@jbarket/loomai 0.8.0 → 0.9.1

package/dist/ui/data.js

@@ -0,0 +1,129 @@
+/**
+ * Read-only queries behind loom's own pages: memories with their heat
+ * explained, one memory by ref, the memories about a person. Plain SQL over
+ * memories.db opened read-only, like the digest; nothing here writes.
+ */
+import { existsSync } from 'node:fs';
+import BetterSqlite3 from 'better-sqlite3';
+import { resolveSqliteDbPath } from '../config.js';
+import { DEFAULT_HALF_LIFE_DAYS, HALF_LIVES, decayedRecallHeat, heatOf, pickForDigest, temperature, tierOf } from '../backends/salience.js';
+const EPISODE = 'episode';
+const COLUMNS = 'ref, title, category, project, content, sourcing, scope, created, updated, last_accessed, expires_at, times_seen, metadata, salience, recall_heat, recall_heat_at';
+function open(contextDir) {
+    const path = resolveSqliteDbPath(contextDir);
+    if (!existsSync(path))
+        return null;
+    const db = new BetterSqlite3(path, { readonly: true });
+    db.pragma('busy_timeout = 5000');
+    return db;
+}
+function hasColumns(db) {
+    return new Set(db.pragma('table_info(memories)').map((c) => c.name));
+}
+/** Older stores lack some columns; select what exists and default the rest. */
+function selectList(db) {
+    const have = hasColumns(db);
+    return COLUMNS.split(', ').map((c) => (have.has(c) ? c : `NULL AS ${c}`)).join(', ');
+}
+function personOf(metadata) {
+    try {
+        const m = JSON.parse(metadata || '{}');
+        return typeof m.person === 'string' && m.person ? m.person : null;
+    }
+    catch {
+        return null;
+    }
+}
+function view(r, nowMs, inDigest = false) {
+    const heat = heatOf(r, nowMs);
+    const writtenHeat = temperature(r.updated ?? r.created, r.category, nowMs);
+    const recallHeat = decayedRecallHeat(r.recall_heat, r.recall_heat_at, r.category, nowMs);
+    return {
+        ref: r.ref, title: r.title, category: r.category, project: r.project, content: r.content,
+        sourcing: r.sourcing, scope: r.scope, created: r.created, updated: r.updated,
+        lastAccessed: r.last_accessed, expiresAt: r.expires_at, timesSeen: r.times_seen ?? 1,
+        person: personOf(r.metadata), stored: r.salience ?? heat, heat, writtenHeat, recallHeat, tier: tierOf(heat),
+        halfLifeDays: HALF_LIVES[r.category] ?? DEFAULT_HALF_LIFE_DAYS, inDigest,
+    };
+}
+/** Live memories (not episodes) hottest first, each marked with whether the digest carries it. */
+export function heatList(contextDir, opts = {}) {
+    const db = open(contextDir);
+    if (!db)
+        return { rows: [], total: 0, inDigest: 0 };
+    try {
+        const nowMs = opts.nowMs ?? Date.now();
+        const all = db.prepare(`SELECT ${selectList(db)} FROM memories WHERE archived = 0 AND category != ?`).all(EPISODE)
+            .map((r) => view(r, nowMs))
+            .sort((a, b) => b.heat - a.heat);
+        // The same selection the boot digest makes, so "in the digest" is exact.
+        const picked = new Set(pickForDigest(all.map((m) => ({ ...m, salience: m.heat }))).map((m) => m.ref));
+        for (const m of all)
+            m.inDigest = picked.has(m.ref);
+        const filtered = opts.category ? all.filter((m) => m.category === opts.category) : all;
+        return { rows: filtered.slice(0, opts.limit ?? 40), total: all.length, inDigest: picked.size };
+    }
+    finally {
+        db.close();
+    }
+}
+export function memoryByRef(contextDir, ref, nowMs = Date.now()) {
+    const db = open(contextDir);
+    if (!db)
+        return null;
+    try {
+        const r = db.prepare(`SELECT ${selectList(db)} FROM memories WHERE ref = ? AND archived = 0`).get(ref);
+        if (!r)
+            return null;
+        const m = view(r, nowMs);
+        if (m.category !== EPISODE) {
+            m.inDigest = heatList(contextDir, { limit: 400, nowMs }).rows.some((x) => x.ref === ref && x.inDigest);
+        }
+        return m;
+    }
+    finally {
+        db.close();
+    }
+}
+/** User memories tagged to a person, newest first. */
+export function memoriesAbout(contextDir, slug, opts = {}) {
+    const db = open(contextDir);
+    if (!db)
+        return [];
+    try {
+        const nowMs = opts.nowMs ?? Date.now();
+        const rows = db.prepare(`SELECT ${selectList(db)} FROM memories
+       WHERE category = 'user' AND archived = 0 AND json_extract(metadata, '$.person') = ?
