@jbarket/loomai 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -12,6 +12,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-24
+
+### Changed
+
+- **loom's page, v2.** Home is now the tape: the last day's episodes grouped
+  by hour and filterable by where they happened, with tiles across the top
+  and top of mind and the people who need a look beside it. **Mind** lists
+  every memory by heat, marks exactly what the boot digest carries, and says
+  why each one has its heat. Pending proposals moved there, with ratify and
+  reject. One memory and People (each card, with what's newer than it) are
+  their own pages.
+- **The page contract, v2 (docs/extensions.md, "The page").** A piece answers
+  `ui --json` with a manifest (a tab, a Home tile, "Your call" asks),
+  `ui page --json` with pages, and `ui act --json` to run actions. New blocks:
+  `kv`, `callout`, `filters`, `details`, `form`, `buttons`. Links can stay in
+  the piece, go to loom's pages, or carry a query. A first-version
+  `{sections}` answer still renders, as the piece's page.
+  - **Actions:** a form posts to `/ui/act/<source>` with an anti-forgery token
+    bound to the session cookie. Cross-site posts are refused. Fields go to
+    the piece on stdin only, and the result shows once without touching the
+    URL. A `secret` field never carries a value.
+  - **Sessions:** the cookie is now a random session id held in memory, and
+    signing out revokes it. Another site (or another port on the host) can
+    link to the page but not embed or fetch it. At most 6 pieces run at
+    once, and nothing a piece starts outlives its answer.
+  - **`/ui/sections.json` is gone;** `/ui/pieces.json` lists the installed
+    pieces' manifests, for scripts.
+- **Top of mind reads heat live.** The boot digest and the page compute each
+  memory's heat from its timestamps when read, instead of trusting the stored
+  field the consolidation lane refreshes. Between passes the stored field went
+  stale, and Top of Mind fell back to write order.
+- **Recall adds heat by rank instead of resetting every result to full heat.**
+  One vague query used to put ten unrelated memories at the top of mind. Now
+  the top result gets 0.5, the next 0.3 and 0.2, and the rest 0.1, decaying
+  on the memory's half-life and capped at 1. A write, an update or a repeat
+  remember still makes a memory fully hot. `last_accessed` still records
+  every look, for pruning. New columns `recall_heat` and `recall_heat_at`
+  (migration `add_recall_heat`) start at 0.
+
+## [0.8.0] - 2026-10-24
+
+### Added
+
+- **loom's page: `/ui` on the HTTP daemon.** A read-only web page with loom's
+  own sections: top of mind, the last 24h of episodes, proposals waiting, and
+  people. It also gets a group for each installed piece that answers
+  `loom-<piece> ui --json` in a small section vocabulary (stats, list, table,
+  text, link). Pieces send data, never markup: everything is escaped, the page
+  has no script, and a CSP forbids script and framing. Invalid answers are
+  dropped whole, and a slow or missing piece is left out.
+  - **Login:** the bearer token, once. The page requires `LOOM_BEARER_TOKEN` (no
+    token gives 403, like `/cli`). The cookie is keyed per daemon process, isn't
+    the token, and lasts 30 days or until a restart. Pieces never see loom's
+    tokens; on a timeout their whole process group is killed; concurrent loads
+    share one run per piece.
+  - **`/ui/sections.json`:** the same data, for scripts.
+  - **Scope:** full scope only.
+
 ## [0.7.0] - 2026-10-24
 
 ### Added
@@ -588,7 +646,9 @@ Initial public release.
   stack and all added external-service dependencies or operational
   overhead.
 
-[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/sleepunit-agents/loom/compare/v0.8.0...v0.9.0
+[0.8.0]: https://github.com/sleepunit-agents/loom/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/sleepunit-agents/loom/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/sleepunit-agents/loom/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/sleepunit-agents/loom/compare/v0.4.1...v0.5.0

package/README.md

@@ -383,6 +383,36 @@ header, or a body that isn't `application/json`). The knowledge-only daemon
 has no `/cli`. Every other command (`doctor`, `inject`, `serve`, …) stays
 local, and `--url` on one of them is an error.
 
