`[data-tabs-notice="skew"\|"stalled"]`, `data-skew`): "Another tab runs a newer SLICC. Reload this tab." with **Reload** (`data-action="reload"`, calls `reload()`), "Another tab runs an older SLICC. Reload the other SLICC tab.", or "Chrome paused the tab running SLICC. Switch to it to continue.". An `alone` tab shows only the brand and "SLICC is open in another tab." (`[data-tabs="alone"]`). |
 | `approvals` (optional) | BIOS | `list()` returns waiting `Approval`s; emit `approvals` when the list changes. A `sudo` approval has `id`, `requester` (`kind` `agent` or `user`, `name`, optional `agentId` and `where`, such as a terminal's title), `command` (without `sudo`; bios joins the kernel's argv shell-quoted), optional `target` (the user to run as; shown as `sudo -u {target}` unless `root`), optional `cwd`, `createdAt`, `expiresAt` (epoch ms) and `always` (offer Always allow, which covers the requester's user and this exact command). With `decide(id, 'once' \| 'always' \| 'deny')`, which resolves once the decision is recorded and then drops the request from `list()`, the tab shows a warning alert dialog (`dialog[data-approval][data-kind][data-requester]`): "Allow sudo?", "{name} wants to run this with sudo[ in {where}]:" for an agent or "You ran this with sudo[ in {where}] (as {name}):" for a user, the command, "In {cwd}", a notice when the command changes secret rules, what Always allow does, "Denied automatically in m:ss." and how many more wait, with **Deny** (`data-action="deny"`, focused; Escape also denies), **Always allow** (`always`) and **Allow once** (`once`). A command that names `/etc/fnox` (or anything in it) or `/etc/slicc/secrets-policy.toml`, resolved against `cwd`, globs included (with quotes and backslashes removed, operands after `--` included; a path with `[`, `{` or `$` counts when the part before it could lead to them), or that names `/`, `/etc` or `/etc/slicc` in a command other than a read-only one (such as `ls`, `cat`, `stat` or `grep`), or runs with `cwd` in `/etc/fnox`, or names a relative path with `fnox` or `secrets-policy` in it wherever `cd` may have led, gets "This changes secret rules." with the path (`[data-secret-rules]`, the path in the attribute). Read-only commands count only by bare name or from `/bin` and `/usr/bin`. `/proc/<pid>/root` counts as `/` and `/proc/self/cwd` as `cwd`. Otherwise a command with a parameter expansion or command substitution (`$…`, backticks), a `~+` or `~-` path or a `~` path that climbs with `..`, a path through another process's `/proc/<pid>/cwd`, `fd` or `map_files` or through `/dev/fd`, or more than 4096 characters, gets "This may change secret rules." with the first such part in the attribute. Other symlinks aren't followed. Either way there's no Always allow, even when `always` is `true` (`decide(id, 'always')` isn't called for it), so each change to the rules is asked for. For half a second after a request shows, only Deny works, so a double-click can't approve it. A rejected `decide` shows its message in the dialog (`[data-error]`, `dialog[data-rejected]`) in place of the countdown, with only **Close** (`data-action="close"`, focused; Escape also closes), which moves on to the next waiting request or closes the dialog. Pass `decide` in every tab: the first decision wins. When a request ends without a decision in this tab, emit `ended` with `{ id, reason }` and drop it from `list()`: `answered` (another tab decided) shows "Answered in another tab", `expired` shows "Sudo request timed out", each with the command and **Close** (`data-action="close"`, `dialog[data-gone]`), and `withdrawn` (the requester went away) closes the dialog silently. Without `ended`, a request that leaves the list reads as expired past `expiresAt` and answered before it. Without `decide`, each request is a warning notice in the chat panels: "Waiting for sudo approval", who asks and the command, and "Answer it in the tab running SLICC. Denied automatically at {time}." A guest request has `kind` `guest-message` (`text`, optional `attachments` of `{ name, mimeType, size }`) or `guest-tool` (`tool`, `summary`), plus `requester` (`kind` `guest`), `agentId`, optional `agentName`, `createdAt`, `expiresAt`, `always: false` and an optional `verdict` (`{ decision: 'allow' \| 'deny', reason }`, the automatic check's view). Its dialog (`[data-approval-kind]` on the body) reads "Allow a guest’s message?" with "{name} wants to send this to {agentName ?? 'this cone'}:", the text as plain text in a scrolling box (`[data-guest-text]`, never Markdown or HTML) and the attachments as name · type · size (`[data-attachments]`), or "Allow a guest’s tool call?" with "{agentName ?? 'This cone'} wants to run {tool} for {name}:" and the summary (`[data-summary]`); then "The automatic check would allow this: {reason}" or "…deny this: {reason}" (`[data-verdict]`, the decision in the attribute). It offers only **Deny** and **Allow once**, whatever `always` says. `decide` gets no `reason` from the UI; a rejected `decide` shows its message inline (`[data-error]`) with only **Close**, as for sudo. Ended guest requests read "Answered elsewhere", "Guest message timed out" or "Guest tool call timed out". Without `decide`, a guest request's notice reads "Waiting for approval of a guest’s message" with "{name}'s message to {agentName} waits for approval on the device in control.", or "Waiting for approval of a guest’s tool call" with "{agentName} wants to run {tool} for {name}, which waits for approval on the device in control.", then "Denied automatically at {time}." |
