@gavin-hu/my-pi-agent 0.18.0 → 0.20.0

package/extensions/plan/web-plan.ts

@@ -0,0 +1,150 @@
+/**
+ * The review page's plan renderer: the DOM a frame draws, thrown away and rebuilt.
+ *
+ * The seventh capability out of the review client's template literal, and the one with the
+ * most to read: it builds every block, its comment rail, and the cards under it, then puts
+ * the reader back where they were. Reads arrive through getters and mutations leave through
+ * callbacks, so the client keeps every variable it owns — `activeIndex`, the quote a click
+ * is waiting for, the observer — and this function holds only the shape of one frame.
+ *
+ * Two rules it owns, both about a repaint not stealing the reader's place:
+ *
+ * - focus is restored only when it was inside the plan to begin with, so a frame the stream
+ *   caused cannot pull the keyboard out of the page the reviewer is working in;
+ * - the active block's class is put back in place rather than by scrolling, so the arrow
+ *   keys resume where they were instead of jumping to the top.
+ */
+
+import type { ClientNode } from "../../lib/web/client-runtime.ts";
+import type { ComposerDeps } from "./web-composer.ts";
+import { blockElements, type IslandBlock, setActive } from "./web-blocks.ts";
+import type { SectionWatcher } from "./web-outline.ts";
+
+/** What `el` has to answer for a frame. Spliced beside it; declared for the checker. */
+type Build = (tag: string, className?: string, text?: string | null) => ClientNode;
+declare const el: Build;
+
+/** The quote a click on a block's control is waiting for: the reader's selection. */
+export interface PendingQuote {
+	wrap: ClientNode;
+	quote: string;
+}
+
+/** What a repaint reads, and the callbacks it changes the client's state through. */
+export interface PlanRenderDeps {
+	planEl: ClientNode | null;
+	outlineList: ClientNode | null;
+	/** The element that had focus before this frame, or null when nothing did. */
+	focused: ClientNode | null;
+	blocks(): readonly IslandBlock[];
+	annotations(): readonly { anchor: number }[];
+	activeIndex(): number;
+	setActiveIndex(index: number): void;
+	pendingQuote(): PendingQuote | null;
+	clearPendingQuote(): void;
+	/** The composer lifecycle, for the close a repaint begins with. */
+	composer(): ComposerDeps;
+	/** The block's content, from the Markdown half. */
+	renderBlock(wrap: ClientNode, block: IslandBlock): void;
+	/** The cards under one block, and the loose ones that lost their anchor. */
+	renderComments(scope: ClientNode, line: number): void;
+	renderCommentCards(scope: ClientNode, list: readonly unknown[]): void;
+	/** The text a reader selected inside a block, used as the next comment's quote. */
+	selectionIn(wrap: ClientNode): string;
+	open(wrap: ClientNode, block: IslandBlock, quote: string): void;
+	/** The facts and the header chip, repainted after the blocks. */
+	facts(): void;
+	updateState(): void;
+}
+
+/**
+ * Draw the plan, and put the reader back. Returns the section watcher it installed.
+ *
+ * The client's own zero-argument entry is `renderAll()`: it builds the frame's deps and
+ * hands them here, which is how the fragments keep calling a name that takes nothing.
+ */
+export function renderPlanFrame(
+	deps: PlanRenderDeps,
+	closePlan: () => void,
+	observe: (
+		planEl: ClientNode | null,
+		list: ClientNode | null,
+		previous: SectionWatcher | null,
