@monster-orange/den 0.4.14 → 0.4.15

package/src/ui/server/pair-routes.ts

@@ -22,8 +22,8 @@ export interface PairRouteDeps {
   pairs: PairRequests;
   sendJson: (res: http.ServerResponse, body: unknown, status?: number) => void;
   readBody: (req: http.IncomingMessage) => Promise<string>;
-  /** A new browser session for this request (via "code"); its Set-Cookie line. */
-  signIn: (req: http.IncomingMessage) => string;
+  /** A new browser session for this request (via "code"): its Set-Cookie line and approval key. */
+  signIn: (req: http.IncomingMessage) => { cookie: string; approveKey: string };
   /** The client's address for a new request's record, when Den knows it. */
   client: (req: http.IncomingMessage) => string | undefined;
   /** The commands that approve `code`: on the server, and by ssh from the browser's machine. */
@@ -132,8 +132,11 @@ export async function handlePairRoutes(
         deps.sendJson(res, { ok: false, state: "gone" }, 404);
         return true;
       }
-      res.setHeader("Set-Cookie", deps.signIn(req));
-      deps.sendJson(res, { ok: true, state: "ok" });
+      const s = deps.signIn(req);
+      res.setHeader("Set-Cookie", s.cookie);
+      res.setHeader("Cache-Control", "no-store");
+      // The approval key goes to this answer only (web-session.ts).
+      deps.sendJson(res, { ok: true, state: "ok", approveKey: s.approveKey });
       return true;
     }
     deps.sendJson(res, {

package/src/ui/server/public/agents-page.js

@@ -1702,6 +1702,12 @@ function paintDetails() {
  * and the dialog says so.
  */
 function paintRuntime(reset) {
+  paintRuntimeFields(reset);
+  // Last: a Name that names a running agent disables Start (AG-10.10b).
+  paintStartsAs();
+}
+
+function paintRuntimeFields(reset) {
   const rs = $d("#ag-runtime");
   const go = $d("#ag-go");
   const ready = $d("#ag-r-ready");
@@ -1712,7 +1718,6 @@ function paintRuntime(reset) {
   $d("#ag-task-l").hidden = plain || !!sd.bring;
   $d("#ag-adv").hidden = plain || !!sd.bring;
   $d("#ag-name-l").hidden = plain || !!sd.bring;
-  paintStartsAs();
   if (sd.bring) {
     $d("#ag-r-miss").hidden = true;
     ready.hidden = true;
@@ -1958,14 +1963,93 @@ function showStartError(err) {
   el.hidden = false;
 }
 
