@daugasauron/dolly-build 0.1.5-rc.0 → 0.1.6

package/{src → page}/snapshot-records.mjs

@@ -1,6 +1,11 @@
 import { unretainedPath } from "./image-names.mjs";
-const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
-export const MAX_SNAPSHOT_BYTES = 2 * 1024 * 1024 * 1024;
+import { DOLLY_SNAPSHOT_VERSION, DOLLY_SNAPSHOT_HEADER_BYTES as HEADER_BYTES, DOLLY_SNAPSHOT_RECORD_HEADER_BYTES as RECORD_HEADER_BYTES,
+  DOLLY_SNAPSHOT_RECORD_DIRECTORY as DIRECTORY, DOLLY_SNAPSHOT_RECORD_FILE as FILE, DOLLY_SNAPSHOT_RECORD_SYMLINK as SYMLINK,
+  DOLLY_SNAPSHOT_MAX_PATHS, DOLLY_SNAPSHOT_MAX_MEBIBYTES, DOLLY_SNAPSHOT_PATH_MIN_BYTES, DOLLY_SNAPSHOT_PATH_MAX_BYTES,
+  DOLLY_SNAPSHOT_SYMLINK_MIN_BYTES, DOLLY_SNAPSHOT_SYMLINK_MAX_BYTES } from "../host/runtime/abi.mjs";
+// A snapshot part's layout and limits are abi/dolly-image-0.wat's.
+const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }), encoder = new TextEncoder();
+export const MAX_SNAPSHOT_BYTES = DOLLY_SNAPSHOT_MAX_MEBIBYTES * 1024 * 1024;
 // Packs average 2 MiB or more (scripts/share-pages-snapshots.mjs): an image of
 // MAX_SNAPSHOT_BYTES needs about 1,024, which this bound leaves room for.
 const MAX_SNAPSHOT_PACKS = MAX_SNAPSHOT_BYTES / (1024 * 1024);
@@ -12,27 +17,46 @@ function compareBytes(left, right) {
   return left.length - right.length;
 }
 
-// The 16-byte snapshot header: its record count.
-function decodeHeader(bytes) {
+// A snapshot part's header: its record count.
+export function decodeSnapshotHeader(bytes) {
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  if (bytes.length < 16 || decoder.decode(bytes.subarray(0, 8)) !== "DOLLYSNP" || view.getUint32(8, true) !== 2) {
-    throw new Error("invalid Dolly snapshot header");
-  }
+  if (bytes.length < HEADER_BYTES || decoder.decode(bytes.subarray(0, 8)) !== "DOLLYSNP" ||
+      view.getUint32(8, true) !== DOLLY_SNAPSHOT_VERSION) throw new Error("invalid Dolly snapshot header");
   const count = view.getUint32(12, true);
-  if (count === 0 || count > 100_000) throw new Error("invalid Dolly snapshot record count");
+  if (count === 0 || count > DOLLY_SNAPSHOT_MAX_PATHS) throw new Error("invalid Dolly snapshot record count");
   return count;
 }
 
-// A record's 16-byte header: its kind, path length and data size.
-function decodeRecordHeader(bytes) {
+// A record's header: its kind, path length and data size.
+export function decodeRecordHeader(bytes) {
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
   const kind = view.getUint32(0, true), pathLength = view.getUint32(4, true), size = view.getBigUint64(8, true);
-  if (kind < 1 || kind > 3 || pathLength < 2 || pathLength >= 4096 ||
-      size > BigInt(MAX_SNAPSHOT_BYTES) || (kind === 1 && size !== 0n) ||
-      (kind === 3 && (size === 0n || size >= 4096n))) throw new Error("invalid snapshot record size");
+  if (kind < DIRECTORY || kind > SYMLINK || pathLength < DOLLY_SNAPSHOT_PATH_MIN_BYTES || pathLength > DOLLY_SNAPSHOT_PATH_MAX_BYTES ||
+      size > BigInt(MAX_SNAPSHOT_BYTES) || (kind === DIRECTORY && size !== 0n) ||
+      (kind === SYMLINK && (size < BigInt(DOLLY_SNAPSHOT_SYMLINK_MIN_BYTES) || size > BigInt(DOLLY_SNAPSHOT_SYMLINK_MAX_BYTES)))) {
+    throw new Error("invalid snapshot record size");
+  }
   return { kind, pathLength, size: Number(size) };
 }
 
