@monster-orange/den 0.4.0 → 0.4.2

package/src/ui/server/public/shell.js

@@ -254,7 +254,7 @@
     // The lock chip and its popover (R8).
     "lock.locked": "Locked",
     "lock.unlocked": "Unlocked",
-    "lock.title": "Unlock to start, stop and restart services",
+    "lock.title": "Unlock to start, stop and restart services and agents",
     "lock.nopw": "Passwordless sudo (NOPASSWD): no admin password needed",
     "lock.session": "Unlocked for this session",
     "lock.sessionDesc":
@@ -353,6 +353,24 @@
     "err.500.time": "Time",
     "err.500.id": "Request id",
     "err.500.version": "Version",
+    "err.421.title": "Wrong address",
+    "err.421.lead":
+      "This server answers only on its own addresses, so a page on another name can't reach it.",
+    "err.421.open": "Open on localhost",
+    "err.refused.title": "Request refused",
+    "err.signin.title": "Sign in to use {name}",
+    "err.signin.terminal": "Sign in to use the terminal",
+    "err.signin.agents": "Sign in to start agents",
+    "err.signin.sub": "This browser isn't signed in",
+    "err.signin.lead": "Run {cmd} and open the link.",
+    "err.signin.expiredTitle": "Sign-in link expired",
+    "err.signin.expired":
+      "That sign-in link expired or was used. Run {cmd} for a new one.",
+    "err.signin.local":
+      "A sign-in belongs to one address. This page is on {host}: open the same page on localhost, where this browser is signed in.",
+    "err.signin.why":
+      "There is no password: the link comes from a file only your user account can read.",
+    "err.signin.copy": "Copy command",
     "err.422.title": "Config is invalid",
     "err.422.sub": "The distribution config fails validation",
     "err.422.lead":
@@ -388,6 +406,7 @@
     "set.cli.cli_tabs": "Terminal tabs",
     "set.cli.log_window_lines": "Log pane lines",
     "set.cli.web_port": "Your web port",
+    "set.cli.signin": "Browser sign-in",
     "set.distribution.brand": "Product name",
     "set.distribution.github_org": "GitHub org",
     "set.distribution.orgs": "Org labels",
@@ -397,6 +416,74 @@
     "err.retry": "Retry",
     "err.copy": "Copy details",
     "err.copied": "Copied",
+    // The Workspaces page's Agents section (AG-4a, agents-section.js).
+    "ag.title": "Agents",
+    "ag.caption": "Agents in {ws}",
+    "ag.count": "{n} agents",
+    "ag.count.one": "{n} agent",
+    "ag.col.agent": "Agent",
+    "ag.col.runtime": "Runtime",
+    "ag.col.state": "State",
+    "ag.col.cwd": "Directory",
+    "ag.col.started": "Started",
+    "ag.col.actions": "Actions",
+    "ag.loading": "Loading agents…",
+    "ag.none": "No agents in this workspace yet",
+    "ag.personaOf": "persona {persona}",
+    "ag.state.running": "running",
+    "ag.state.stopping": "stopping…",
+    "ag.state.stopped": "stopped",
+    "ag.state.ended": "ended",
+    "ag.state.exited": "exited",
+    "ag.state.exitedCode": "exited ({code})",
+    "ag.stop": "Stop",
+    "ag.resume": "Resume",
+    "ag.stopName": "Stop {id}",
+    "ag.resumeName": "Resume {id}",
+    "ag.start": "+ Start agent",
+    "ag.persona": "Persona",
+    "ag.runtime": "Runtime",
+    "ag.runtime.auto": "The persona's",
+    "ag.unavailable": "unavailable",
+    "ag.go": "Start",
+    "ag.starting": "Starting…",
+    "ag.cancel": "Cancel",
+    "ag.started": "Started agent {id}",
+    "ag.stopped": "Stopped agent {id}",
+    "ag.resumed": "Resumed agent {id}",
+    // The Agents tab (AG-4a-term, agents-page.js).
+    "n.agents": "Agents",
+    "kind.agent": "Agent",
+    "ag.sub": "{n} sessions · {w} waiting · {scope}",