+	) => SectionWatcher | null,
+	previousObserver: SectionWatcher | null,
+): SectionWatcher | null {
+	const { planEl } = deps;
+	if (!planEl) return previousObserver;
+	// Focus is only put back when it was inside this document to begin with.
+	const keepFocus = !!(deps.focused && deps.focused !== planEl && planEl.contains(deps.focused));
+	closePlan();
+	const scrollTop = planEl.scrollTop;
+	planEl.replaceChildren();
+	const anchored: Record<number, boolean> = {};
+	for (const block of deps.blocks()) {
+		if (block.kind === "blank") continue;
+		anchored[block.start] = true;
+		const wrap = el("div", "bf-block");
+		wrap.setAttribute("data-line", String(block.start));
+		wrap.setAttribute("data-kind", String(block.kind));
+		if (block.kind === "heading") wrap.id = "s-" + block.start;
+		deps.renderBlock(wrap, block);
+		const mine = deps.annotations().filter((annotation) => annotation.anchor === block.start);
+		if (mine.length > 0) wrap.classList.add("bf-block--commented");
+		const rail = el("div", "bf-block__rail");
+		const add = el("button", "bf-block__add");
+		add.type = "button";
+		add.textContent = "+";
+		add.setAttribute("aria-label", "Comment on this block");
+		add.addEventListener("click", function () {
+			// Read at click time, not at render time: a selection made after this frame is
+			// the quote the reader means.
+			const waiting = deps.pendingQuote();
+			const quoted = waiting && waiting.wrap === wrap ? waiting.quote : deps.selectionIn(wrap);
+			deps.clearPendingQuote();
+			deps.open(wrap, block, quoted);
+		});
+		rail.appendChild(add);
+		if (mine.length > 0) {
+			const badge = el("span", "bf-block__count");
+			badge.textContent = String(mine.length);
+			badge.title = mine.length === 1 ? "1 review comment" : mine.length + " review comments";
+			rail.appendChild(badge);
+		}
+		wrap.appendChild(rail);
+		wrap.addEventListener("focusin", function () {
+			const next = setActive(planEl, blockElements(planEl).indexOf(wrap));
+			if (next !== null) deps.setActiveIndex(next);
+		});
+		planEl.appendChild(wrap);
+		deps.renderComments(planEl, block.start);
+	}
+	const orphans = deps.annotations().filter((annotation) => !anchored[annotation.anchor]);
+	if (orphans.length > 0) {
+		const box = el("div", "bf-comments bf-comments--orphans");
+		const note = el("p");
+		note.textContent = "Comments not attached to a current block";
+		box.appendChild(note);
+		deps.renderCommentCards(box, orphans);
+		planEl.appendChild(box);
+	}
+	planEl.scrollTop = scrollTop;
+	// The DOM was rebuilt, so the active block's class is gone; restore it in place rather
+	// than scrolling, so the keyboard resumes where the reviewer was.
+	const activeIndex = deps.activeIndex();
+	const active = activeIndex >= 0 ? blockElements(planEl)[activeIndex] : null;
+	if (active) active.classList.add("bf-block--active");
+	// The focused element went with the old DOM, so put the tab stop back on the block's
+	// comment control: that is where adding, editing, or deleting left it.
+	if (keepFocus && active) {
+		const stop = active.querySelector(".bf-block__add");
+		if (stop) stop.focus();
+	}
+	deps.facts();
+	const observer = observe(planEl, deps.outlineList, previousObserver);
+	deps.updateState();
+	return observer;
+}
+
+/** The block renderer as source, for the client bundle. */
+export const WEB_PLAN_JS = String(renderPlanFrame);

