@jossuealcala/madre 1.0.0 → 1.0.2

package/src/server.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import http from 'node:http';
 import { readFile, realpath, writeFile, mkdir, cp, rename, access, stat } from 'node:fs/promises';
 import { existsSync, openSync, rmSync } from 'node:fs';
@@ -6,6 +8,7 @@ import { probePort, framable } from './ports.mjs';
 import { ControlDesk } from './room/control.mjs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { gzipSync } from 'node:zlib';
 import { homedir, hostname } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -33,6 +36,9 @@ const PACKAGE = JSON.parse(await readFile(new URL('../package.json', import.meta
 // run from its source, where the repository's `.git` sits beside `src/`. What npm installs never
 // carries a `.git` (`files` in package.json), so there no setting and no variable opens it.
 const FROM_SOURCE = existsSync(new URL('../.git', import.meta.url));
+// Where the author's token for the usage widget is kept: a vault name no module can take (module
+// ids are kebab-case, src/modules/sdk.mjs), so no module ever reads it.
+export const OWNER_VAULT = 'madre_owner';
 let crashHandlersInstalled = false;
 
 // RIPLEY's bridge, injected into every page it renders: reports the page's path
@@ -57,11 +63,12 @@ export function injectRipleyBridge(body) {
 import { QuotaMonitor } from './quota-monitor.mjs';
 import { defaultQuotaSources } from './quota-sources.mjs';
 import { Room } from './room.mjs';
-import { changeNeedsPhrase, keyHolds, mergeOverride, overrideSettings, phraseHash, publicOverride } from './override.mjs';
+import { COPILOT_WINDOWS } from './room/copilot.mjs';
+import { OVERRIDE_GRACE, changeNeedsPhrase, keyHolds, mergeOverride, overrideSettings, phraseHash, publicOverride } from './override.mjs';
 import { extensionById, findOnPath, runInstaller } from './extensions.mjs';
-import { accountNoteFor, installPlanFor, looksLikeAdminProblem, loginPlanFor, probeAgentAuth, probeAll, TAKES_KEY } from './auth-probe.mjs';
-import { applyKey, keyPlanFor } from './credentials.mjs';
-import { forgetSecret, summary as vaultSummary, writeSecret } from './vault.mjs';
+import { accountNoteFor, installPlanFor, looksLikeAdminProblem, loginPlanFor, looksLikeCodePrompt, probeAgentAuth, probeAll, TAKES_KEY } from './auth-probe.mjs';
+import { applyKey, keyPlanFor, openCodeKeyProviders, readOpenCodeProviders, removeOpenCodeKey } from './credentials.mjs';
+import { forgetSecret, readSecret, summary as vaultSummary, writeSecret } from './vault.mjs';
 import { applyConfigToEnv, loadConfig as readConfig, updateConfig } from './config.mjs';
 import { Privacy, normalizeTerms, privacySettings } from './privacy.mjs';
 import { checkForUpdate, detectInstall, updateCommand, releaseUrl, applyCommand, fetchCommand } from './updates.mjs';
@@ -74,8 +81,8 @@ const SDK_PAGE = { es: 'https://madre.run/sdk/', en: 'https://madre.run/en/sdk/'
 import { moduleUpdate } from './modules/updates.mjs';
 import { adoptStrays, chatIndex, chatLedger, createChat, deleteChat, isChatId, listChats, openChat as openChatIndex, projectFloor, renameChat, touchChat } from './chats.mjs';
 import { spawn } from 'node:child_process';
-import { totalmem } from 'node:os';
-import { discoverModels } from './models.mjs';
+import { cpus, freemem, loadavg, totalmem } from 'node:os';
+import { discoverModels, groupOpenCode, openCodeHidden, parseOpenCodeVerbose, providerLabel, OPENCODE_OWN } from './models.mjs';
 import { observable } from './modules/intents-observe.mjs';
 import { normalizeMode, setImageModule } from './capabilities.mjs';
 import { resolveGeminiKey } from './image-studio.mjs';
@@ -97,7 +104,9 @@ import { currentNetwork, lanAddresses } from './bridge/network.mjs';
 import { PHONE_MAX_MODE, writtenMode } from './bridge/policy.mjs';
 import { qrSvg } from './bridge/qr.mjs';
 import { readHandoff, writeHandoff } from './bridge/handoff.mjs';
-import { changeLooks, readLooks } from './looks.mjs';
+import { changeLooks, readLooks, changeRoomLook, roomLooks } from './looks.mjs';
+import { localAiConfig, localAiFor, localAiPatch } from './local-ai.mjs';
+import { heartbeat } from './heartbeat.mjs';
 import { askRoom, associateProject, ensureSalasProject, forgetProject, isSalasRoom, knownRooms, listFolders, markProject, projectRoomId, roomComesUp, salasRoomId, startRoom, suggestProjects, universeOf } from './salas.mjs';
 import { parseWork, recentWork, WORK_SYSTEM, workPrompt } from './lobby-work.mjs';
 import { CHANNEL_HEADER, MAX_LIMIT as ENLACE_MAX_LIMIT, NO_SUCH_LINK, NOTICES as ENLACE_NOTICES, activeContracts, askEnlace, channelKey, countRecent, linkTraffic, mayServe, noteCrossing, noticeEnlace, readsFrom, recallContract, revokeContract, sameKey, servingRooms, signContract } from './enlaces.mjs';
@@ -105,6 +114,41 @@ import { CHANNEL_HEADER, MAX_LIMIT as ENLACE_MAX_LIMIT, NO_SUCH_LINK, NOTICES as
 const sourceDirectory = dirname(fileURLToPath(import.meta.url));
 const publicDirectory = join(sourceDirectory, '..', 'public');
 
+// The page's own scripts and styles (2026-10-15): an ETag from the file's size and time, so a
+// reload that finds them unchanged gets «304» and the browser reuses its copy — and the code it
+// already compiled — instead of reading 2.5 MB again; and gzip for whoever asks, compressed once per
+// change of the file. `no-cache` still revalidates every time, so an edit shows on the next load.
+// Only the compressed copy is kept in memory (~0.6 MB for all of them); the plain file is read when
+// a client does not take gzip.
+const assetCache = new Map();
+async function sendAsset(request, response, file, type) {
+  const info = await stat(file);
+  const tag = `W/"${info.size.toString(36)}-${Math.floor(info.mtimeMs).toString(36)}"`;
+  const headers = { 'content-type': type, 'cache-control': 'no-cache', etag: tag, vary: 'accept-encoding' };
+  if (request.headers['if-none-match'] === tag) { response.writeHead(304, headers); return response.end(); }
+  const gzip = /\bgzip\b/.test(String(request.headers['accept-encoding'] ?? '')) && info.size > 8192;
+  if (gzip) {
+    let held = assetCache.get(file);
+    if (held?.tag !== tag) { held = { tag, body: gzipSync(await readFile(file), { level: 6 }) }; assetCache.set(file, held); }
+    response.writeHead(200, { ...headers, 'content-encoding': 'gzip', 'content-length': held.body.length });
+    return response.end(held.body);
+  }
+  const body = await readFile(file);
+  response.writeHead(200, { ...headers, 'content-length': body.length });
+  return response.end(body);
+}
+
+// The record as a page opening it needs it (2026-10-15). `quota.updated` is how full each agent's
+// window is, read again every few minutes; the page keeps only the last reading of each agent, so
+// every older one was downloaded, parsed and drawn for nothing — 87% of a long conversation's
+// record, and seconds of drawing. The ledger keeps them all; the page gets the newest of each.
+export function forThePage(events) {
+  const lastQuota = new Map();
+  for (const event of events) if (event?.type === 'quota.updated') lastQuota.set(event.payload?.agent ?? null, event);
+  const keep = new Set(lastQuota.values());
+  return events.filter((event) => event?.type !== 'quota.updated' || keep.has(event));
+}
+
 function sendJson(response, status, value) {
   response.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
   response.end(JSON.stringify(value));
@@ -202,6 +246,9 @@ export async function createPulseServer({
   // What language the screens speak. The prompt the agents read is not one of them, and the
   // environment wins over the file, as it does for every other setting here.
   setRoomLanguage(process.env.PULSE_LANGUAGE ?? (await readConfig(root)).language);
+  // Whether anyone set it: a MADRE nobody has set takes the language of the first browser that
+  // opens it (public/i18n.js, browserLanguage), once, and keeps it as if it had been chosen.
