@jossuealcala/madre 1.0.1 → 1.0.2

package/src/server.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import http from 'node:http';
 import { readFile, realpath, writeFile, mkdir, cp, rename, access, stat } from 'node:fs/promises';
 import { existsSync, openSync, rmSync } from 'node:fs';
@@ -6,6 +8,7 @@ import { probePort, framable } from './ports.mjs';
 import { ControlDesk } from './room/control.mjs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { gzipSync } from 'node:zlib';
 import { homedir, hostname } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -60,10 +63,11 @@ export function injectRipleyBridge(body) {
 import { QuotaMonitor } from './quota-monitor.mjs';
 import { defaultQuotaSources } from './quota-sources.mjs';
 import { Room } from './room.mjs';
-import { changeNeedsPhrase, keyHolds, mergeOverride, overrideSettings, phraseHash, publicOverride } from './override.mjs';
+import { COPILOT_WINDOWS } from './room/copilot.mjs';
+import { OVERRIDE_GRACE, changeNeedsPhrase, keyHolds, mergeOverride, overrideSettings, phraseHash, publicOverride } from './override.mjs';
 import { extensionById, findOnPath, runInstaller } from './extensions.mjs';
 import { accountNoteFor, installPlanFor, looksLikeAdminProblem, loginPlanFor, looksLikeCodePrompt, probeAgentAuth, probeAll, TAKES_KEY } from './auth-probe.mjs';
-import { applyKey, keyPlanFor, OPENCODE_PROVIDERS, readOpenCodeProviders, removeOpenCodeKey } from './credentials.mjs';
+import { applyKey, keyPlanFor, openCodeKeyProviders, readOpenCodeProviders, removeOpenCodeKey } from './credentials.mjs';
 import { forgetSecret, readSecret, summary as vaultSummary, writeSecret } from './vault.mjs';
 import { applyConfigToEnv, loadConfig as readConfig, updateConfig } from './config.mjs';
 import { Privacy, normalizeTerms, privacySettings } from './privacy.mjs';
@@ -78,7 +82,7 @@ import { moduleUpdate } from './modules/updates.mjs';
 import { adoptStrays, chatIndex, chatLedger, createChat, deleteChat, isChatId, listChats, openChat as openChatIndex, projectFloor, renameChat, touchChat } from './chats.mjs';
 import { spawn } from 'node:child_process';
 import { cpus, freemem, loadavg, totalmem } from 'node:os';
-import { discoverModels, groupOpenCode, openCodeHidden, providerLabel, OPENCODE_OWN } from './models.mjs';
+import { discoverModels, groupOpenCode, openCodeHidden, parseOpenCodeVerbose, providerLabel, OPENCODE_OWN } from './models.mjs';
 import { observable } from './modules/intents-observe.mjs';
 import { normalizeMode, setImageModule } from './capabilities.mjs';
 import { resolveGeminiKey } from './image-studio.mjs';
@@ -110,6 +114,41 @@ import { CHANNEL_HEADER, MAX_LIMIT as ENLACE_MAX_LIMIT, NO_SUCH_LINK, NOTICES as
 const sourceDirectory = dirname(fileURLToPath(import.meta.url));
 const publicDirectory = join(sourceDirectory, '..', 'public');
 
+// The page's own scripts and styles (2026-10-15): an ETag from the file's size and time, so a
+// reload that finds them unchanged gets «304» and the browser reuses its copy — and the code it
+// already compiled — instead of reading 2.5 MB again; and gzip for whoever asks, compressed once per
+// change of the file. `no-cache` still revalidates every time, so an edit shows on the next load.
+// Only the compressed copy is kept in memory (~0.6 MB for all of them); the plain file is read when
+// a client does not take gzip.
