@lampdotdev/lamp 0.35.0 → 0.36.2-nightly.17

package/cli/lamps/web-starter/lamp.js

@@ -113,10 +113,11 @@
     image: function (name) { return loadImage(LampAssets.url(name)); }
   };
 
-  function Failure(message, needsSetup) {
+  function Failure(message, needsSetup, help) {
     this.name = 'LampAI.Failure';
     this.message = message;
     this.needsSetup = needsSetup || null;
+    this.help = help || null;
     this.stack = (new Error(message)).stack;
   }
   Failure.prototype = Object.create(Error.prototype);
@@ -190,6 +191,8 @@
   }
 
   // Why a copy Lamp didn't put on a device has no AI: a page on the web (its published page) is away from Lamp.
+  // Where someone with no Lamp finds how to turn AI on, for a page away from Lamp.
+  var AI_HELP = 'https://lamp.dev';
   function unplaced() {
     return here.protocol === 'https:'
       ? 'This page is on the web, away from Lamp, so it has no AI here. Open it in Lamp for that.'
@@ -206,7 +209,7 @@
       var ipv4 = /^http:\/\/\d+\.\d+\.\d+\.\d+:/;
       list = list.filter(function (r) { return ipv4.test(r); }).concat(list.filter(function (r) { return !ipv4.test(r); }));
     }
-    if (!list.length) return Promise.reject(new Failure(unplaced()));
+    if (!list.length) return Promise.reject(new Failure(unplaced(), null, AI_HELP));
     // With a deadline (LampAI.act's turn), each try gets only the time left, and none starts after it.
     function left() { return deadline ? deadline - Date.now() : timeout; }
     function attempt(i, round) {
@@ -229,7 +232,7 @@
   function token() {
     var kept = read('install.token', null);
     if (kept && installed && kept.app === installed.app) return Promise.resolve(kept.token);
-    if (!installed) return Promise.reject(new Failure(unplaced()));
+    if (!installed) return Promise.reject(new Failure(unplaced(), null, AI_HELP));
     return send('/app/claim', { app: installed.app }, null, 10000).then(function (answer) {
       if (answer.status !== 200 || !answer.reply.token) {
         throw new Failure('This app needs Lamp to put it on this device once more before it can use AI: press Play in Lamp on your Mac.');
@@ -240,10 +243,50 @@
     });
   }
 
+  // A page shared on lamp.dev plays from a host of its own under play.lamp.dev, away from Lamp. The person's own
+  // Lamp or lamp on this computer can answer it (Lamp's `SharedPagesAI`, or `lamp ai`, at a port of the computer's
+  // own), once they've allowed this
+  // page there; the token it's given is kept with the page's saved things. Whether there's an AI is asked first,
+  // without one, so the person is asked only when the page uses it.
+  var NEARBY = 'http://127.0.0.1:47423';
+  function shared() { return !installed && here.protocol === 'https:' && /\.play\.lamp\.dev$/.test(here.hostname || ''); }
+  function safari() {
+    var ua = (window.navigator && navigator.userAgent) || '';
+    return /Safari\//.test(ua) && !/Chrome|Chromium|CriOS|Edg|OPR|Firefox|FxiOS/.test(ua);
+  }
+  function nearby(path, body, timeout, deadline) {
+    var text = JSON.stringify(body);
+    function go(t) { return exchange(NEARBY, path, t, text, deadline ? Math.max(1000, deadline - Date.now()) : timeout); }
+    function allow() {
+      return exchange(NEARBY, '/pair', null, JSON.stringify({ name: document.title || '' }), 130000).then(function (answer) {
+        if (answer.status !== 200 || !answer.reply.token) throw new Failure('This computer didn\'t allow this page to use its AI.');
+        write('nearby.token', answer.reply.token);
+        return answer.reply.token;
+      });
+    }
+    var kept = read('nearby.token', null);
+    var done = path === '/ai/status' || (body && body.probe === true) ? go(kept) : (kept ? Promise.resolve(kept) : allow()).then(function (t) {
+      return go(t).then(function (answer) {
+        if (answer.status !== 401) return answer;
+        // Taken back on the computer: ask once more.
+        forget('nearby.token');
+        return allow().then(go);
+      });
+    });
+    return done.then(null, function (e) {
+      if (e instanceof Failure) throw e;
+      // Safari never lets a page on the web reach this computer this way, so Lamp or lamp ai open here wouldn't help.
+      if (safari()) throw new Failure('AI here works in Chrome or in Lamp, or with Lamp\'s command line: lamp play and this page\'s link.', null, AI_HELP);
+      throw new Failure('AI isn\'t available here. Open Lamp on this computer, or with Lamp\'s command line, run lamp ai.', null, AI_HELP);
+    });
+  }
+
   function post(path, body, timeout, deadline) {
     timeout = timeout || 240000;
     var done;
-    if (bridge) {
+    if (!bridge && shared()) {
+      done = nearby(path, body, timeout, deadline);
+    } else if (bridge) {
       // The TV preview on the Mac answers for Lamp itself.
       done = bridge.postMessage({ path: path, body: JSON.stringify(body), timeout: timeout }).then(function (r) {
         var reply = {};
@@ -454,8 +497,11 @@
 