+    "ag.sub.one": "{n} session · {w} waiting · {scope}",
+    "ag.all": "all workspaces",
+    "ag.waiting": "waiting",
+    "ag.session": "session",
+    "ag.empty":
+      "Pick a session on the left to open its terminal. Open more to tile them (up to 4).",
+    "ag.none.scope": "No sessions or agents in {scope} yet",
+    "ag.detach": "Close pane",
+    "ag.detachName": "Close {id}'s pane (it keeps running)",
+    "ag.detached": "Closed {id}'s pane: it keeps running",
+    "ag.open": "Open",
+    "ag.openName": "Open {id} in Agents",
+    "ws.openAgents": "Open in Agents →",
+    "ag.signin": "Sign in to open terminals: run {cli} web login",
+    "ag.revoked": "token revoked",
+    "ag.revokedTip":
+      "Its token was revoked (web logout --all): stop and resume it, or start it again, to give it a new one",
+    "ag.ended":
+      "This session has ended. Its record stays until it is resumed or removed.",
+    "ag.exitedLine": "[the session exited{code}]",
+    "ag.lost": "[disconnected: {why}]",
+    "ag.reconnect": "Reconnect",
+    "ag.noBackend":
+      "Terminals need the optional PTY module (den-pty is unavailable): {cli} doctor says why",
+    "ag.noHost": "No session host is running: nothing has started yet",
+    "ag.ws": "Workspace",
+    "ag.pal": "Agents › {ws} / {name}",
+    "ag.palStart": "Start agent…",
+    "ag.cap": "Up to 4 panes: {id}'s closed to make room (it keeps running)",
   };
   // The languages the UI has a catalog for, each named in itself (a name is
   // never translated). The server's list is ui-language.ts's UI_LANGUAGES.
@@ -479,6 +566,9 @@
     settings:
       '<circle cx="12" cy="12" r="3"/><path d="M12 3v3M12 18v3M3 12h3M18 12h3M5.6 5.6l2.1 2.1M16.3 16.3l2.1 2.1M5.6 18.4l2.1-2.1M16.3 7.7l2.1-2.1"/>',
     page: '<rect x="5" y="4" width="14" height="16" rx="2"/><path d="M9 9h6M9 13h6"/>',
+    // The prototype's Agents icon: a terminal window with a prompt.
+    agents:
+      '<rect x="3" y="5" width="18" height="14" rx="2"/><path d="M7 10l3 2-3 2M12 15h5"/>',
     edge: '<path d="M12 3l8 4v5c0 4.5-3.4 8.3-8 9-4.6-.7-8-4.5-8-9V7z"/><path d="M8 12h8M12 8v8"/>',
   };
   function icon(name) {
@@ -1146,6 +1236,17 @@
       order: 15,
       href: "/graph",
     },
+    // The Agents tab (AG-4a-term, AG spec §5d): sessions and terminal
+    // panes, after Graph as the prototype orders them.
+    {
+      id: "agents",
+      label: "n.agents",
+      icon: "agents",
+      group: "develop",
+      order: 17,
+      href: "/agents",
+      keywords: ["sessions", "terminal"],
+    },
     {
       id: "services",
       label: "n.services",
@@ -3011,6 +3112,19 @@
               : typeof data === "string" && data.trim()
                 ? data.trim().slice(0, 300)
                 : t("api.failed", { what: what }) + " (" + r.status + ")";
+          // SEC-1: a sign-in refusal in the page's language, with its command.
+          if (
+            data &&
+            data.code === "signin_required" &&
+            (data.scope === "agents" || data.scope === "terminal")
+          ) {
+            var cmd = /`([^`]+)`/.exec(String(data.error || ""));
+            msg =
+              (data.scope === "agents"
+                ? t("err.signin.agents")
+                : t("err.signin.terminal")) +
+              (cmd ? ". " + t("err.signin.lead", { cmd: cmd[1] }) : "");
+          }
           throw apiError(msg, {
             status: r.status,
             code: data && typeof data === "object" ? data.code : null,
@@ -3247,12 +3361,43 @@
     }
   }
 