+export function snapshotHeader(count) {
+  const bytes = new Uint8Array(HEADER_BYTES), view = new DataView(bytes.buffer);
+  bytes.set(encoder.encode("DOLLYSNP"));
+  view.setUint32(8, DOLLY_SNAPSHOT_VERSION, true);
+  view.setUint32(12, count, true);
+  return bytes;
+}
+
+// A record's header and its encoded path PATH.
+export function recordHeader(kind, path, size) {
+  const bytes = new Uint8Array(RECORD_HEADER_BYTES + path.length), view = new DataView(bytes.buffer);
+  view.setUint32(0, kind, true);
+  view.setUint32(4, path.length, true);
+  view.setBigUint64(8, BigInt(size), true);
+  bytes.set(path, RECORD_HEADER_BYTES);
+  return bytes;
+}
+
 // The path of PATHBYTES, valid and after PREVIOUS in byte order.
 function decodePath(pathBytes, previous) {
   const path = decoder.decode(pathBytes);
@@ -47,7 +71,7 @@ function checkParents(records) {
   for (const path of records.keys()) {
     for (let slash = path.indexOf("/", 1); slash !== -1; slash = path.indexOf("/", slash + 1)) {
       const parent = records.get(path.slice(0, slash));
-      if (parent && parent.kind !== 1) throw new Error(`snapshot parent is not a directory: ${path}`);
+      if (parent && parent.kind !== DIRECTORY) throw new Error(`snapshot parent is not a directory: ${path}`);
     }
   }
 }
@@ -55,20 +79,20 @@ function checkParents(records) {
 export function decodeSnapshotRecords(input) {
   const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
   if (bytes.length > MAX_SNAPSHOT_BYTES) throw new Error("invalid Dolly snapshot header");
-  const count = decodeHeader(bytes.subarray(0, 16));
+  const count = decodeSnapshotHeader(bytes.subarray(0, HEADER_BYTES));
   const records = new Map();
-  let offset = 16, previous;
+  let offset = HEADER_BYTES, previous;
   for (let index = 0; index < count; index += 1) {
-    if (offset > bytes.length - 16) throw new Error("truncated snapshot record");
-    const { kind, pathLength, size } = decodeRecordHeader(bytes.subarray(offset, offset + 16));
-    offset += 16;
+    if (offset > bytes.length - RECORD_HEADER_BYTES) throw new Error("truncated snapshot record");
+    const { kind, pathLength, size } = decodeRecordHeader(bytes.subarray(offset, offset + RECORD_HEADER_BYTES));
+    offset += RECORD_HEADER_BYTES;
     if (offset > bytes.length - pathLength - size) throw new Error("truncated snapshot record");
     const pathBytes = bytes.subarray(offset, offset + pathLength);
     const path = decodePath(pathBytes, previous);
     previous = pathBytes;
     offset += pathLength;
     const data = bytes.subarray(offset, offset + size);
-    if (kind === 3 && data.includes(0)) throw new Error("invalid snapshot symlink");
+    if (kind === SYMLINK && data.includes(0)) throw new Error("invalid snapshot symlink");
     records.set(path, { kind, data });
     offset += size;
   }
@@ -143,19 +167,19 @@ class PieceReader {
 // snapshot's size.
 export async function scanSnapshotRecords(pieces, keep) {
   const reader = new PieceReader(pieces);
-  const count = decodeHeader(await reader.take(16));
+  const count = decodeSnapshotHeader(await reader.take(HEADER_BYTES));
   const records = new Map();
   let previous;
   for (let index = 0; index < count; index += 1) {
-    const { kind, pathLength, size } = decodeRecordHeader(await reader.take(16));
+    const { kind, pathLength, size } = decodeRecordHeader(await reader.take(RECORD_HEADER_BYTES));
     const pathBytes = await reader.take(pathLength);
     const path = decodePath(pathBytes, previous);
     previous = pathBytes;
     const offset = reader.position;
     let data;
-    if (kind === 3 || (kind === 2 && keep(path))) {
+    if (kind === SYMLINK || (kind === FILE && keep(path))) {
       data = await reader.take(size);
-      if (kind === 3 && data.includes(0)) throw new Error("invalid snapshot symlink");
+      if (kind === SYMLINK && data.includes(0)) throw new Error("invalid snapshot symlink");
     } else await reader.skip(size);
     records.set(path, { kind, data, offset, size });
   }
@@ -165,35 +189,30 @@ export async function scanSnapshotRecords(pieces, keep) {
 }
 