 | `vault` (optional) | BIOS | The vault's view for SLICC, typed after `@ai-ecoverse/slicc-vault` (spectrum re-declares the types it uses, and `compat/vault.ts` checks that the package's types fit them). `status()` returns the `VaultStatus` (`locked`, `lock`, `scrub`, `waiting` requests, and optional `exportedAt` and `backupReminder`) or `null` while loading, and `list()` the `VaultList` (`secrets` as `SecretView`s, `refused` rules, `exits`, and the first `audit` page with `auditMore`) or `null`. Emit `status` and `list` when they change (bios re-lists after the vault's `changed` events), and `availability` when the optional `availability()` (`connecting`, `waiting`, `locked` or `ready`) changes. `audit(before?, limit?)` resolves with an older `AuditPage` (`before` is a `seq`). The optional page ops, each hiding its control when missing: `put(name, value, request?)` (a value request's `put` must use its `name`), `cancel(request)`, `remove(name, kind?)`, `restore(name, kind?)`, `import(kind, bytes, { password?, pick? })` (a `pick` stage, then `done`), `export(passphrase)` (the bundle's bytes), `lock()` and `dismissBackupReminder()`. They reject with a `VaultFailure`, an `Error` with an `ErrorCode` `code` (`isVaultFailure` from `/ui`). Values go to the vault only through `put`, and never through another port. `button()` returns a new `VaultButton`, `{ element, post(message), listen(fn) }` returning an unsubscribe: bios wraps the vault's `button.html` frame and its postMessage protocol, and spectrum only sends `ButtonMessage`s and receives `ButtonEvent`s. The passkey lock (unlock and protect) happens in the vault's own popup, which only a click in that frame can open. `notices`, `acknowledge` and the `notice` event are still typed, and ignored. |
+| `guests` (optional) | the tray hub | Guest seats on a cone. `list()` returns the `GuestSeat`s (`id`, `label`, `agentId`, the cone, `createdAt`, `expiresAt` or `null`, `gates`, `connected` and `pending`, how many of their messages or tool calls wait for review); a revoked or expired seat leaves it at once. Emit `seats` when it changes. `mint(agentId, { label, expiresAt, gates })` resolves with the `seat` and its `url`, which the panel shows once and never keeps, and `revoke(id)` ends a seat; both reject with an `Error` whose message is a sentence to show. The hub caps `expiresAt` at 30 days. `gates` (`{ messages, tools }`) are fixed at mint, so changing them means revoking and minting again; each is a `GuestGate`: `user` (a person with Control approves each one), `cone` (the shared cone itself decides, messages only), `agent` (the automatic check decides by the owner's intent and asks a person when unsure), `scoop:<name>` (that scoop decides) or `off` (no review: messages go straight in as follow-ups, messages only). The optional `unavailable()` returns a sentence when seats can't be minted here (no tray hub, or a follower without Control), or `null`; emit `unavailable` with it when it changes. |
 | `follow` (optional) | BIOS | Only on a follower page, a SLICC that shows another SLICC's agent over a link. `state()` returns the `FollowState`: `owner` (its display name), `link` (`connecting` for the first connection, `connected`, `reconnecting` after a connection dropped, `unlinked` when the owner unlinked this device, or `failed`), `access` (`{ view, control, terminal }`, what the owner allows this device), an optional `name` (this device's name on the owner, for the waiting page) and an optional `error` (shown when `failed`). Emit `follow` when it changes. Connected without `view` means waiting to be allowed. `leave()` forgets the link and the optional `retry()` tries again from `failed`. Pass only the surfaces a follower has to `<slicc-app>` (agents, chat, terminal and settings) and leave out `network`. |
 
-The dummy supports `createDummyModel({ updates: 'boot' | 'starting' | 'current' | 'available' | 'restart' | 'failure' })`, also selectable with `?updates=` on `/ui/`. Fixtures stay stable for inspection; `model.updates.setScenario('current')` completes boot. Dummy Update now and Retry simulate download and link progress; Restart agent and Reload only change fixture state, never restart a real process or reload the browser. `createDummyModel({ packages: 'mixed' | 'empty' | 'fail' | 'user' | 'off' })` (or `?packages=` on `/ui/`, off by default) adds invented optional packages in every state: Install and Retry finish after a short wait and install missing requirements too, `fail` makes them fail, `user` adds a pinned agent-kit and two additions (one with a