   // Doing things for the person: LampAI.act
 
-  // 60 seconds is the longest any route allows; each answer says its route's own (`seconds`), and the turn keeps to it.
-  var ACT_LIMITS = { steps: 4, writes: 6, seconds: 60 };
+  // A turn has no time limit of its own: a real answer is never cut off, however long the model takes. Each step is
+  // given ACT_STEP_SECONDS, which only a call that has stopped answering reaches. An app that wants a quicker turn
+  // asks for one (`limits: { seconds }`); steps and writes it may only lower.
+  var ACT_LIMITS = { steps: 4, writes: 6 };
+  var ACT_STEP_SECONDS = 600;
   var actRan = {};      // turn id -> call key -> the result a write gave, while this copy of the page is open
   function actId() { return 't' + Date.now().toString(36) + Math.random().toString(36).slice(2, 8); }
   function isList(v) { return Object.prototype.toString.call(v) === '[object Array]'; }
@@ -481,10 +527,11 @@
   function act(request, options) {
     var o = options || {}, tools = o.tools || {};
     var limits = {};
-    ['steps', 'writes', 'seconds'].forEach(function (k) {
+    ['steps', 'writes'].forEach(function (k) {
       var asked = o.limits && typeof o.limits[k] === 'number' ? o.limits[k] : ACT_LIMITS[k];
       limits[k] = Math.max(1, Math.min(asked, ACT_LIMITS[k]));
     });
+    var asked = o.limits && typeof o.limits.seconds === 'number' && o.limits.seconds > 0 ? o.limits.seconds : null;
     var id = o.turn || actId();
     if (!actRan[id]) {
       var kept = Object.keys(actRan);
@@ -492,7 +539,7 @@
       actRan[id] = {};
     }
     var ran = actRan[id];
-    var started = Date.now(), deadline = started + limits.seconds * 1000;
+    var started = Date.now(), deadline = asked ? started + Math.max(1, asked) * 1000 : Infinity;
     var out = { turn: id, reply: '', ask: false, choices: [], done: [], failed: [], skipped: [], reads: [], stopped: null, error: '' };
     var steps = [], route = null, writes = 0, over = false, settle;
     var declared = Object.keys(tools).map(function (name) {
@@ -514,7 +561,7 @@
       return over;
     }
     var result = new Promise(function (resolve) { settle = resolve; });
-    var timer = setTimeout(function () { stop('time'); }, limits.seconds * 1000);
+    var timer = asked ? setTimeout(function () { stop('time'); }, Math.max(1, asked) * 1000) : null;
     result.then(function () { clearTimeout(timer); });
 