-/** AG-10.10: the id this start takes, so two of one persona are told apart. */
+/**
+ * AG-10.10b: the id a Name gives, as the server's nameSlug: lowercase,
+ * spaces to "-", only id characters, at most 64; null when none is left.
+ */
+export function nameSlug(name) {
+  const s = String(name)
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, "-")
+    .replace(/[^a-z0-9._-]/g, "")
+    .replace(/-{2,}/g, "-")
+    .replace(/^[^a-z0-9]+/, "")
+    .slice(0, 64)
+    .replace(/[-._]+$/, "");
+  return s && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(s) ? s : null;
+}
+
+/**
+ * The id this start takes (AG-10.10, 10.10b), said as you type: a Name is
+ * the id as its slug. A running agent here with that id or title: "is
+ * already running · Open it", Start off. A stopped one: "Resume it", or
+ * Start takes the next suffix.
+ */
 function paintStartsAs() {
   const el = $d("#ag-as");
   if (!el) return;
   const p = sd.pid && sd.pid !== PLAIN && !sd.bring ? curPersona() : null;
   el.hidden = !p;
-  if (p)
-    el.textContent = t("ag.new.as", { id: sd.data?.startsAs?.[p.id] ?? p.id });
+  el.textContent = "";
+  if (!p) return;
+  const name = ($d("#ag-name")?.value ?? "").trim();
+  const slug = name ? nameSlug(name) : null;
+  const ws = $d("#ag-ws")?.value || viewWorkspaces()[0];
+  const here = (st.data?.sessions ?? []).filter(
+    (r) => r.kind === "agent" && r.workspace === ws,
+  );
+  const live = (r) => r.state === "running" || r.state === "stopping";
+  const match = name
+    ? (here.find(
+        (r) =>
+          live(r) &&
+          (r.agent === slug ||
+            (r.displayName ?? "").toLowerCase() === name.toLowerCase()),
+      ) ?? here.find((r) => r.agent === slug))
+    : null;
+  const act = (label, fn) => {
+    const b = document.createElement("button");
+    b.type = "button";
+    b.className = "den-btn sm";
+    b.textContent = label;
+    b.addEventListener("click", fn);
+    return b;
+  };
+  if (match && live(match)) {
+    el.append(
+      t("ag.new.isRunning", { id: match.agent }) + " · ",
+      act(t("ag.new.openIt"), () => {
+        $d("#ag-dlg").close?.();
+        void openPane(match.id);
+      }),
+    );
+    $d("#ag-go").disabled = true;
+    return;
+  }
+  if (match) {
+    el.append(
+      t("ag.new.isStopped", { id: match.agent }) + " · ",
+      act(t("ag.new.resumeIt"), () => {
+        $d("#ag-dlg").close?.();
+        void restartRow(match, "resume", null);
+      }),
+      " " + t("ag.new.orNext", { id: nextFree(slug) }),
+    );
+    return;
+  }
+  el.textContent = t("ag.new.as", {
+    id: slug ?? sd.data?.startsAs?.[p.id] ?? p.id,
+  });
+}
+
+/** The first `<slug>-<n>` no agent on this page has (the server decides). */
+function nextFree(slug) {
+  const ids = new Set((st.data?.sessions ?? []).map((r) => r.agent));
+  for (let n = 2; n < 1000; n++)
+    if (!ids.has(`${slug.slice(0, 58)}-${n}`))
+      return `${slug.slice(0, 58)}-${n}`;
+  return slug;
 }
 
 async function submitStart(form) {
@@ -2131,6 +2215,9 @@ function wireStartDialog(root) {
     if (e.target.id === "ag-q") {
       sd.f.q = e.target.value;
       paintPlist(false);
+    } else if (e.target.id === "ag-name") {
+      // AG-10.10b: what the Name gives, as you type.
+      paintRuntime(false);
     } else if (e.target.id === "ag-tools") {
       sd.extras = splitCommands(e.target.value);
       syncPermBlock(form, "ag", sd.data, {