+  let languageChosen = Boolean(process.env.PULSE_LANGUAGE || (await readConfig(root)).language);
   // RIPLEY renders HTML in the viewer only while the human has it switched on; read live, the switch is the module's.
   const ripleyOn = async () => Boolean((await readConfig(root)).modules?.ripley?.enabled);
   agentTimeouts ??= agentTimeoutsFromEnv();
@@ -357,6 +404,120 @@ export async function createPulseServer({
   // rooms, asked of them at most every few minutes (each room works its zones out itself).
   const lobbyWork = { file: join(roomDir, 'lobby-work.json'), loaded: false, key: null, at: 0, tried: 0, bullets: null, model: null, error: null, running: null };
   const lobbyDecisions = { at: 0, list: null, running: null };
+  // A busy agent can delay a room's glance without closing the room. Keep the last confirmed
+  // reading for a short time, and distinguish a slow answer from a stopped process.
+  const lobbyGlances = new Map();
+  // HOME'S WIDGETS (2026-10-13): what each one shows comes from something that already exists —
+  // the machine (node:os), each open project's servers sentinel (/api/ports) and dataset
+  // (/api/dataset: maturity, pairs, the model trained on it), this room's own dataset for the
+  // Coordinator, and Ollama as this room probed it. A reading is kept 30 s, so a page that asks
+  // every few seconds never makes the projects work for it.
+  const widgetReadings = new Map();
+  let cpuSeen = null;
+  const cpuTimes = () => cpus().reduce((sum, one) => {
+    const times = one.times;
+    sum.idle += times.idle;
+    sum.total += times.user + times.nice + times.sys + times.idle + times.irq;
+    return sum;
+  }, { idle: 0, total: 0 });
+  async function cpuBusy() {
+    let before = cpuSeen;
+    if (!before || Date.now() - before.at > 60000) { before = { ...cpuTimes(), at: Date.now() }; await new Promise((done) => setTimeout(done, 300)); }
+    const now = { ...cpuTimes(), at: Date.now() };
+    cpuSeen = now;
+    const total = now.total - before.total;
+    return total > 0 ? Math.max(0, Math.min(1, 1 - (now.idle - before.idle) / total)) : null;
+  }
+  const readinessOf = (answer) => (answer && !answer.unreachable && !answer.outdated ? {
+    pairs: answer.readiness?.pairs ?? 0, target: answer.readiness?.target ?? 300, aberrations: answer.readiness?.aberrations ?? 0,
+    good: answer.readiness?.good ?? 0, bad: answer.readiness?.bad ?? 0, trained: answer.trained ?? null,
+    score: answer.maturity?.score ?? null, stage: answer.maturity?.stage?.label ?? null, says: answer.maturity?.stage?.says ?? null,
+    weakest: (() => { const one = (answer.maturity?.signals ?? []).find((signal) => signal.id === answer.maturity?.weakest); return one ? { label: one.label ?? null, next: one.next ?? null } : null; })(),
+    signals: (answer.maturity?.signals ?? []).map((one) => ({ id: one.id, label: one.label, value: one.value })),
+  } : null);
+  // Each project with whether it uses the local AI, for the widget that shows Ollama (src/local-ai.mjs).
+  const withLocalAi = async (projects) => { const config = await readConfig(root); return projects.map((one) => ({ ...one, localAi: localAiFor(config, one.id).on })); };
+  async function openProjects() {
+    const salas = salasRoomId(root);
+    return (await knownRooms(root)).filter((one) => one.open && one.id !== salas);
+  }
+  // Memory a program could have now. os.freemem() counts only pages nobody holds; macOS keeps
+  // most of the rest as cache it gives back at once, so «free» read 0.1 GB of 16 on an idle Mac.
+  // The system's own count: free, inactive, speculative and purgeable pages on macOS (vm_stat),
+  // MemAvailable on Linux; freemem() where neither answers.
+  async function memoryAvailable() {
+    try {
+      if (process.platform === 'darwin') {
+        const { stdout } = await execFileAsync('vm_stat', [], { timeout: 2000 });
+        const page = Number(stdout.match(/page size of (\d+) bytes/)?.[1] ?? 0);
+        const pages = (name) => Number(stdout.match(new RegExp(`Pages ${name}:\\s+(\\d+)`))?.[1] ?? 0);
+        if (page) return { bytes: (pages('free') + pages('inactive') + pages('speculative') + pages('purgeable')) * page, source: 'vm_stat' };
+      }
+      if (process.platform === 'linux') {
+        const kb = Number((await readFile('/proc/meminfo', 'utf8')).match(/^MemAvailable:\s+(\d+)/m)?.[1] ?? 0);
+        if (kb) return { bytes: kb * 1024, source: 'meminfo' };
+      }
+    } catch { /* the plain count below */ }
+    return { bytes: freemem(), source: 'freemem' };
+  }
+  async function homeWidget(kind) {
+    const kept = widgetReadings.get(kind);
+    // madre.run's count moves once a day: the author's reading is kept ten minutes, the Mac's thirty seconds.
+    if (kept && Date.now() - kept.at < (kind === 'usage' ? 600000 : 30000)) return kept.reading;
+    let reading;
+    if (kind === 'system') {
+      const total = totalmem();
+      const free = await memoryAvailable();
+      reading = { available: true, cpu: { busy: await cpuBusy(), cores: cpus().length, load: loadavg().map((one) => Math.round(one * 100) / 100) }, memory: { total, free: Math.min(total, free.bytes), source: free.source } };
+    } else if (kind === 'servers') {
+      const rooms = await openProjects();
+      const projects = await Promise.all(rooms.map(async (one) => {
+        const answer = await askRoom(one.open.port, '/api/ports', { timeoutMs: 4000 });
+        if (answer.unreachable && answer.status === 412) return { id: one.id, name: one.name, preview: false, ports: [] };
+        if (answer.unreachable || answer.outdated) return { id: one.id, name: one.name, unreachable: true, ports: [] };
+        return { id: one.id, name: one.name, preview: true, ports: (answer.ports ?? []).map((port) => ({ port: port.port, status: port.status ?? null, command: port.command ?? null })) };
+      }));
+      reading = { available: projects.some((one) => one.preview), projects };
+    } else if (kind === 'memory' || kind === 'models') {
+      const rooms = await openProjects();
+      const projects = await Promise.all(rooms.map(async (one) => ({ id: one.id, name: one.name, ...(readinessOf(await askRoom(one.open.port, '/api/dataset', { timeoutMs: 6000 })) ?? { unreachable: true }) })));
+      reading = kind === 'memory'
+        ? { available: projects.some((one) => !one.unreachable), projects }
+        : { available: true, ollama: { running: Boolean(ollama.running), models: (ollama.models ?? []).map((model) => model.name).filter(Boolean) }, projects: await withLocalAi(projects) };
+    } else if (kind === 'usage') {
+      // The author's own reading of how many copies are on (src/heartbeat.mjs, madre.run's
+      // /api/usage). It exists only in a copy run from source that holds the author's token
+      // (scripts/owner-usage.mjs); anywhere else there is no such widget.
+      const token = FROM_SOURCE ? await readSecret(root, OWNER_VAULT, 'usage') : null;
+      if (!token) return null;
+      const answer = await reportFetch(process.env.PULSE_USAGE_URL ?? 'https://madre.run/api/usage', { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) }).catch(() => null);
+      const body = answer?.ok ? await answer.json().catch(() => null) : null;
+      reading = body?.ok ? { available: true, ...body } : { available: false, status: answer?.status ?? 0 };
+    } else if (kind === 'coordinator' && !salasRoom) {
+      // Home's page is served by every project too: the Coordinator's record is its own room's.