+         AND (expires_at IS NULL OR expires_at > ?) AND (? IS NULL OR created > ?)
+       ORDER BY created DESC LIMIT ?`).all(slug, new Date(nowMs).toISOString(), opts.since ?? null, opts.since ?? null, opts.limit ?? 20);
+        return rows.map((r) => view(r, nowMs));
+    }
+    finally {
+        db.close();
+    }
+}
+/** Episodes in the last `hours`, newest first, with where each body was. */
+export function tapeRows(contextDir, hours, nowMs = Date.now()) {
+    const db = open(contextDir);
+    if (!db)
+        return [];
+    try {
+        const since = new Date(nowMs - hours * 3_600_000).toISOString();
+        const rows = db.prepare(`SELECT ref, title, created, project, metadata FROM memories
+       WHERE category = ? AND archived = 0 AND created >= ? AND (expires_at IS NULL OR expires_at > ?)
+       ORDER BY created DESC`).all(EPISODE, since, new Date(nowMs).toISOString());
+        return rows.map((r) => {
+            let where = r.project?.trim() || '?';
+            try {
+                const m = JSON.parse(r.metadata || '{}');
+                if (typeof m.where === 'string' && m.where.trim())
+                    where = m.where.trim();
+            }
+            catch { /* keep the fallback */ }
+            return { ref: r.ref, title: r.title, created: r.created, where };
+        });
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/ui/handler.d.ts

@@ -6,6 +6,7 @@ export interface UiOptions {
     /** Env for piece discovery and piece processes (PATH decides which pieces exist). */
     env: NodeJS.ProcessEnv;
 }
-export declare function isUiPath(pathname: string): boolean;
-/** Handle a /ui request. The caller has already matched isUiPath. */
+/** Whether a request is for the page (see the header for how `/` is shared with MCP). */
+export declare function isUiRequest(req: IncomingMessage, pathname: string): boolean;
+/** Handle a request for the page. The caller has already matched isUiRequest. */
 export declare function handleUi(req: IncomingMessage, res: ServerResponse, pathname: string, opts: UiOptions): Promise<void>;

package/dist/ui/handler.js

@@ -1,26 +1,49 @@
 /**
- * loom's web UI on the HTTP daemon (full scope only): GET /ui, the page;
- * GET /ui/sections.json, the same sections as data; /ui/login and /ui/logout.
+ * loom's web UI on the HTTP daemon (full scope only).
+ *
+ *   GET  /                         Home: the tape, tiles, "Your call"
+ *   GET  /mind, /people[/<slug>], /memory/<ref>   loom's own pages
+ *   GET  /p/<piece>[/<path>]       a piece's page
+ *   GET  /pieces.json              the installed pieces' manifests, for scripts
+ *   POST /act/<source>             an action (source = loom or a piece)
+ *   GET/POST /login, POST /logout
+ *   /ui/…                          the old address: redirects to the same page at the root
+ *
+ * The page shares the daemon with MCP, which answers on any other path. `/`
+ * is the page only for a plain browser GET: a POST, a request with an MCP
+ * session, or one asking for an event stream is MCP's.