 export function encodeSnapshotRecords(records) {
-  const encoder = new TextEncoder();
   const entries = [...records].map(([path, record]) => ({ path: encoder.encode(path), ...record }))
     .sort((left, right) => compareBytes(left.path, right.path));
-  const size = entries.reduce((sum, record) => sum + 16 + record.path.length + record.data.length, 16);
-  if (size > MAX_SNAPSHOT_BYTES || entries.length === 0 || entries.length > 100_000) throw new Error("snapshot exceeds record limits");
-  const bytes = new Uint8Array(size), view = new DataView(bytes.buffer);
-  bytes.set(encoder.encode("DOLLYSNP"));
-  view.setUint32(8, 2, true);
-  view.setUint32(12, entries.length, true);
-  let offset = 16;
+  const size = entries.reduce((sum, record) => sum + RECORD_HEADER_BYTES + record.path.length + record.data.length, HEADER_BYTES);
+  if (size > MAX_SNAPSHOT_BYTES || entries.length === 0 || entries.length > DOLLY_SNAPSHOT_MAX_PATHS) throw new Error("snapshot exceeds record limits");
+  const bytes = new Uint8Array(size);
+  bytes.set(snapshotHeader(entries.length));
+  let offset = HEADER_BYTES;
   for (const record of entries) {
-    view.setUint32(offset, record.kind, true);
-    view.setUint32(offset + 4, record.path.length, true);
-    view.setBigUint64(offset + 8, BigInt(record.data.length), true);
-    bytes.set(record.path, offset + 16);
-    bytes.set(record.data, offset + 16 + record.path.length);
-    offset += 16 + record.path.length + record.data.length;
+    const header = recordHeader(record.kind, record.path, record.data.length);
+    bytes.set(header, offset);
+    bytes.set(record.data, offset + header.length);
+    offset += header.length + record.data.length;
   }
   return bytes;
 }
 