package/extensions/plan/web-router.ts

@@ -13,14 +13,13 @@
  */
 
 import {
+	envelopeRefusal,
 	eventHeaders,
-	hostHeaderName,
-	isAllowedHostHeader,
 	jsonError,
-	jsonHeaders,
 	jsonResponse,
 	pageHeaders,
 	parseRequestUrl,
+	postOnly,
 	scriptHeaders,
 	type ServeResponse,
 } from "../../lib/http/index.ts";
@@ -84,12 +83,6 @@ function isResponse(value: PlanAnnotation[] | ServeResponse): value is ServeResp
 	return !Array.isArray(value);
 }
 
-/** The 405 for a route that only accepts POST, or nothing when the method is right. */
-function postOnly(method: string, what: string): ServeResponse | undefined {
-	if (method.toUpperCase() === "POST") return undefined;
-	return jsonError(405, `Use POST to ${what}.`);
-}
-
 /**
  * The 403 for a route the caller's role may not use, or nothing when it may. Each
  * route keeps its own sentence, because the reason differs: a reviewer posts
@@ -111,53 +104,6 @@ function linkIdOf(body: string): string | undefined {
 	return typeof id === "string" && id !== "" ? id : undefined;
 }
 
-/** Validate method and `Host`; returns an error response to send instead. */
-function checkEnvelope(
-	ctx: ReviewContext,
-	method: string,
-	headers: Record<string, string | string[] | undefined>,
-): ServeResponse | undefined {
-	const upper = method.toUpperCase();
-	if (upper !== "GET" && upper !== "HEAD" && upper !== "POST") {
-		return {
-			...jsonError(405, "Only GET, HEAD, and POST are served."),
-			headers: { ...jsonHeaders(), Allow: "GET, HEAD, POST" },
-		};
-	}
-	// Fail closed: a missing or non-string Host is rejected too, not just a
-	// foreign one, so the DNS-rebinding guard cannot be skipped.
-	if (!isAllowedHostHeader(headers, { hosts: ctx.hosts(), required: true })) {
-		return jsonError(403, "Unexpected Host header.");
-	}
-	return upper === "POST" ? checkOrigin(headers) : undefined;
-}
-
-/**
- * Refuse a state-changing request another site made. A browser sends `Origin`
- * on every POST and `Sec-Fetch-Site` with its own classification; a request
- * with neither is a script or a test, which has no ambient credential to abuse.
- */
-function checkOrigin(headers: Record<string, string | string[] | undefined>): ServeResponse | undefined {
-	const site = headers["sec-fetch-site"];
-	if (typeof site === "string" && site !== "" && site !== "same-origin" && site !== "none") {
-		return jsonError(403, "Cross-origin request refused.");
-	}
-	const origin = headers.origin;
-	if (origin === undefined) return undefined;
-	if (typeof origin !== "string" || origin === "") return jsonError(403, "Unexpected Origin header.");
-	let parsed: URL;
-	try {
-		parsed = new URL(origin);
-	} catch {
-		return jsonError(403, "Unexpected Origin header.");
-	}
-	const host = headers.host;
-	if (typeof host !== "string" || hostHeaderName(parsed.host) !== hostHeaderName(host)) {
-		return jsonError(403, "Cross-origin request refused.");
-	}
-	return undefined;
-}
-
 /**
  * Handle one request. `method`, `rawUrl`, and `headers` are the raw HTTP
  * values; `body` is the request body for a POST.
@@ -169,14 +115,13 @@ export async function handleReviewRequest(
 	headers: Record<string, string | string[] | undefined> = {},
 	body = "",
 ): Promise<ServeResponse> {
-	const envelope = checkEnvelope(ctx, method, headers);
+	const envelope = envelopeRefusal({ method, headers, hosts: ctx.hosts() });
 	if (envelope) return envelope;
 
 	const parsed = parseRequestUrl(rawUrl);
 	if (!parsed) return jsonError(400, "Malformed request URL.");
 	const { pathname, search } = parsed;
 
-	if (pathname === "/favicon.ico") return { status: 204, headers: { "Cache-Control": "no-store" } };
 	if (pathname === THEME_JS_PATH) return { status: 200, headers: scriptHeaders(), body: THEME_JS };
 	if (pathname === "/client.js") return { status: 200, headers: scriptHeaders(), body: REVIEW_CLIENT_JS };
 