warning) that Unpin and Remove take out of the list, and removing Python while uv is installed asks through the `confirm` option (the `/ui/` page passes spectrum's `confirm`). `updateFixtures`, `packageFixtures` and `DummyUpdates` are exported from `/dummy`. `createDummyModel({ mounts: 'mount' | 'cancel' | 'fail' | 'needs' })` (or `?mounts=` on `/ui/`) turns on the optional mount members, which are off by default: `mountFolder` mounts invented files at `/mnt/photos`, resolves with `null`, or rejects, as `model.files.mount.scenario` says; `needs` also lists `/mnt/photos` in `needsFolder()` until a folder is inserted there. `createDummyModel({ network: 'ok' | 'limited' | 'failing' | 'off' })` (or `?network=` on `/ui/`, default `limited`) sets the dummy network: slicc on this computer as a linked device (`route: 'link'`, with browser automation through it), the page fetch with CORS failures, or no route, all invented; `off` leaves out the port. `model.network.setScenario()` switches it and Check again re-emits after a short wait. `createDummyModel({ tailnet: 'off' | 'needs-login' | 'running' | 'failed' })` (or `?tailnet=` on `/ui/`, off by default) adds an invented tailnet: an auth key starting with `tskey-` signs in, `mast-pi` and `keel-router` are online exit nodes and `buoy-laptop` is offline, and Retry on `failed` connects. While the dummy tailnet runs with an exit node, the route is `tailnet` and the health `ok`. `createDummyModel({ links: 'none' | 'preparing' | 'linked' | 'reconnecting' | 'exit' | 'prompt' | 'denied' | 'remote' | 'followers' })` (or `?links=` on `/ui/`, off by default) adds invented linked devices and the exit members: `linked` has quay-studio (on this computer) and pier-nuc, which can be exits and have a Chrome each, and dock-builder, which can't; quay-studio shares `sketches` and pier-nuc `proj` and a read-only `archive`, which **Mount** attaches to the dummy files at `/mnt/<source>` (with `mountInfo` naming the source) and **Eject** or the Files strip detaches; with no other browser automation, the dummy reports `via: 'link'`; `exit` sends traffic through quay-studio; `reconnecting` holds traffic for pier-nuc (health `failing`, and `ok` while the exit device is connected, both without a `detail`, as bios reports them); `remote` has pier-nuc allowed and prompting, quay-studio watching, and an offline reef-laptop that only ever connected for control; `prompt` and `denied` wait for Local Network Access, and Try again links quay-studio. New join URL changes the URL, and `model.network.setLinks()` switches scenarios. `createDummyModel({ leaders: 'connected' | 'failed' | 'unlinked' | 'disconnected' | 'two' })` (or `?leaders=` on `/ui/`, off by default) adds invented leaders and their members: cove-studio connected, marsh-desk failed with an error, cove-studio unlinked (gone on the next status), cove-studio disconnected, or both cove-studio and marsh-desk; Retry and Reconnect move a leader to connecting, then connected, Disconnect makes it disconnected and Forget drops it, each after a short wait. `networkFixtures`, `tailnetFixtures`, `linksFixtures`, `leadersFixtures`, `joinUrl` and `DummyNetwork` are exported from `/dummy`. `createDummyModel({ changes: 'files' | 'git' | 'nogit' })` (or `?changes=` on `/ui/`, default `files`) adds a git `changes` port: `git` lists the pending changes under `/workspace/harbor` and `/workspace/skills` with their `repo` and no author, and `nogit` reports git as unavailable. `DummyChanges` is exported from `/dummy`. `createDummyModel({ notices: 'storage' | 'mixed' | 'fail' | 'off' })` (or `?notices=` on `/ui/`, off by default) adds an invented storage warning with Try again, which clears it after a short wait (`mixed` adds an informative notice without actions, and `fail` makes Try again fail). `noticeFixtures` and `DummyNotices` are exported from `/dummy`. `createDummyModel({ browser: 'idle' | 'driving' | 'off' })` (or `?browser=` on `/ui/`, default `idle`) sets the dummy browser: `idle` has a history of invented actions (about 180 on harbor's tab, enough for Show more) and no driven tab, `driving` has harbor and quiet-otter driving two tabs, with harbor's last click still running and frames every 500 ms while watched, and `off` has no tabs. Stopping an agent releases its tabs. Like bios, `actions()` keeps the latest 500 per tab from the last 24 hours, 5,000 in total (`actionLimits`). `DummyBrowser`, `actionLimits`, `browserHistory` and `page` are exported from `/dummy`. `createDummyModel({ sprinkles: 'builtin' | 'cones' })` (or `?sprinkles=` on `/ui/`, default `builtin`) adds, with `cones`, invented sprinkles of other cones: a Board in harbor and one in tide-tables, and a Changelog in release-notes. `createDummyModel({ tabs: 'owner' | 'follower' | 'connecting' | 'stalled' | 'newer' | 'older' | 'alone' | 'off' })` (or `?tabs=` on `/ui/`, off by default) adds a tabs port in that state; `model.tabs.setScenario()` switches it, and Reload connects again and becomes a follower after a short wait. `tabsFixtures` and `DummyTabs` are exported from `/dummy`.