+const assetCache = new Map();
+async function sendAsset(request, response, file, type) {
+  const info = await stat(file);
+  const tag = `W/"${info.size.toString(36)}-${Math.floor(info.mtimeMs).toString(36)}"`;
+  const headers = { 'content-type': type, 'cache-control': 'no-cache', etag: tag, vary: 'accept-encoding' };
+  if (request.headers['if-none-match'] === tag) { response.writeHead(304, headers); return response.end(); }
+  const gzip = /\bgzip\b/.test(String(request.headers['accept-encoding'] ?? '')) && info.size > 8192;
+  if (gzip) {
+    let held = assetCache.get(file);
+    if (held?.tag !== tag) { held = { tag, body: gzipSync(await readFile(file), { level: 6 }) }; assetCache.set(file, held); }
+    response.writeHead(200, { ...headers, 'content-encoding': 'gzip', 'content-length': held.body.length });
+    return response.end(held.body);
+  }
+  const body = await readFile(file);
+  response.writeHead(200, { ...headers, 'content-length': body.length });
+  return response.end(body);
+}
+
+// The record as a page opening it needs it (2026-10-15). `quota.updated` is how full each agent's
+// window is, read again every few minutes; the page keeps only the last reading of each agent, so
+// every older one was downloaded, parsed and drawn for nothing — 87% of a long conversation's
+// record, and seconds of drawing. The ledger keeps them all; the page gets the newest of each.
+export function forThePage(events) {
+  const lastQuota = new Map();
+  for (const event of events) if (event?.type === 'quota.updated') lastQuota.set(event.payload?.agent ?? null, event);
+  const keep = new Set(lastQuota.values());
+  return events.filter((event) => event?.type !== 'quota.updated' || keep.has(event));
+}
+
 function sendJson(response, status, value) {
   response.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
   response.end(JSON.stringify(value));
@@ -207,6 +246,9 @@ export async function createPulseServer({
   // What language the screens speak. The prompt the agents read is not one of them, and the
   // environment wins over the file, as it does for every other setting here.
   setRoomLanguage(process.env.PULSE_LANGUAGE ?? (await readConfig(root)).language);
+  // Whether anyone set it: a MADRE nobody has set takes the language of the first browser that
+  // opens it (public/i18n.js, browserLanguage), once, and keeps it as if it had been chosen.
+  let languageChosen = Boolean(process.env.PULSE_LANGUAGE || (await readConfig(root)).language);
   // RIPLEY renders HTML in the viewer only while the human has it switched on; read live, the switch is the module's.
   const ripleyOn = async () => Boolean((await readConfig(root)).modules?.ripley?.enabled);
   agentTimeouts ??= agentTimeoutsFromEnv();
@@ -557,7 +599,7 @@ export async function createPulseServer({
     wireLocal(room);
     for (const held of parked.values()) wireLocal(held.room);
     if (room) {
-      if (changed) await room.record('agents.updated', { agents: agents.map((agent) => ({ id: agent.id, label: agent.label, detected: agent.detected, ready: agent.ready, version: agent.version, local: Boolean(agent.local), route: agent.route ?? null })), removed: fifth.ready ? [] : [MADRE_AGENT_ID], reason: fifth.ready ? `@madre is in the room · ${fifth.version}` : '@madre left the room: Ollama has no chat model running' });
+      if (changed) await room.record('agents.updated', { agents: agents.map((agent) => ({ id: agent.id, label: agent.label, detected: agent.detected, ready: agent.ready, version: agent.version, local: Boolean(agent.local), route: agent.route ?? null })), removed: fifth.ready ? [] : [MADRE_AGENT_ID], reason: fifth.ready ? `@madre is in the project · ${fifth.version}` : '@madre left the project: Ollama has no chat model running' });
       // That a local model is running is not the same as it being of use on this project, and
       // the second thing is the one a person needs told. Said once per model, in the room, with
       // the one button that settles it — the crew line above fires only when the crew CHANGES,
@@ -602,8 +644,10 @@ export async function createPulseServer({
   const passes = new Map();          // token -> { agent, mode, until, once }
   const keyMisses = [];              // when the last wrong keys were typed
   const PASS_ONCE_MS = 30 * 60 * 1000;
-  function issuePass(agent, mode) {
-    const minutes = overrideConfig.grace[mode] ?? 0;
+  // `asked` is a window the human chose on an agent's request for this mode (2026-10-14): one of
+  // the windows the project allows, never longer, and only for that agent and mode.
+  function issuePass(agent, mode, asked = 0) {
+    const minutes = asked > 0 && OVERRIDE_GRACE[mode]?.includes(asked) ? asked : overrideConfig.grace[mode] ?? 0;
     const token = randomBytes(24).toString('hex');
     const pass = { agent, mode, until: Date.now() + (minutes ? minutes * 60000 : PASS_ONCE_MS), once: !minutes };
     passes.set(token, pass);
@@ -616,6 +660,18 @@ export async function createPulseServer({
     if (pass.once) passes.delete(token);
     return true;
   }
+  // The copilot (src/room/copilot.mjs): one window for the project, opened with the #3 key, up to
+  // 24 hours. In memory only, like the passes: a restart and STOP ALL close it. Every conversation
+  // of the project asks this one when it decides whether a message is a copilot's.