     // Reads run together; then the writes, one after another, each checked right before it runs. A write that
@@ -590,23 +637,15 @@
       if (over) return;
       var left = deadline - Date.now();
       if (left <= 500) return stop('time');
+      // The step's own time: what's left of an app's turn, or the step's guard against a call that has stopped.
+      var stepTime = Math.min(left, ACT_STEP_SECONDS * 1000);
       var body = { request: String(request), about: o.about || '', now: present(), tools: declared, steps: steps,
-                   history: (o.history || []).slice(-3), seconds: Math.floor(left / 1000) };
+                   history: (o.history || []).slice(-3), seconds: Math.floor(stepTime / 1000) };
       if (o.context !== undefined) body.context = jsonState(o.context);
       if (route) body.route = route;
       if (steps.length >= limits.steps - 1) body.final = true;
       if (o.model) body.model = o.model;
-      post('/ai/act', body, left, deadline).then(function (answer) {
-        // The route's own time for a turn (25 seconds over OpenRouter, a minute through Claude Code, Codex or a model
-        // on the Mac) shortens the turn's deadline, counted from its start; it never lengthens it.
-        if (!over && typeof answer.seconds === 'number' && answer.seconds > 0) {
-          var end = started + Math.min(answer.seconds, limits.seconds) * 1000;
-          if (end < deadline) {
-            deadline = end;
-            clearTimeout(timer);
-            timer = setTimeout(function () { stop('time'); }, Math.max(0, deadline - Date.now()));
-          }
-        }
+      post('/ai/act', body, stepTime, Date.now() + stepTime).then(function (answer) {
         // Cancelled, out of time or already over: an answer that comes late runs nothing.
         if (late()) return;
         route = answer.route || route;
@@ -693,24 +732,42 @@
    * Text calls take a few seconds; decisions well under a second; image calls 10-60 seconds. Show `error.message` on
    * failure. Aspect ratios look like "1:1", "16:9", "3:4".
    *
-   * Not every Mac has every kind of AI set up, and a device away from the Mac's Wi-Fi, or with Lamp closed, has none.
-   * `LampAI.isAvailable('pictures')` (or 'text', 'decisions') says whether it can answer now: check it where a
-   * feature depends on it, and show the feature with a short note ("Pictures need AI set up in Lamp") rather than
-   * hiding it or failing at it. A call that fails for that reason has `needsSetup` set on its error.
+   * Not every Mac has every kind of AI set up, a device away from the Mac's Wi-Fi or with Lamp closed has none, and a
+   * page shared on lamp.dev has it only on a computer that answers it. `LampAI.status('pictures')` (or 'text',
+   * 'decisions', 'act', 'hear') says whether it can answer now and, when it can't, the line to show: check it where
+   * a feature depends on it, and show the feature with its `reason` as it's given rather than words of the app's
+   * own, or hiding it or failing at it, and where it gives `help` (a page away from Lamp), a link to it beside the
+   * reason: "How to turn on AI". A call that fails for that reason has `needsSetup`, or `help`, set on its error.
    */
   var LampAI = {
     Failure: Failure,
 
-    /** Whether this kind of AI ('text', 'decisions', 'pictures' or 'act') can answer now. False when Lamp can't be reached. */
-    isAvailable: function (capability) {
-      // 'act' is asked of /ai/act itself: true only when this lamp.js has it, the app around the page lets the
-      // route through (an older one answers Not found) and the AI that answers the app can take it.
-      if (capability === 'act') return post('/ai/act', { probe: true }, 10000).then(function (reply) { return reply.act === true; }, function () { return false; });
-      // 'hear' the same way: this lamp.js, the app around the page and the AI set up in Lamp can all take it.
-      if (capability === 'hear') return post('/ai/hear', { probe: true }, 10000).then(function (reply) { return reply.hear === true; }, function () { return false; });
-      return post('/ai/status', {}, 10000).then(function (reply) { return reply[capability] === true; }, function () { return false; });
+    /** Whether this kind of AI ('text', 'decisions', 'pictures', 'act' or 'hear') can answer now: { available, reason,
+     *  help }, where `reason` is the short line to show when it can't, written for where the page is, and `help`, when
+     *  it's there, the page that says how to turn AI on, to link to beside it. */
+    status: function (capability) {
+      var no = function (reason, help) {
+        var said = { available: false, reason: reason || 'AI isn\'t set up for this here.' };
+        if (help) said.help = help;
+        return said;
+      };
+      // 'act' is asked of /ai/act itself: available only when this lamp.js has it, the app around the page lets the
+      // route through (an older one answers Not found) and the AI that answers the app can take it. 'hear' the same.
+      if (capability === 'act' || capability === 'hear') {
+        return post('/ai/' + capability, { probe: true }, 10000).then(function (reply) {
+          return reply[capability] === true ? { available: true, reason: '' } : no(reply.reason || reply.why);
+        }, function (e) { return no(e && e.message, e && e.help); });
+      }
+      return post('/ai/status', {}, 10000).then(function (reply) {
+        if (reply[capability] === true) return { available: true, reason: '' };
+        var detail = reply.details && reply.details[capability];
+        return no(detail && detail.reason);
+      }, function (e) { return no(e && e.message, e && e.help); });
     },
 