+### loom's page — `/ui`
+
+The full-scope daemon serves a web page at `/ui`. **Home** is the tape:
+what every body did in the last day, by hour and by where it happened, with
+top of mind and the people cards that need a look beside it. **Mind** lists
+every memory by heat and says why each one has it, which is how you find a
+memory that shouldn't be in what the agent wakes up holding. One memory and
+**People** (each card, with what's newer than it) are a click away.
+
+Everything else comes from installed **pieces**. A piece that answers
+`ui --json` gets a tab, a tile on Home and items under "Your call", and its
+own pages and forms: the task queue, the secrets store (write-only: add and
+replace, never read back), the chat bridges. Nothing to configure: install a
+piece and it shows up, uninstall it and it's gone. loom never names a piece
+([`docs/extensions.md`](docs/extensions.md), "The page").
+
+**The page needs `LOOM_BEARER_TOKEN`.** A daemon with no token serves none
+(403), the same rule as `/cli`, because any site that DNS-rebinds a name to
+the loopback address could read an open page. Log in once with the token. The
+browser gets a session: a random id the daemon keeps in memory. It's not the
+token, it can't be replayed against `/mcp` or `/cli`, and it can't be used to
+guess the token. It lasts 30 days, until you sign out (which revokes it), or
+until the daemon restarts. Every form carries an anti-forgery token bound to
+that session, a cross-site post is refused, and another site can link to the
+page but not embed or fetch it. A form's fields go to the piece on stdin, and loom never logs, keeps
+or puts them in a URL. Scripts can send the bearer header instead (for
+example `/ui/pieces.json` for the pieces' manifests). The page runs no script
+and is served under a CSP that forbids script and framing. Pieces never
+receive loom's bearer tokens.
+
 ### Behind a reverse proxy
 
 Terminate TLS at a reverse proxy in front of the daemon and point the
@@ -476,8 +506,12 @@ wakes knowing what's top-of-mind without having to fish via `recall`.
 Each memory carries a stored salience "temperature" that **decays by a
 per-category half-life** (pursuit coolest-fastest at 7 days, through
 project, self/feedback, reference, up to user at 90 days) and **reheats
-on access** — a `recall` hit, a write, or an update bumps it back toward
-hot. The digest fills a token budget **hottest-first** and groups the
+with use**. A write, an update or a repeat `remember` makes it fully hot.
+A `recall` adds heat by rank: the top result gets 0.5, the next 0.3 and
+0.2, and everything below 0.1, capped at 1. So a memory is hot when it
+keeps being the answer, not because it once turned up near the bottom of
+someone's results. Heat is computed from those timestamps when the digest is read, so
+it can't go stale if the consolidation lane skips a night. The digest fills a token budget **hottest-first** and groups the
 selected memories into tiers (Hot / Warm / Cool, labeled *Top of mind* /
 *Recent* / *Background*).
 

package/dist/backends/migrations.js

@@ -319,6 +319,24 @@ export const MIGRATIONS = [
             }).immediate();
         },
     },
+    {
+        id: 'add_recall_heat',
+        description: 'Add recall_heat + recall_heat_at: heat that recall adds by rank and that decays, ' +
+            'so one incidental hit no longer makes a memory hot (t-1489)',
+        pending: (db) => !hasColumn(db, 'memories', 'recall_heat') || !hasColumn(db, 'memories', 'recall_heat_at'),
+        run: (db) => {
+            db.transaction(() => {
+                // Starts at 0 for every row: no recall history counts until recall
+                // adds to it. Heat falls back to when each memory was written or edited.
+                if (!hasColumn(db, 'memories', 'recall_heat')) {
+                    db.prepare('ALTER TABLE memories ADD COLUMN recall_heat REAL NOT NULL DEFAULT 0').run();
+                }
+                if (!hasColumn(db, 'memories', 'recall_heat_at')) {
+                    db.prepare('ALTER TABLE memories ADD COLUMN recall_heat_at TEXT').run();
+                }
+            }).immediate();
+        },
+    },
 ];
 /**
  * Apply pending migrations to a database.