  *
  * Auth follows the daemon's bearer token, and the UI needs one: a daemon with
  * no token serves no /ui (like /cli), because an open page would be readable
  * by any site that DNS-rebinds a name to the loopback address. A browser logs
- * in once by pasting the token. The cookie is `<issued-at>.<mac>`, a MAC under
- * a key this process made at start, over the issued-at time and a digest of
- * the token. It isn't the token and isn't derivable from it, so it can't be
- * replayed as a bearer or used to guess the token offline. It lasts 30 days,
- * or until the daemon restarts (log in again). Scripts can send the bearer
- * header instead. The page is read-only, has no script, and is served under a
- * CSP that forbids script and framing.
+ * in once by pasting the token and gets a session: a random id held in this
+ * process's memory. It isn't the token and isn't derivable from it, so it
+ * can't be replayed as a bearer or used to guess the token. It lasts 30 days,
+ * until logout (which revokes it), until the token changes, or until the
+ * daemon restarts. Scripts can send the bearer header instead.
+ *
+ * A GET from another site or another port is served only as a top-level
+ * navigation, never to an <img> or a fetch (fetch metadata).
+ *
+ * Every POST from a browser carries an anti-forgery token derived from its
+ * cookie, and a cross-site POST is refused outright (Sec-Fetch-Site / Origin),
+ * on top of the SameSite=Strict cookie. The page runs no script and is served
+ * under a CSP that forbids script and framing. Action fields go to the piece
+ * on stdin and are never logged, stored, or put in a URL; the one-time result
+ * message is kept in memory under a random id for a minute.
  */
 import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { checkBearer } from '../transport/guards.js';
-import { agentName, coreSections, uiTimeZone } from './core.js';
-import { pieceSections } from './piece-sections.js';
-import { renderLogin, renderPage } from './render.js';
+import { agentName, coreAct, corePage, homePage, uiTimeZone } from './core.js';
+import { pieceAct, pieceManifests, piecePage } from './pieces.js';
+import { CORE, pieceSource, renderHome, renderLogin, renderPage } from './render.js';
+import { ID, LIMITS, QUERY_KEY, splitPage, validPath } from './vocab.js';
 const COOKIE = 'loom_ui';
 const LOGIN_MAX_BYTES = 4096;
+const ACT_MAX_BYTES = 64 * 1024;
 const COOKIE_MAX_AGE_S = 30 * 24 * 3600;
+const FLASH_TTL_MS = 60_000;
+const FLASH_MAX = 200;
 /** This process's cookie key. Never written anywhere: a restart means logging in again. */
 const COOKIE_KEY = randomBytes(32);
 const SECURITY_HEADERS = {
@@ -29,28 +52,51 @@ const SECURITY_HEADERS = {
     'referrer-policy': 'no-referrer',
     'cache-control': 'no-store',
 };
-export function isUiPath(pathname) {
-    return pathname === '/ui' || pathname.startsWith('/ui/');
+const PAGE_ROOTS = ['/login', '/logout', '/pieces.json', '/mind', '/people', '/memory', '/p', '/act'];
+/** Whether a request is for the page (see the header for how `/` is shared with MCP). */
+export function isUiRequest(req, pathname) {
+    if (pathname === '/ui' || pathname.startsWith('/ui/'))
+        return true;
+    if (pathname === '/') {
+        if (req.method !== 'GET' && req.method !== 'HEAD')
+            return false;
+        if (req.headers['mcp-session-id'] !== undefined)
+            return false;
+        return !/text\/event-stream/i.test(req.headers.accept ?? '');
+    }
+    return PAGE_ROOTS.some((r) => pathname === r || pathname.startsWith(`${r}/`));
 }
 const digest = (s) => createHash('sha256').update(s).digest();
-function mac(issuedAt, secret) {
-    return createHmac('sha256', COOKIE_KEY).update(`loom-ui-v2|${issuedAt}|`).update(digest(secret)).digest('hex');
+const sessions = new Map();
+const MAX_SESSIONS = 50;
+function newSession(secret) {
+    const id = randomBytes(32).toString('hex');
+    sessions.set(id, { issuedAt: Math.floor(Date.now() / 1000), secret: digest(secret) });
+    // Oldest first in a Map: drop the oldest past the cap.