+The dummy supports `createDummyModel({ updates: 'boot' | 'starting' | 'current' | 'available' | 'restart' | 'failure' })`, also selectable with `?updates=` on `/ui/`. Fixtures stay stable for inspection; `model.updates.setScenario('current')` completes boot. Dummy Update now and Retry simulate download and link progress; Restart agent and Reload only change fixture state, never restart a real process or reload the browser. `createDummyModel({ packages: 'mixed' | 'empty' | 'fail' | 'user' | 'off' })` (or `?packages=` on `/ui/`, off by default) adds invented optional packages in every state: Install and Retry finish after a short wait and install missing requirements too, `fail` makes them fail, `user` adds a pinned agent-kit and two additions (one with a warning) that Unpin and Remove take out of the list, and removing Python while uv is installed asks through the `confirm` option (the `/ui/` page passes spectrum's `confirm`). `updateFixtures`, `packageFixtures` and `DummyUpdates` are exported from `/dummy`. `createDummyModel({ mounts: 'mount' | 'cancel' | 'fail' | 'needs' })` (or `?mounts=` on `/ui/`) turns on the optional mount members, which are off by default: `mountFolder` mounts invented files at `/mnt/photos`, resolves with `null`, or rejects, as `model.files.mount.scenario` says; `needs` also lists `/mnt/photos` in `needsFolder()` until a folder is inserted there. `createDummyModel({ network: 'ok' | 'limited' | 'failing' | 'off' })` (or `?network=` on `/ui/`, default `limited`) sets the dummy network: slicc on this computer as a linked device (`route: 'link'`, with browser automation through it), the page fetch with CORS failures, or no route, all invented; `off` leaves out the port. `model.network.setScenario()` switches it and Check again re-emits after a short wait. `createDummyModel({ tailnet: 'off' | 'needs-login' | 'running' | 'failed' })` (or `?tailnet=` on `/ui/`, off by default) adds an invented tailnet: an auth key starting with `tskey-` signs in, `mast-pi` and `keel-router` are online exit nodes and `buoy-laptop` is offline, and Retry on `failed` connects. While the dummy tailnet runs with an exit node, the route is `tailnet` and the health `ok`. `createDummyModel({ links: 'none' | 'preparing' | 'linked' | 'reconnecting' | 'exit' | 'prompt' | 'denied' | 'remote' | 'followers' })` (or `?links=` on `/ui/`, off by default) adds invented linked devices and the exit members: `linked` has quay-studio (on this computer) and pier-nuc, which can be exits and have a Chrome each, and dock-builder, which can't; quay-studio shares `sketches` and pier-nuc `proj` and a read-only `archive`, which **Mount** attaches to the dummy files at `/mnt/<source>` (with `mountInfo` naming the source) and **Eject** or the Files strip detaches; with no other browser automation, the dummy reports `via: 'link'`; `exit` sends traffic through quay-studio; `reconnecting` holds traffic for pier-nuc (health `failing`, and `ok` while the exit device is connected, both without a `detail`, as bios reports them); `remote` has pier-nuc allowed and prompting, quay-studio watching, and an offline reef-laptop that only ever connected for control; `prompt` and `denied` wait for Local Network Access, and Try again links quay-studio. New join URL changes the URL, and `model.network.setLinks()` switches scenarios. `createDummyModel({ leaders: 'connected' | 'failed' | 'unlinked' | 'disconnected' | 'two' })` (or `?leaders=` on `/ui/`, off by default) adds invented leaders and their members: cove-studio connected, marsh-desk failed with an error, cove-studio unlinked (gone on the next status), cove-studio disconnected, or both cove-studio and marsh-desk; Retry and Reconnect move a leader to connecting, then connected, Disconnect makes it disconnected and Forget drops it, each after a short wait. `networkFixtures`, `tailnetFixtures`, `linksFixtures`, `leadersFixtures`, `joinUrl` and `DummyNetwork` are exported from `/dummy`. `createDummyModel({ guests: 'on' | 'none' | 'unavailable' | 'fail' })` (or `?guests=` on `/ui/`, off by default) adds an invented `guests` port: `on` has Seat 1 (Mara) on sliccy, connected with 2 waiting and 5 days left, and Seat 2 (Ole) on harbor, not connected and without expiry; `none` has no