+    /** Whether this kind of AI can answer now, as `status` says. */
+    isAvailable: function (capability) { return LampAI.status(capability).then(function (s) { return s.available; }); },
+
     /** options: data (text from outside the app, for the AI to work on, not obey), images (pictures to look at),
      *  system, json (true asks for JSON and gives back the parsed value: describe its exact shape in the prompt),
      *  model (Lamp's id: "sonnet", "opus", "haiku", "claude-fable-5-2"). */
@@ -719,7 +776,7 @@
     /**
      * Does what the person asks, in their own words, with the app's own reads and writes: the model picks calls,
      * the page runs them, the model sees what happened, until it replies (at most 4 model calls and 6 writes a turn,
-     * and 25 seconds over OpenRouter or a minute through Claude Code, Codex or a model on the Mac). Check `LampAI.isAvailable('act')` first; keep the app's buttons for everything.
+     * with no time limit unless the app sets one with `limits: { seconds }`; Cancel ends it at once). Check `LampAI.isAvailable('act')` first; keep the app's buttons for everything.
      *
      *     var turn = LampAI.act('Add milk', {
      *       about: 'A family dashboard: the calendar, chores and the shopping list.',
@@ -816,6 +873,7 @@
      * probability, choice, score and confidence. Fails only when no item could be judged.
      */
     decideEach: function (items, questions, options) {
+      var failed = null;
       var o = options || {}, about = o.about || function (item) { return item; };
       var limit = Math.max(1, o.concurrency || 12), total = items.length, done = 0, next = 0;
       var results = new Array(total), saved = o.remember ? read('verdicts', {}) : null, now = Date.now();
@@ -843,7 +901,7 @@
           for (var k in (reply.answers || {})) if (reply.answers.hasOwnProperty(k)) answers[k] = decision(reply.answers[k]);
           if (key) saved[key] = { answers: reply.answers, until: now + o.remember * 1000 };
           finish(i, answers);
-        }, function (error) { finish(i, null, error.message); });
+        }, function (error) { if (!failed) failed = error; finish(i, null, error.message); });
       }
       function worker() {
         if (next >= total) return Promise.resolve();
@@ -859,7 +917,8 @@
           keys.slice(-2000).forEach(function (k) { kept[k] = saved[k]; });
           write('verdicts', kept);
         }
-        if (total && results.every(function (r) { return r.error; })) throw new Failure(results[0].error);
+        // Every item failed: the first failure's setup and help go with it, as a single decision's would.
+        if (total && results.every(function (r) { return r.error; })) throw new Failure(results[0].error, failed && failed.needsSetup, failed && failed.help);
         return results;
       });
     },

package/cli/link.mjs

@@ -22,6 +22,9 @@ const REFUSALS = {
   rate_limited: "the site has taken as many as it takes for now: try again in a while",
   service_unavailable: "the site can't keep it just now: try again in a moment",
   not_found: "the link is no longer there",
+  invalid_username: "a username is 2 to 30 lowercase letters, digits and dashes, starting and ending with a letter or digit, and not one of the site's own words",
+  username_taken: "that username is someone else's: choose another",
+  invalid_email: "that isn't an email address the site can write to",
 };
 
 /** The site couldn't be reached at all: offline, or the site is down. */
@@ -32,14 +35,15 @@ export class Unreachable extends Problem {}
  * a little later each time, when the site can't be reached or can't answer just now; any other is sent once. A refusal
  * carries the status the site gave it. No redirect is followed: a link's secret goes to the site and nowhere else.
  */
-export async function call(method, url, { secret, json, bytes, tries = 1 } = {}) {
+export async function call(method, url, { secret, account, json, bytes, tries = 1, seconds = 120 } = {}) {
   const headers = {
     ...(secret ? { authorization: `Bearer ${secret}` } : {}),
+    ...(account ? { "x-lamp-account": account } : {}),
     ...(json ? { "content-type": "application/json" } : bytes ? { "content-type": "application/octet-stream" } : {}),
   };
   for (let attempt = 0; ; attempt++) {
     let answer = null;
-    try { answer = await fetch(url, { method, headers, body: json ? JSON.stringify(json) : bytes, redirect: "manual", signal: AbortSignal.timeout(120_000) }); } catch {}
+    try { answer = await fetch(url, { method, headers, body: json ? JSON.stringify(json) : bytes, redirect: "manual", signal: AbortSignal.timeout(seconds * 1000) }); } catch {}
     if (answer && answer.status < 500) {
       const said = await answer.json().catch(() => null);
       if (answer.ok) return { status: answer.status, said: said ?? {} };
@@ -65,33 +69,65 @@ function onSite(site, address) {
  * name, line, words, who it's by, the questions its page asks, its shape, picture and icon). A link the site no longer
  * has is made again. Answers its id, its address and its secret.
  */
-export async function publishLink({ site = siteOrigin(), body, earlier }) {
+export async function publishLink({ site = siteOrigin(), body, earlier, account }) {
   if (earlier) {
     try {
-      const { said } = await call("PUT", `${site}/api/wishes?id=${encodeURIComponent(earlier.id)}`, { secret: earlier.secret, json: body });
+      const { said } = await call("PUT", `${site}/api/wishes?id=${encodeURIComponent(earlier.id)}`, { secret: earlier.secret, account, json: body });
       // A change keeps the link; its address follows the name, so a rename shows in it (the old one still works).
       return { id: earlier.id, url: onSite(site, said.url) ?? earlier.url ?? null, secret: earlier.secret };
     } catch (error) { if (error.status !== 404) throw error; }
   }
-  const { said } = await call("POST", `${site}/api/wishes`, { json: body });
+  const { said } = await call("POST", `${site}/api/wishes`, { account, json: body });
   const url = onSite(site, said.url);
   if (typeof said.id !== "string" || typeof said.secret !== "string" || !url) throw new Problem("the site's answer couldn't be read");
   return { id: said.id, url, secret: said.secret };
 }
 