+  // The config fails validation (0.4.1): the server marks every page it
+  // serves while it does (data-config-invalid on #den-shell), and the first
+  // /api answer of 422 config_invalid marks it too. From then on the shell
+  // and its modules start none of the polls and streams that read the
+  // config (health, edge, workspaces, applications, the org config, …):
+  // each would only answer 422 again. A reload once fixed starts them.
+  var configBad = host.dataset.configInvalid === "1";
+  // SEC-1b: a refusal page (421 "Wrong address", or signed out): the server
+  // marks it (data-api-off), since every /api call from it would answer
+  // the same refusal. The shell starts none of its polls and streams, the
+  // same gate as an invalid config, and the status chip reads unknown.
+  var apiOffPage = host.dataset.apiOff === "1";
+  function apiOff() {
+    return apiOffPage;
+  }
+  function configInvalid() {
+    return configBad || apiOffPage;
+  }
+  function markConfigInvalid() {
+    if (configBad) return;
+    configBad = true;
+    try {
+      window.dispatchEvent(new CustomEvent("den:config-invalid"));
+    } catch (e) {
+      /* no CustomEvent */
+    }
+  }
+
   // R26d: the server unreachable.
   var server = { up: true, delay: 0, timer: null, tick: null, nextAt: 0 };
   var rawFetch =
     typeof window.fetch === "function" ? window.fetch.bind(window) : null;
   function sameOrigin(input) {
-    var u = typeof input === "string" ? input : input && input.url;
+    var u =
+      typeof input === "string"
+        ? input
+        : input && (typeof input.url === "string" ? input.url : input.href);
     if (!u) return false;
     if (u.charAt(0) === "/" && u.charAt(1) !== "/") return true;
     try {
@@ -3319,13 +3464,102 @@
     hideBanner("net");
     serverState(true);
   }
+  // SEC-1a: every same-origin call that changes something (POST, PUT,
+  // PATCH, DELETE), through denShell.api() or a page's own fetch(), carries
+  // X-Den-CSRF with the token GET /api/session hands out. The token is per
+  // server start: a 403 `csrf` (the server restarted) fetches a fresh one
+  // and retries once. Never sent to another origin.
+  var CSRF_METHODS = { POST: 1, PUT: 1, PATCH: 1, DELETE: 1 };
+  var csrf = { token: null, pending: null };
+  function csrfToken(fresh) {
+    if (fresh) csrf.token = null;
+    if (csrf.token) return Promise.resolve(csrf.token);
+    if (!csrf.pending)
+      csrf.pending = rawFetch("/api/session", {
+        cache: "no-store",
+        credentials: "same-origin",
+      })
+        .then(function (r) {
+          return r.ok ? r.json() : null;
+        })
+        .then(
+          function (b) {
+            csrf.pending = null;
+            csrf.token = b && typeof b.csrf === "string" ? b.csrf : null;
+            return csrf.token;
+          },
+          function () {
+            csrf.pending = null;
+            return null;
+          },
+        );
+    return csrf.pending;
+  }
+  function isRequest(input) {
+    return typeof Request !== "undefined" && input instanceof Request;
+  }
+  function methodOf(input, init) {
+    var m = (init && init.method) || (isRequest(input) && input.method);
+    return String(m || "GET").toUpperCase();
+  }
+  function withCsrf(input, init, token) {
+    var headers = new Headers(
+      (init && init.headers) || (isRequest(input) ? input.headers : undefined),
+    );
+    headers.set("X-Den-CSRF", token);
+    return Object.assign({}, init || {}, { headers: headers });
+  }
+  function csrfFetch(input, init) {
+    // A body that can be sent twice (not a stream) may be retried.
+    var body = init && init.body;
+    var again =
+      !isRequest(input) &&
+      (body == null ||
+        typeof body === "string" ||
+        (typeof FormData !== "undefined" && body instanceof FormData) ||
+        (typeof URLSearchParams !== "undefined" &&
+          body instanceof URLSearchParams) ||
+        (typeof Blob !== "undefined" && body instanceof Blob));
+    var send = function (token) {
+      return rawFetch(input, token ? withCsrf(input, init, token) : init);
+    };
+    return csrfToken(false).then(function (token) {
+      return send(token).then(function (r) {
+        if (!again || !r || r.status !== 403) return r;
+        return r
+          .clone()
+          .json()
+          .then(
+            function (b) {
+              if (!b || b.code !== "csrf") return r;
+              return csrfToken(true).then(function (fresh) {
+                return fresh ? send(fresh) : r;
+              });
+            },
+            function () {
+              return r;
+            },
+          );
+      });
+    });
+  }
   if (rawFetch && !window.fetch.__denShell) {
     var wrapped = function (input, init) {
-      var p = rawFetch(input, init);
+      var p =
+        CSRF_METHODS[methodOf(input, init)] && sameOrigin(input)
+          ? csrfFetch(input, init)
+          : rawFetch(input, init);
       if (!p || typeof p.then !== "function") return p;
       return p.then(
         function (r) {
           if (!server.up && sameOrigin(input)) serverBack();
+          if (r && r.status === 422 && !configBad && sameOrigin(input))
+            r.clone()
+              .json()
+              .then(function (b) {
+                if (b && b.code === "config_invalid") markConfigInvalid();
+              })
+              .catch(function () {});
           return r;
         },
         function (err) {
@@ -3337,6 +3571,8 @@
     };
     wrapped.__denShell = true;
     window.fetch = wrapped;
+    // The token is in hand before the first click needs it.
+    if (!apiOffPage) csrfToken(false);
   }
 