+  let copilot = null;                 // { since, until, minutes, timer }
+  const copilotNow = () => (copilot && copilot.until > Date.now() ? { since: copilot.since, until: copilot.until, minutes: copilot.minutes } : null);
+  const copilotState = () => ({ active: Boolean(copilotNow()), ...(copilotNow() ?? {}), windows: COPILOT_WINDOWS });
+  async function endCopilot(reason) {
+    if (!copilot) return;
+    clearTimeout(copilot.timer);
+    copilot = null;
+    await room.record('copilot.ended', { reason }).catch(() => null);
+  }
   let listening = null;
   const listeningPort = () => listening?.address?.()?.port ?? Number(process.env.PULSE_PORT ?? 4317);
   // One CONTROL desk for the whole project, shared by every conversation alive at once: a single
@@ -635,6 +691,7 @@ export async function createPulseServer({
     bishopForTurn: salasRoom ? async (turn) => moduleById('bishop').promptForTurn({ ...(await moduleContext()), record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }, turn) : null,
     // Fase 3e: notes a link with automatic recall brings to a turn. Never in the room of Salas
     // (BISHOP has its own); recorded in the conversation of the turn that read them.
+    copilot: copilotNow,
     linkedForTurn: salasRoom ? null : async (turn) => recallForTurn(await moduleContext(), { ...turn, port: listeningPort(), roomDir,
       record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }),
     softTokenBudget,
@@ -1123,8 +1180,9 @@ export async function createPulseServer({
     // its own takes the first thing the human said in it.
     unsubscribeChats = room.subscribe((event) => {
       if (event?.type !== 'message.created' || event.ghost) return;
+      // A message MADRE wrote for the human (results going back) neither names nor previews it.
       const human = event.payload?.role === 'user';
-      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
+      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human && !event.payload?.auto ? saidText(event.payload) : null, counts: human })).catch(() => null);
     });
     unsubscribeActivity = watchActivity(room, chatId);
     sentinel.seed(historicalEvents);
@@ -1221,7 +1279,7 @@ export async function createPulseServer({
     const offTouch = target.subscribe((event) => {
       if (event?.type !== 'message.created' || event.ghost) return;
       const human = event.payload?.role === 'user';
-      chatWrites = chatWrites.then(() => touchChat(roomDir, id, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
+      chatWrites = chatWrites.then(() => touchChat(roomDir, id, { text: human && !event.payload?.auto ? saidText(event.payload) : null, counts: human })).catch(() => null);
     });
     const offActivity = watchActivity(target, id);
     const offModules = wireModules(target, id);
@@ -1611,15 +1669,11 @@ export async function createPulseServer({
         response.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...PAGE_GUARDS });
         return response.end(html);
       }
-      if (request.method === 'GET' && ['/app.js', '/nostromo-engine.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/editor.js', '/routing.js', '/abduction.js', '/review-ask.js', '/loader.js', '/tour.js', '/tour-chapters.js', '/touch.js'].includes(url.pathname)) {
-        const js = await readFile(join(publicDirectory, url.pathname.slice(1)));
-        response.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });
-        return response.end(js);
+      if (request.method === 'GET' && ['/app.js', '/nostromo-engine.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/editor.js', '/routing.js', '/abduction.js', '/review-ask.js', '/loader.js', '/tour.js', '/tour-chapters.js', '/touch.js', '/attribution.js'].includes(url.pathname)) {
+        return sendAsset(request, response, join(publicDirectory, url.pathname.slice(1)), 'text/javascript; charset=utf-8');
       }
       if (request.method === 'GET' && url.pathname === '/styles.css') {
-        const css = await readFile(join(publicDirectory, 'styles.css'));
-        response.writeHead(200, { 'content-type': 'text/css; charset=utf-8' });
-        return response.end(css);
+        return sendAsset(request, response, join(publicDirectory, 'styles.css'), 'text/css; charset=utf-8');
       }
       const abductionAssets = new Map([
         ['/assets/abduction-cat.png', 'abduction-cat.png'],
@@ -1773,9 +1827,7 @@ export async function createPulseServer({
         return response.end(html);
       }
       if (request.method === 'GET' && (url.pathname === '/salas-mac.js' || url.pathname === '/salas-mac.css' || url.pathname === '/macroverso.js')) {
-        const file = await readFile(join(publicDirectory, url.pathname.slice(1)));
-        response.writeHead(200, { 'content-type': url.pathname.endsWith('.js') ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8', 'cache-control': 'no-cache' });
-        return response.end(file);
+        return sendAsset(request, response, join(publicDirectory, url.pathname.slice(1)), url.pathname.endsWith('.js') ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8');
       }
       // A widget of Home, read here (homeWidget above): only from this Mac's own pages.