package/src/ui/server/public/error-page.js

@@ -139,7 +139,7 @@ function withCmd(text, cmd) {
 function withHost(t, key, vars) {
   const marks = {};
   const v = { ...vars };
-  for (const k of ["host", "target"])
+  for (const k of ["host", "target", "user"])
     if (k in v) {
       marks[k] = v[k];
       v[k] = `\u0001${k}\u0001`;
@@ -203,6 +203,20 @@ export function countdownText(ms) {
  * Where a signed-in page goes: the page that was asked for. On /signin,
  * its same-origin `next` (else `/`); anywhere else, the same URL.
  */
+/**
+ * 0.4.15: keep a sign-in's approval key (web-session.ts) in this origin's
+ * localStorage, where shell.js sends it from. It comes in the sign-in's
+ * own answer only.
+ */
+function keepApproveKey(b) {
+  if (!b || typeof b.approveKey !== "string") return;
+  try {
+    localStorage.setItem("den.approveKey", b.approveKey);
+  } catch {
+    /* storage blocked: this browser signs in again to approve */
+  }
+}
+
 export function landingAfterSignIn(loc) {
   if (loc.pathname !== "/signin") return loc.pathname + loc.search + loc.hash;
   const n = new URLSearchParams(loc.search).get("next") || "/";
@@ -263,6 +277,7 @@ function wireGithub(root, t, s) {
           return;
         }
         if (b.state === "ok") {
+          keepApproveKey(b);
           show(
             `<p class="lead" style="margin-top:12px">${esc(t("err.signin.githubDone"))}</p>`,
           );
@@ -351,6 +366,9 @@ function wirePair(root, t, s) {
   if (!box) return;
   const host = s.machine || "";
   const target = s.ssh?.target || "";
+  // SEC-2a-UX: the account to log in as, so the SSH app doesn't guess one.
+  const user = s.ssh?.user || "";
+  const login = user ? `${user}@${target}` : target;
   let poll = null;
   let tick = null;
   let gen = 0;
@@ -376,7 +394,7 @@ function wirePair(root, t, s) {
   const show = (b) => {
     const term =
       s.ssh?.name && target
-        ? `<a class="btn" id="den-pair-term" href="ssh://${esc(target)}">${esc(t("err.signin.openTerminal"))}</a>`
+        ? `<a class="btn" id="den-pair-term" href="ssh://${esc(login)}">${esc(t("err.signin.openTerminal"))}</a>`
         : "";
     box.innerHTML =
       `<ol class="den-steps">` +
@@ -389,7 +407,11 @@ function wirePair(root, t, s) {
       `<p>${withHost(t, "err.signin.noTerminal", { host })}</p>` +
       cmdLine("den-pair-ssh", b.ssh, t, term) +
       (term
-        ? `<p class="den-pair-note">${withHost(t, "err.signin.sshNote", { target })}</p>`
+        ? `<p class="den-pair-note" id="den-pair-note">${
+            user
+              ? withHost(t, "err.signin.sshUserNote", { host, user })
+              : withHost(t, "err.signin.sshNote", { target })
+          }</p>`
         : "");
     wireCopy(box, t);
   };
@@ -432,6 +454,7 @@ function wirePair(root, t, s) {
                 return;
               }
               if (p.state === "ok") {
+                keepApproveKey(p);
                 stop();
                 box.innerHTML = `<p class="lead" id="den-pair-in">${esc(t("err.signin.youreIn"))}</p>`;
                 location.replace(landingAfterSignIn(location));
@@ -524,6 +547,7 @@ function mountSignedOut(root, sh, d) {
         .then((b) => {
           go.disabled = false;
           if (b.ok) {
+            keepApproveKey(b);
             err.textContent = "";
             form.innerHTML = `<p class="lead" id="den-confirm-in">${esc(t("err.signin.youreIn"))}</p>`;
             location.replace(typeof b.next === "string" ? b.next : "/");

package/src/ui/server/public/header.js

@@ -251,7 +251,7 @@ function _injectChangelogStyles() {
       padding: 5px 16px; border-radius: 5px; font-size: 12px;
       font-weight: 600; cursor: pointer;
     }
-    .cl-got-it:hover { opacity: .85; }
+    .cl-got-it:hover { filter: brightness(0.92); }
   `;
   document.head.appendChild(style);
 