package/dist/backends/salience.d.ts

@@ -45,9 +45,39 @@ export declare function applyObservation(current: number, kind: 'confirm' | 'con
  * goes through update() and stamps `observed_at`) is.
  */
 export declare function decayedConfidence(rawConfidence: number, lastTouchIso: string, category: string, nowMs: number): number;
+/**
+ * How much one recall adds to a memory's recall heat, by its rank in the
+ * results: the top hit counts most, an incidental hit near the bottom barely
+ * at all. Recall used to reset every result to full heat, so one vague query
+ * put ten unrelated memories at the top of mind (t-1489).
+ */
+export declare const RECALL_WEIGHTS: readonly number[];
+export declare const RECALL_TAIL_WEIGHT = 0.1;
+export declare function recallWeight(rank: number): number;
+/** A stored recall heat, decayed by the category's half-life since it was last added to. */
+export declare function decayedRecallHeat(value: number | null | undefined, atIso: string | null | undefined, category: string, nowMs: number): number;
+/** The recall heat after one more hit at `rank`: decay what's there, add the weight, cap at 1. */
+export declare function bumpedRecallHeat(value: number | null | undefined, atIso: string | null | undefined, category: string, rank: number, nowMs: number): number;
+export interface HeatInput {
+    category: string;
+    created: string;
+    updated: string | null;
+    recall_heat?: number | null;
+    recall_heat_at?: string | null;
+}
+/**
+ * A memory's heat right now. Writing or editing it (including a repeat
+ * remember) makes it fully hot, decaying from then; recall adds to it by rank
+ * (recallWeight), so a memory stays hot by being used again and again, not by
+ * turning up once at the bottom of someone's results.
+ */
+export declare function heatOf(r: HeatInput, nowMs: number): number;
+/** Columns heatOf reads; older stores without the recall columns read them as null. */
+export declare function heatColumns(db: Database): string;
 /**
  * Recompute and STORE the salience scalar for every non-archived memory. Called
- * by the consolidation lane (stored + lane-refresh, not computed-on-read).
+ * by the consolidation lane. The digest no longer depends on it (it reads heat
+ * live, see liveRows); the stored field is for anything that sorts in SQL.
  * Returns the number of memories recomputed.
  */
 export declare function recomputeSalience(db: Database, nowMs: number): number;
@@ -64,13 +94,17 @@ export interface DigestOptions {
     tokenBudget?: number;
     /** Rough chars-per-token for the budget estimate. */
     charsPerToken?: number;
+    /** The moment heat is read at (tests pin it). */
+    nowMs?: number;
 }
 /**
- * Assemble the boot digest from already-recomputed salience: order hottest-first,
+ * Assemble the boot digest from rows with heat already set: order hottest-first,
  * fill the token budget, group the included atoms under their tier headers. Pure
  * selection + ordering of authored content — no generated prose, no persisted
  * glue. Returns null when there is nothing to show.
  */
+/** The rows the digest includes: hottest first, until the token budget is spent. */
+export declare function pickForDigest<T extends DigestRow>(rows: T[], opts?: DigestOptions): T[];
 export declare function assembleDigest(rows: DigestRow[], opts?: DigestOptions): string | null;
 /** Lane entry point: recompute + store salience for a context. Returns count (or null if no store). */
 export declare function recomputeSalienceForContext(contextDir: string, nowMs: number): number | null;
@@ -88,9 +122,9 @@ export interface DigestAtom {
  * tier-labeled, ordered hot→cold, plus the total memory count. Same
  * assemble-not-generate view as the text digest — just shaped for rendering.
  */
-export declare function digestData(contextDir: string, limit?: number): {
+export declare function digestData(contextDir: string, limit?: number, nowMs?: number): {
     atoms: DigestAtom[];
     total: number;
 } | null;
-/** Assemble the boot digest for a context from stored salience. Returns null if no store / nothing hot. */
+/** Assemble the boot digest for a context, with heat read live. Returns null if no store / nothing hot. */
 export declare function digestForContext(contextDir: string, opts?: DigestOptions): string | null;