 export function mergeSnapshotRecords(parts) {
   const records = new Map();
-  let size = 16;
+  let size = HEADER_BYTES;
   for (const part of parts) {
     for (const [path, record] of decodeSnapshotRecords(part)) {
       if (records.has(path)) throw new Error(`duplicate packed snapshot path: ${path}`);
-      size += 16 + new TextEncoder().encode(path).length + record.data.length;
-      if (size > MAX_SNAPSHOT_BYTES || records.size >= 100_000) throw new Error("packed snapshot exceeds limits");
+      size += RECORD_HEADER_BYTES + encoder.encode(path).length + record.data.length;
+      if (size > MAX_SNAPSHOT_BYTES || records.size >= DOLLY_SNAPSHOT_MAX_PATHS) throw new Error("packed snapshot exceeds limits");
       records.set(path, record);
     }
   }
@@ -205,15 +224,15 @@ export function mergeSnapshotRecords(parts) {
 export function validateSnapshotPacks(metadata) {
   if (!Array.isArray(metadata.packs) || metadata.packs.length === 0 || metadata.packs.length > MAX_SNAPSHOT_PACKS) throw new Error("invalid snapshot packs");
   const hashes = new Set();
-  let size = 16;
+  let size = HEADER_BYTES;
   for (const pack of metadata.packs) {
     if (!/^[0-9a-f]{64}$/.test(pack.sha256) || hashes.has(pack.sha256) ||
-        !Number.isSafeInteger(pack.byteLength) || pack.byteLength < 16 || pack.byteLength > MAX_SNAPSHOT_BYTES ||
+        !Number.isSafeInteger(pack.byteLength) || pack.byteLength < HEADER_BYTES || pack.byteLength > MAX_SNAPSHOT_BYTES ||
         !Number.isSafeInteger(pack.encodedByteLength) || pack.encodedByteLength <= 0 || pack.encodedByteLength > MAX_SNAPSHOT_BYTES) {
       throw new Error("invalid snapshot pack descriptor");
     }
     hashes.add(pack.sha256);
-    size += pack.byteLength - 16;
+    size += pack.byteLength - HEADER_BYTES;
     if (size > MAX_SNAPSHOT_BYTES) throw new Error("packed snapshot exceeds size limit");
   }
   if (size !== metadata.byteLength) throw new Error("snapshot pack sizes do not match image");

package/{src → page}/static-asset.mjs

@@ -61,31 +61,47 @@ export async function boundedAssetBody(response, limit, signal) {
 // Pages before v0.1.5 read the X-Dolly-Parts header instead.
 export const PARTS_MANIFEST_START = '{"byteLength":';
 
-// Whether a whole response's body begins as a manifest, read from a copy of it.
-async function isPartsManifest(response) {
-  if (response.status !== 200 || !response.body) return false;
-  const start = new TextEncoder().encode(PARTS_MANIFEST_START), reader = response.clone().body.getReader();
-  const head = new Uint8Array(start.length);
-  let size = 0;
-  try {
-    while (size < start.length) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      const taken = value.subarray(0, start.length - size);
-      head.set(taken, size);
-      size += taken.length;
-    }
-  } finally {
-    // Not awaited: cancelling a copy settles only once the response is read too.
-    reader.cancel().catch(() => {});
+// The first `length` bytes of a response's body, and a response whose body is
+// all of it again, those bytes first. It reads the body itself: reading a
+// copy of it and cancelling the copy cost the original its first bytes, in
+// Firefox up to 151 and in Node, when other bodies were read meanwhile.
+async function peeked(response, length) {
+  const reader = response.body.getReader(), chunks = [];
+  let size = 0, ended = false;
+  while (size < length) {
+    const next = await reader.read();
+    if (next.done) { ended = true; break; }
+    chunks.push(next.value);
+    size += next.value.length;
   }
-  return size === start.length && head.every((byte, index) => byte === start[index]);
+  const head = new Uint8Array(Math.min(size, length));
+  for (let offset = 0, index = 0; offset < head.length; ++index) {
+    const taken = chunks[index].subarray(0, head.length - offset);
+    head.set(taken, offset);
+    offset += taken.length;
+  }
+  const body = new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(chunk);
+      if (ended) controller.close();
+    },
+    async pull(controller) {
+      const next = await reader.read();
+      if (next.done) controller.close(); else controller.enqueue(next.value);
+    },
+    cancel: reason => reader.cancel(reason),
+  }, { highWaterMark: 0 });
+  const whole = new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  Object.defineProperty(whole, "url", { value: response.url });
+  return { head, whole };
 }
 