+/**
+ * Asks for a maker's account (`username` and `email`), or with an address that has one, to sign in to it: answers
+ * `{ username, key, existing, sent }`. The key is the account's once the email's link is opened.
+ */
+export async function askAccount({ site = siteOrigin(), username, email }) {
+  const { said } = await call("POST", `${site}/api/accounts`, { json: { ...(username ? { username } : {}), email } });
+  if (typeof said.key !== "string" || typeof said.username !== "string") throw new Problem("the site's answer couldn't be read");
+  return said;
+}
+
+/** The username a key is an account's, once the email's link was opened; null before. */
+export async function accountName({ site = siteOrigin(), key }) {
+  const { said } = await call("GET", `${site}/api/accounts`, { secret: key, seconds: 20 });
+  return typeof said.username === "string" ? said.username : null;
+}
+
 /**
  * What a followed link has now: its name, who it's by (null for nobody), its file's version (0 with no file), and the
  * file's address, only from where the site keeps them. Null when it can't be asked, or is gone. Asks with nothing of
  * the person's.
  */
-export async function latestOf({ site = siteOrigin(), id }) {
+export async function latestOf({ site = siteOrigin(), id, user, app }) {
   let said;
-  try { ({ said } = await call("GET", `${site}/api/wishes?id=${encodeURIComponent(id)}`)); } catch { return null; }
+  const asked = id ? `id=${encodeURIComponent(id)}` : `user=${encodeURIComponent(user)}&app=${encodeURIComponent(app)}`;
+  try { ({ said } = await call("GET", `${site}/api/wishes?${asked}`)); } catch { return null; }
   if (said.format !== 1 || !Number.isInteger(said.version)) return null;
   let file = null;
   try { const url = new URL(said.file); if (url.protocol === "https:" || (url.protocol === "data:" && new URL(site).protocol === "http:")) file = url.href; } catch {}
   const by = typeof said.by === "string" ? said.by.trim().slice(0, LIMITS.by) : "";
-  return { name: typeof said.name === "string" ? said.name : null, by: by || null, version: said.version, file };
+  return { id: typeof said.id === "string" ? said.id : id ?? null, name: typeof said.name === "string" ? said.name : null, by: by || null, version: said.version, file,
+    // Absent from a site from before that doesn't say; null while a link's first page is still being stored.
+    page: !("page" in said) ? undefined : Number.isInteger(said.page) ? said.page : null };
+}
+
+/**
+ * The site stores a page's files after it answers its last part, and the link shows the page before until they're in:
+ * waits until it shows `version` (a minute at most; a site from before that doesn't say is taken at its word).
+ */
+export async function pageUp({ site = siteOrigin(), id, version, said = () => {} }) {
+  for (let waited = 0; waited < 60; waited += 2) {
+    const now = await latestOf({ site, id });
+    if (!now || now.page === undefined || (Number.isInteger(now.page) && now.page >= version)) return;
+    if (waited === 0) said("Waiting for lamp.dev to put the page up…");
+    await sleep(2000);
+  }
 }
 
 const fileAddress = (site, id, more = "") => `${site}/api/wish-file?id=${encodeURIComponent(id)}${more}`;
@@ -108,7 +144,8 @@ export async function sendFile({ site = siteOrigin(), link, bytes, page = false,
     said(`Sending ${page ? "the page" : "the file"}: part ${n + 1} of ${count}`);
     await call("PUT", fileAddress(site, link.id, `${what}&part=${n}&of=${count}`), { secret: link.secret, bytes: bytes.subarray(n * FILE_LIMITS.part, (n + 1) * FILE_LIMITS.part), tries: 4 });
   }
-  return (await call("POST", fileAddress(site, link.id, what), { secret: link.secret })).said.version ?? null;
+  // Putting a page together stores each of its files, which for a big game's takes minutes (the site gives it five).
+  return (await call("POST", fileAddress(site, link.id, what), { secret: link.secret, seconds: 330 })).said.version ?? null;
 }
 