package/dist/backends/salience.js

@@ -1,10 +1,10 @@
 /**
  * Salience temperature + the assembled boot digest (c-loom-memory: it-loom-salience).
  *
- * A memory's temperature is a stored scalar that DECAYS by a per-category
- * half-life and REHEATS on access (recall stamps last_accessed; write/update
- * stamps updated) — so a frequently-touched fact stays warm and an untouched one
- * cools. The consolidation lane recomputes the stored field; the digest assembler
+ * A memory's temperature DECAYS by a per-category half-life and REHEATS when
+ * it's written or edited (full heat) or recalled (heat added by rank, see
+ * recallWeight) — so a frequently-used fact stays warm and an untouched one
+ * cools. It's computed when read (heatOf); the stored scalar is a cache. The consolidation lane recomputes the stored field; the digest assembler
  * fills a token budget HOTTEST-FIRST from existing authored atoms, labeled into
  * tiers. It ASSEMBLES a view over authored memories — it never generates new
  * prose (the integrity line: loom holds the pen, unlike Anthropic's native digest
@@ -91,23 +91,56 @@ export function decayedConfidence(rawConfidence, lastTouchIso, category, nowMs)
     const temp = temperature(lastTouchIso, category, nowMs);
     return FEEDBACK_CONFIDENCE_DEFAULT + (rawConfidence - FEEDBACK_CONFIDENCE_DEFAULT) * temp;
 }
-/** Most-recent-touch timestamp for a row (recall/write reheat through these). */
-function lastTouch(r) {
-    return r.last_accessed ?? r.updated ?? r.created;
+/**
+ * How much one recall adds to a memory's recall heat, by its rank in the
+ * results: the top hit counts most, an incidental hit near the bottom barely
+ * at all. Recall used to reset every result to full heat, so one vague query
+ * put ten unrelated memories at the top of mind (t-1489).
+ */
+export const RECALL_WEIGHTS = [0.5, 0.3, 0.2];
+export const RECALL_TAIL_WEIGHT = 0.1;
+export function recallWeight(rank) {
+    return RECALL_WEIGHTS[rank] ?? RECALL_TAIL_WEIGHT;
+}
+/** A stored recall heat, decayed by the category's half-life since it was last added to. */
+export function decayedRecallHeat(value, atIso, category, nowMs) {
+    if (!value || !atIso)
+        return 0;
+    return Math.min(1, value * temperature(atIso, category, nowMs));
+}
+/** The recall heat after one more hit at `rank`: decay what's there, add the weight, cap at 1. */
+export function bumpedRecallHeat(value, atIso, category, rank, nowMs) {
+    return Math.min(1, decayedRecallHeat(value, atIso, category, nowMs) + recallWeight(rank));
+}
+/**
+ * A memory's heat right now. Writing or editing it (including a repeat
+ * remember) makes it fully hot, decaying from then; recall adds to it by rank
+ * (recallWeight), so a memory stays hot by being used again and again, not by
+ * turning up once at the bottom of someone's results.
+ */
+export function heatOf(r, nowMs) {
+    const written = temperature(r.updated ?? r.created, r.category, nowMs);
+    return Math.max(written, decayedRecallHeat(r.recall_heat, r.recall_heat_at, r.category, nowMs));
+}
+/** Columns heatOf reads; older stores without the recall columns read them as null. */
+export function heatColumns(db) {
+    const have = hasColumn(db, 'memories', 'recall_heat');