 // Streams verified parts, holding at most one 20 MiB part per request. Each
 // part matches the manifest hash before any of its bytes are delivered.
-export async function decodeStaticAsset(response, target, init, maximumBytes, fetchRequest = globalThis.fetch.bind(globalThis)) {
-  if (!await isPartsManifest(response)) return response;
+export async function decodeStaticAsset(given, target, init, maximumBytes, fetchRequest = globalThis.fetch.bind(globalThis)) {
+  if (given.status !== 200 || !given.body) return given;
+  const start = new TextEncoder().encode(PARTS_MANIFEST_START), { head, whole: response } = await peeked(given, start.length);
+  if (head.length !== start.length || head.some((byte, index) => byte !== start[index])) return response;
   const url = new URL(target);
   if ((init.method ?? "GET") !== "GET" || url.search || url.hash ||
       url.username || url.password || !/^https?:$/.test(url.protocol)) throw new Error("invalid multipart asset request");

package/{src → page}/version.mjs

@@ -1,3 +1,3 @@
 // The version being developed: the release tag vX.Y.Z, the site path /vX.Y.Z/
 // and the prefix of every recipe reference. package.json holds the same value.
-export const DOLLY_VERSION = "0.1.5";
+export const DOLLY_VERSION = "0.1.6";

package/scripts/dolly-build-init/Dollyfile

@@ -1,18 +1,12 @@
 # Pi reads its instructions, skills, extensions and themes from /home/dolly/.pi/agent/
 # (Pi's docs/configuration.md, in the image under /usr/lib/node_modules/@earendil-works/pi-coding-agent/docs/).
 # A FILE row writes its body, each line indented four spaces, into the image.
+# The skills are the directories of public/skills/, which the page writes at boot.
 
 FILE /home/dolly/.pi/agent/AGENTS.md
     You are the coding agent of this project. Keep answers short, and run the
     project's tests after a change.
 
-FILE /home/dolly/.pi/agent/skills/changelog/SKILL.md
-    ---
-    name: changelog
-    description: Keeps /workspace/CHANGELOG.md. Use when asked to record a change.
-    ---
-    Add the change under "## Unreleased", one line each, newest first.
-
 FILE /home/dolly/.pi/agent/extensions/hello.js
     export default function (pi) {
       pi.registerCommand("hello", {
@@ -52,3 +46,5 @@ FILE /etc/dolly/init.slop
     # pi-key ANTHROPIC_API_KEY --offline --provider anthropic --model claude-sonnet-5-5
     printf '\nPi exited; this is a Slop shell.\n'
     /bin/foreground -i /bin/slop
+
+ENTRY /bin/foreground -i /bin/slop /etc/dolly/init.slop

package/scripts/dolly-build-init/public/icon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><rect width="16" height="16" rx="3" fill="#f2d45c"/></svg>