+    while (sessions.size > MAX_SESSIONS)
+        sessions.delete(sessions.keys().next().value);
+    return id;
 }
-function cookieValue(secret, issuedAt = Math.floor(Date.now() / 1000)) {
-    return `${issuedAt}.${mac(issuedAt, secret)}`;
+/** The anti-forgery token for a session: bound to its id, useless without it. */
+function csrfFor(id) {
+    return createHmac('sha256', COOKIE_KEY).update(`loom-ui-csrf|${id}`).digest('hex');
 }
 /** Equal-length digests, so neither the content nor the length of a guess leaks. */
 function safeEq(a, b) {
     return timingSafeEqual(digest(a), digest(b));
 }
-function validCookie(value, secrets, nowS = Math.floor(Date.now() / 1000)) {
-    const m = /^(\d{1,12})\.([0-9a-f]{64})$/.exec(value);
-    if (!m)
+function validSession(id, secrets, nowS = Math.floor(Date.now() / 1000)) {
+    if (!/^[0-9a-f]{64}$/.test(id))
         return false;
-    const issuedAt = Number(m[1]);
-    if (issuedAt > nowS + 60 || nowS - issuedAt > COOKIE_MAX_AGE_S)
+    const s = sessions.get(id);
+    if (!s)
         return false;
-    return secrets.some((s) => safeEq(m[2], mac(issuedAt, s)));
+    if (nowS - s.issuedAt > COOKIE_MAX_AGE_S) {
+        sessions.delete(id);
+        return false;
+    }
+    // A session dies with its token: rotate the token and old sessions stop.
+    return secrets.some((t) => timingSafeEqual(digest(t), s.secret));
 }
 function readCookie(req, name) {
     for (const part of (req.headers.cookie ?? '').split(';')) {
@@ -60,14 +106,51 @@ function readCookie(req, name) {
     }
     return undefined;
 }
-function authorized(req, opts) {
+function whoIs(req, opts) {
     if (opts.secrets.length === 0)
-        return false;
+        return null;
     const c = readCookie(req, COOKIE);
-    if (c && validCookie(c, opts.secrets))
-        return true;
+    if (c && validSession(c, opts.secrets))
+        return { kind: 'session', cookie: c };
     const header = req.headers['authorization'];
-    return header !== undefined && opts.secrets.some((s) => checkBearer(s, header).ok);
+    if (header !== undefined && opts.secrets.some((s) => checkBearer(s, header).ok))
+        return { kind: 'bearer' };
+    return null;
+}
+/**
+ * A GET from somewhere else is fine as a top-level navigation (a link in a
+ * chat) and refused otherwise: an <img> or fetch from another site, or from
+ * another port on this host (same-site, so the cookie rides along), must not
+ * make loom run a piece.
+ */
+function allowedGet(req) {
+    const site = req.headers['sec-fetch-site'];
+    if (site === undefined || site === 'same-origin' || site === 'none')
+        return true;
+    return req.headers['sec-fetch-mode'] === 'navigate' && req.headers['sec-fetch-dest'] === 'document';
+}
+/**
+ * A browser POST must come from loom's own page. Sec-Fetch-Site is set by
+ * every current browser and can't be forged by a page; Origin, when sent,
+ * must name this host. Either one saying "elsewhere" is a refusal.