       if (request.method === 'GET' && url.pathname === '/api/salas/widget') {
@@ -1833,7 +1885,7 @@ export async function createPulseServer({
         // the room of Salas, whether or not that room exists yet (phase 3d).
         const salas = salasRoomId(root);
         const enlaces = await Promise.all(activeContracts(await readConfig(root), { salas }).map(async (contract) => ({ ...contract, traffic: await linkTraffic(servingRooms(contract).map((id) => join(root, 'rooms', id)), contract) })));
-        return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: roomLanguage(), here, version: PACKAGE.version ?? null, rooms: seen, handoff: (await readHandoff(root)).mac ?? null, salas, enlaces, phonePreview: await phonePreview() });
+        return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: roomLanguage(), languageChosen, here, version: PACKAGE.version ?? null, rooms: seen, handoff: (await readHandoff(root)).mac ?? null, salas, enlaces, phonePreview: await phonePreview() });
       }
       // The open rooms, each in one line (its glance: who works, who waits, its last conversation;
       // never its census or the links), for the room's switcher (2026-10-10), asked every few
@@ -2161,7 +2213,7 @@ export async function createPulseServer({
       if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/recall') {
         const payload = await body(request).catch(() => ({}));
         if (request.headers.origin === undefined) return sendJson(response, 403, { error: t('This is changed by you, from Home.') });
-        if (typeof payload.recall !== 'boolean') return sendJson(response, 422, { error: t('recall is on or off.') });
+        if (typeof payload.recall !== 'boolean') return sendJson(response, 422, { error: t('automatic recall can only be on or off.') });
         const contract = await recallContract(root, String(payload.id ?? ''), payload.recall, { salas: salasRoomId(root) });
         if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
         return sendJson(response, 200, { contract });
@@ -2257,6 +2309,7 @@ export async function createPulseServer({
           // wins over the config here as it does everywhere else, and reading the file again
           // would hand the page a different answer from the one the server itself is using.
           language: roomLanguage(),
+          languageChosen,
           // Which conversation this page is looking at, and the others it could open.
           chats: await chatsView(),
           agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })),
@@ -2283,7 +2336,7 @@ export async function createPulseServer({
           capabilities: room.capabilities(),
           quotaSources: quotaMonitor.snapshot(),
           budgetWindow: room.budgetWindow(),
-          events: await store.readAll(),
+          events: forThePage(await store.readAll()),
         });
       }
       if (request.method === 'GET' && url.pathname === '/api/events') {
@@ -2477,12 +2530,37 @@ export async function createPulseServer({
         if ((mode !== 3 && mode !== 4) || !agents.some((one) => one.id === agent)) return sendJson(response, 400, { error: t('Unlock #3 or #4 for an agent of this project.') });
         const now = Date.now();
         while (keyMisses.length && keyMisses[0] < now - 60000) keyMisses.shift();
-        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong keys. Wait a minute and try again.') });
+        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong confirmations. Wait a minute and try again.') });
         if (!keyHolds(overrideConfig, { mode, words: payload.words, designation: basename(canonicalProjectRoot) })) {
           keyMisses.push(now);
           return sendJson(response, 403, { error: t('That is not it. Try again, or cancel.'), denied: true });
         }
-        return sendJson(response, 200, issuePass(agent, mode));
+        return sendJson(response, 200, issuePass(agent, mode, Number(payload.minutes) || 0));
+      }
+      // The copilot: what it is now, turning it on with the #3 key for a chosen while, turning it off.