package/scripts/dolly-build-init/public/index.html

@@ -1,61 +1,9 @@
 <!doctype html>
 <meta charset="utf-8">
 <title>__NAME__</title>
-<link rel="icon" href="data:,">
-<style>
-  /* The font of the popups of Pi's ask_user and show_html, and the scheme of their
-     form controls. Their colours and the terminal's are theme.json's. */
-  #dolly { --dolly-html-font: ui-monospace, monospace; --dolly-html-color-scheme: dark; }
-</style>
-<main id="dolly" style="position:fixed;inset:0"></main>
-<script type="module">
-  // Dolly needs cross-origin isolation. Where the host sends no COOP and COEP
-  // headers, coi-serviceworker.js adds them: the page registers it and loads again
-  // under it, once; boot() says so if that did not isolate it.
-  if (!crossOriginIsolated && navigator.serviceWorker && !sessionStorage.getItem("dolly-isolation-retry")) {
-    sessionStorage.setItem("dolly-isolation-retry", "1");
-    await navigator.serviceWorker.register("./coi-serviceworker.js");
-    await navigator.serviceWorker.ready;
-    location.reload();
-    await new Promise(() => {});
-  }
-  sessionStorage.removeItem("dolly-isolation-retry");
-  const { boot } = await import("./dolly/src/browser.mjs");
-  const { images, image, modules } = await import("./image/index.mjs");
-
-  // The hosts the agent may reach, and nothing else: the model's provider here,
-  // one rule per host the agent needs (api.github.com, pypi.org). A rule names an
-  // origin, its paths and methods, and the header that carries the key (docs/http.md
-  // in @daugasauron/dolly). Hosts without CORS headers go through a relay of your
-  // own (docs/agent-frontend.md).
-  const policy = { rules: [
-    { origin: "https://openrouter.ai", pathPrefix: "/api/v1/", methods: ["GET", "POST"], credentialHeaders: ["authorization"] },
-    // { origin: "https://api.anthropic.com", pathPrefix: "/v1/", methods: ["POST"], credentialHeaders: ["x-api-key"] },
-  ] };
-
-  // The project: workspace/ is written into /workspace at each boot. dolly-build
-  // lists its files in workspace.json beside this page. Pi's tools can read these
-  // files; they are not for secrets.
-  const listing = await fetch("./workspace.json");
-  if (!listing.ok) throw new Error("workspace.json must list the files under workspace/, as dolly-build writes it");
-  const files = {};
-  await Promise.all((await listing.json()).map(async path => {
-    const url = `./workspace/${path.split("/").map(encodeURIComponent).join("/")}`;
-    files[`/workspace/${path}`] = new Uint8Array(await (await fetch(url)).arrayBuffer());
-  }));
-  // The sandbox's colours, all in theme.json: Pi's theme (Pi's docs/themes.md), written
-  // over the image's, whose background, text, accent and muted the terminal and the
-  // popups take too (docs/embedding.md in @daugasauron/dolly).
-  const theme = await (await fetch("./theme.json")).text();
-  files["/home/dolly/.pi/agent/themes/dolly.json"] = theme;
-  const { vars } = JSON.parse(theme), look = document.querySelector("#dolly").style;
-  look.setProperty("--dolly-background", vars.background);
-  look.setProperty("--dolly-color", vars.text);
-  look.setProperty("--dolly-accent", vars.accent);
-  look.setProperty("--dolly-display-palette-8", vars.muted);
-
-  // Save (Ctrl+Shift+S) keeps the sandbox's state in this browser and names it in the
-  // address, ?session=NAME: the page then opens that save, as it was, in place of a fresh start.
-  const session = new URLSearchParams(location.search).get("session") ?? undefined;
-  await boot(document.querySelector("#dolly"), { images, image, modules, http: { policy }, files, session });
-</script>
+<link rel="icon" href="./icon.svg">
+<link rel="stylesheet" href="./page.css">
+<main id="dolly"></main>
+<!-- No inline script or style: the site may serve the Content-Security-Policy docs/embedding.md
+     gives (in @daugasauron/dolly). -->
+<script type="module" src="./main.mjs"></script>