 /** Takes the link's file away, which keeps showing the idea, and its page with it; with `page` only the page. */
@@ -118,19 +155,46 @@ export async function removeFile({ site = siteOrigin(), link, page = false }) {
 }
 
 /** The ideas sent to the link that are still open, oldest first: each with its number. Only the link's secret reads them. */
-export async function ideasOf({ site = siteOrigin(), link }) {
-  try { return (await call("GET", `${site}/api/wish-ideas?id=${encodeURIComponent(link.id)}`, { secret: link.secret })).said.ideas ?? []; }
+export async function ideasOf({ site = siteOrigin(), link, earlier = false }) {
+  try { return (await call("GET", `${site}/api/wish-ideas?id=${encodeURIComponent(link.id)}${earlier ? "&earlier=1" : ""}`, { secret: link.secret })).said.ideas ?? []; }
   catch (error) { if (error.status === 404) return []; throw error; }
 }
 
 /** Lets an idea go: with `built` it's in, and the site first writes to whoever asked to hear. Whether it did. */
-export async function removeIdea({ site = siteOrigin(), link, n, built = false }) {
+export async function removeIdea({ site = siteOrigin(), link, n, built = false, note }) {
   try {
-    const { said } = await call("DELETE", `${site}/api/wish-ideas?id=${encodeURIComponent(link.id)}&n=${Number(n)}${built ? "&built=1" : ""}`, { secret: link.secret });
+    const { said } = await call("DELETE", `${site}/api/wish-ideas?id=${encodeURIComponent(link.id)}&n=${Number(n)}${built ? "&built=1" : ""}`,
+      { secret: link.secret, ...(note ? { json: { note } } : {}) });
     return { notified: said.notified === true };
   } catch (error) { if (error.status === 404) return { notified: false }; throw error; }
 }
 
+/**
+ * Says something more about an idea, its sender emailed if they gave an address, and answers whether they were;
+ * without a note, only that the maker has seen to their answer.
+ */
+export async function replyIdea({ site = siteOrigin(), link, n, note }) {
+  try {
+    const { said } = await call("PATCH", `${site}/api/wish-ideas?id=${encodeURIComponent(link.id)}&n=${Number(n)}`,
+      { secret: link.secret, ...(note ? { json: { note } } : {}) });
+    return { notified: said.notified === true };
+  } catch (error) {
+    if (error.status === 404) throw new Problem(`there's no idea ${Number(n)} on this link`);
+    if (error.status === 429) throw new Problem(`idea ${Number(n)} has as many messages as it can keep`);
+    throw error;
+  }
+}
+
+/**
+ * The maker's own address for the link's ideas and replies, as `{ email, confirmed }`; with `email`, given ("" takes it
+ * away), and the site emails it to confirm first.
+ */
+export async function makerOf({ site = siteOrigin(), link, email }) {
+  const { said } = await call(email === undefined ? "GET" : "PUT", `${site}/api/wish-ideas?id=${encodeURIComponent(link.id)}&maker=1`,
+    { secret: link.secret, ...(email === undefined ? {} : { json: { email } }) });
+  return { email: typeof said.email === "string" ? said.email : null, confirmed: said.confirmed === true, ...(email ? { sent: said.sent === true } : {}) };
+}
+
 /** Takes the link down, with its page and the ideas sent to it. A link the site no longer has is down already. */
 export async function removeLink({ site = siteOrigin(), link }) {
   try { await call("DELETE", `${site}/api/wishes?id=${encodeURIComponent(link.id)}`, { secret: link.secret }); }