package/extensions/plan/web-settle.ts

@@ -0,0 +1,194 @@
+/**
+ * The review page's settlement: the four ways a review ends, and the one POST they share.
+ *
+ * The eighth capability out of the review client's template literal. Every write has the
+ * same shape — POST the annotations, read the answer, report it in the status line — and
+ * what differs is whether the review settles: the owner's save and approve finish it, a
+ * reviewer's post does not (the server keeps the review open so she can keep editing), and
+ * cancel is the owner's own decision and carries no body at all.
+ *
+ * The page owns its flags, its buttons, and its stream; this module owns the rules about
+ * them, so it reads through getters and reports changes through the callbacks it is given.
+ */
+
+/** What a settlement reads of the page, and the changes it reports. */
+export interface SettleDeps {
+	/** The path a write goes to, without its query string. */
+	token(): string;
+	role(): string;
+	/** The comments this writer may write: her own when she is a reviewer, all when owner. */
+	mine(): readonly unknown[];
+	annotations(): readonly unknown[];
+	/** Whether the review has already ended, by any of the three routes. */
+	settled(): boolean;
+	setStatus(text: string, kind?: string): void;
+	/** The three buttons a conflict disables, and the fourth a close does. */
+	buttons(): {
+		approve: { disabled: boolean } | null;
+		save: { disabled: boolean } | null;
+		post: { disabled: boolean } | null;
+	};
+	/** The draft this tab's work lives in: cleared once the server has it. */
+	clearDraft(): void;
+	/** The page is no longer dirty: the server has everything this tab wrote. */
+	markClean(): void;
+	/** The server bound this reviewer's name to her link: adopt it. */
+	adoptName(name: string): void;
+	/** Put a reload button beside the controls: the page cannot recover on its own. */
+	offerReload(): void;
+	/** Record how the review ended, stop following it, and stop offering to change it. */
+	markSettled(kind: "saved" | "approved" | "closed"): void;
+	settleStream(): void;
+	lockActions(): void;
+	/** Repaint the header chip and the facts. */
+	updateState(): void;
+	/** Refuse to leave a half-written comment, saying why. */
+	confirmNoDraft(): boolean;
+	post(url: string, body: unknown): Promise<{ ok: boolean; status: number; body: unknown }>;
+	/** A body-less POST, for the close that carries nothing. */
+	send(url: string): Promise<unknown>;
+	/** What a body-less conflict says, when the server gave no sentence of its own. */
+	planMoved: string;
+}
+
+/** What a settlement reports back: the flag it set, and whether the page is finished. */
+export interface SettleResult {
+	outcome: "ok" | "conflict" | "failed";
+	reason?: string;
+}
+
+/**
+ * POST the annotations, and read the answer on both branches.
+ *
+ * A 409 disables the three write buttons and offers a reload, because the page's island is
+ * out of date and no retry from here can fix that; anything else surfaces the server's own
+ * sentence, which is why the body is parsed on both branches rather than only on success.
+ */
+export function submitAnnotations(
+	deps: SettleDeps,
+	url: string,
+	okText: string,
+	failText: string,
+	onOk: (() => void) | null,
+): Promise<SettleResult> {
+	const payload = deps.role() === "reviewer" ? deps.mine() : deps.annotations();
+	return deps
+		.post(url + "?token=" + encodeURIComponent(deps.token()), { annotations: payload })
+		.then((result) => {
+			if (result.ok) {
+				deps.markClean();
+				deps.clearDraft();
+				deps.setStatus(okText, "saved");
+				if (onOk) onOk();
+				deps.updateState();
+				// The server binds a reviewer's name to her link on the first post, so a
+				// second tab of the same link posts under the same name.