+      const coordinator = (await knownRooms(root)).find((one) => one.id === salasRoomId(root));
+      const answer = coordinator?.open ? await askRoom(coordinator.open.port, '/api/salas/widget?kind=coordinator', { timeoutMs: 6000 }) : null;
+      reading = answer && !answer.unreachable && !answer.outdated ? answer : { available: false };
+    } else if (kind === 'coordinator') {
+      const notes = memory ? memory.memories({ limit: 5000 }) : [];
+      const ready = datasetReadiness(await store.readAll(), notes);
+      const research = room.memoryResearch();
+      reading = { available: true, ...readinessOf({ readiness: ready, trained: ollama.madreModel ?? null, maturity: maturity({ readiness: ready, notes, links: research?.links ?? [], stats: research?.stats ?? null }) }), notes: notes.length };
+    } else return null;
+    widgetReadings.set(kind, { at: Date.now(), reading });
+    return reading;
+  }
+  async function lobbyGlance(one) {
+    if (!one.open) { lobbyGlances.delete(one.id); return null; }
+    const reading = await askRoom(one.open.port, '/api/glance?census=1', { timeoutMs: 1200 });
+    if (!reading.unreachable && !reading.outdated) {
+      lobbyGlances.set(one.id, { port: one.open.port, reading, at: Date.now() });
+      return reading;
+    }
+    const last = lobbyGlances.get(one.id);
+    if (reading.unreachable && last?.port === one.open.port && Date.now() - last.at < 30000) return { ...last.reading, delayed: true };
+    return reading;
+  }
   // Every conversation's room other than the open one (see the note above mountChat); declared
   // here because the local wiring below reaches all of them.
   const parked = new Map();   // chatId -> { room, store, off, feed }
@@ -395,6 +556,15 @@ export async function createPulseServer({
     target.setInvoker(MADRE_ADAPTER, localWiring.madre ? madreInvoker({ memory, ollama: () => ({ ...ollama, chatModel: ollama.madreModel ?? ollama.chatModel }), fetchImpl: reportFetch }) : null);
   }
   const ollamaSettings = async () => ({ enabled: true, embeddings: true, archivist: true, agent: true, ...((await readConfig(root)).modules?.ollama ?? {}) });
+  // Whether this project uses the local AI at all, as Home decides it (src/local-ai.mjs).
+  const thisRoomId = projectRoomId(canonicalProjectRoot);
+  const localAiHere = async () => localAiFor(await readConfig(root), thisRoomId, { home: salasRoom });
+  // This project's own switch, outside «auto»; null when Home decides.
+  async function setLocalAiHere(on) {
+    if (salasRoom || !(await localAiHere()).editable) return null;
+    await updateConfig(root, localAiPatch(await readConfig(root), { rooms: { [thisRoomId]: Boolean(on) } }));
+    return wireOllama({ probe: false });
+  }
   // What the TRAIN card needs: where the recipe ships, the room, the model name @madre will pick up, a base that fits this machine.
   function trainingInfo() {
     const slug = basename(canonicalProjectRoot).toLowerCase().replace(/[^a-z0-9]+/g, '-');
@@ -407,7 +577,9 @@ export async function createPulseServer({
     const slug = basename(canonicalProjectRoot).toLowerCase().replace(/[^a-z0-9]+/g, '-');
     const trained = (ollama.models ?? []).map((model) => model.name).find((name) => name.startsWith(`madre-${slug}`)) ?? null;
     ollama = { ...ollama, madreModel: trained };
-    const settings = await ollamaSettings();
+    const project = await localAiHere();
+    // Off for this project reads exactly as the module switched off, and only here.
+    const settings = { ...(await ollamaSettings()), enabled: project.on };
     const useEmbeddings = ollama.running && settings.enabled && settings.embeddings && ollama.embedModel;
     const useArchivist = ollama.running && settings.enabled && settings.archivist && ollama.chatModel;
     if (memory) {
@@ -427,7 +599,7 @@ export async function createPulseServer({
     wireLocal(room);
     for (const held of parked.values()) wireLocal(held.room);
     if (room) {
-      if (changed) await room.record('agents.updated', { agents: agents.map((agent) => ({ id: agent.id, label: agent.label, detected: agent.detected, ready: agent.ready, version: agent.version, local: Boolean(agent.local), route: agent.route ?? null })), removed: fifth.ready ? [] : [MADRE_AGENT_ID], reason: fifth.ready ? `@madre is in the room · ${fifth.version}` : '@madre left the room: Ollama has no chat model running' });
+      if (changed) await room.record('agents.updated', { agents: agents.map((agent) => ({ id: agent.id, label: agent.label, detected: agent.detected, ready: agent.ready, version: agent.version, local: Boolean(agent.local), route: agent.route ?? null })), removed: fifth.ready ? [] : [MADRE_AGENT_ID], reason: fifth.ready ? `@madre is in the project · ${fifth.version}` : '@madre left the project: Ollama has no chat model running' });
       // That a local model is running is not the same as it being of use on this project, and
       // the second thing is the one a person needs told. Said once per model, in the room, with
       // the one button that settles it — the crew line above fires only when the crew CHANGES,
@@ -442,7 +614,7 @@ export async function createPulseServer({
         });
       }
     }
-    return { ...ollama, settings, embeddings: Boolean(useEmbeddings), archivist: Boolean(useArchivist), agent: fifth.ready };
+    return { ...ollama, settings, project, embeddings: Boolean(useEmbeddings), archivist: Boolean(useArchivist), agent: fifth.ready };
   }
   // Memory settings the human keeps in config.json (MU/TH/UR → MEMORY); environment still wins at launch.
   const memoryConfig = async () => ({ archivist: 'auto', archivists: null, every: 10, idleMinutes: 10, embedProvider: 'auto', recallShare: 0.3, cascade: true, ...((await readConfig(root)).memory ?? {}) });
@@ -472,8 +644,10 @@ export async function createPulseServer({
   const passes = new Map();          // token -> { agent, mode, until, once }
   const keyMisses = [];              // when the last wrong keys were typed
   const PASS_ONCE_MS = 30 * 60 * 1000;
-  function issuePass(agent, mode) {
-    const minutes = overrideConfig.grace[mode] ?? 0;
+  // `asked` is a window the human chose on an agent's request for this mode (2026-10-14): one of
+  // the windows the project allows, never longer, and only for that agent and mode.
+  function issuePass(agent, mode, asked = 0) {
+    const minutes = asked > 0 && OVERRIDE_GRACE[mode]?.includes(asked) ? asked : overrideConfig.grace[mode] ?? 0;
     const token = randomBytes(24).toString('hex');
     const pass = { agent, mode, until: Date.now() + (minutes ? minutes * 60000 : PASS_ONCE_MS), once: !minutes };
     passes.set(token, pass);
@@ -486,6 +660,18 @@ export async function createPulseServer({
     if (pass.once) passes.delete(token);
     return true;
   }
+  // The copilot (src/room/copilot.mjs): one window for the project, opened with the #3 key, up to
+  // 24 hours. In memory only, like the passes: a restart and STOP ALL close it. Every conversation
+  // of the project asks this one when it decides whether a message is a copilot's.
+  let copilot = null;                 // { since, until, minutes, timer }
+  const copilotNow = () => (copilot && copilot.until > Date.now() ? { since: copilot.since, until: copilot.until, minutes: copilot.minutes } : null);
+  const copilotState = () => ({ active: Boolean(copilotNow()), ...(copilotNow() ?? {}), windows: COPILOT_WINDOWS });
+  async function endCopilot(reason) {
+    if (!copilot) return;
+    clearTimeout(copilot.timer);
+    copilot = null;
+    await room.record('copilot.ended', { reason }).catch(() => null);
+  }
   let listening = null;
   const listeningPort = () => listening?.address?.()?.port ?? Number(process.env.PULSE_PORT ?? 4317);
   // One CONTROL desk for the whole project, shared by every conversation alive at once: a single
@@ -505,6 +691,7 @@ export async function createPulseServer({
     bishopForTurn: salasRoom ? async (turn) => moduleById('bishop').promptForTurn({ ...(await moduleContext()), record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }, turn) : null,
     // Fase 3e: notes a link with automatic recall brings to a turn. Never in the room of Salas
     // (BISHOP has its own); recorded in the conversation of the turn that read them.
+    copilot: copilotNow,
     linkedForTurn: salasRoom ? null : async (turn) => recallForTurn(await moduleContext(), { ...turn, port: listeningPort(), roomDir,
       record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }),
     softTokenBudget,
@@ -585,6 +772,11 @@ export async function createPulseServer({
       config.opencode = { model: patch.opencode.model || undefined };
       if (patch.opencode.model) process.env.PULSE_OPENCODE_MODEL = String(patch.opencode.model); else delete process.env.PULSE_OPENCODE_MODEL;
     }
+    // The providers left out of the composer's chooser: ids only, the way OpenCode names them.
