@monster-orange/den 0.4.14 → 0.4.15

package/src/ui/server/public/shell.js

@@ -383,6 +383,8 @@
     "err.signin.noTerminal":
       "Don't have a terminal on {host}? From this computer, run:",
     "err.signin.openTerminal": "Open Terminal",
+    "err.signin.sshUserNote":
+      "Log in with your {host} account ({user}) and its password, or an SSH key.",
     "err.signin.sshNote":
       "Open Terminal opens ssh://{target} in your terminal app. It needs SSH access to {target}.",
     "err.signin.whyTitle": "Why?",
@@ -569,6 +571,11 @@
     "ag.new.name": "Name (optional)",
     "ag.new.as": "Starts as {id}",
     "ag.new.openRunning": "Open the running one",
+    "ag.new.isRunning": "{id} is already running",
+    "ag.new.openIt": "Open it",
+    "ag.new.isStopped": "{id} is stopped",
+    "ag.new.resumeIt": "Resume it",
+    "ag.new.orNext": "or Start makes {id}",
     "ag.new.taskPh":
       "e.g. Take the empty-state story. Match the design and add a test.",
     "ag.new.adv": "Advanced: model and permissions",
@@ -598,6 +605,27 @@
     "ag.bring.now": "just now",
     "ag.bring.min": "{n} min ago",
     "ag.bring.h": "{n} h ago",
+    "ap.title": "{agent} wants to:",
+    "ap.agent": "The {name} agent",
+    "ap.noAgent": "Something on this machine (no agent identity)",
+    "ap.noAgentWarn": "If you didn't ask an agent to do this, Deny.",
+    "ap.signin.title": "Something is waiting for your approval.",
+    "ap.signin": "Sign in to see it: run {cmd} and open the link.",
+    "ap.do.workspace_create": 'Create the workspace "{name}"',
+    "ap.do.repo_add": 'Add the repo at {path} to workspace "{workspace}"',
+    "ap.do.repo_add.new":
+      'Add the repo at {path} to a new workspace "{workspace}"',
+    "ap.do.service_try": "Start {service}",
+    "ap.says": "Agent says:",
+    "ap.review": "Review",
+    "ap.hide": "Hide details",
+    "ap.later": "Later",
+    "ap.deny": "Deny",
+    "ap.allow": "Allow",
+    "ap.waits": "Nothing changes until you allow it. It waits until {time}.",
+    "ap.more": "{n} more waiting",
+    "ap.failed": "It ran, and failed: {error}",
+    "ap.done": "Done: {what}",
     "ag.new.note":
       "Starts in the workspace folder. It keeps running if you close the pane.",
     "ag.new.started": "Started {p} in {w}",
@@ -3852,6 +3880,37 @@
   // server start: a 403 `csrf` (the server restarted) fetches a fresh one
   // and retries once. Never sent to another origin.
   var CSRF_METHODS = { POST: 1, PUT: 1, PATCH: 1, DELETE: 1 };
+  // 0.4.15: the approval key (web-session.ts). A sign-in's 303 carries it
+  // in the URL fragment (#ak=…), which never reaches a server: keep it in
+  // this origin's localStorage (other localhost ports can't read it),
+  // strip it from the address bar, and send it with every same-origin
+  // change as X-Den-Approve-Key. Only approving needs it.
+  var APPROVE_KEY_STORE = "den.approveKey";
+  (function takeApproveKey() {
+    var m = /(?:^#|&)ak=([A-Za-z0-9_-]{43})(?:&|$)/.exec(location.hash || "");
+    if (!m) return;
+    try {
+      localStorage.setItem(APPROVE_KEY_STORE, m[1]);
+    } catch (e) {
+      /* storage blocked: this browser signs in again to approve */
+    }
+    try {
+      history.replaceState(
+        history.state,
+        "",
+        location.pathname + location.search,
+      );
+    } catch (e) {
+      location.hash = "";
+    }
+  })();
+  function approveKey() {
+    try {
+      return localStorage.getItem(APPROVE_KEY_STORE);
+    } catch (e) {
+      return null;
+    }
+  }
   var csrf = { token: null, pending: null };
   function csrfToken(fresh) {
     if (fresh) csrf.token = null;
@@ -3890,6 +3949,9 @@
       (init && init.headers) || (isRequest(input) ? input.headers : undefined),
     );
     headers.set("X-Den-CSRF", token);
+    var ak = approveKey();
+    if (ak && !headers.has("X-Den-Approve-Key"))
+      headers.set("X-Den-Approve-Key", ak);
     return Object.assign({}, init || {}, { headers: headers });
   }
   function csrfFetch(input, init) {
@@ -3958,6 +4020,257 @@
     if (!apiOffPage) csrfToken(false);
   }
 