seats; `unavailable` has none and says guests need the tray hub, so minting rejects; and `fail` makes `mint` reject with a sentence. `mint` adds a seat after a short wait and resolves with an invented `https://www.example.com/guest/…` URL, `revoke` drops the seat, and `model.guests.setScenario()` switches scenarios. `guestsFixtures`, `guestsUnavailable`, `guestsRefused` and `DummyGuests` are exported from `/dummy`. `createDummyModel({ changes: 'files' | 'git' | 'nogit' })` (or `?changes=` on `/ui/`, default `files`) adds a git `changes` port: `git` lists the pending changes under `/workspace/harbor` and `/workspace/skills` with their `repo` and no author, and `nogit` reports git as unavailable. `DummyChanges` is exported from `/dummy`. `createDummyModel({ notices: 'storage' | 'mixed' | 'fail' | 'off' })` (or `?notices=` on `/ui/`, off by default) adds an invented storage warning with Try again, which clears it after a short wait (`mixed` adds an informative notice without actions, and `fail` makes Try again fail). `noticeFixtures` and `DummyNotices` are exported from `/dummy`. `createDummyModel({ browser: 'idle' | 'driving' | 'off' })` (or `?browser=` on `/ui/`, default `idle`) sets the dummy browser: `idle` has a history of invented actions (about 180 on harbor's tab, enough for Show more) and no driven tab, `driving` has harbor and quiet-otter driving two tabs, with harbor's last click still running and frames every 500 ms while watched, and `off` has no tabs. Stopping an agent releases its tabs. Like bios, `actions()` keeps the latest 500 per tab from the last 24 hours, 5,000 in total (`actionLimits`). `DummyBrowser`, `actionLimits`, `browserHistory` and `page` are exported from `/dummy`. `createDummyModel({ sprinkles: 'builtin' | 'cones' })` (or `?sprinkles=` on `/ui/`, default `builtin`) adds, with `cones`, invented sprinkles of other cones: a Board in harbor and one in tide-tables, and a Changelog in release-notes. `createDummyModel({ tabs: 'owner' | 'follower' | 'connecting' | 'stalled' | 'newer' | 'older' | 'alone' | 'off' })` (or `?tabs=` on `/ui/`, off by default) adds a tabs port in that state; `model.tabs.setScenario()` switches it, and Reload connects again and becomes a follower after a short wait. `tabsFixtures` and `DummyTabs` are exported from `/dummy`.
 
 `createDummyModel({ follow: 'connecting' | 'waiting' | 'watch' | 'control' | 'full' | 'reconnecting' | 'unlinked' | 'failed' })` (`?follow=` on `/ui/`, which then leaves out the network port and offers only agents, chat, terminal and settings) makes the page a follower of SLICC on quay-studio: connecting, waiting to be allowed, View only, View and Control, everything, reconnecting, unlinked, or failed, where Try again connects with everything allowed. Leave counts in `model.follow.left` (the `/ui/` page then drops `?follow=`), and `model.follow.setScenario()` switches it. `followFixtures` and `DummyFollow` are exported from `/dummy`. `?links=followers` lists quay-studio (a CLI on this computer, Control always allowed), pier-nuc (a remote CLI, prompting), bay-laptop (a follower with everything allowed, watching, a terminal open), reef-phone (View only, watching) and tide-tablet (asking to follow); every links scenario has a follow link.
 

package/dist/slicc-dummy.js

@@ -484,6 +484,88 @@ var DummyFollow = class extends Emitter {
   }
 };
 
+// src/dummy/guests.ts
+var hour = 36e5;
+var day = 24 * hour;
+var cap = 30 * day;
+var guestsUnavailable = "Guests need the tray hub. Connect this SLICC to a tray to invite one.";
+var guestsRefused = "The hub couldn\u2019t make a link right now. Try again in a minute.";
+function guestsFixtures(scenario, now2 = Date.now()) {
+  if (scenario === "none" || scenario === "unavailable") return [];
+  return [
+    {
+      id: "seat-mara",
+      label: "Seat 1 (Mara)",
+      agentId: "cone-sliccy",
+      createdAt: now2 - 2 * hour,
+      expiresAt: now2 + 5 * day + 3 * hour,
+      gates: { messages: "user", tools: "user" },
+      connected: true,
+      pending: 2
+    },
+    {
+      id: "seat-ole",
+      label: "Seat 2 (Ole)",
+      agentId: "cone-harbor",
+      createdAt: now2 - 3 * day,
+      expiresAt: null,
+      gates: { messages: "scoop:quiet-otter", tools: "agent" },