+    if (patch.opencode && 'hidden' in patch.opencode) {
+      if (!Array.isArray(patch.opencode.hidden) || patch.opencode.hidden.some((id) => typeof id !== 'string' || !/^[\w.-]{1,60}$/.test(id))) throw new Error(t('Hidden providers must be a list of provider names.'));
+      config.opencode = { ...(config.opencode ?? {}), hidden: [...new Set(patch.opencode.hidden)] };
+    }
     if (patch.timeouts) {
       const timeouts = { ...room.settings().agentTimeouts };
       for (const [key, value] of Object.entries(patch.timeouts)) {
@@ -651,34 +843,75 @@ export async function createPulseServer({
   }
 
   let loggingIn = null;
-  async function loginAgent(id) {
+  // A sign-in in flight, as the room is allowed to see it: which door, the address to open, and
+  // whether the CLI is waiting to be told the code that page gave back. Never the code itself.
+  let loginRun = null;
+  const loginState = () => (loginRun ? { agent: loginRun.agent, method: loginRun.method, command: loginRun.command, url: loginRun.url, asksForCode: loginRun.asksForCode, awaitingCode: loginRun.awaitingCode, startedAt: loginRun.startedAt } : null);
+
+  async function loginAgent(id, { method = null } = {}) {
     const agent = agents.find((item) => item.id === id);
     if (!agent) return { status: 404, body: { error: `Unknown agent: ${id}.` } };
     if (!agent.detected) return { status: 412, body: { error: `${agent.label} is not installed on this computer.`, install: loginPlanFor(agent)?.install ?? [] } };
-    const plan = loginRunners[id]?.(agent) ?? loginPlanFor(agent);
+    const plan = loginRunners[id]?.(agent, { method }) ?? loginPlanFor(agent, { method });
     if (!plan) return { status: 404, body: { error: `No sign-in flow known for ${id}.` } };
     if (!plan.headless) return { status: 409, body: { error: `${agent.label} signs in from its own prompt. Run this in a terminal, then press RECHECK.`, command: plan.display, note: plan.note } };
     if (loggingIn) return { status: 409, body: { error: `A sign-in is already running (${loggingIn}).` } };
     loggingIn = id;
-    await room.record('connection.login.started', { agent: id, command: plan.display, note: plan.note });
+    loginRun = { agent: id, method: plan.method ?? null, command: plan.display, url: null, asksForCode: Boolean(plan.asksForCode), awaitingCode: false, startedAt: Date.now(), child: null };
+    await room.record('connection.login.started', { agent: id, command: plan.display, note: plan.note, method: plan.method ?? null });
     void (async () => {
       const lines = [];
       const result = await runInstaller({
         command: plan.command,
         args: plan.args,
         projectRoot: canonicalProjectRoot,
-        timeoutMs: 300000,
+        // A person is in the middle of this: the browser, the account, the code. Five minutes was
+        // the installer's clock, and it killed sign-ins that were only waiting on a human.
+        timeoutMs: 900000,
+        // A CLI that asks for a code needs a way to be answered, and its question never ends in a
+        // newline, so the half-line is flushed rather than left sitting in the buffer.
+        stdin: plan.asksForCode ? 'pipe' : 'ignore',
+        flushIdleMs: plan.asksForCode ? 600 : 0,
+        quietNote: 'the sign-in is waiting on you: finish it in the page that opened',
+        onChild: (handle) => { if (loginRun?.agent === id) loginRun.child = handle; },
         onLine: (line) => {
           lines.push(line);
           const url = line.match(/https?:\/\/\S+/)?.[0] ?? null;
+          if (loginRun?.agent === id) {
+            if (url) loginRun.url = url;
+            if (plan.asksForCode && looksLikeCodePrompt(line)) loginRun.awaitingCode = true;
+          }
           void room.record('connection.login.output', { agent: id, line: line.slice(0, 500), url });
         },
       });
       await refreshSessions();
       await room.record('connection.login.finished', { agent: id, code: result.code, error: result.error ?? null, session: sessions[id] ?? null, tail: lines.slice(-6) });
       loggingIn = null;
+      loginRun = null;
     })();
-    return { status: 202, body: { accepted: true, command: plan.display } };
+    return { status: 202, body: { accepted: true, command: plan.display, method: plan.method ?? null, asksForCode: Boolean(plan.asksForCode) } };
+  }
+
+  // The second half of a browser sign-in: the page hands back a code and the CLI is waiting for
+  // it on its own input. The room types it in. The code is a credential for the minute it lives,
+  // so it is taken from this computer only and never written to the ledger.
+  async function answerLogin(id, code) {
+    if (!loginRun || loginRun.agent !== id) return { status: 409, body: { error: 'No sign-in is waiting for a code.' } };
+    if (!loginRun.child?.write) return { status: 409, body: { error: 'That sign-in cannot be answered from here.' } };
+    const text = String(code ?? '').trim();
+    if (!text) return { status: 400, body: { error: 'Paste the code the page gave you.' } };
+    if (/\s/.test(text) || text.length > 400) return { status: 400, body: { error: 'That does not look like the code: check you copied all of it and nothing else.' } };
+    loginRun.child.write(`${text}\n`);
+    loginRun.awaitingCode = false;
+    await room.record('connection.login.answered', { agent: id });
+    return { status: 202, body: { accepted: true } };
+  }
+
+  async function cancelLogin(id) {
+    if (!loginRun || loginRun.agent !== id) return { status: 409, body: { error: 'No sign-in is running for that agent.' } };
+    loginRun.child?.cancel?.();
+    await room.record('connection.login.cancelled', { agent: id });
+    return { status: 202, body: { cancelled: true } };
   }
 
   // A CLI installed from the room appears without restarting: detection runs again, the roster
@@ -889,8 +1122,12 @@ export async function createPulseServer({
       // The human answering clears what waited; a message BISHOP's channel brought is not the human.
       if (event?.type === 'message.created' && said.role === 'user' && said.via !== 'bishop') { for (const key of [...asks.keys()]) asks.delete(key); }
       else if (event?.type === 'choice.offered') asks.set(`choice:${said.responseMessageId}`, { kind: 'choice', agent: said.agent, text: said.question ?? null, at: event.timestamp });
-      else if (event?.type === 'run.requested') asks.set(`run:${said.responseMessageId}`, { kind: 'run', agent: said.agent, text: said.commands?.[0]?.line ?? null, at: event.timestamp });
-      else if (event?.type === 'run.started') asks.delete(`run:${said.responseMessageId}`);
+      else if (event?.type === 'run.requested') {
+        for (const [index, command] of (said.commands ?? []).entries()) {
+          if (command.argv) asks.set(`run:${said.responseMessageId}:${index}`, { kind: 'run', agent: said.agent, text: command.line, at: event.timestamp });
+        }
+      }
+      else if (event?.type === 'run.started') asks.delete(`run:${said.responseMessageId}:${said.index}`);
       // BISHOP (fase 4c): a #3/#4 proposal waits for the human's key in this room; in Salas, a
       // plan with something to press waits until it closes.
       else if (event?.type === 'bishop.order.proposed') asks.set(`bishop:${said.plan}:${said.step}`, { kind: 'bishop', agent: said.agent, mode: said.mode, text: said.text ?? null, at: event.timestamp });
@@ -903,7 +1140,7 @@ export async function createPulseServer({
   }
   function asksOf(target, now = Date.now()) {
     const modes = (target.pendingModes?.() ?? []).map((asked) => ({ kind: 'mode', agent: asked.agent, mode: asked.mode, text: null }));
-    const kept = [...(asksByRoom.get(target)?.values() ?? [])].filter((ask) => now - Date.parse(ask.at ?? 0) < ASK_FRESH_MS);
+    const kept = [...(asksByRoom.get(target)?.values() ?? [])].filter((ask) => now - Date.parse(ask.at ?? 0) < ASK_FRESH_MS).sort((a, b) => String(b.at).localeCompare(String(a.at)));
     return [...modes, ...kept];
   }
   let unsubscribeAsks = () => {};
@@ -943,8 +1180,9 @@ export async function createPulseServer({
     // its own takes the first thing the human said in it.
     unsubscribeChats = room.subscribe((event) => {
       if (event?.type !== 'message.created' || event.ghost) return;
+      // A message MADRE wrote for the human (results going back) neither names nor previews it.
       const human = event.payload?.role === 'user';
-      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
+      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human && !event.payload?.auto ? saidText(event.payload) : null, counts: human })).catch(() => null);
     });
     unsubscribeActivity = watchActivity(room, chatId);
     sentinel.seed(historicalEvents);
@@ -999,6 +1237,11 @@ export async function createPulseServer({
     active: async () => clients.size > 0 && await ripleyOn(),
   });
   if (!testMode) serverSentinel.start();
+  // «Still in use», once a day per copy (src/heartbeat.mjs): a little after start, then looked at
+  // every few hours; the day it was already said, nothing goes.