+				const body = result.body as { author?: unknown } | null;
+				if (deps.role() === "reviewer" && body && typeof body.author === "string" && body.author) {
+					deps.adoptName(body.author);
+				}
+				return { outcome: "ok" as const };
+			}
+			if (result.status === 409) {
+				const buttons = deps.buttons();
+				if (buttons.approve) buttons.approve.disabled = true;
+				if (buttons.save) buttons.save.disabled = true;
+				if (buttons.post) buttons.post.disabled = true;
+				deps.offerReload();
+				const body = result.body as { error?: unknown } | null;
+				const reason = body && typeof body.error === "string" ? body.error : deps.planMoved;
+				deps.setStatus(reason, "error");
+				return { outcome: "conflict" as const, reason };
+			}
+			const body = result.body as { error?: unknown } | null;
+			throw new Error(body && typeof body.error === "string" ? body.error : "server returned " + result.status);
+		})
+		.catch((error: { message?: string }) => {
+			const reason = failText + (error && error.message ? error.message : "");
+			deps.setStatus(reason, "error");
+			return { outcome: "failed" as const, reason };
+		});
+}
+
+/** Save the annotations and finish the review: the owner's way to close an approved plan. */
+export function saveReview(deps: SettleDeps): Promise<SettleResult> | null {
+	if (deps.settled()) return null;
+	if (deps.confirmNoDraft()) return null;
+	deps.setStatus("Saving\u2026");
+	return submitAnnotations(
+		deps,
+		"/api/feedback",
+		"Saved \u2014 return to Pi to continue.",
+		"Could not save: ",
+		function () {
+			deps.markSettled("saved");
+			deps.settleStream();
+			deps.lockActions();
+		},
+	);
+}
+
+/**
+ * Post a reviewer's comments and keep the review open.
+ *
+ * A reviewer's write never settles the page: the server keeps the review open so she can
+ * keep editing her own comments, and closing the stream here would strand her.
+ */
+export function postReviewComments(deps: SettleDeps): Promise<SettleResult> | null {
+	if (deps.settled()) return null;
+	if (deps.confirmNoDraft()) return null;
+	deps.setStatus("Posting\u2026");
+	return submitAnnotations(
+		deps,
+		"/api/comment",
+		"Comments posted \u2014 the owner sees them now.",
+		"Could not post: ",
+		null,
+	);
+}
+
+/** Approve the plan, which finishes the review. */
+export function approveReview(deps: SettleDeps): Promise<SettleResult> | null {
+	if (deps.settled()) return null;
+	deps.setStatus("Approving\u2026");
+	return submitAnnotations(
+		deps,
+		"/api/approve",
+		"Approved \u2014 return to Pi to continue.",
+		"Could not approve: ",
+		function () {
+			deps.markSettled("approved");
+			deps.settleStream();
+			deps.lockActions();
+		},
+	);
+}
+
+/**
+ * Close the review without saving: only the owner may, and the page says so while it asks.
+ *
+ * The close carries no body, so it is the one write that does not go through
+ * `submitAnnotations`; its answer is a status line either way, because a tab that closed the
+ * review has nothing left to do with a failure.
+ */
+export function cancelReview(deps: SettleDeps): Promise<void> | null {
+	if (deps.role() !== "owner" || deps.settled()) return null;
+	if (deps.confirmNoDraft()) return null;
+	deps.markSettled("closed");
+	deps.settleStream();
+	deps.lockActions();
+	deps.setStatus("Closing\u2026");
+	deps.updateState();
+	return deps
+		.send("/api/cancel?token=" + encodeURIComponent(deps.token()))
+		.catch(function () {})
+		.then(function () {
+			deps.setStatus("Closed \u2014 return to Pi.");
+			deps.updateState();
+		});
+}
+
+/** The settlement rules as source, for the client bundle. */
+export const WEB_SETTLE_JS = [submitAnnotations, saveReview, postReviewComments, approveReview, cancelReview]
+	.map(String)
+	.join("\n\n");