+    return have ? 'created, updated, recall_heat, recall_heat_at' : 'created, updated, NULL AS recall_heat, NULL AS recall_heat_at';
 }
 /**
  * Recompute and STORE the salience scalar for every non-archived memory. Called
- * by the consolidation lane (stored + lane-refresh, not computed-on-read).
+ * by the consolidation lane. The digest no longer depends on it (it reads heat
+ * live, see liveRows); the stored field is for anything that sorts in SQL.
  * Returns the number of memories recomputed.
  */
 export function recomputeSalience(db, nowMs) {
     const rows = db
-        .prepare('SELECT id, category, created, updated, last_accessed FROM memories WHERE archived = 0')
+        .prepare(`SELECT id, category, ${heatColumns(db)} FROM memories WHERE archived = 0`)
         .all();
     const upd = db.prepare('UPDATE memories SET salience = ? WHERE id = ?');
     const tx = db.transaction(() => {
         for (const r of rows)
-            upd.run(temperature(lastTouch(r), r.category, nowMs), r.id);
+            upd.run(heatOf(r, nowMs), r.id);
     });
     // The nightly full-table recompute is the heaviest write in loom; wrap it so
     // a concurrent remember() call during the recompute retries instead of throwing.
@@ -126,23 +159,28 @@ function atomLine(r) {
     return `- **${r.title}** (${r.category}${tag}) — ${clipped}`;
 }
 /**
- * Assemble the boot digest from already-recomputed salience: order hottest-first,
+ * Assemble the boot digest from rows with heat already set: order hottest-first,
  * fill the token budget, group the included atoms under their tier headers. Pure
  * selection + ordering of authored content — no generated prose, no persisted
  * glue. Returns null when there is nothing to show.
  */
-export function assembleDigest(rows, opts = {}) {
+/** The rows the digest includes: hottest first, until the token budget is spent. */
+export function pickForDigest(rows, opts = {}) {
     const budgetChars = (opts.tokenBudget ?? DEFAULT_TOKEN_BUDGET) * (opts.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN);
     const ordered = [...rows].sort((a, b) => b.salience - a.salience);
     const picked = [];
     let used = 0;
     for (const r of ordered) {
-        const line = atomLine(r);
-        if (used + line.length > budgetChars && picked.length > 0)
+        const len = atomLine(r).length;
+        if (used + len > budgetChars && picked.length > 0)
             break; // hottest-first to the cap
-        picked.push({ tier: tierOf(r.salience), line });
-        used += line.length + 1;
+        picked.push(r);
+        used += len + 1;
     }
+    return picked;
+}
+export function assembleDigest(rows, opts = {}) {
+    const picked = pickForDigest(rows, opts).map((r) => ({ tier: tierOf(r.salience), line: atomLine(r) }));
     if (picked.length === 0)
         return null;
     const tierOrder = ['Hot', 'Warm', 'Cool'];
@@ -185,12 +223,32 @@ export function recomputeSalienceForContext(contextDir, nowMs) {
         db.close();
     }
 }
+/**
+ * Every live authored memory (not episodes) with its heat computed NOW from
+ * its timestamps, hottest first. The digest reads heat this way instead of
+ * trusting the stored field: the stored field only moves when the
+ * consolidation lane runs, and when the lane missed days (t-1488, and once
+ * before for two months) Top of Mind froze, with ties at 1.0 falling back to