+  const sayAlive = () => { void heartbeat({ root, version: PACKAGE.version, fetchImpl: reportFetch }); };
+  const aliveTimers = testMode ? [] : [setTimeout(sayAlive, 20_000), setInterval(sayAlive, 6 * 60 * 60 * 1000)];
+  for (const timer of aliveTimers) timer.unref?.();
   const endClients = (feed) => { for (const client of [...feed.clients.keys()]) { feed.clients.delete(client); try { client.end(); } catch { /* already gone */ } } };
   async function closeHeld(id) {
     const held = parked.get(id);
@@ -1036,7 +1279,7 @@ export async function createPulseServer({
     const offTouch = target.subscribe((event) => {
       if (event?.type !== 'message.created' || event.ghost) return;
       const human = event.payload?.role === 'user';
-      chatWrites = chatWrites.then(() => touchChat(roomDir, id, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
+      chatWrites = chatWrites.then(() => touchChat(roomDir, id, { text: human && !event.payload?.auto ? saidText(event.payload) : null, counts: human })).catch(() => null);
     });
     const offActivity = watchActivity(target, id);
     const offModules = wireModules(target, id);
@@ -1262,6 +1505,8 @@ export async function createPulseServer({
         }),
         ollama: {
           state: () => ollama,
+          project: () => localAiHere(),
+          setProject: (on) => setLocalAiHere(on),
           wire: (options) => wireOllama(options),
           // Getting Ollama onto this computer, with the command in plain sight, and waking it.
           install: async () => {
@@ -1424,15 +1669,11 @@ export async function createPulseServer({
         response.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...PAGE_GUARDS });
         return response.end(html);
       }
-      if (request.method === 'GET' && ['/app.js', '/nostromo-engine.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/editor.js', '/routing.js', '/abduction.js', '/review-ask.js', '/loader.js', '/tour.js', '/tour-chapters.js', '/touch.js'].includes(url.pathname)) {
-        const js = await readFile(join(publicDirectory, url.pathname.slice(1)));
-        response.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });
-        return response.end(js);
+      if (request.method === 'GET' && ['/app.js', '/nostromo-engine.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/editor.js', '/routing.js', '/abduction.js', '/review-ask.js', '/loader.js', '/tour.js', '/tour-chapters.js', '/touch.js', '/attribution.js'].includes(url.pathname)) {
+        return sendAsset(request, response, join(publicDirectory, url.pathname.slice(1)), 'text/javascript; charset=utf-8');
       }
       if (request.method === 'GET' && url.pathname === '/styles.css') {
-        const css = await readFile(join(publicDirectory, 'styles.css'));
-        response.writeHead(200, { 'content-type': 'text/css; charset=utf-8' });
-        return response.end(css);
+        return sendAsset(request, response, join(publicDirectory, 'styles.css'), 'text/css; charset=utf-8');
       }
       const abductionAssets = new Map([
         ['/assets/abduction-cat.png', 'abduction-cat.png'],
@@ -1567,7 +1808,7 @@ export async function createPulseServer({
           chats: chats.length,
           chat: latest ? { id: latest.id, title: latest.title, named: latest.named, preview: latest.preview, at: latest.updatedAt, messages: latest.messages } : null,
           working: [...working],
-          waiting: waiting.slice(0, 5).map(({ kind, agent, mode, text, chat, chatTitle }) => ({ kind, agent, mode: mode ?? undefined, text: typeof text === 'string' ? text.slice(0, 140) : null, chat, chatTitle })),
+          waiting: waiting.sort((a, b) => String(b.at ?? '').localeCompare(String(a.at ?? ''))).slice(0, 5).map(({ kind, agent, mode, text, chat, chatTitle }) => ({ kind, agent, mode: mode ?? undefined, text: typeof text === 'string' ? text.slice(0, 140) : null, chat, chatTitle })),
           waitingCount: waiting.length,
           // What the archive holds, counted, when Salas asks (?census=1): never the words, only how
           // many of each kind and how many travel into turns.
@@ -1586,24 +1827,65 @@ export async function createPulseServer({
         return response.end(html);
       }
       if (request.method === 'GET' && (url.pathname === '/salas-mac.js' || url.pathname === '/salas-mac.css' || url.pathname === '/macroverso.js')) {
-        const file = await readFile(join(publicDirectory, url.pathname.slice(1)));
-        response.writeHead(200, { 'content-type': url.pathname.endsWith('.js') ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8', 'cache-control': 'no-cache' });
-        return response.end(file);
+        return sendAsset(request, response, join(publicDirectory, url.pathname.slice(1)), url.pathname.endsWith('.js') ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8');
+      }
+      // A widget of Home, read here (homeWidget above): only from this Mac's own pages.
+      if (request.method === 'GET' && url.pathname === '/api/salas/widget') {
+        const reading = await homeWidget(String(url.searchParams.get('kind') ?? ''));
+        if (!reading) return sendJson(response, 404, { error: t('Home has no widget by that name.') });
+        return sendJson(response, 200, reading);
+      }
+      // Which projects use the local AI (src/local-ai.mjs): the mode and each project's switch,
+      // written once in config.json and applied at once in every open project.
+      if (url.pathname === '/api/salas/local-ai' && (request.method === 'GET' || request.method === 'POST')) {
+        if (request.method === 'POST') {
+          const patch = await body(request);
+          const before = await readConfig(root);
+          const rooms = patch?.rooms && typeof patch.rooms === 'object' ? { ...patch.rooms } : {};
+          // A new mode changes what NEW projects get; the ones already here keep what they had.
+          if (patch?.mode && patch.mode !== localAiConfig(before).mode) {
+            const salasId = salasRoomId(root);
+            const ids = (await knownRooms(root)).map((one) => one.id);
+            if (!salasRoom) ids.push(thisRoomId);
+            for (const id of ids) if (id !== salasId && !(id in rooms)) rooms[id] = localAiFor(before, id).chosen;
+          }
+          await updateConfig(root, localAiPatch(before, { mode: patch?.mode, rooms }));
+          await wireOllama({ probe: false });
+          widgetReadings.delete('models');
+        }
+        const config = await readConfig(root);
+        const salas = salasRoomId(root);
+        const known = (await knownRooms(root)).filter((one) => one.id !== salas);
+        // The project serving this page is one of them even before Home has listed it.
+        if (!salasRoom && !known.some((one) => one.id === thisRoomId)) known.push({ id: thisRoomId, name: basename(canonicalProjectRoot), open: { port: null } });
+        const later = [];
+        if (request.method === 'POST') {
+          await Promise.all(known.filter((one) => one.open && one.id !== thisRoomId).map(async (one) => {
+            const answer = await askRoom(one.open.port, '/api/local-ai/apply', { method: 'POST', timeoutMs: 6000 });
+            if (answer.unreachable || answer.outdated) later.push(one.name);
+          }));
+        }
+        const projects = known.map((one) => ({ id: one.id, name: one.name, open: Boolean(one.open), ...localAiFor(config, one.id) }));
+        return sendJson(response, 200, { ...localAiConfig(config), master: localAiFor(config).master, ollama: { running: Boolean(ollama.running), models: (ollama.models ?? []).length }, projects, later });
       }
       if (request.method === 'GET' && url.pathname === '/api/salas') {
         const rooms = await knownRooms(root);
         const here = basename(roomDir);
+        const own = await roomLooks(root);
+        // A project that never chose its own wears the wallpaper every page shared before.