package/cli/local-ai.mjs

@@ -0,0 +1,193 @@
+// `lamp ai`: the AI for a page shared on lamp.dev, answered on this computer with the person's own Claude Code or
+// Codex (ai.mjs), the way `lamp dev` answers a page it serves. A shared page is away from Lamp, so lamp.js asks here,
+// at a port of this computer's own (127.0.0.1), where a browser lets an https page call plain http.
+//
+// Only the person decides which pages spend their subscription. Each shared link plays from an origin of its own
+// (`playOrigin` in site/lib/shared-wishes.js: <the link's id in hex>.play.lamp.dev), which a browser always names in
+// the request and a page can't change, so an approval is for one link's page: the first time it asks, the person is
+// asked in the terminal, and the page is given a token it keeps and sends from then on. Nothing else is answered:
+// another site, another link's page, or a request naming this computer by another name (a site that rebinds its own
+// name to 127.0.0.1) is refused. Whether there's an AI here (`/ai/status` and the probes) is answered without one, so a
+// page can say what it can do before anyone is asked.
+
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { createInterface } from "node:readline";
+import { answer as answerAI, engine } from "./ai.mjs";
+
+/** The port lamp.js on a shared page asks (`LOCAL_AI` there): one, fixed, since the page can't be told another. */
+export const LOCAL_AI_PORT = 47423;
+const PLAY_HOST = "play.lamp.dev";
+const MOST = 2_000_000, AT_ONCE = 3, ASKING_FOR = 120_000;
+const ROUTES = new Set(["/ai/status", "/ai", "/ai/act", "/ai/decide", "/ai/hear", "/ai/image"]);
+
+const keptFile = () => join(process.env.LAMP_DEV_HOME || join(homedir(), ".lamp", "dev"), "shared-pages-ai.json");
+
+/** The pages the person has let use their AI, by origin: `{ token, id, name, at }`. */
+export function allowed() {
+  try { const kept = JSON.parse(readFileSync(keptFile(), "utf8")); return kept && typeof kept === "object" ? kept : {}; } catch { return {}; }
+}
+function keep(all) {
+  const file = keptFile();
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file + ".new", JSON.stringify(all, null, 2), { mode: 0o600 });
+  renameSync(file + ".new", file);
+}
+/** Forgets every page let in: each asks again. */
+export function forgetAllowed() { if (existsSync(keptFile())) rmSync(keptFile()); }
+
+/** Forgets one page let in, by its origin: it asks again the next time it uses the AI. */
+export function forgetPage(origin) {
+  const all = allowed();
+  if (!(origin in all)) return;
+  delete all[origin];
+  if (Object.keys(all).length) keep(all); else forgetAllowed();
+}
+
+/** The link a shared page's origin plays, by its id, or null for any other origin. */
+export function linkOf(origin) {
+  let url;
+  try { url = new URL(origin); } catch { return null; }
+  if (url.protocol !== "https:" || url.port || !url.host.endsWith("." + PLAY_HOST)) return null;
+  const hex = url.host.slice(0, -PLAY_HOST.length - 1);
+  if (!/^(?:[0-9a-f]{2}){10}$/.test(hex)) return null;
+  const id = Buffer.from(hex, "hex").toString();
+  return /^[A-Za-z0-9]{10}$/.test(id) ? id : null;
+}
+
+const same = (a, b) => {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  const x = Buffer.from(a), y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+};
+
+/**
+ * Answers shared pages' AI until it's closed. `ask(question, page)` puts a yes-or-no to the person and resolves true
+ * for yes; by default it's the terminal's, and without a terminal nothing is let in. `answer(path, body, page)` is the
+ * AI's [status, reply]: the person's Claude Code, Codex or OpenRouter key by default, Lamp's own AI when Lamp's app runs this
+ * (`sharedPages` in calls.mjs). Resolves to the server once it listens.
+ */
+export async function serveLocalAI({ port = LOCAL_AI_PORT, ask = askInTerminal(), answer = answerAI, said = console.log } = {}) {
+  const busy = new Map(), queued = new Map(), refused = new Set(), waiting = new Map();
+  // A few of a page's requests run at once and the rest wait their turn, since lamp.js asks many at a time
+  // (`LampAI.decideEach`) and takes a refusal as that item's answer.
+  const turn = (origin) => {
+    if ((busy.get(origin) || 0) < AT_ONCE) { busy.set(origin, (busy.get(origin) || 0) + 1); return Promise.resolve(); }
+    return new Promise((go) => queued.set(origin, [...(queued.get(origin) || []), go]));
+  };
+  const done = (origin) => {
+    const next = queued.get(origin)?.shift();
+    if (next) next();
+    else busy.set(origin, busy.get(origin) - 1);
+  };
+  // One question at a time in the terminal; a page that asks again while it's waiting gets the same answer, and one
+  // the person said no to isn't asked about again while this runs.
+  let asking = Promise.resolve();
+  const askAbout = (origin, id, name) => {
+    if (waiting.has(origin)) return waiting.get(origin);
+    const asked = asking.then(async () => {
+      const kept = allowed()[origin];