+ */
+function sameOrigin(req) {
+    const site = req.headers['sec-fetch-site'];
+    if (site !== undefined && site !== 'same-origin' && site !== 'none')
+        return false;
+    const origin = req.headers.origin;
+    if (origin !== undefined) {
+        if (origin === 'null')
+            return false;
+        try {
+            if (new URL(origin).host !== req.headers.host)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
 }
 function send(res, status, type, body, extra = {}) {
     res.writeHead(status, { 'content-type': type, ...SECURITY_HEADERS, ...extra });
@@ -77,9 +160,10 @@ function redirect(res, to, extra = {}) {
     res.writeHead(303, { location: to, ...SECURITY_HEADERS, ...extra });
     res.end();
 }
-function readForm(req) {
+function readForm(req, max) {
     return new Promise((resolve) => {
-        let body = '';
+        const chunks = [];
+        let bytes = 0;
         let done = false;
         const finish = (v) => { if (!done) {
             done = true;
@@ -88,72 +172,253 @@ function readForm(req) {
         req.on('data', (d) => {
             if (done)
                 return;
-            body += d.toString('utf-8');
-            if (body.length > LOGIN_MAX_BYTES) {
+            bytes += d.length;
+            if (bytes > max) {
                 finish(null);
                 req.destroy();
+                return;
             }
+            chunks.push(d);
         });
-        req.on('end', () => finish(new URLSearchParams(body)));
+        req.on('end', () => finish(new URLSearchParams(Buffer.concat(chunks).toString('utf-8'))));
         req.on('error', () => finish(null));
         req.on('close', () => finish(null));
     });
 }
-async function sections(opts) {
-    const core = coreSections(opts.contextDir);
-    const { contributed, skipped } = await pieceSections(opts.env);
-    return { core, pieces: contributed, skipped };
+/** The page's own query: valid keys only, loom's `_` keys and oversize values dropped. */
+function pageQuery(url) {
+    const q = Object.create(null);
+    let n = 0;
+    for (const [k, v] of url.searchParams) {
+        if (!QUERY_KEY.test(k) || v.length > LIMITS.queryValue || Object.hasOwn(q, k))
+            continue;
+        if (++n > LIMITS.query)
+            break;
+        q[k] = v;
+    }
+    return q;
+}
+const flashes = new Map();
+function putFlash(flash) {
+    const now = Date.now();
+    for (const [k, v] of flashes)
+        if (now - v.at > FLASH_TTL_MS || flashes.size > FLASH_MAX)
+            flashes.delete(k);
+    const id = randomBytes(12).toString('hex');
+    flashes.set(id, { at: now, flash });
+    return id;
 }
-/** Handle a /ui request. The caller has already matched isUiPath. */
+function takeFlash(id) {
+    if (!id)
+        return undefined;
+    const f = flashes.get(id);
+    flashes.delete(id);
+    return f && Date.now() - f.at <= FLASH_TTL_MS ? f.flash : undefined;
+}
+// ─── Assembling a page ───────────────────────────────────────────────────────
+function clock() {
+    return new Intl.DateTimeFormat('en-US', { timeZone: uiTimeZone(), weekday: 'short', hour: 'numeric', minute: '2-digit', timeZoneName: 'short' }).format(new Date());
+}
+function hasPages(p) {
+    return Boolean(p.manifest.tab || p.manifest.legacy?.length);
+}
+function chrome(opts, pieces, skipped, current, csrf, flash) {
+    const tabs = pieces.filter(hasPages)
+        .map((p) => ({ label: p.manifest.tab?.label ?? p.piece, href: `/p/${p.piece}`, current: current === `p/${p.piece}`, piece: true }))
+        .sort((a, b) => a.label.localeCompare(b.label));
+    return {
+        agent: agentName(opts.contextDir),
+        nav: [
+            { label: 'Home', href: '/', current: current === '', piece: false },
+            { label: 'Mind', href: '/mind', current: current === 'mind', piece: false },
+            { label: 'People', href: '/people', current: current === 'people', piece: false },
+            ...tabs,
+        ],
+        clock: clock(),
+        csrf,
+        flash,
+        skipped,
+    };
+}
+/** Where to land after an action: the page the piece names, or back where the form was. */
+function landing(source, result, back) {
+    const s = (result.page !== undefined ? splitPage(result.page) : null) ?? splitPage(back);
+    const core = s?.core || source.id === 'loom';
+    const path = s?.path ?? '';
+    const q = s ? new URLSearchParams(s.query).toString() : '';
+    const base = core ? `/${path}` : `/p/${source.id}${path ? `/${path}` : ''}`;
+    return q ? `${base}?${q}` : base;
+}
+function withFlash(to, id) {
+    return `${to}${to.includes('?') ? '&' : '?'}_flash=${id}`;
+}
+const notFound = { title: 'Not found', sections: [] };
+/** decodeURIComponent, or null for a malformed escape (a 404, never a 500). */
+function decode(s) {
+    try {
+        return decodeURIComponent(s);
+    }
+    catch {
+        return null;
+    }
+}
+/** Handle a request for the page. The caller has already matched isUiRequest. */
 export async function handleUi(req, res, pathname, opts) {
     // No token, no page: an open /ui would be readable by any site that
     // DNS-rebinds a name to the loopback address (the same rule as /cli).
     if (opts.secrets.length === 0) {
         return send(res, 403, 'text/plain', 'forbidden: loom\'s page requires LOOM_BEARER_TOKEN');
     }
+    // The page used to live under /ui. Old links and bookmarks land on the same page.