+      if (request.method === 'GET' && url.pathname === '/api/copilot') return sendJson(response, 200, copilotState());
+      if (request.method === 'POST' && url.pathname === '/api/copilot') {
+        if (viaPhone) return sendJson(response, 403, { error: t('The copilot is turned on from the computer, not from the phone.') });
+        const payload = await body(request).catch(() => ({}));
+        const minutes = Number(payload.minutes);
+        if (!COPILOT_WINDOWS.includes(minutes)) return sendJson(response, 400, { error: t('Choose how long the copilot lasts: up to 24 hours.') });
+        const now = Date.now();
+        while (keyMisses.length && keyMisses[0] < now - 60000) keyMisses.shift();
+        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong confirmations. Wait a minute and try again.') });
+        if (!keyHolds(overrideConfig, { mode: 3, words: payload.words, designation: basename(canonicalProjectRoot) })) {
+          keyMisses.push(now);
+          return sendJson(response, 403, { error: t('That is not it. Try again, or cancel.'), denied: true });
+        }
+        if (copilot) clearTimeout(copilot.timer);
+        const until = now + minutes * 60000;
+        copilot = { since: now, until, minutes, timer: setTimeout(() => { void endCopilot('time'); }, minutes * 60000) };
+        copilot.timer.unref?.();
+        await room.record('copilot.started', { until: new Date(until).toISOString(), minutes });
+        return sendJson(response, 200, copilotState());
+      }
+      if (request.method === 'POST' && url.pathname === '/api/copilot/off') {
+        await endCopilot('human');
+        return sendJson(response, 200, copilotState());
       }
       // This project's switch for the local AI (src/local-ai.mjs). In «auto» Home decides and the
       // switch does not move; /apply is how Home tells an open project the choice changed.
@@ -2513,7 +2591,7 @@ export async function createPulseServer({
           const proof = patch.override.proof;
           delete patch.override.proof;
           if (changeNeedsPhrase(overrideConfig) && !(typeof proof === 'string' && proof.trim() && phraseHash(overrideConfig.phrase.salt, proof) === overrideConfig.phrase.hash)) {
-            return sendJson(response, 403, { error: t('Type your current phrase to change the keys.'), needsPhrase: true });
+            return sendJson(response, 403, { error: t('Type your current phrase to change how modes are confirmed.'), needsPhrase: true });
           }
         }
         return sendJson(response, 200, { settings: await applySettings(patch) });
@@ -2549,6 +2627,12 @@ export async function createPulseServer({
         const payload = request.method === 'POST' ? await body(request).catch(() => ({})) : {};
         // `viaPhone` (encargo §6, excepción 4): a module can refuse the phone by its own hand.
         const result = await moduleRoute.route.handler(await moduleContext(), { request, url, params: moduleRoute.params, payload, viaPhone });
+        // A page instead of JSON, for the one place a browser lands on a module's route on its
+        // own: the way back from a sign-in (Connect MCP's OAuth). Never cached.
+        if (typeof result.html === 'string') {
+          response.writeHead(result.status ?? 200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'" });
+          return response.end(result.html);
+        }
         return sendJson(response, result.status ?? 200, result.body ?? {});
       }
       // Where this room's tokens go: what each block of the briefing has cost, how much came back
@@ -2716,6 +2800,7 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         const language = payload.language === 'en' ? 'en' : 'es';
         await updateConfig(root, { language });
+        languageChosen = true;
         setRoomLanguage(process.env.PULSE_LANGUAGE ?? language);
         return sendJson(response, 200, { language });
       }
@@ -2883,7 +2968,7 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         const result = await room.code000({ strikes: Number(payload.strikes) || CODE000_STRIKES });
-        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('Security is silent.') });
+        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('The Security module did not respond.') });
       }
       if (request.method === 'GET' && url.pathname === '/api/memory') {
         if (!designationOk(url.searchParams.get('designation'))) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
@@ -3194,10 +3279,11 @@ export async function createPulseServer({
         return sendJson(response, result.status, result.body);
       }
       if (request.method === 'GET' && url.pathname === '/api/models') {
+        // `--verbose` adds each model's metadata, its «variants» (the reasoning rungs) among it.