+  // ── ON-3: an agent's held write waits for the person ─────────────────
+  // (approval-routes.ts) Every page asks GET /api/approvals every few
+  // seconds while it is in view, and opens the oldest request: Den's own
+  // words for it (the agent's note only quoted), Review (what it will do),
+  // Later, Deny, Allow. Allow and Deny go through the wrapped fetch above,
+  // so they carry the CSRF token and the approval key; the server decides
+  // who may approve (a browser that isn't signed in is told to sign in).
+  // The frame is the Start dialog's (persona-ui.css's .pe-dlg).
+  var ap = { dlg: null, shown: null, later: {}, busy: false, css: null };
+  function apCss() {
+    if (ap.css) return ap.css;
+    ap.css = new Promise(function (done) {
+      if (document.querySelector('link[href="/persona-ui.css"]')) return done();
+      var l = document.createElement("link");
+      l.rel = "stylesheet";
+      l.href = "/persona-ui.css";
+      l.onload = l.onerror = function () {
+        done();
+      };
+      document.head.appendChild(l);
+    });
+    return ap.css;
+  }
+  function apWhat(a) {
+    var p = a.params || {};
+    var key = "ap.do." + a.action + (p.isNew ? ".new" : "");
+    var s = t(key, p);
+    if (s !== key) return s;
+    s = String(a.summary || a.action);
+    return s.charAt(0).toUpperCase() + s.slice(1);
+  }
+  function apDialog() {
+    if (ap.dlg) return ap.dlg;
+    var d = document.createElement("dialog");
+    d.className = "pe-dlg den-ap-dlg";
+    d.id = "den-ap-dlg";
+    d.setAttribute("aria-labelledby", "den-ap-h");
+    d.innerHTML =
+      '<form method="dialog">' +
+      '<h2 id="den-ap-h"></h2>' +
+      '<p class="help den-ap-who" id="den-ap-who" hidden></p>' +
+      '<p class="den-ap-what" id="den-ap-what"></p>' +
+      '<p class="help" id="den-ap-note" hidden></p>' +
+      '<pre class="den-ap-det" id="den-ap-det" hidden></pre>' +
+      '<p class="help" id="den-ap-waits"></p>' +
+      '<p class="err" id="den-ap-err" role="alert" hidden></p>' +
+      '<div class="btns">' +
+      '<button type="button" class="den-btn" id="den-ap-review" aria-expanded="false" aria-controls="den-ap-det"></button>' +
+      '<span class="sp help" id="den-ap-more"></span>' +
+      '<button type="button" class="den-btn" id="den-ap-later"></button>' +
+      '<button type="button" class="den-btn" id="den-ap-deny"></button>' +
+      '<button type="button" class="den-btn primary" id="den-ap-allow"></button>' +
+      "</div></form>";
+    document.body.appendChild(d);
+    var $ = function (id) {
+      return d.querySelector("#" + id);
+    };
+    $("den-ap-review").addEventListener("click", function () {
+      var det = $("den-ap-det");
+      det.hidden = !det.hidden;
+      $("den-ap-review").textContent = t(det.hidden ? "ap.review" : "ap.hide");
+      $("den-ap-review").setAttribute("aria-expanded", String(!det.hidden));
+    });
+    $("den-ap-later").addEventListener("click", function () {
+      apLater();
+    });
+    // Esc is Later: the request keeps waiting (and the agent with it).
+    d.addEventListener("cancel", function (e) {
+      e.preventDefault();
+      apLater();
+    });
+    $("den-ap-deny").addEventListener("click", function () {
+      apDecide("deny");
+    });
+    $("den-ap-allow").addEventListener("click", function () {
+      apDecide("allow");
+    });
+    ap.dlg = d;
+    return d;
+  }
+  function apLater() {
+    if (ap.shown) ap.later[ap.shown.id] = 1;
+    apClose();
+  }
+  function apClose() {
+    ap.shown = null;
+    if (ap.dlg && ap.dlg.open) ap.dlg.close();
+  }
+  function apShow(a, more) {
+    var d = apDialog();
+    var $ = function (id) {
+      return d.querySelector("#" + id);
+    };
+    var same = ap.shown && ap.shown.id === a.id;
+    ap.shown = a;
+    // No agent token: say so, and what to do if no agent was asked.
+    $("den-ap-h").textContent = t("ap.title", {
+      agent: a.agent ? t("ap.agent", { name: a.agent }) : t("ap.noAgent"),
+    });
+    $("den-ap-who").hidden = !!a.agent;
+    $("den-ap-who").textContent = a.agent ? "" : t("ap.noAgentWarn");
+    $("den-ap-what").textContent = apWhat(a);
+    var note = $("den-ap-note");
+    note.hidden = !a.note;
+    note.textContent = a.note ? t("ap.says") + " “" + a.note + "”" : "";
+    $("den-ap-det").textContent = (a.details || []).join("\n");
+    var time = new Date(a.expiresAt);
+    $("den-ap-waits").textContent = t("ap.waits", {
+      time: isNaN(time)
+        ? ""
+        : time.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" }),
+    });
+    $("den-ap-more").textContent = more ? t("ap.more", { n: more }) : "";