+    if (pathname === '/ui' || pathname.startsWith('/ui/')) {
+        const to = new URL(req.url ?? pathname, 'http://loom.invalid');
+        // One leading slash, never two: `/ui//evil.example` must not become a
+        // protocol-relative `//evil.example`.
+        const rest = '/' + pathname.slice(3).replace(/^[/\\]+/, '');
+        res.writeHead(308, { location: rest + to.search, ...SECURITY_HEADERS });
+        return void res.end();
+    }
     const secure = req.headers['x-forwarded-proto'] === 'https';
-    if (pathname === '/ui/login') {
+    if (pathname === '/login') {
         // Unauthenticated: the login page names no agent.
         if (req.method === 'GET')
             return send(res, 200, 'text/html; charset=utf-8', renderLogin());
         if (req.method !== 'POST')
             return send(res, 405, 'text/plain', 'method not allowed');
-        const form = await readForm(req);
+        if (!sameOrigin(req))
+            return send(res, 403, 'text/plain', 'forbidden: cross-site request');
+        const form = await readForm(req, LOGIN_MAX_BYTES);
         if (!form)
             return send(res, 413, 'text/plain', 'too large');
         const token = form.get('token')?.trim() ?? '';
         const match = opts.secrets.find((s) => safeEq(token, s));
         if (!match)
             return send(res, 401, 'text/html; charset=utf-8', renderLogin('That token didn’t match.'));
-        return redirect(res, '/ui', {
-            'set-cookie': `${COOKIE}=${cookieValue(match)}; Path=/ui; HttpOnly; SameSite=Strict; Max-Age=${COOKIE_MAX_AGE_S}${secure ? '; Secure' : ''}`,
+        return redirect(res, '/', {
+            'set-cookie': `${COOKIE}=${newSession(match)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${COOKIE_MAX_AGE_S}${secure ? '; Secure' : ''}`,
         });
     }
-    if (pathname === '/ui/logout') {
+    const who = whoIs(req, opts);
+    const csrf = who?.kind === 'session' ? csrfFor(who.cookie) : '';
+    if (pathname === '/logout') {
         if (req.method !== 'POST')
             return send(res, 405, 'text/plain', 'method not allowed');
-        return redirect(res, '/ui/login', { 'set-cookie': `${COOKIE}=; Path=/ui; HttpOnly; SameSite=Strict; Max-Age=0` });
+        if (!sameOrigin(req))
+            return send(res, 403, 'text/plain', 'forbidden: cross-site request');
+        // Revoke it server-side, so a copy of the cookie stops working too.
+        const c = readCookie(req, COOKIE);
+        if (c)
+            sessions.delete(c);
+        return redirect(res, '/login', { 'set-cookie': `${COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0` });
+    }
+    if (!who) {
+        if (pathname.endsWith('.json'))
+            return send(res, 401, 'application/json', JSON.stringify({ error: 'unauthorized' }));
+        if (req.method === 'GET')
+            return redirect(res, '/login');
+        return send(res, 401, 'text/plain', 'unauthorized');
+    }
+    const url = new URL(req.url ?? pathname, 'http://loom.invalid');
+    if (pathname.startsWith('/act/')) {
+        if (req.method !== 'POST')
+            return send(res, 405, 'text/plain', 'method not allowed');
+        if (!sameOrigin(req))
+            return send(res, 403, 'text/plain', 'forbidden: cross-site request');
+        const sourceId = pathname.slice('/act/'.length);
+        if (sourceId !== 'loom' && !ID.test(sourceId))
+            return send(res, 404, 'text/plain', 'not found');
+        const form = await readForm(req, ACT_MAX_BYTES);
+        if (!form)
+            return send(res, 413, 'text/plain', 'too large');
+        // A browser session must prove the form came from loom's page. A bearer
+        // script has no ambient credential a forger could ride, so it needs none.