+        const before = (await readLooks(root)).looks['pulse.wallpaper'] ?? null;
         const seen = await Promise.all(rooms.map(async (one) => ({
           ...one,
           here: one.id === here,
-          glance: one.open ? await askRoom(one.open.port, '/api/glance?census=1') : null,
+          glance: await lobbyGlance(one),
+          wallpaper: own[one.id]?.wallpaper ?? before,
         })));
         // The links in force (docs/MACROVERSO.md, fase 3c), each with what crossed: counted from the
         // lines the serving room keeps beside its record, never from a ledger. `salas` is the id of
         // the room of Salas, whether or not that room exists yet (phase 3d).
         const salas = salasRoomId(root);
         const enlaces = await Promise.all(activeContracts(await readConfig(root), { salas }).map(async (contract) => ({ ...contract, traffic: await linkTraffic(servingRooms(contract).map((id) => join(root, 'rooms', id)), contract) })));
-        return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: roomLanguage(), here, version: PACKAGE.version ?? null, rooms: seen, handoff: (await readHandoff(root)).mac ?? null, salas, enlaces, phonePreview: await phonePreview() });
+        return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: roomLanguage(), languageChosen, here, version: PACKAGE.version ?? null, rooms: seen, handoff: (await readHandoff(root)).mac ?? null, salas, enlaces, phonePreview: await phonePreview() });
       }
       // The open rooms, each in one line (its glance: who works, who waits, its last conversation;
       // never its census or the links), for the room's switcher (2026-10-10), asked every few
@@ -1649,9 +1931,18 @@ export async function createPulseServer({
         if (!room) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
         if (room.open) return sendJson(response, 200, { room: room.id, port: room.open.port, already: true });
         if (!room.root) return sendJson(response, 404, { error: t('The folder of that project is no longer on this Mac.') });
+        // Where start.log stood before this try: only what this one wrote is read if it fails.
+        const logFrom = await stat(join(root, 'rooms', room.id, 'start.log')).then((info) => info.size, () => 0);
         startRoom({ projectRoot: room.root, roomDir: join(root, 'rooms', room.id) });
         const up = await roomComesUp(root, room.id);
-        if (!up) return sendJson(response, 504, { error: t('The project did not open. What it said on the way up is in start.log, beside its record.') });
+        if (!up) {
+          // The commonest reason, said as itself: another MADRE (another Home, `madre start`) already
+          // has this folder open, and one folder is one room. Where it is, so the person can go there.
+          const said = (await readFile(join(root, 'rooms', room.id, 'start.log'), 'utf8').catch(() => '')).slice(logFrom);
+          const there = [...said.matchAll(/already open for this project\s+(http:\/\/127\.0\.0\.1:\d+)/g)].at(-1)?.[1];
+          if (there) return sendJson(response, 409, { error: t('This project is already open in another MADRE, at {address}. Use that one, or close it there first.', { address: there }), address: there });
+          return sendJson(response, 504, { error: t('The project did not open. What it said on the way up is in start.log, beside its record.') });
+        }
         return sendJson(response, 200, { room: up.id, port: up.open.port });
       }
       // ---- The lobby adds projects (2026-10-10, src/salas.mjs). Only this page, on this Mac: a
@@ -1922,7 +2213,7 @@ export async function createPulseServer({
       if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/recall') {
         const payload = await body(request).catch(() => ({}));
         if (request.headers.origin === undefined) return sendJson(response, 403, { error: t('This is changed by you, from Home.') });
-        if (typeof payload.recall !== 'boolean') return sendJson(response, 422, { error: t('recall is on or off.') });
+        if (typeof payload.recall !== 'boolean') return sendJson(response, 422, { error: t('automatic recall can only be on or off.') });
         const contract = await recallContract(root, String(payload.id ?? ''), payload.recall, { salas: salasRoomId(root) });
         if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
         return sendJson(response, 200, { contract });
@@ -2018,6 +2309,7 @@ export async function createPulseServer({
           // wins over the config here as it does everywhere else, and reading the file again
           // would hand the page a different answer from the one the server itself is using.
           language: roomLanguage(),
+          languageChosen,
           // Which conversation this page is looking at, and the others it could open.
           chats: await chatsView(),
           agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })),
@@ -2040,10 +2332,11 @@ export async function createPulseServer({
           control: room.control(),
           sessions,
           sessionsAt,
+          login: loginState(),
           capabilities: room.capabilities(),
           quotaSources: quotaMonitor.snapshot(),
           budgetWindow: room.budgetWindow(),
-          events: await store.readAll(),
+          events: forThePage(await store.readAll()),
         });
       }
       if (request.method === 'GET' && url.pathname === '/api/events') {
@@ -2237,18 +2530,58 @@ export async function createPulseServer({
         if ((mode !== 3 && mode !== 4) || !agents.some((one) => one.id === agent)) return sendJson(response, 400, { error: t('Unlock #3 or #4 for an agent of this project.') });
         const now = Date.now();
         while (keyMisses.length && keyMisses[0] < now - 60000) keyMisses.shift();
-        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong keys. Wait a minute and try again.') });
+        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong confirmations. Wait a minute and try again.') });
         if (!keyHolds(overrideConfig, { mode, words: payload.words, designation: basename(canonicalProjectRoot) })) {
           keyMisses.push(now);
           return sendJson(response, 403, { error: t('That is not it. Try again, or cancel.'), denied: true });
         }
-        return sendJson(response, 200, issuePass(agent, mode));
+        return sendJson(response, 200, issuePass(agent, mode, Number(payload.minutes) || 0));
+      }
+      // The copilot: what it is now, turning it on with the #3 key for a chosen while, turning it off.
+      if (request.method === 'GET' && url.pathname === '/api/copilot') return sendJson(response, 200, copilotState());
+      if (request.method === 'POST' && url.pathname === '/api/copilot') {
+        if (viaPhone) return sendJson(response, 403, { error: t('The copilot is turned on from the computer, not from the phone.') });
+        const payload = await body(request).catch(() => ({}));
+        const minutes = Number(payload.minutes);
+        if (!COPILOT_WINDOWS.includes(minutes)) return sendJson(response, 400, { error: t('Choose how long the copilot lasts: up to 24 hours.') });
+        const now = Date.now();
+        while (keyMisses.length && keyMisses[0] < now - 60000) keyMisses.shift();
+        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong confirmations. Wait a minute and try again.') });
+        if (!keyHolds(overrideConfig, { mode: 3, words: payload.words, designation: basename(canonicalProjectRoot) })) {
+          keyMisses.push(now);
+          return sendJson(response, 403, { error: t('That is not it. Try again, or cancel.'), denied: true });
+        }
+        if (copilot) clearTimeout(copilot.timer);
+        const until = now + minutes * 60000;
+        copilot = { since: now, until, minutes, timer: setTimeout(() => { void endCopilot('time'); }, minutes * 60000) };
+        copilot.timer.unref?.();
+        await room.record('copilot.started', { until: new Date(until).toISOString(), minutes });
+        return sendJson(response, 200, copilotState());
+      }
+      if (request.method === 'POST' && url.pathname === '/api/copilot/off') {
+        await endCopilot('human');
+        return sendJson(response, 200, copilotState());
+      }
+      // This project's switch for the local AI (src/local-ai.mjs). In «auto» Home decides and the
+      // switch does not move; /apply is how Home tells an open project the choice changed.
+      if (request.method === 'GET' && url.pathname === '/api/local-ai') return sendJson(response, 200, { project: await localAiHere(), running: Boolean(ollama.running) });
+      if (request.method === 'POST' && url.pathname === '/api/local-ai/apply') {
+        const status = await wireOllama({ probe: false });
+        return sendJson(response, 200, { project: status.project });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/local-ai') {
+        const patch = await body(request);
+        if (typeof patch?.on !== 'boolean') return sendJson(response, 400, { error: t('Say on or off.') });
+        if (salasRoom) return sendJson(response, 409, { error: t('The Coordinator follows the local AI switch of Modules.') });
+        const status = await setLocalAiHere(patch.on);
+        if (!status) return sendJson(response, 409, { error: t('Home turns the local AI on in every project. Change it in Home › Settings › Local AI.') });
+        return sendJson(response, 200, { project: status.project });
       }
       if (request.method === 'GET' && url.pathname === '/api/settings') {
         await refreshPrivacy();
         const stored = await readConfig(root);
         if (stored.override) stored.override = publicOverride(stored.override);
-        return sendJson(response, 200, { settings: effectiveSettings(), config: stored, sessions, sessionsAt, loggingIn, agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })) });
+        return sendJson(response, 200, { settings: effectiveSettings(), config: stored, sessions, sessionsAt, loggingIn, login: loginState(), agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })) });
       }
       if (request.method === 'POST' && url.pathname === '/api/settings') {
         const patch = await body(request);
@@ -2258,7 +2591,7 @@ export async function createPulseServer({
           const proof = patch.override.proof;
           delete patch.override.proof;
           if (changeNeedsPhrase(overrideConfig) && !(typeof proof === 'string' && proof.trim() && phraseHash(overrideConfig.phrase.salt, proof) === overrideConfig.phrase.hash)) {
-            return sendJson(response, 403, { error: t('Type your current phrase to change the keys.'), needsPhrase: true });
+            return sendJson(response, 403, { error: t('Type your current phrase to change how modes are confirmed.'), needsPhrase: true });
           }
         }
         return sendJson(response, 200, { settings: await applySettings(patch) });
@@ -2294,6 +2627,12 @@ export async function createPulseServer({
         const payload = request.method === 'POST' ? await body(request).catch(() => ({})) : {};
         // `viaPhone` (encargo §6, excepción 4): a module can refuse the phone by its own hand.
         const result = await moduleRoute.route.handler(await moduleContext(), { request, url, params: moduleRoute.params, payload, viaPhone });
+        // A page instead of JSON, for the one place a browser lands on a module's route on its
+        // own: the way back from a sign-in (Connect MCP's OAuth). Never cached.