+    $("den-ap-later").textContent = t("ap.later");
+    $("den-ap-deny").textContent = t("ap.deny");
+    $("den-ap-allow").textContent = t("ap.allow");
+    if (!same) {
+      $("den-ap-det").hidden = true;
+      $("den-ap-review").textContent = t("ap.review");
+      $("den-ap-review").setAttribute("aria-expanded", "false");
+      $("den-ap-err").hidden = true;
+    }
+    if (!d.open)
+      apCss().then(function () {
+        if (ap.shown && ap.shown.id === a.id && !d.open) d.showModal();
+      });
+  }
+  function apError(msg) {
+    var e = apDialog().querySelector("#den-ap-err");
+    e.textContent = msg;
+    e.hidden = false;
+  }
+  function apDecide(decision) {
+    var a = ap.shown;
+    if (!a || ap.busy) return;
+    ap.busy = true;
+    var btns = ap.dlg.querySelectorAll("button");
+    for (var i = 0; i < btns.length; i++) btns[i].disabled = true;
+    fetch("/api/approvals/" + encodeURIComponent(a.id) + "/decide", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ decision: decision }),
+    })
+      .then(function (r) {
+        return r.json().then(
+          function (b) {
+            return { ok: r.ok, b: b || {} };
+          },
+          function () {
+            return { ok: false, b: {} };
+          },
+        );
+      })
+      .then(
+        function (x) {
+          if (!x.ok) {
+            apError(x.b.error || t("ap.failed", { error: x.b.code || "?" }));
+            return;
+          }
+          var res = x.b.result;
+          if (decision === "allow" && res && res.ok === false)
+            toast(t("ap.failed", { error: res.error || "?" }));
+          else if (decision === "allow")
+            toast(t("ap.done", { what: apWhat(a) }));
+          apClose();
+          apPoll();
+        },
+        function (e) {
+          apError(String((e && e.message) || e));
+        },
+      )
+      .then(function () {
+        ap.busy = false;
+        for (var j = 0; j < btns.length; j++) btns[j].disabled = false;
+      });
+  }
+  // Reading what waits needs what approving needs (approvals.ts): the
+  // session's CSRF token and the approval key, on a GET too. A browser
+  // without them is told only that something waits, and to sign in.
+  function apList(fresh) {
+    var ak = approveKey();
+    // No approval key: only the count, to say "sign in to see it".
+    if (!ak)
+      return rawFetch("/api/approvals?count=1", {
+        cache: "no-store",
+        credentials: "same-origin",
+      }).then(function (r) {
+        return r.ok
+          ? r.json().then(function (b) {
+              return { code: "signin_to_approve", waiting: b && b.waiting };
+            })
+          : null;
+      });
+    return csrfToken(fresh).then(function (token) {
+      var h = { "X-Den-Approve-Key": ak };
+      if (token) h["X-Den-CSRF"] = token;
+      return rawFetch("/api/approvals", {
+        cache: "no-store",
+        credentials: "same-origin",
+        headers: h,
+      }).then(function (r) {
+        return r.json().then(
+          function (b) {
+            if (!fresh && r.status === 403 && b && b.code === "csrf")
+              return apList(true);
+            return b;
+          },
+          function () {
+            return null;
+          },
+        );
+      });
+    });
+  }
+  function apSignin(b) {
+    if (b && b.code === "signin_to_approve" && b.waiting > 0)
+      showBanner("approvals", {
+        title: t("ap.signin.title"),
+        text: t("ap.signin", { cmd: "__DEN_CLI__ web login" }),
+      });
+    else hideBanner("approvals");
+  }
+  function apPoll() {
+    if (document.hidden || ap.busy) return;
+    apList(false).then(
+      function (b) {
+        apSignin(b);
+        var list = (b && b.ok && b.pending) || [];
+        var open = list.filter(function (a) {
+          return !ap.later[a.id];
+        });
+        if (!open.length) return apClose();
+        var cur =
+          (ap.shown &&
+            open.filter(function (a) {
+              return a.id === ap.shown.id;
+            })[0]) ||
+          open[0];
+        apShow(cur, open.length - 1);
+      },
+      function () {},
+    );
+  }
+  if (!apiOffPage && !configBad && rawFetch) {
+    setInterval(apPoll, 3000);
+    document.addEventListener("visibilitychange", function () {
+      if (!document.hidden) apPoll();
+    });
+    setTimeout(apPoll, 300);
+  }
+
   // ── the UI language (R19): a user pref ───────────────────────────────
   // /api/settings `language` (user.yml), then a reload: the server serves
   // every page with that language's catalog from its first paint.