+      connected: false,
+      pending: 0
+    }
+  ];
+}
+var DummyGuests = class extends Emitter {
+  scenario;
+  #seats;
+  #clock;
+  #count = 0;
+  constructor(scenario, clock2) {
+    super();
+    this.scenario = scenario;
+    this.#clock = clock2;
+    this.#seats = guestsFixtures(scenario);
+  }
+  list() {
+    return this.#seats;
+  }
+  unavailable() {
+    return this.scenario === "unavailable" ? guestsUnavailable : null;
+  }
+  setScenario(scenario) {
+    this.scenario = scenario;
+    this.#seats = guestsFixtures(scenario);
+    this.emit("unavailable", this.unavailable());
+    this.emit("seats", this.#seats);
+  }
+  async mint(agentId, draft) {
+    await this.#clock.sleep(4);
+    const refused = this.unavailable() ?? (this.scenario === "fail" ? guestsRefused : null);
+    if (refused) throw new Error(refused);
+    this.#count += 1;
+    const now2 = Date.now();
+    const seat = {
+      id: `seat-${now2.toString(36)}-${this.#count}`,
+      label: draft.label,
+      agentId,
+      createdAt: now2,
+      expiresAt: draft.expiresAt === null ? null : Math.min(draft.expiresAt, now2 + cap),
+      gates: draft.gates,
+      connected: false,
+      pending: 0
+    };
+    this.#seats = [...this.#seats, seat];
+    this.emit("seats", this.#seats);
+    return { seat, url: `https://www.example.com/guest/${seat.id}#k=Tq7Lm2Vx9Rb4` };
+  }
+  async revoke(id) {
+    await this.#clock.sleep(4);
+    if (!this.#seats.some((seat) => seat.id === id)) throw new Error("That guest is already gone.");
+    this.#seats = this.#seats.filter((seat) => seat.id !== id);
+    this.emit("seats", this.#seats);
+  }
+};
+
 // src/dummy/script.ts
 var units = "/workspace/harbor/src/lib/units.ts";
 var kelvin = `
@@ -2378,16 +2460,16 @@ var status = `<!DOCTYPE html>
 `;
 
 // src/dummy/extras.ts
-var day = 864e5;
+var day2 = 864e5;
 var now = Date.UTC(2026, 9, 5, 9, 0);
 function frozenConversation(topic, reply) {
   return [
-    { id: `f-${topic}-1`, role: "user", text: topic, createdAt: now - 3 * day },
+    { id: `f-${topic}-1`, role: "user", text: topic, createdAt: now - 3 * day2 },
     {
       id: `f-${topic}-2`,
       role: "assistant",
       status: "done",
-      createdAt: now - 3 * day + 6e4,
+      createdAt: now - 3 * day2 + 6e4,
       parts: [{ type: "text", text: reply }]
     }
   ];
@@ -2401,7 +2483,7 @@ var frozen = [
       title: "Write the onboarding guide for new contributors",
       model: "claude-sonnet-5-5",
       messages: 42,
-      frozenAt: now - 2 * day
+      frozenAt: now - 2 * day2
     },
     messages: frozenConversation(
       "Write the onboarding guide for new contributors",
@@ -2416,7 +2498,7 @@ var frozen = [
       title: "Spike: can the cache move to KV without a cold start?",
       model: "claude-opus-5-5",
       messages: 118,
-      frozenAt: now - 6 * day
+      frozenAt: now - 6 * day2
     },
     messages: frozenConversation(
       "Spike: can the cache move to KV without a cold start?",
@@ -2431,7 +2513,7 @@ var frozen = [
       title: "Summarize Q3 uptime and incidents",
       model: "claude-haiku-4-5",
       messages: 17,
-      frozenAt: now - 21 * day
+      frozenAt: now - 21 * day2
     },
     messages: frozenConversation(
       "Summarize Q3 uptime and incidents",
@@ -2446,7 +2528,7 @@ var frozen = [
       title: "Check the tide tables against the harbor feed",
       model: "claude-haiku-4-5",
       messages: 9,
-      frozenAt: now - 1 * day
+      frozenAt: now - 1 * day2
     },
     messages: frozenConversation(
       "Check the tide tables against the harbor feed",
@@ -2461,7 +2543,7 @@ var frozen = [
       title: "Write the nightly digest of merged pull requests",
       model: "claude-sonnet-5-5",
       messages: 6,
-      frozenAt: now - 3 * day
+      frozenAt: now - 3 * day2
     },
     messages: frozenConversation(
       "Write the nightly digest of merged pull requests",
@@ -2477,7 +2559,7 @@ var memories = [
     title: "Lead with the result",
     body: "Keep replies short. Lead with the result, then the evidence.",
     tag: "feedback",
-    updatedAt: now - 5 * day
+    updatedAt: now - 5 * day2
   },
   {
     id: "mem-2",
@@ -2486,7 +2568,7 @@ var memories = [
     title: "Tests before \u201Cfixed\u201D",