         const listOpenCode = async (opencode) => {
-          const models = [];
-          await runInstaller({ command: opencode.path, args: ['models'], projectRoot: canonicalProjectRoot, timeoutMs: 20000, onLine: (line) => { if (/^[\w.-]+\/[\w.:-]+$/.test(line.trim())) models.push(line.trim()); } });
-          return models;
+          const lines = [];
+          await runInstaller({ command: opencode.path, args: ['models', '--verbose'], projectRoot: canonicalProjectRoot, timeoutMs: 30000, onLine: (line) => { lines.push(line); } });
+          return parseOpenCodeVerbose(lines);
         };
         return sendJson(response, 200, { models: await discoverModels({ agents, config: await readConfig(root), listOpenCode: url.searchParams.get('opencode') === '1' ? listOpenCode : async () => [] }) });
       }
@@ -3212,12 +3298,15 @@ export async function createPulseServer({
         const hidden = new Set(openCodeHidden(config));
         const signed = new Map((await readOpenCodeProviders({ home: credentialHome })).map((one) => [one.id, one.type]));
         const groups = new Map(groupOpenCode(names).map((group) => [group.id, group]));
-        const ids = [...new Set([...OPENCODE_PROVIDERS.map((one) => one.id), ...signed.keys(), ...groups.keys()])];
+        // Every provider a key opens, from OpenCode's own catalogue (credentials.mjs), plus the
+        // ones already signed in or listing models.
+        const keyable = new Map((await openCodeKeyProviders({ home: credentialHome })).map((one) => [one.id, one]));
+        const ids = [...new Set([...keyable.keys(), ...signed.keys(), ...groups.keys()])];
         const providers = ids.map((id) => {
-          const known = OPENCODE_PROVIDERS.find((one) => one.id === id);
+          const known = keyable.get(id);
           const own = id === OPENCODE_OWN;
           const via = own ? 'own' : signed.get(id) ?? null;
-          return { id, label: providerLabel(id), keyUrl: known?.keyUrl ?? null, takesKey: Boolean(known), via, models: groups.get(id)?.models ?? [], hidden: hidden.has(id) };
+          return { id, label: known?.label ?? providerLabel(id), keyUrl: known?.keyUrl ?? null, takesKey: Boolean(known), featured: Boolean(known?.featured), via, models: groups.get(id)?.models ?? [], hidden: hidden.has(id) };
         }).sort((a, b) => Number(Boolean(b.via)) - Number(Boolean(a.via)) || Number(a.via === 'own') - Number(b.via === 'own') || a.label.localeCompare(b.label));
         return sendJson(response, 200, { providers, default: process.env.PULSE_OPENCODE_MODEL ?? null });
       }
@@ -3267,6 +3356,7 @@ export async function createPulseServer({
         // Every conversation at work, not only the one on screen: the brake is the room's, not the chat's.
         const result = await room.stopAll();
         passes.clear();
+        await endCopilot('stopall');
         for (const held of parked.values()) {
           const more = await held.room.stopAll().catch(() => ({ plans: 0, turns: 0 }));
           result.plans += more.plans ?? 0;
@@ -3298,9 +3388,18 @@ export async function createPulseServer({
         if (typeof payload.responseMessageId !== 'string' || !Number.isInteger(index) || index < 0) return sendJson(response, 400, { error: t('Name the request and the line to run.') });
         const here = await scopeOf(url);
         if (here.error) return sendJson(response, 404, here);
-        const outcome = await here.room.runRequested({ responseMessageId: payload.responseMessageId, index });
+        const outcome = await here.room.runRequested({ responseMessageId: payload.responseMessageId, index, returnCap: viaPhone ? PHONE_MAX_MODE : 3 });
         return sendJson(response, outcome.status, outcome.ok ? outcome.result : { error: outcome.error });
       }
+      // The human ran some lines of a request and hands back what there is, without the rest.
+      if (request.method === 'POST' && url.pathname === '/api/runs/return') {
+        const payload = await body(request).catch(() => ({}));
+        if (typeof payload.responseMessageId !== 'string') return sendJson(response, 400, { error: t('Say which request to hand back.') });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const outcome = await here.room.returnRun({ responseMessageId: payload.responseMessageId, returnCap: viaPhone ? PHONE_MAX_MODE : 3 });
+        return sendJson(response, outcome.status, outcome.ok ? outcome : { error: outcome.error });
+      }
       if (request.method === 'GET' && url.pathname === '/api/commands') {
         const ctx = await moduleContext();
         const fromModules = await Promise.all(moduleCommands().map(async (command) => {
@@ -3412,7 +3511,7 @@ export async function createPulseServer({
         if (!asked) return sendJson(response, 409, { error: t('That request is no longer pending.') });
         if (decision !== 'deny' && asked.mode > PHONE_MAX_MODE) {
           if (viaPhone) return sendJson(response, 403, { error: t('#3 EDIT and #4 FULL ACCESS are opened from the Mac.') });
-          if (!spendPass(key, asked.agent, asked.mode)) return sendJson(response, 403, { error: t('#{n} needs its key. Unlock it again and send.', { n: asked.mode }), needsKey: true });
+          if (!spendPass(key, asked.agent, asked.mode)) return sendJson(response, 403, { error: t('#{n} needs your confirmation. Unlock it again and send.', { n: asked.mode }), needsKey: true });
         }
         const result = here.room.decideMode(requestId, decision);
         return sendJson(response, result.ok ? 200 : 409, result);
@@ -3432,12 +3531,20 @@ export async function createPulseServer({
         const here = await scopeOf(url);
         if (here.error) return sendJson(response, 404, here);
         const room = here.room;
+        // A copilot message at #3 goes with the copilot's window instead of a pass; from this
+        // computer only. With the window closed it is said, and the page asks for the key again.