+ * write order. The stored field stays, refreshed by the lane, for anything
+ * that sorts in SQL.
+ */
+function liveRows(db, nowMs) {
+    const rows = db
+        .prepare(`SELECT title, category, content, salience AS stored, sourcing, ${heatColumns(db)} FROM memories WHERE archived = 0 AND category != ?`)
+        .all(EPISODE_CATEGORY);
+    return rows
+        .map(({ created, updated, recall_heat, recall_heat_at, ...r }) => ({
+        ...r,
+        salience: heatOf({ category: r.category, created, updated, recall_heat, recall_heat_at }, nowMs),
+    }))
+        .sort((a, b) => b.salience - a.salience);
+}
 /**
  * Structured salience digest for a UI widget: the hottest authored atoms,
  * tier-labeled, ordered hot→cold, plus the total memory count. Same
  * assemble-not-generate view as the text digest — just shaped for rendering.
  */
-export function digestData(contextDir, limit = 40) {
+export function digestData(contextDir, limit = 40, nowMs = Date.now()) {
     const db = openMemoriesDb(contextDir, true);
     if (!db)
         return null;
@@ -198,17 +256,16 @@ export function digestData(contextDir, limit = 40) {
         if (!hasColumn(db, 'memories', 'salience'))
             return { atoms: [], total: 0 };
         const total = db.prepare('SELECT COUNT(*) AS n FROM memories WHERE archived = 0').get().n;
-        const rows = db
-            .prepare('SELECT title, category, content, salience, sourcing FROM memories WHERE archived = 0 AND category != ? ORDER BY salience DESC LIMIT ?')
-            .all(EPISODE_CATEGORY, limit);
-        const atoms = rows.map((r) => ({ ...r, tier: tierOf(r.salience) }));
+        const atoms = liveRows(db, nowMs)
+            .slice(0, limit)
+            .map(({ stored: _stored, ...r }) => ({ ...r, tier: tierOf(r.salience) }));
         return { atoms, total };
     }
     finally {
         db.close();
     }
 }
-/** Assemble the boot digest for a context from stored salience. Returns null if no store / nothing hot. */
+/** Assemble the boot digest for a context, with heat read live. Returns null if no store / nothing hot. */
 export function digestForContext(contextDir, opts = {}) {
     const db = openMemoriesDb(contextDir, true);
     if (!db)
@@ -218,14 +275,9 @@ export function digestForContext(contextDir, opts = {}) {
         // path can't migrate; the lane / normal backend connect will add the column).
         if (!hasColumn(db, 'memories', 'salience'))
             return null;
-        const rows = db
-            .prepare(
-        // Episodes are the tape, not the digest: a fresh episode is always
-        // salience 1.0 and would crowd Top of Mind with what just happened.
-        // sourcing: LEFT JOIN-style null-safe select — old stores without the
-        // column return NULL which DigestRow.sourcing accepts.
-        'SELECT title, category, content, salience, sourcing FROM memories WHERE archived = 0 AND category != ? ORDER BY salience DESC LIMIT 100')
-            .all(EPISODE_CATEGORY);
+        // Episodes are the tape, not the digest: a fresh episode is always hot
+        // and would crowd Top of Mind with what just happened.
+        const rows = liveRows(db, opts.nowMs ?? Date.now()).slice(0, 100);
         return assembleDigest(rows, opts);
     }
     finally {