+      if (kept) return kept.token;
+      const titled = name ? `"${name}" ` : "A page ";
+      const yes = await ask(`${titled}shared at lamp.dev/w/${id} wants to use your ${engineName()} here. Allow it?`, { id, name });
+      if (!yes) { refused.add(origin); return null; }
+      const token = randomBytes(32).toString("base64url");
+      keep({ ...allowed(), [origin]: { token, id, name: name || "", at: new Date().toISOString() } });
+      said(`Allowed ${name ? `"${name}"` : `lamp.dev/w/${id}`}. lamp ai --forget takes it back.`);
+      return token;
+    });
+    asking = asked.catch(() => {});
+    waiting.set(origin, asked);
+    asked.finally(() => waiting.delete(origin));
+    return asked;
+  };
+
+  const server = createServer(async (request, response) => {
+    const origin = request.headers.origin || "";
+    const id = linkOf(origin);
+    const reply = (status, body) => {
+      const headers = { "Content-Type": "application/json", "Cache-Control": "no-store", Vary: "Origin" };
+      if (id) headers["Access-Control-Allow-Origin"] = origin;
+      response.writeHead(status, headers);
+      response.end(JSON.stringify(body));
+    };
+    // Only this computer's own name for itself: a site that points a name of its own at 127.0.0.1 is someone else.
+    const host = String(request.headers.host || "").replace(/:\d+$/, "");
+    if (host !== "127.0.0.1" && host !== "localhost") return reply(403, { error: "Not here." });
+    if (!id) return reply(403, { error: "Only a page shared on lamp.dev can ask here." });
+    const url = new URL(request.url, "http://127.0.0.1");
+    if (request.method === "OPTIONS") {
+      response.writeHead(204, {
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": "POST",
+        "Access-Control-Allow-Headers": "Authorization, Content-Type",
+        "Access-Control-Allow-Private-Network": "true",
+        "Access-Control-Max-Age": "600",
+        Vary: "Origin",
+      });
+      return response.end();
+    }
+    if (request.method !== "POST") return reply(405, { error: "Method not allowed." });
+
+    let body = {};
+    try {
+      const chunks = [];
+      let size = 0;
+      for await (const chunk of request) {
+        size += chunk.length;
+        if (size > MOST) return reply(413, { error: "That's too much to ask at once." });
+        chunks.push(chunk);
+      }
+      const text = Buffer.concat(chunks).toString();
+      body = text ? JSON.parse(text) : {};
+    } catch { return reply(400, { error: "That wasn't JSON." }); }
+
+    if (url.pathname === "/pair") {
+      if (refused.has(origin)) return reply(403, { error: "Not allowed on this computer." });
+      const name = typeof body?.name === "string" ? body.name.replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 60) : "";
+      const token = await askAbout(origin, id, name);
+      return token ? reply(200, { token }) : reply(403, { error: "Not allowed on this computer." });
+    }
+    if (!ROUTES.has(url.pathname)) return reply(404, { error: "Not found." });
+    // What there is to answer with, asked before anyone is let in: only the routes whose probe asks no model.
+    const asksNothing = url.pathname === "/ai/status" || (body?.probe === true && (url.pathname === "/ai/act" || url.pathname === "/ai/hear"));
+    if (asksNothing) {
+      const [status, answered] = await answer(url.pathname, url.pathname === "/ai/status" ? {} : { probe: true }, { id });
+      return reply(status, answered);
+    }
+    const kept = allowed()[origin];
+    const given = String(request.headers.authorization || "").replace(/^Bearer\s+/i, "");
+    if (!kept || !same(given, kept.token)) return reply(401, { error: "This page isn't allowed to use the AI here yet." });
+    await turn(origin);
+    try {
+      const [status, answered] = await answer(url.pathname, body, { id });
+      reply(status, answered);
+    } catch (error) {
+      reply(502, { error: error?.message || "The AI didn't answer." });
+    } finally {
+      done(origin);
+    }
+  });
+  await new Promise((done, fail) => { server.once("error", fail); server.listen(port, "127.0.0.1", () => { server.off("error", fail); done(); }); });
+  return server;
+}
+
+const engineName = () => ({ codex: "Codex", openrouter: "OpenRouter key" })[engine()] ?? "Claude Code";
+
+/** A yes-or-no in the terminal, or always no without one. */
+export function askInTerminal({ input = process.stdin, output = process.stdout } = {}) {
+  return (question) => {
+    if (!input.isTTY) {
+      output.write(`${question} No: lamp ai can only ask in a terminal.\n`);
+      return Promise.resolve(false);
+    }
+    const lines = createInterface({ input, output });
+    return new Promise((done) => {
+      const timer = setTimeout(() => { output.write("\nNo answer, so not allowed.\n"); lines.close(); done(false); }, ASKING_FOR);
+      lines.question(`${question} [y/N] `, (said) => { clearTimeout(timer); lines.close(); done(/^y(es)?$/i.test(said.trim())); });
+    });
+  };
+}