+        if (payload.copilot === true && (viaPhone || !copilotNow())) {
+          if (!viaPhone) return sendJson(response, 409, { error: t('The copilot is off: it ended or was stopped. Turn it on again, or send and confirm #3.'), copilotOff: true });
+          delete payload.copilot;
+        }
         // Modes are checked before the turn is accepted, so the composer
         // hears "no" with a reason instead of a silent log line.
         const gate = await room.modeCheck(payload);
         if (!gate.ok) return sendJson(response, gate.status ?? 403, { error: gate.error, mode: gate.mode, maxMode: gate.maxMode });
+        const byCopilot = payload.copilot === true && gate.mode === 3;
+        if (!byCopilot) delete payload.copilot;
         // #3 and #4 go with the pass their key gave, for this agent (above).
-        if (gate.mode >= 3 && !spendPass(payload.key, gate.agent, gate.mode)) return sendJson(response, 403, { error: t('#{n} needs its key. Unlock it again and send.', { n: gate.mode }), mode: gate.mode, needsKey: true });
+        if (gate.mode >= 3 && !byCopilot && !spendPass(payload.key, gate.agent, gate.mode)) return sendJson(response, 403, { error: t('#{n} needs your confirmation. Unlock it again and send.', { n: gate.mode }), mode: gate.mode, needsKey: true });
         delete payload.key;
         const turns = await turnsPolicy();
         if (turns.enabled) {

package/src/setup.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';

package/src/smtp.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // SMTP, enough of it to send one message over TLS. No dependencies, by the same rule as the rest
 // of MADRE: a library that handles the human's mail password is a library somebody has to read.
 //

package/src/tour.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // The welcome of MADRE 1.0 (2026-10-11): one bonjour per person and per major version, then the
 // chapters that tell everything new, at the person's own pace (docs: the «Recorrido de MADRE 1.0»
 // decision, option B with two pieces of C — the one-line hints and the sheet of gestures).

package/src/updates.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Release channel: is there a newer MADRE on npm? One read of the public registry, at most
 // once a day, cached in ~/.pulse/updates.json. It sends the package name and nothing else,
 // the same request `npx` makes; PULSE_UPDATE_CHECK=0 or the switch in MU/TH/UR turns it off.

package/src/usage-sentinel.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import { t } from './i18n.mjs';
 
 const severity = { normal: 0, warning: 1, critical: 2, exhausted: 3 };

package/src/vault.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // The vault: where a connector's secret lives.
 //
 // Until now MADRE held none. A key for Gemini or OpenCode is written where THAT CLI looks for it

package/src/verdict.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // One sentence about where a room stands, and one thing to do about it.
 //
 // Everything needed to say it was already being measured: six readings of what the archive is
@@ -28,7 +30,7 @@ export function verdictFor({ maturity = null, exams = {}, cold = null, asks = 0
     return {
       headline: stage?.label ?? null,
       says: consistency.says,
-      next: { text: t('Settle the {n} contradictions EYECAT is holding. Until they are settled, everything built on this archive inherits them.', { n: consistency.open }), where: where('nostromo') },
+      next: { text: (consistency.open === 1 ? t('Settle the contradiction the memory reviewer found. Until it is settled, everything built on this memory inherits it.') : t('Settle the {n} contradictions the memory reviewer found. Until they are settled, everything built on this memory inherits them.', { n: consistency.open })), where: where('nostromo') },
     };
   }
 

package/src/whats-new.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // What a version brings, said to the person who just got it.
 //
 // After an update the room opens once on a sheet of what is new: a few things, each said plainly,