     body: "Run the tests before saying something is fixed, and quote the summary line.",
     tag: "feedback",
-    updatedAt: now - 9 * day
+    updatedAt: now - 9 * day2
   },
   {
     id: "mem-3",
@@ -2495,7 +2577,7 @@ var memories = [
     title: "Works in UTC",
     body: "Schedules, timestamps and cron expressions are in UTC unless stated otherwise.",
     tag: "user",
-    updatedAt: now - 30 * day
+    updatedAt: now - 30 * day2
   },
   {
     id: "mem-4",
@@ -2504,7 +2586,7 @@ var memories = [
     title: "harbor",
     body: "Forecast API, deployed as a worker. Cache bugs show up around midnight UTC. Staging deploys are frozen on Fridays.",
     tag: "project",
-    updatedAt: now - day
+    updatedAt: now - day2
   },
   {
     id: "mem-5",
@@ -2513,7 +2595,7 @@ var memories = [
     title: "release-notes",
     body: "Drafted every Friday from merged pull requests, grouped as features, fixes and chores.",
     tag: "project",
-    updatedAt: now - 4 * day
+    updatedAt: now - 4 * day2
   },
   {
     id: "mem-6",
@@ -2522,7 +2604,7 @@ var memories = [
     title: "Cache keys",
     body: "Cache keys are `city:UTC-date`. Never key on local time.",
     tag: "project",
-    updatedAt: now - 2 * day
+    updatedAt: now - 2 * day2
   },
   {
     id: "mem-7",
@@ -2531,7 +2613,7 @@ var memories = [
     title: "Retries",
     body: "Retry upstream calls three times with exponential backoff starting at 250 ms.",
     tag: null,
-    updatedAt: now - 2 * day
+    updatedAt: now - 2 * day2
   },
   {
     id: "mem-8",
@@ -2540,7 +2622,7 @@ var memories = [
     title: "Past tense, no ticket numbers",
     body: "One sentence per change, in the past tense, without ticket numbers.",
     tag: "feedback",
-    updatedAt: now - 7 * day
+    updatedAt: now - 7 * day2
   },
   {
     id: "mem-9",
@@ -2549,7 +2631,7 @@ var memories = [
     title: "Read the tests first",
     body: "Start a review from the tests, then read the change they cover.",
     tag: "feedback",
-    updatedAt: now - 3 * day,
+    updatedAt: now - 3 * day2,
     source: "entry"
   },
   {
@@ -2559,7 +2641,7 @@ var memories = [
     title: "Checks",
     body: "Flag any change to cache keys. Ask for a test when a retry count changes.",
     tag: null,
-    updatedAt: now - 3 * day,
+    updatedAt: now - 3 * day2,
     source: "notes"
   }
 ];
@@ -5943,8 +6025,8 @@ Done in 3.8s`
 
 // src/dummy/vault.ts
 var minute2 = 6e4;
-var hour = 60 * minute2;
-var day2 = 24 * hour;
+var hour2 = 60 * minute2;
+var day3 = 24 * hour2;
 var harbor = { domain: "api.harbor.example", header: "Authorization", methods: [], paths: [] };
 var pier = {
   domain: "packages.pier.example",
@@ -5965,7 +6047,7 @@ function vaultSecrets(now2 = Date.now()) {
       rules: [harbor],
       exits: ["proxy", "tailscale", "device:link-pier"],
       exec: false,
-      createdAt: now2 - 12 * day2,
+      createdAt: now2 - 12 * day3,
       usedAt: now2 - 4 * minute2
     },
     {
@@ -5979,9 +6061,9 @@ function vaultSecrets(now2 = Date.now()) {
       rules: [pier],
       exec: "argv",
       execArgv: [["pier", "publish"]],
-      createdAt: now2 - 3 * day2,
-      usedAt: now2 - 2 * hour,
-      expiresAt: now2 + 3 * day2
+      createdAt: now2 - 3 * day3,
+      usedAt: now2 - 2 * hour2,
+      expiresAt: now2 + 3 * day3
     },
     {
       name: "TIDE_MAIL",
@@ -6008,7 +6090,7 @@ function vaultSecrets(now2 = Date.now()) {
         }
       ],
       exec: false,
-      createdAt: now2 - 20 * day2,
+      createdAt: now2 - 20 * day3,
       expiresAt: now2 + 50 * minute2
     },
     {
@@ -6021,7 +6103,7 @@ function vaultSecrets(now2 = Date.now()) {
       domains: [],
       rules: [],
       exec: "any",
-      createdAt: now2 - 2 * hour
+      createdAt: now2 - 2 * hour2
     },
     {
       name: "BUOY_OLD_TOKEN",
@@ -6033,8 +6115,8 @@ function vaultSecrets(now2 = Date.now()) {
       domains: ["buoy.example"],
       rules: [{ domain: "buoy.example", header: "X-Buoy-Key", methods: ["GET"], paths: [] }],
       exec: "shell",
-      createdAt: now2 - 40 * day2,
-      removedAt: now2 - day2
+      createdAt: now2 - 40 * day3,
+      removedAt: now2 - day3
     }
   ];
 }
@@ -6051,7 +6133,7 @@ function accountRecords(now2 = Date.now()) {