package/scripts/dolly-build-init/public/main.mjs

@@ -0,0 +1,52 @@
+// Dolly needs cross-origin isolation. Where the host sends no COOP and COEP
+// headers, coi-serviceworker.js adds them: the page registers it and loads again
+// under it, once; boot() says so if that did not isolate it.
+if (!crossOriginIsolated && navigator.serviceWorker && !sessionStorage.getItem("dolly-isolation-retry")) {
+  sessionStorage.setItem("dolly-isolation-retry", "1");
+  await navigator.serviceWorker.register("./coi-serviceworker.js");
+  await navigator.serviceWorker.ready;
+  location.reload();
+  await new Promise(() => {});
+}
+sessionStorage.removeItem("dolly-isolation-retry");
+const { boot } = await import("./dolly/page/browser.mjs");
+const { images, image, modules } = await import("./image/index.mjs");
+
+// The hosts the agent may reach, and nothing else: the model's provider here,
+// one rule per host the agent needs (api.github.com, pypi.org). A rule names an
+// origin, its paths and methods, and the header that carries the key (docs/http.md
+// in @daugasauron/dolly). Hosts without CORS headers go through a relay of your
+// own (docs/agent-frontend.md).
+const policy = { rules: [
+  { origin: "https://openrouter.ai", pathPrefix: "/api/v1/", methods: ["GET", "POST"], credentialHeaders: ["authorization"] },
+  // { origin: "https://api.anthropic.com", pathPrefix: "/v1/", methods: ["POST"], credentialHeaders: ["x-api-key"] },
+] };
+
+// The project and Pi's skills: workspace/ is written into /workspace and each
+// skills/NAME/ (a SKILL.md and the files it names, Pi's docs/skills.md) into Pi's
+// skills at each boot. dolly-build lists their files in workspace.json and skills.json
+// beside this page. Pi's tools can read these files; they are not for secrets.
+const files = {};
+for (const [tree, directory] of [["workspace", "/workspace"], ["skills", "/home/dolly/.pi/agent/skills"]]) {
+  const listing = await fetch(`./${tree}.json`);
+  if (!listing.ok) throw new Error(`${tree}.json must list the files under ${tree}/, as dolly-build writes it`);
+  await Promise.all((await listing.json()).map(async path => {
+    const url = `./${tree}/${path.split("/").map(encodeURIComponent).join("/")}`;
+    files[`${directory}/${path}`] = new Uint8Array(await (await fetch(url)).arrayBuffer());
+  }));
+}
+// The sandbox's colours, all in theme.json: Pi's theme (Pi's docs/themes.md), written
+// over the image's, whose background, text, accent and muted the terminal and the
+// popups take too (docs/embedding.md in @daugasauron/dolly).
+const theme = await (await fetch("./theme.json")).text();
+files["/home/dolly/.pi/agent/themes/dolly.json"] = theme;
+const { vars } = JSON.parse(theme), look = document.querySelector("#dolly").style;
+look.setProperty("--dolly-background", vars.background);
+look.setProperty("--dolly-color", vars.text);
+look.setProperty("--dolly-accent", vars.accent);
+look.setProperty("--dolly-display-palette-8", vars.muted);
+
+// Save (Ctrl+Shift+S) keeps the sandbox's state in this browser and names it in the
+// address, ?session=NAME: the page then opens that save, as it was, in place of a fresh start.
+const session = new URLSearchParams(location.search).get("session") ?? undefined;
+await boot(document.querySelector("#dolly"), { images, image, modules, http: { policy }, files, session });

package/scripts/dolly-build-init/public/page.css

@@ -0,0 +1,3 @@
+/* The page: Dolly fills it. The font of the popups of Pi's ask_user and show_html, and the
+   scheme of their form controls; their colours and the terminal's are theme.json's. */
+#dolly { position: fixed; inset: 0; --dolly-html-font: ui-monospace, monospace; --dolly-html-color-scheme: dark; }

package/scripts/dolly-build-init/public/skills/changelog/SKILL.md

@@ -0,0 +1,5 @@
+---
+name: changelog
+description: Keeps /workspace/CHANGELOG.md. Use when asked to record a change.
+---
+Add the change under "## Unreleased", one line each, newest first.

package/scripts/dolly-build-init/workflow.yml

@@ -0,0 +1,42 @@
+# Builds the site of Dollyfile-__NAME__ in Playwright's headless Chromium, the version
+# package-lock.json pins. npm ci and that browser are its downloads: the runtime, the
+# packages and the build are in node_modules. The site is the artifact github-pages.
+name: __NAME__
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npx playwright-core install --with-deps chromium-headless-shell
+      - run: npx dolly-build Dollyfile-__NAME__ __NAME__ --browser chromium
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: __NAME__
+
+  # Publishes the site on GitHub Pages from main, once the repository's Pages
+  # source is "GitHub Actions" (Settings, Pages): remove the "#" of these lines.
+  # deploy:
+  #   if: github.ref == 'refs/heads/main'
+  #   needs: build
+  #   runs-on: ubuntu-latest
+  #   permissions:
+  #     pages: write
+  #     id-token: write
+  #   environment:
+  #     name: github-pages
+  #     url: ${{ steps.deployment.outputs.page_url }}
+  #   steps:
+  #     - id: deployment
+  #       uses: actions/deploy-pages@v4