package/extensions/plan/web-share-session.ts

@@ -3,13 +3,12 @@
  * network, and the state the owner's page and `/plan share` read.
  *
  * Separate from `web.ts` because the review session's job is its own lifecycle —
- * open, settle, close — while this module owns the socket that exists only while
- * the owner has sharing on. It is handed the one request handler, the token
+ * open, settle, close — while this module owns the address, the links, and the
+ * listener's lifetime. It is handed the one request handler, the token
  * hooks, and the frame hooks, so it never reaches into the session's maps.
  */
 
-import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
-import { bindHost, createCloser, LOOPBACK_HOSTS } from "../../lib/http/index.ts";
+import { LOOPBACK_HOSTS, type LoopbackHandler, type LoopbackServer, serveLoopback } from "../../lib/http/index.ts";
 import { qrSvg } from "../../lib/qr.ts";
 import type { ReviewFrame, ReviewRole } from "./types.ts";
 import {
@@ -27,7 +26,9 @@ import {
 /** What the share listener needs from the review session it belongs to. */
 export interface ShareSessionDeps {
 	/** The one request handler: a loopback page and a shared page are the same page. */
-	handleRequest: (request: IncomingMessage, response: ServerResponse) => void;
+	handleRequest: LoopbackHandler;
+	/** The body cap both listeners read under, so a shared page is not read differently. */
+	maxBodyBytes: number;
 	/** The owner's bound port, reused for the link when it is free. */
 	ownerPort: () => number;
 	/** The machine's interfaces, or a snapshot a test injected. */
@@ -65,8 +66,7 @@ export interface ShareSession {
 export function createShareSession(deps: ShareSessionDeps): ShareSession {
 	let address = "";
 	let port = 0;
-	let server: Server | undefined;
-	let closeServer: (() => Promise<void>) | undefined;
+	let server: LoopbackServer | undefined;
 	const links: LinkTable = createLinkTable({
 		mint: deps.mintReviewer,
 		revoke: deps.revokeReviewer,
@@ -87,24 +87,20 @@ export function createShareSession(deps: ShareSessionDeps): ShareSession {
 
 	/** Bind the shared listener on `chosen`, reusing the owner's port when it is free. */
 	const bind = async (chosen: string): Promise<void> => {
-		const candidate = createServer(deps.handleRequest);
-		let bound: number | undefined;
-		for (const attempt of [deps.ownerPort(), 0]) {
-			try {
-				bound = await bindHost(candidate, chosen, attempt);
-				break;
-			} catch {
-				bound = undefined;
-			}
+		try {
+			const bound = await serveLoopback({
+				host: chosen,
+				ports: [deps.ownerPort(), 0],
+				maxBodyBytes: deps.maxBodyBytes,
+				handler: deps.handleRequest,
+			});
+			server = bound;
+			address = chosen;
+			port = bound.port;
+		} catch {
+			// Neither the owner's port nor a free one answered: the caller reports it.
+			server = undefined;
 		}
-		if (bound === undefined) {
-			candidate.close();
-			return;
-		}
-		server = candidate;
-		closeServer = createCloser(candidate);
-		address = chosen;
-		port = bound;
 	};
 
 	/**
@@ -176,21 +172,19 @@ export function createShareSession(deps: ShareSessionDeps): ShareSession {
 		// The reviewers are told before their listener goes away; the review itself
 		// stays open for its owner.
 		deps.endStreams("revoked", { role: "reviewer" });
-		const closer = closeServer;
+		const closer = server;
 		server = undefined;
-		closeServer = undefined;
 		address = "";
 		port = 0;
 		reason = undefined;
-		if (closer) await closer();
+		if (closer) await closer.close();
 		return settle();
 	};
 
 	const close = async (): Promise<void> => {
-		const closer = closeServer;
+		const closer = server;
 		server = undefined;
-		closeServer = undefined;
-		if (closer) await closer();
+		if (closer) await closer.close();
 	};
 
 	return { share, invite, revoke, stop, state: snapshot, hosts, close };