+        if (who.kind === 'session' && !safeEq(form.get('_csrf') ?? '', csrf)) {
+            return send(res, 403, 'text/plain', 'forbidden: this form is stale or not from loom\'s page; reload and try again');
+        }
+        const action = form.get('_action') ?? '';
+        const back = form.get('_path') ?? '';
+        if (!/^[a-z][a-z0-9_-]{0,39}$/.test(action))
+            return send(res, 400, 'text/plain', 'bad action');
+        const backLink = splitPage(back) ? back : '';
+        // A form has up to LIMITS.fields fields plus LIMITS.hidden hidden values.
+        // More than that is refused whole, never cut short: a truncated form
+        // could drop the very field (a secret) the piece needs.
+        const fields = Object.create(null);
+        for (const [k, v] of form) {
+            if (k.startsWith('_') || !/^[a-z][a-z0-9_-]{0,39}$/.test(k) || Object.hasOwn(fields, k))
+                continue;
+            fields[k] = v;
+        }
+        if (Object.keys(fields).length > LIMITS.fields + LIMITS.hidden)
+            return send(res, 400, 'text/plain', 'too many fields');
+        let source;
+        let result;
+        if (sourceId === 'loom') {
+            source = CORE;
+            result = await coreAct(opts.contextDir, action, fields);
+        }
+        else {
+            const { pieces } = await pieceManifests(opts.env);
+            const info = pieces.find((p) => p.piece === sourceId);
+            if (!info)
+                return send(res, 404, 'text/plain', 'not found');
+            source = pieceSource(info.piece);
+            const path = splitPage(backLink)?.path ?? '';
+            result = await pieceAct(info, { action, path, fields }, opts.env);
+        }
+        const to = landing(source, result, backLink);
+        // A piece's message is labeled with the piece, so it can't pass as loom's.
+        const from = source.id === 'loom' ? undefined : source.id;
+        return redirect(res, withFlash(to, putFlash({ ok: result.ok, message: result.message, from })));
     }
-    const agent = agentName(opts.contextDir);
     if (req.method !== 'GET')
         return send(res, 405, 'text/plain', 'method not allowed');
-    if (pathname === '/ui/sections.json') {
-        if (!authorized(req, opts))
-            return send(res, 401, 'application/json', JSON.stringify({ error: 'unauthorized' }));
-        const s = await sections(opts);
-        return send(res, 200, 'application/json', JSON.stringify({ agent, ...s }));
-    }
-    if (pathname === '/ui' || pathname === '/ui/') {
-        if (!authorized(req, opts))
-            return redirect(res, '/ui/login');
-        const s = await sections(opts);
-        return send(res, 200, 'text/html; charset=utf-8', renderPage({
-            agent,
-            core: s.core,
-            pieces: s.pieces,
-            skipped: s.skipped,
-            generatedAt: new Date().toLocaleTimeString('en-US', { timeZone: uiTimeZone(), hour: '2-digit', minute: '2-digit' }),
+    if (!allowedGet(req))
+        return send(res, 403, 'text/plain', 'forbidden: loom\'s page can only be opened, not embedded or fetched from another site');
+    if (pathname === '/pieces.json') {
+        const m = await pieceManifests(opts.env);
+        return send(res, 200, 'application/json', JSON.stringify({
+            agent: agentName(opts.contextDir),
+            pieces: m.pieces.map((p) => ({ piece: p.piece, manifest: p.manifest })),
+            skipped: m.skipped,
         }));
     }
-    return send(res, 404, 'text/plain', 'not found');
+    const query = pageQuery(url);
+    const flash = takeFlash(url.searchParams.get('_flash'));
+    const { pieces, skipped } = await pieceManifests(opts.env);
+    const skippedNames = skipped.map((s) => s.piece);
+    const html = (body, status = 200) => send(res, status, 'text/html; charset=utf-8', body);
+    if (pathname === '/') {