+        if (typeof result.html === 'string') {
+          response.writeHead(result.status ?? 200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'" });
+          return response.end(result.html);
+        }
         return sendJson(response, result.status ?? 200, result.body ?? {});
       }
       // Where this room's tokens go: what each block of the briefing has cost, how much came back
@@ -2382,6 +2721,8 @@ export async function createPulseServer({
             reports: Boolean(sentinel.settings().autoReport),
             anthropic: agents.some((agent) => agent.id === 'claude' && agent.ready),
             ollama: Boolean(ollama.running),
+            alive: true,
+            usage: FROM_SOURCE && Boolean(await readSecret(root, OWNER_VAULT, 'usage')),
           },
         }));
       }
@@ -2444,7 +2785,13 @@ export async function createPulseServer({
       // round trip; this is the durable one, shared by every browser on this machine.
       // The looks every page shares (src/looks.mjs): Home and each project are different origins,
       // so the browser alone kept a choice for one page only.
-      if (request.method === 'GET' && url.pathname === '/api/looks') return sendJson(response, 200, await readLooks(root));
+      if (request.method === 'GET' && url.pathname === '/api/looks') return sendJson(response, 200, await readLooks(root, { room: basename(roomDir) }));
+      // This project's own wallpaper («only in this project»), or back to the shared one with null.
+      if (request.method === 'POST' && url.pathname === '/api/looks/room') {
+        const payload = await body(request).catch(() => ({}));
+        const answer = await changeRoomLook(root, basename(roomDir), payload?.wallpaper ?? null);
+        return sendJson(response, answer.error ? 400 : 200, answer);
+      }
       if (request.method === 'POST' && url.pathname === '/api/looks') {
         const answer = await changeLooks(root, await body(request).catch(() => null));
         return sendJson(response, answer.error ? 400 : 200, answer);
@@ -2453,6 +2800,7 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         const language = payload.language === 'en' ? 'en' : 'es';
         await updateConfig(root, { language });
+        languageChosen = true;
         setRoomLanguage(process.env.PULSE_LANGUAGE ?? language);
         return sendJson(response, 200, { language });
       }
@@ -2545,7 +2893,10 @@ export async function createPulseServer({
         if (request.method === 'GET' && url.pathname === '/api/tour') {
           const state = await readTour(root);
           if (viaPhone || !fromHere) return sendJson(response, 200, { version: TOUR_VERSION, state, owed: false, returning: false, chapters: CHAPTERS, hints: HINTS });
-          return sendJson(response, 200, { version: TOUR_VERSION, state, owed: !state.bonjourAt, returning: state.path ? state.path === 'back' : await cameBefore(root), chapters: CHAPTERS, hints: HINTS });
+          // Where this person comes from: the tour of 1.0 (path «since»), 0.7.2 (their words in a room's
+          // record, path «back»), or nowhere — a first install.
+          const from = state.path === 'since' || (!state.path && state.before === '1.0') ? '1.0' : (state.path ? state.path === 'back' : await cameBefore(root)) ? '0.7.2' : null;
+          return sendJson(response, 200, { version: TOUR_VERSION, state, owed: !state.bonjourAt, returning: Boolean(from), from, chapters: CHAPTERS, hints: HINTS });
         }
         if (viaPhone || !fromHere || (request.method === 'POST' && request.headers.origin !== `http://${host}`)) return sendJson(response, 403, { error: t('This is done on the Mac.') });
         if (request.method === 'POST' && url.pathname === '/api/tour') {
@@ -2617,7 +2968,7 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         const result = await room.code000({ strikes: Number(payload.strikes) || CODE000_STRIKES });
-        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('Security is silent.') });
+        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('The Security module did not respond.') });
       }
       if (request.method === 'GET' && url.pathname === '/api/memory') {
         if (!designationOk(url.searchParams.get('designation'))) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
@@ -2841,7 +3192,7 @@ export async function createPulseServer({
       if (request.method === 'POST' && url.pathname === '/api/agents/probe') {
         // Look for the binaries again too: a CLI installed a moment ago must appear now.
         await redetectAgents();
-        return sendJson(response, 200, { sessions, sessionsAt, agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })) });
+        return sendJson(response, 200, { sessions, sessionsAt, loggingIn, login: loginState(), agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })) });
       }
       // A provider key for a CLI that signs in from its own prompt. Local connections only: a key
       // pasted from another machine would travel the network. It is written where that CLI looks
@@ -2906,17 +3257,72 @@ export async function createPulseServer({
       }
       const loginMatch = request.method === 'POST' && url.pathname.match(/^\/api\/agents\/([a-z0-9-]+)\/login$/);
       if (loginMatch) {
-        const result = await loginAgent(loginMatch[1]);
+        const payload = await body(request).catch(() => ({}));
+        const result = await loginAgent(loginMatch[1], { method: payload.method ? String(payload.method) : null });
+        return sendJson(response, result.status, result.body);
+      }
+      // The code the sign-in page gives back. It is a credential while it lives, so it is taken
+      // from this computer only — the same rule as a key — and it never reaches the ledger.
+      const loginCodeMatch = request.method === 'POST' && url.pathname.match(/^\/api\/agents\/([a-z0-9-]+)\/login\/code$/);
+      if (loginCodeMatch) {
+        const address = request.socket.remoteAddress ?? '';
+        if (viaPhone || !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) {
+          return sendJson(response, 403, { error: t('A key is only accepted from this computer, never over the network.') });
+        }
+        const payload = await body(request).catch(() => ({}));
+        const result = await answerLogin(loginCodeMatch[1], payload.code);
+        return sendJson(response, result.status, result.body);
+      }
+      const loginStopMatch = request.method === 'POST' && url.pathname.match(/^\/api\/agents\/([a-z0-9-]+)\/login\/cancel$/);
+      if (loginStopMatch) {
+        const result = await cancelLogin(loginStopMatch[1]);
         return sendJson(response, result.status, result.body);
       }
       if (request.method === 'GET' && url.pathname === '/api/models') {
+        // `--verbose` adds each model's metadata, its «variants» (the reasoning rungs) among it.
         const listOpenCode = async (opencode) => {
-          const models = [];
-          await runInstaller({ command: opencode.path, args: ['models'], projectRoot: canonicalProjectRoot, timeoutMs: 20000, onLine: (line) => { if (/^[\w.-]+\/[\w.:-]+$/.test(line.trim())) models.push(line.trim()); } });
-          return models;
+          const lines = [];
+          await runInstaller({ command: opencode.path, args: ['models', '--verbose'], projectRoot: canonicalProjectRoot, timeoutMs: 30000, onLine: (line) => { lines.push(line); } });
+          return parseOpenCodeVerbose(lines);
         };
         return sendJson(response, 200, { models: await discoverModels({ agents, config: await readConfig(root), listOpenCode: url.searchParams.get('opencode') === '1' ? listOpenCode : async () => [] }) });
       }
+      // OpenCode's providers for AJUSTES: who has a key or an account, what each offers, which are
+      // left out of the chooser. Never a key: only that one is there and of what kind.