package/src/ui/server/public/i18n/es.js

@@ -271,6 +271,8 @@
     "err.signin.noTerminal":
       "¿No tienes una terminal en {host}? Desde este ordenador, ejecuta:",
     "err.signin.openTerminal": "Abrir Terminal",
+    "err.signin.sshUserNote":
+      "Inicia sesión con tu cuenta de {host} ({user}) y su contraseña, o con una clave SSH.",
     "err.signin.sshNote":
       "Abrir Terminal abre ssh://{target} en tu aplicación de terminal. Necesita acceso SSH a {target}.",
     "err.signin.whyTitle": "¿Por qué?",
@@ -459,6 +461,11 @@
     "ag.new.name": "Nombre (opcional)",
     "ag.new.as": "Se inicia como {id}",
     "ag.new.openRunning": "Abrir el que está en ejecución",
+    "ag.new.isRunning": "{id} ya está en ejecución",
+    "ag.new.openIt": "Abrirlo",
+    "ag.new.isStopped": "{id} está detenido",
+    "ag.new.resumeIt": "Reanudarlo",
+    "ag.new.orNext": "o Iniciar crea {id}",
     "ag.new.taskPh":
       "p. ej., Toma la historia del estado vacío. Sigue el diseño y añade una prueba.",
     "ag.new.adv": "Avanzado: modelo y permisos",
@@ -488,6 +495,28 @@
     "ag.bring.now": "ahora mismo",
     "ag.bring.min": "hace {n} min",
     "ag.bring.h": "hace {n} h",
+    "ap.title": "{agent} quiere:",
+    "ap.agent": "El agente {name}",
+    "ap.noAgent": "Algo en esta máquina (sin identidad de agente)",
+    "ap.noAgentWarn": "Si no le pediste esto a un agente, deniégalo.",
+    "ap.signin.title": "Algo espera tu aprobación.",
+    "ap.signin": "Inicia sesión para verlo: ejecuta {cmd} y abre el enlace.",
+    "ap.do.workspace_create": 'Crear el espacio "{name}"',
+    "ap.do.repo_add":
+      'Añadir el repositorio de {path} al espacio "{workspace}"',
+    "ap.do.repo_add.new":
+      'Añadir el repositorio de {path} a un espacio nuevo "{workspace}"',
+    "ap.do.service_try": "Iniciar {service}",
+    "ap.says": "El agente dice:",
+    "ap.review": "Revisar",
+    "ap.hide": "Ocultar detalles",
+    "ap.later": "Más tarde",
+    "ap.deny": "Denegar",
+    "ap.allow": "Permitir",
+    "ap.waits": "Nada cambia hasta que lo permitas. Espera hasta las {time}.",
+    "ap.more": "{n} más en espera",
+    "ap.failed": "Se ejecutó y falló: {error}",
+    "ap.done": "Hecho: {what}",
     "ag.new.note":
       "Se inicia en la carpeta del espacio de trabajo. Sigue en ejecución si cierras el panel.",
     "ag.new.started": "{p} iniciado en {w}",

package/src/ui/server/public/i18n/ja.js

@@ -260,6 +260,8 @@
     "err.signin.noTerminal":
       "{host} のターミナルがありませんか?このコンピューターで次を実行します:",
     "err.signin.openTerminal": "ターミナルを開く",
+    "err.signin.sshUserNote":
+      "{host} のアカウント({user})とそのパスワード、または SSH キーでログインします。",
     "err.signin.sshNote":
       "「ターミナルを開く」はターミナルアプリで ssh://{target} を開きます。{target} への SSH アクセスが必要です。",
     "err.signin.whyTitle": "なぜ?",
@@ -442,6 +444,11 @@
     "ag.new.name": "名前（任意）",
     "ag.new.as": "{id} として開始します",
     "ag.new.openRunning": "実行中のものを開く",
+    "ag.new.isRunning": "{id} はすでに実行中です",
+    "ag.new.openIt": "開く",
+    "ag.new.isStopped": "{id} は停止しています",
+    "ag.new.resumeIt": "再開する",
+    "ag.new.orNext": "または開始で {id} を作成します",
     "ag.new.taskPh":
       "例: 空の状態のストーリーを担当。デザインに合わせ、テストを追加する。",
     "ag.new.adv": "詳細設定: モデルと権限",
@@ -472,6 +479,30 @@
     "ag.bring.now": "たった今",
     "ag.bring.min": "{n} 分前",
     "ag.bring.h": "{n} 時間前",
+    "ap.title": "{agent}が次のことを求めています:",
+    "ap.agent": "エージェント {name} ",
+    "ap.noAgent": "このマシン上の何か（エージェントの識別なし）",
+    "ap.noAgentWarn":
+      "エージェントにこれを頼んでいなければ、拒否してください。",
+    "ap.signin.title": "承認を待っているものがあります。",
+    "ap.signin":
+      "サインインすると表示されます: {cmd} を実行してリンクを開いてください。",
+    "ap.do.workspace_create": "ワークスペース「{name}」を作成",
+    "ap.do.repo_add":
+      "{path} のリポジトリをワークスペース「{workspace}」に追加",
+    "ap.do.repo_add.new":
+      "{path} のリポジトリを新しいワークスペース「{workspace}」に追加",
+    "ap.do.service_try": "{service} を起動",
+    "ap.says": "エージェントのコメント:",
+    "ap.review": "確認",
+    "ap.hide": "詳細を隠す",
+    "ap.later": "あとで",
+    "ap.deny": "拒否",
+    "ap.allow": "許可",
+    "ap.waits": "許可するまで何も変わりません。{time} まで待ちます。",
+    "ap.more": "ほかに {n} 件が待機中",
+    "ap.failed": "実行しましたが失敗しました: {error}",
+    "ap.done": "完了: {what}",
     "ag.new.note":
       "ワークスペースのフォルダーで開始します。ペインを閉じても実行は続きます。",
     "ag.new.started": "{w} で {p} を開始しました",