package/dist/backends/sqlite-vec.js

@@ -21,7 +21,7 @@ import { retryWrite } from './retry.js';
 import { computeUniqKey } from './dedup.js';
 import { effectiveScope, isVisibleInProject } from './scope.js';
 import { FEEDBACK_CATEGORY } from '../categories.js';
-import { FEEDBACK_CONFIDENCE_DEFAULT, applyObservation, decayedConfidence, } from './salience.js';
+import { FEEDBACK_CONFIDENCE_DEFAULT, applyObservation, bumpedRecallHeat, decayedConfidence, } from './salience.js';
 function slugify(text) {
     return text
         .toLowerCase()
@@ -165,11 +165,20 @@ export class SqliteVecBackend {
         const results = hits.map((h, i) => rowToMatch(h.mem, h.distance, blended?.[i]));
         const hitIds = hits.map((h) => h.mem.id);
         if (hitIds.length > 0) {
-            const now = new Date().toISOString();
-            const stamp = this.db.prepare('UPDATE memories SET last_accessed = ? WHERE id = ?');
+            // last_accessed still records that someone looked (prune's staleness
+            // reads it). Heat is separate: each hit adds to recall_heat by its rank,
+            // so the top result warms a lot and an incidental one barely (t-1489).
+            const nowMs = Date.now();
+            const now = new Date(nowMs).toISOString();
+            const read = this.db.prepare('SELECT category, recall_heat, recall_heat_at FROM memories WHERE id = ?');
+            const stamp = this.db.prepare('UPDATE memories SET last_accessed = ?, recall_heat = ?, recall_heat_at = ? WHERE id = ?');
             const tx = this.db.transaction((ids) => {
-                for (const id of ids)
-                    stamp.run(now, id);
+                ids.forEach((id, rank) => {
+                    const r = read.get(id);
+                    if (!r)
+                        return;
+                    stamp.run(now, bumpedRecallHeat(r.recall_heat, r.recall_heat_at, r.category, rank, nowMs), now, id);
+                });
             });
             retryWrite(() => tx(hitIds));
         }

package/dist/transport/http-server.js

@@ -32,6 +32,7 @@ import { EmptyResultSchema } from '@modelcontextprotocol/core';
 import { createLoomServer } from '../server.js';
 import { createBackend } from '../backends/index.js';
 import { handleCliBody } from './cli-endpoint.js';
+import { handleUi, isUiPath } from '../ui/handler.js';
 import { assertSafeBind, checkBearer, checkBearerMulti, checkPayloadSize, DEFAULT_MAX_BODY_BYTES, } from './guards.js';
 /**
  * SSE keep-alive: the SDK opens the standalone GET stream but sends no
@@ -196,6 +197,19 @@ export async function startHttpServer(opts) {
     }
     const http = createServer((req, res) => {
         void (async () => {
+            // /ui: loom's web page (src/ui). Its own auth (a cookie from the bearer,
+            // or the bearer header), so it comes before the bearer gate. Full scope
+            // only: a scoped server has no memory to show.
+            const uiPath = new URL(req.url ?? '/', 'http://localhost').pathname;
+            if (isUiPath(uiPath)) {
+                if (opts.createServer)
+                    return sendError(res, 404, 'not-found: this server has no UI');
+                return handleUi(req, res, uiPath, {
+                    contextDir: opts.contextDir,
+                    secrets: opts.token ? [opts.token] : Object.values(opts.tokens ?? {}),
+                    env: process.env,
+                });
+            }
             // Auth gate (ac-lt-auth-gate): reject unauthenticated when a token (or
             // token map) is configured. Multi-token mode additionally resolves
             // WHICH identity made this call — the bearer itself is the identity

package/dist/ui/core.d.ts

@@ -0,0 +1,21 @@
+import { type ActResult, type Page, type Tile } from './vocab.js';
+/** loom's zone (LOOM_TIMEZONE, then TZ), and one that Intl accepts: a bad value never breaks the page. */
+export declare function uiTimeZone(): string;
+/** The agent's name: IDENTITY.md's first heading, else the context dir's name. */
+export declare function agentName(contextDir: string): string;
+export interface CoreOptions {
+    timeZone?: string;
+    nowMs?: number;
+}
+/** "Sat Oct 24, 12:09 pm" */
+export declare function when(iso: string | null, tz: string): string;
+export interface Home {
+    tile: Tile;
+    page: Page;
+}
+/** Home: the tape is the page. Top of mind and people sit beside it. */
+export declare function homePage(contextDir: string, query: Record<string, string>, opts?: CoreOptions): Home;
+/** One of loom's pages by path (not Home), or null when there's no such page. */
+export declare function corePage(contextDir: string, path: string, query: Record<string, string>, opts?: CoreOptions): Page | null;
+/** Run one of loom's own actions from the page. */
+export declare function coreAct(contextDir: string, action: string, fields: Record<string, string>): Promise<ActResult>;