+      if (request.method === 'GET' && url.pathname === '/api/agents/opencode/providers') {
+        const opencode = agents.find((agent) => agent.id === 'opencode');
+        if (!opencode?.detected) return sendJson(response, 404, { error: t('OpenCode is not installed.') });
+        const names = [];
+        await runInstaller({ command: opencode.path, args: ['models'], projectRoot: canonicalProjectRoot, timeoutMs: 20000, onLine: (line) => { if (/^[\w.-]+\/[\w.:/-]+$/.test(line.trim())) names.push(line.trim()); } });
+        const config = await readConfig(root);
+        const hidden = new Set(openCodeHidden(config));
+        const signed = new Map((await readOpenCodeProviders({ home: credentialHome })).map((one) => [one.id, one.type]));
+        const groups = new Map(groupOpenCode(names).map((group) => [group.id, group]));
+        // Every provider a key opens, from OpenCode's own catalogue (credentials.mjs), plus the
+        // ones already signed in or listing models.
+        const keyable = new Map((await openCodeKeyProviders({ home: credentialHome })).map((one) => [one.id, one]));
+        const ids = [...new Set([...keyable.keys(), ...signed.keys(), ...groups.keys()])];
+        const providers = ids.map((id) => {
+          const known = keyable.get(id);
+          const own = id === OPENCODE_OWN;
+          const via = own ? 'own' : signed.get(id) ?? null;
+          return { id, label: known?.label ?? providerLabel(id), keyUrl: known?.keyUrl ?? null, takesKey: Boolean(known), featured: Boolean(known?.featured), via, models: groups.get(id)?.models ?? [], hidden: hidden.has(id) };
+        }).sort((a, b) => Number(Boolean(b.via)) - Number(Boolean(a.via)) || Number(a.via === 'own') - Number(b.via === 'own') || a.label.localeCompare(b.label));
+        return sendJson(response, 200, { providers, default: process.env.PULSE_OPENCODE_MODEL ?? null });
+      }
+      // A provider's key out of OpenCode, from this computer only, the same rule as putting one in.
+      if (request.method === 'POST' && url.pathname === '/api/agents/opencode/providers/remove') {
+        const address = request.socket.remoteAddress ?? '';
+        if (viaPhone || !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) return sendJson(response, 403, { error: t('A key is only changed from this computer, never over the network.') });
+        const opencode = agents.find((agent) => agent.id === 'opencode');
+        if (!opencode?.detected) return sendJson(response, 412, { error: t('OpenCode is not installed.') });
+        const payload = await body(request).catch(() => ({}));
+        const result = await removeOpenCodeKey({ provider: payload.provider, home: credentialHome, executable: opencode.path ?? 'opencode' });
+        if (!result.ok) return sendJson(response, 422, { error: result.error });
+        await refreshSessions();
+        await room.record('connection.key.removed', { agent: 'opencode', label: opencode.label, provider: payload.provider });
+        return sendJson(response, 200, { ok: true });
+      }
       if (request.method === 'GET' && url.pathname === '/api/agents/opencode/models') {
         const opencode = agents.find((agent) => agent.id === 'opencode');
         if (!opencode?.detected) return sendJson(response, 404, { error: t('OpenCode is not installed.') });
@@ -2950,6 +3356,7 @@ export async function createPulseServer({
         // Every conversation at work, not only the one on screen: the brake is the room's, not the chat's.
         const result = await room.stopAll();
         passes.clear();
+        await endCopilot('stopall');
         for (const held of parked.values()) {
           const more = await held.room.stopAll().catch(() => ({ plans: 0, turns: 0 }));
           result.plans += more.plans ?? 0;
@@ -2981,9 +3388,18 @@ export async function createPulseServer({
         if (typeof payload.responseMessageId !== 'string' || !Number.isInteger(index) || index < 0) return sendJson(response, 400, { error: t('Name the request and the line to run.') });
         const here = await scopeOf(url);
         if (here.error) return sendJson(response, 404, here);
-        const outcome = await here.room.runRequested({ responseMessageId: payload.responseMessageId, index });
+        const outcome = await here.room.runRequested({ responseMessageId: payload.responseMessageId, index, returnCap: viaPhone ? PHONE_MAX_MODE : 3 });
         return sendJson(response, outcome.status, outcome.ok ? outcome.result : { error: outcome.error });
       }
+      // The human ran some lines of a request and hands back what there is, without the rest.
+      if (request.method === 'POST' && url.pathname === '/api/runs/return') {
+        const payload = await body(request).catch(() => ({}));
+        if (typeof payload.responseMessageId !== 'string') return sendJson(response, 400, { error: t('Say which request to hand back.') });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const outcome = await here.room.returnRun({ responseMessageId: payload.responseMessageId, returnCap: viaPhone ? PHONE_MAX_MODE : 3 });
+        return sendJson(response, outcome.status, outcome.ok ? outcome : { error: outcome.error });
+      }
       if (request.method === 'GET' && url.pathname === '/api/commands') {
         const ctx = await moduleContext();
         const fromModules = await Promise.all(moduleCommands().map(async (command) => {
@@ -3087,11 +3503,16 @@ export async function createPulseServer({
       }
       if (request.method === 'POST' && /^\/api\/modes\/[\w-]+\/decide$/.test(url.pathname)) {
         const requestId = url.pathname.split('/')[3];
-        const { decision } = await body(request);
+        const { decision, key } = await body(request);
         const here = await scopeOf(url);
         if (here.error) return sendJson(response, 404, here);
-        // From a phone a mode is granted up to #2, as it is asked for up to #2.
-        if (viaPhone && decision !== 'deny' && (here.room.modeAsked(requestId) ?? 0) > PHONE_MAX_MODE) return sendJson(response, 403, { error: t('#3 EDIT and #4 FULL ACCESS are opened from the Mac.') });
+        if (!['once', 'plan', 'deny'].includes(decision)) return sendJson(response, 400, { error: t('Decision must be once, plan or deny.') });
+        const asked = here.room.modeRequest(requestId);
+        if (!asked) return sendJson(response, 409, { error: t('That request is no longer pending.') });
+        if (decision !== 'deny' && asked.mode > PHONE_MAX_MODE) {
+          if (viaPhone) return sendJson(response, 403, { error: t('#3 EDIT and #4 FULL ACCESS are opened from the Mac.') });
+          if (!spendPass(key, asked.agent, asked.mode)) return sendJson(response, 403, { error: t('#{n} needs your confirmation. Unlock it again and send.', { n: asked.mode }), needsKey: true });
+        }
         const result = here.room.decideMode(requestId, decision);
         return sendJson(response, result.ok ? 200 : 409, result);
       }
@@ -3110,12 +3531,20 @@ export async function createPulseServer({
         const here = await scopeOf(url);
         if (here.error) return sendJson(response, 404, here);
         const room = here.room;
+        // A copilot message at #3 goes with the copilot's window instead of a pass; from this
+        // computer only. With the window closed it is said, and the page asks for the key again.
+        if (payload.copilot === true && (viaPhone || !copilotNow())) {
+          if (!viaPhone) return sendJson(response, 409, { error: t('The copilot is off: it ended or was stopped. Turn it on again, or send and confirm #3.'), copilotOff: true });
+          delete payload.copilot;
+        }
         // Modes are checked before the turn is accepted, so the composer
         // hears "no" with a reason instead of a silent log line.
         const gate = await room.modeCheck(payload);
         if (!gate.ok) return sendJson(response, gate.status ?? 403, { error: gate.error, mode: gate.mode, maxMode: gate.maxMode });
+        const byCopilot = payload.copilot === true && gate.mode === 3;
+        if (!byCopilot) delete payload.copilot;
         // #3 and #4 go with the pass their key gave, for this agent (above).
-        if (gate.mode >= 3 && !spendPass(payload.key, gate.agent, gate.mode)) return sendJson(response, 403, { error: t('#{n} needs its key. Unlock it again and send.', { n: gate.mode }), mode: gate.mode, needsKey: true });
+        if (gate.mode >= 3 && !byCopilot && !spendPass(payload.key, gate.agent, gate.mode)) return sendJson(response, 403, { error: t('#{n} needs your confirmation. Unlock it again and send.', { n: gate.mode }), mode: gate.mode, needsKey: true });
         delete payload.key;
         const turns = await turnsPolicy();
         if (turns.enabled) {
@@ -3181,6 +3610,7 @@ export async function createPulseServer({
     return server;
   };
   server.on('close', () => quotaMonitor.stop());
+  server.on('close', () => { for (const timer of aliveTimers) clearTimeout(timer); });
 
   server.on('close', () => { void phone.stop(); });
   return { server, store, agents, quotaMonitor, markOpen, releaseOpen, phone };