   // ── the UI language (R19): a user pref ───────────────────────────────
@@ -3401,6 +3637,13 @@
     serverUp: function () {
       return server.up;
     },
+    /**
+     * 0.4.1: true once the config is known to fail validation, or on a
+     * refusal page (apiOff): the config polls and streams don't start.
+     */
+    configInvalid: configInvalid,
+    /** SEC-1b: a refusal page (421, signed out): no /api call would answer. */
+    apiOff: apiOff,
     /** The browser-tab icon (appearance.js: the active theme's, per mode). */
     setFavicon: setFavicon,
     /** The org part of the scope: "/ ORG <title>", static (one org). */
@@ -3480,7 +3723,7 @@
   checkOrphansSoon();
 
   // The server's prefs win over the local copy.
-  if (typeof fetch === "function")
+  if (typeof fetch === "function" && !apiOff())
     fetch("/api/settings")
       .then(function (r) {
         return r.ok ? r.json() : null;
@@ -3502,7 +3745,7 @@
       .catch(function () {});
 
   // The Edge page shows once the edge is configured (no Docker asked).
-  if (typeof fetch === "function")
+  if (typeof fetch === "function" && !configInvalid())
     fetch("/api/edge?probe=1")
       .then(function (r) {
         return r.ok ? r.json() : null;

package/src/ui/server/public/topbar.js

@@ -411,7 +411,7 @@ export function runOf(url, base = "http://localhost/") {
 const LS_LAST_RUN = "__DEN_CLI__-last-run";
 const LS_LOCK = "__DEN_CLI__-lock";
 const SS_PENDING = "__DEN_CLI__-pending-action";
-const KIND = ["page", "service", "app", "action", "setting"];
+const KIND = ["page", "service", "app", "agent", "action", "setting"];
 const kindLabel = (k) =>
   KIND.includes(k)
     ? t(`kind.${k}`)
@@ -507,7 +507,9 @@ let serverDown = false;
 function paintChip() {
   const chip = $("den-status");
   if (!chip) return;
-  if (serverDown) {
+  // R26d, and SEC-1b's refusal pages (421, signed out: sh().apiOff), where
+  // no health is asked for: unknown, neutral, never "Checking…" forever.
+  if (serverDown || sh()?.apiOff?.() === true) {
     chip.classList.remove("bad");
     chip.setAttribute("aria-busy", "false");
     chip.title = t("status.unknownTip");
@@ -779,6 +781,25 @@ function openLogs(svc) {
 
 // ── command palette (R17) ───────────────────────────────────────────────────
 
+/**
+ * The sessions and agents in view (GET /api/sessions), asked when the
+ * palette opens: each is "Agents › <ws> / <name>", which opens its pane on
+ * the Agents page (AG-4a-term).
+ */
+let palSessions = [];
+function askPaletteSessions(redraw) {
+  if (sh()?.apiOff?.()) return;
+  fetch("/api/sessions")
+    .then((r) => (r.ok ? r.json() : null))
+    .then((d) => {
+      palSessions = Array.isArray(d?.sessions) ? d.sessions : [];
+      redraw();
+    })
+    .catch(() => {
+      /* no sessions to offer */
+    });
+}
+
 /** Every palette row: pages, apps, services, their actions, then commands. */
 function paletteItems() {
   const s = sh();
@@ -846,6 +867,26 @@ function paletteItems() {
       run: () => openLogs(svcOf(id)),
     });
   }
+  for (const x of palSessions) {
+    const name = x.kind === "agent" ? (x.persona ?? x.label) : x.label;
+    items.push({
+      key: `agent:${x.id}`,
+      kind: "agent",
+      label: t("ag.pal", { ws: x.workspace, name }),
+      sub: x.kind === "agent" && x.persona !== x.label ? x.label : undefined,
+      dot: x.state === "running" ? "" : "off",
+      keywords: [x.workspace, x.label, x.persona ?? "", "agents", "terminal"],
+      run: () => go(`/agents?open=${encodeURIComponent(x.id)}`),
+    });
+  }
+  if (s?.nav?.().some((n) => n.id === "agents"))
+    items.push({
+      key: "agent:start",
+      kind: "action",
+      label: t("ag.palStart"),
+      keywords: ["agents", "start", "persona"],
+      run: () => go("/agents?start=1"),
+    });
   for (const c of s?.commands?.() ?? [])
     items.push({
       key: `cmd:${c.id}`,
@@ -955,6 +996,9 @@ function openPalette() {
   };
   draw();
   input.focus();
+  askPaletteSessions(() => {
+    if (overlay?.kind === "palette") draw();
+  });
 }
 
 // ── Runs chip (R7) ──────────────────────────────────────────────────────────
@@ -1153,6 +1197,9 @@ async function getJson(url, fallback, init) {
  */
 let vaultAsked = null;
 function checkVault() {
+  // 0.4.1: it reads the config's secrets refs; an invalid one answers 422.
+  if (window.denShell?.configInvalid?.() === true)
+    return Promise.resolve(lock.vault);
   vaultAsked ??= getJson("/api/sudo-password/vault-status", {
     backend: "none",
     label: "",
@@ -1178,6 +1225,8 @@ function checkVault() {
 }
 
 async function initLock() {
+  // A refusal page (SEC-1b): /api would answer the same refusal.
+  if (sh()?.apiOff?.() === true) return;
   try {
     if (sessionStorage.getItem(LS_LOCK) === "1") {
       lock.unlocked = true;