+        const home = homePage(opts.contextDir, query);
+        const tiles = [
+            { ...home.tile, source: CORE },
+            ...pieces.filter((p) => p.manifest.tile).map((p) => ({ ...p.manifest.tile, source: pieceSource(p.piece) })),
+        ];
+        const asks = pieces.flatMap((p) => p.manifest.asks.map((a) => ({ ...a, source: pieceSource(p.piece) })));
+        return html(renderHome(home.page, { source: CORE, path: '', query, csrf }, chrome(opts, pieces, skippedNames, '', csrf, flash), tiles, asks));
+    }
+    if (pathname.startsWith('/p/')) {
+        const rest = pathname.slice('/p/'.length);
+        const slash = rest.indexOf('/');
+        const piece = slash === -1 ? rest : rest.slice(0, slash);
+        const path = slash === -1 ? '' : decode(rest.slice(slash + 1));
+        const info = pieces.find((p) => p.piece === piece && hasPages(p));
+        const ch = chrome(opts, pieces, skippedNames, `p/${piece}`, csrf, flash);
+        if (!info || path === null || !validPath(path))
+            return html(renderPage(notFound, { source: pieceSource(piece), path: '', query: {}, csrf }, ch), 404);
+        const page = await piecePage(info, path, query, opts.env);
+        const ctx = { source: pieceSource(piece), path, query, csrf };
+        if (typeof page === 'string') {
+            return html(renderPage({ title: info.manifest.tab?.label ?? piece, sections: [{ id: 'error', blocks: [{ type: 'callout', tone: 'bad', text: `${piece} couldn't show this page (${page}).` }] }] }, ctx, ch), 502);
+        }
+        return html(renderPage(page, ctx, ch), page.title === 'Not found' && page.sections.length === 0 ? 404 : 200);
+    }
+    const path = decode(pathname.slice(1)) ?? '\0';
+    const top = path.split('/')[0];
+    const ch = chrome(opts, pieces, skippedNames, top, csrf, flash);
+    const page = validPath(path) ? corePage(opts.contextDir, path, query) : null;
+    const ctx = { source: CORE, path: validPath(path) ? path : '', query, csrf };
+    if (!page)
+        return html(renderPage(notFound, ctx, ch), 404);
+    return html(renderPage(page, ctx, ch), page.title === 'Not found' && page.sections.length === 0 ? 404 : 200);
 }

package/dist/ui/pieces.d.ts

@@ -0,0 +1,37 @@
+import { type ActResult, type Manifest, type Page } from './vocab.js';
+export declare const PIECE_TIMEOUT_MS = 3000;
+export declare const ACT_TIMEOUT_MS = 15000;
+export declare const PIECE_MAX_BYTES: number;
+/** Longer than the page's 30s refresh, so an open tab doesn't re-run every piece each time. */
+export declare const CACHE_MS = 45000;
+export interface PieceInfo {
+    piece: string;
+    path: string;
+    manifest: Manifest;
+}
+/** Why a piece contributed nothing, for the page footer (never shown as an error). */
+export interface PieceSkip {
+    piece: string;
+    reason: string;
+}
+export declare function clearPieceCache(path?: string): void;
+export declare function pieceEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * At most this many piece processes at once, across every page load: a burst
+ * of requests queues instead of forking a process each. The time limit starts
+ * when a piece actually runs.
+ */
+export declare const MAX_RUNNING = 6;
+/** Every installed piece's manifest, plus the ones that had nothing to show and why. */
+export declare function pieceManifests(env: NodeJS.ProcessEnv, nowMs?: number): Promise<{
+    pieces: PieceInfo[];
+    skipped: PieceSkip[];
+}>;
+/** One page from a piece, or why it couldn't be had. */
+export declare function piecePage(info: PieceInfo, path: string, query: Record<string, string>, env: NodeJS.ProcessEnv): Promise<Page | string>;
+/** Run an action on a piece. Field values go on stdin only. */
+export declare function pieceAct(info: PieceInfo, request: {
+    action: string;
+    path: string;
+    fields: Record<string, string>;
+}, env: NodeJS.ProcessEnv): Promise<ActResult>;