       domains: ["docs.example"],
       rules: [{ domain: "docs.example", header: "Authorization", methods: [], paths: [] }],
       exec: false,
-      createdAt: now2 - 6 * day2,
+      createdAt: now2 - 6 * day3,
       usedAt: now2 - 20 * minute2
     }
   ];
@@ -6077,7 +6159,7 @@ function vaultAudit(now2 = Date.now()) {
       type: "materialize",
       seq: 11,
       id: "audit-11",
-      at: now2 - 2 * hour,
+      at: now2 - 2 * hour2,
       name: "PIER_PUBLISH_TOKEN",
       exec: "argv",
       path: "/usr/bin/pier",
@@ -6093,7 +6175,7 @@ function vaultAudit(now2 = Date.now()) {
       type: "materialize",
       seq: 10,
       id: "audit-10",
-      at: now2 - 3 * hour,
+      at: now2 - 3 * hour2,
       name: "PIER_PUBLISH_TOKEN",
       uid: 1001,
       tag: "docs-pass",
@@ -6112,7 +6194,7 @@ function vaultAudit(now2 = Date.now()) {
       type: "forward",
       seq: 9,
       id: "audit-9",
-      at: now2 - 6 * hour,
+      at: now2 - 6 * hour2,
       name: "HARBOR_API_KEY",
       domain: "api.harbor.example",
       method: "POST",
@@ -6124,7 +6206,7 @@ function vaultAudit(now2 = Date.now()) {
       type: "policy",
       seq: 8,
       id: "audit-8",
-      at: now2 - day2,
+      at: now2 - day3,
       file: "/etc/slicc/secrets-policy.toml",
       sha256: "4e07408562bedb8b60ce05c1decfe3ad",
       accepted: true,
@@ -6142,7 +6224,7 @@ function vaultAudit(now2 = Date.now()) {
       type: "remove",
       seq: 7,
       id: "audit-7",
-      at: now2 - day2 - hour,
+      at: now2 - day3 - hour2,
       name: "BUOY_OLD_TOKEN"
     },
     {
@@ -6150,7 +6232,7 @@ function vaultAudit(now2 = Date.now()) {
       type: "seal",
       seq: 6,
       id: "audit-6",
-      at: now2 - 3 * day2,
+      at: now2 - 3 * day3,
       name: "PIER_PUBLISH_TOKEN",
       source: "jerk:cone@link-pier",
       rotated: false
@@ -6163,7 +6245,7 @@ function vaultOlder(now2 = Date.now()) {
       type: "materialize",
       seq: 5,
       id: "audit-5",
-      at: now2 - 4 * day2,
+      at: now2 - 4 * day3,
       name: "PIER_PUBLISH_TOKEN",
       uid: 1e3,
       tag: null,
@@ -6181,7 +6263,7 @@ function vaultOlder(now2 = Date.now()) {
       type: "policy",
       seq: 4,
       id: "audit-4",
-      at: now2 - 5 * day2,
+      at: now2 - 5 * day3,
       file: "/etc/fnox/config.toml",
       sha256: "8f14e45fceea167a5a36dedd4bea2543",
       accepted: false,
@@ -6192,7 +6274,7 @@ function vaultOlder(now2 = Date.now()) {
       type: "restore",
       seq: 3,
       id: "audit-3",
-      at: now2 - 6 * day2,
+      at: now2 - 6 * day3,
       name: "TIDE_MAIL",
       uid: 0,
       tag: null
@@ -6201,7 +6283,7 @@ function vaultOlder(now2 = Date.now()) {
       type: "mcp",
       seq: 2,
       id: "audit-2",
-      at: now2 - 7 * day2,
+      at: now2 - 7 * day3,
       name: "DOCS_MCP_TOKEN",
       uid: 1e3,
       tag: "cone",
@@ -6643,6 +6725,9 @@ function vaultAccounts(accounts2) {
     (account) => account.auth === "api-key" || account.id === "github" ? { ...account, store: "vault" } : account
   );
 }
+function guestsPort(guests, time) {
+  return guests === "off" ? {} : { guests: new DummyGuests(guests, time) };
+}
 function createDummyModel({
   delay = 30,
   storage = null,
@@ -6660,6 +6745,7 @@ function createDummyModel({
   approvals = "off",
   follow = "off",
   vault = "off",
+  guests = "off",
   accounts: accounts2 = "settings",
   providers = "connected",
   hold = "off",
@@ -6736,7 +6822,8 @@ function createDummyModel({
     ...follow === "off" ? {} : { follow: new DummyFollow(follow, time) },
     ...vault === "off" ? {} : {
       vault: new DummyVault(vault, time, accounts2 === "vault" ? accountRecords() : [])
-    }
+    },
+    ...guestsPort(guests, time)
   };
   base.vault?.on("status", (status2) => {
     if (!status2.locked && agent.hold()?.reason === "locked") agent.setHold(null);
@@ -6751,6 +6838,7 @@ export {
   DummyBrowser,
   DummyChanges,
   DummyFollow,
+  DummyGuests,
   DummyNetwork,
   DummyNotices,
   DummyTabs,
@@ -6762,6 +6850,9 @@ export {
   browserHistory,
   createDummyModel,
   followFixtures,
+  guestsFixtures,
+  guestsRefused,
+  guestsUnavailable,
   joinUrl,
   leadersFixtures,
   linksFixtures,