package/extensions/plan/web-streams.ts

@@ -3,9 +3,11 @@
  * when a closed tab ends the review.
  *
  * A frame carries only a kind, so the registry is the only thing that knows who
- * is connected. It is keyed by response — a page may hold more than one stream —
- * and records the caller it belongs to, so an owner-only frame, or one revoked
- * link, can be addressed without the caller reaching into the map.
+ * is connected. It is keyed by sink — a page may hold more than one stream — and
+ * records the caller it belongs to, so an owner-only frame, or one revoked link,
+ * can be addressed without the caller reaching into the map. Liveness is the
+ * sink's own (a write after the end is a no-op), so the registry never asks the
+ * socket whether it is still writable.
  *
  * The closed-tab rule lives here because it is a fact about streams: a reviewer's
  * tab opening or closing changes nothing, while the owner's own page going away
@@ -13,7 +15,7 @@
  * against that reload, so it takes the timer as a seam a test can drive by hand.
  */
 
-import type { ServerResponse } from "node:http";
+import type { EventSink } from "../../lib/http/index.ts";
 import type { ArmTimer } from "../../lib/timer.ts";
 import type { ReviewFrame, ReviewRole } from "./types.ts";
 
@@ -44,9 +46,9 @@ export interface StreamRegistryDeps {
 /** The stream set one running review holds. */
 export interface StreamRegistry {
 	/** Register a stream, and stand down a pending closed-tab grace. */
-	add(response: ServerResponse, record: StreamRecord): void;
+	add(sink: EventSink, record: StreamRecord): void;
 	/** Forget a stream, arming the grace when it was the owner's last one. */
-	remove(response: ServerResponse): void;
+	remove(sink: EventSink): void;
 	/** Tell the open pages something changed. */
 	broadcast(kind: ReviewFrame, only?: StreamFilter): void;
 	/** Send one last frame and end the stream with it. */
@@ -60,7 +62,7 @@ export interface StreamRegistry {
 }
 
 export function createStreams(deps: StreamRegistryDeps): StreamRegistry {
-	const clients = new Map<ServerResponse, StreamRecord>();
+	const clients = new Map<EventSink, StreamRecord>();
 	let sawOwner = false;
 	let cancelDrop: (() => void) | undefined;
 
@@ -91,29 +93,27 @@ export function createStreams(deps: StreamRegistryDeps): StreamRegistry {
 	};
 
 	return {
-		add(response, record) {
-			clients.set(response, record);
+		add(sink, record) {
+			clients.set(sink, record);
 			if (record.role === "owner") {
 				sawOwner = true;
 				cancel();
 			}
 		},
-		remove(response) {
-			const record = clients.get(response);
-			clients.delete(response);
+		remove(sink) {
+			const record = clients.get(sink);
+			clients.delete(sink);
 			if (record?.role === "owner") scheduleDrop();
 		},
 		broadcast(kind, only) {
 			for (const [client, record] of clients) {
 				if (!matches(record, only)) continue;
-				if (client.writableEnded || client.destroyed) continue;
 				client.write(`data: ${kind}\n\n`);
 			}
 		},
 		end(kind, only) {
 			for (const [client, record] of clients) {
 				if (!matches(record, only)) continue;
-				if (client.writableEnded || client.destroyed) continue;
 				client.end(`data: ${kind}\n\n`);
 			}
 		},

package/extensions/plan/web-tokens.ts

@@ -15,7 +15,7 @@
  *   carries only the name, so a shared name is a shared marker.
  */
 
-import { randomBytes } from "node:crypto";
+import { mintToken } from "../../lib/http/index.ts";
 import type { ReviewCaller, ReviewRole } from "./types.ts";
 
 /** The token → caller table one running review holds. */
@@ -38,7 +38,7 @@ export interface TokenTable {
 const COLLISION_ATTEMPTS = 8;
 
 /** A 128-bit token; the one credential a reviewer holds. */
-const defaultToken = (): string => randomBytes(16).toString("hex");
+const defaultToken = (): string => mintToken();
 
 /** Build the table for one review. `mint` is the generator a test replaces. */
 export function createTokens(mint: () => string = defaultToken): TokenTable {