package/src/ui/server/public/index.html

@@ -355,7 +355,7 @@
         white-space: nowrap;
       }
       .run-btn:hover:not(:disabled) {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       .run-btn:disabled {
         opacity: 0.45;

package/src/ui/server/public/local-dev.html

@@ -344,7 +344,7 @@
         cursor: pointer;
       }
       .new-ws-form button:hover {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       /* ── Content ──────────────────────────────────────────────────────────── */
       .content {
@@ -552,7 +552,7 @@
         cursor: pointer;
       }
       .add-btn:hover {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       .form-msg {
         font-size: 11px;
@@ -688,8 +688,9 @@
       .add-svc-row.selected {
         background: color-mix(in srgb, var(--accent) 9%, transparent);
       }
+      /* Already in the workspace: readable (WCAG AA), not dimmed. */
       .add-svc-row.already {
-        opacity: 0.4;
+        color: var(--muted);
       }
       .add-svc-row-info {
         flex: 1;
@@ -839,7 +840,7 @@
         cursor: pointer;
       }
       .add-svc-submit:hover {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       .add-svc-submit:disabled {
         opacity: 0.45;

package/src/ui/server/public/persona-ui.css

@@ -561,3 +561,24 @@ dialog.pe-dlg::backdrop {
 .pr[aria-disabled="true"]:hover {
   background: none;
 }
+
+/* ON-3's approval dialog (shell.js, every page): the Start dialog's frame,
+   the request in the body text's size and weight, and Review's lines in
+   the mono box the persona Details use. */
+.den-ap-dlg .den-ap-what {
+  color: var(--text);
+  font: 600 14.5px/1.45 var(--sans);
+  overflow-wrap: anywhere;
+}
+.den-ap-dlg .den-ap-det {
+  margin: 0;
+  max-height: 260px;
+  overflow: auto;
+  padding: 10px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-button, 6px);
+  background: var(--surface, var(--raised));
+  font: 12px/1.5 var(--mono);
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}

package/src/ui/server/public/release.html

@@ -398,7 +398,6 @@
       .loading-note .sub {
         display: block;
         margin-top: 4px;
-        opacity: 0.75;
         font-size: 11px;
       }
       .loading-dots::after {

package/src/ui/server/public/settings-registry.js

@@ -160,7 +160,9 @@ export function deviceLine(d, now = Date.now()) {
       ? `signed in with GitHub${d.login ? ` (@${d.login})` : ""}`
       : d.via === "code"
         ? "approved with a code"
-        : "signed in with a one-time link";
+        : d.via === "claim"
+          ? "claimed with a setup link"
+          : "signed in with a one-time link";
   const name = d.name || "Unknown browser";
   const from = d.client || d.host;
   return {

package/src/ui/server/public/settings.html

@@ -340,10 +340,18 @@
       .set-radio:hover {
         background: var(--sunken);
       }
+      /* Not installed: the option stays readable (WCAG AA); only its
+         radio dims. */
       .set-radio.off {
-        opacity: 0.5;
+        color: var(--muted);
         cursor: default;
       }
+      .set-radio.off:hover {
+        background: none;
+      }
+      .set-radio.off input {
+        opacity: 0.5;
+      }
       .set-radio input {
         accent-color: var(--accent);
         margin: 0;