package/src/ui/server/request-guard.ts

@@ -110,6 +110,8 @@ export interface GuardSession {
   key: string;
   /** The session's own CSRF token. */
   csrf: string;
+  /** sha256 of its approval key (approvals.ts); unset before 0.4.15. */
+  approveKeyHash?: string;
 }
 
 /** How a request reached Den. `edge` and `lan` are beyond loopback. */

package/src/ui/server/route-classes.ts

@@ -95,7 +95,8 @@ export const ROUTES: readonly RouteEntry[] = [
     "/theme-favicon",
     "/theme-favicon/*",
     "/vendor/*",
-    "/report*",
+    "/report",
+    "/report/*",
     "/reports/security/*",
   ].map((p) => R(p)),
   R("/_den/throw", "a test-only route (DEN_DEBUG_ROUTES): it throws"),
@@ -174,6 +175,30 @@ export const ROUTES: readonly RouteEntry[] = [
   R("/api/health", "runs the manifests' health probes: read-only checks"),
   R("/api/test-sources", "git rev-parse in each repo: read-only"),
   R("/api/manifest/validate", "GET validates a file at a path: read-only"),
+  // ON-3 (onboard-routes.ts): reads only; nothing written, no repo tool run.
+  R("/api/onboard/status", "what's set up and the next step (file reads)"),
+  R(
+    "/api/onboard/repos",
+    "lists the git repos in a folder in home; never follows a symlink",
+  ),
+  R(
+    "/api/onboard/manifest",
+    "drafts and validates a side-car manifest; writes nothing",
+  ),
+  // ON-3's held writes (approval-routes.ts): asking runs nothing; Allow is
+  // the person's signed-in browser only (approvals.ts approverAllowed).
+  R("/api/approvals", "what waits for the person (never an agent's token)"),
+  R("/api/approvals/:id", "one held request: the asker's own, or the person's"),
+  M(
+    ["POST"],
+    "/api/approvals",
+    "holds an agent's write for the person; nothing runs until they allow it",
+  ),
+  M(
+    ["POST"],
+    "/api/approvals/:id/decide",
+    "the person's Allow runs the held write once; Deny runs nothing",
+  ),
   R("/api/service/logs", "reads (and follows) a service's log"),
   R("/api/service/taillog", "tails a service's log (tail, docker logs)"),
   R(
@@ -456,6 +481,8 @@ export const REGEX_ROUTES: Readonly<Record<string, readonly string[]>> = {
   "github-routes.ts:LINK_PATH": ["/api/web/owner/link/:id"],
   "pair-routes.ts:POLL_PATH": ["/api/signin/code/:id"],
   "index.ts:LOGIN_WAIT_PATH": ["/api/web/logins/:id"],
+  "approval-routes.ts:ONE_PATH": ["/api/approvals/:id"],
+  "approval-routes.ts:DECIDE_PATH": ["/api/approvals/:id/decide"],
 };
 
 /** Whether `pathname` matches a table path. */

package/src/ui/server/session-routes.ts

@@ -9,8 +9,9 @@
  * `<cli> agents list` does (agent-ops.ts agentRows), and adds the plain
  * sessions (`sessions start`), labelled kind "session". An agent whose
  * actor token `web logout --all` revoked is marked (tokenRevoked). The
- * host knows nothing of approvals yet, so `waiting` is never set here
- * (AG-6a adds it). Asking never starts a session host.
+ * agent with one of Den's held writes waiting for the person (ON-3,
+ * approval-routes.ts) is `waiting` (AG-6a); a runtime's own permission
+ * prompts are not seen here yet. Asking never starts a session host.
  *
  * The io route bridges one WebSocket to one attachment on the session host
  * (its own connection to the host, so a browser and the CLI, or two
@@ -78,6 +79,8 @@ export interface SessionRouteDeps {
   /** Whether workspaces.yml names `ws` (active or not). */
   workspaceExists?: (ws: string) => boolean;
   pty?: () => PtyLoad;
+  /** The agent ids with an approval waiting for the person (AG-6a, ON-3). */
+  waitingAgents?: () => ReadonlySet<string>;
 }
 
 interface Resolved {
@@ -87,6 +90,7 @@ interface Resolved {
   activeWorkspaces: () => string[];
   workspaceExists: (ws: string) => boolean;
   pty: () => PtyLoad;
+  waitingAgents: () => ReadonlySet<string>;
 }
 
 /** A workspace name as `?ws=` may give it. */
@@ -116,6 +120,7 @@ function resolve(d: SessionRouteDeps = {}): Resolved {
           ws,
         )),
     pty: d.pty ?? (() => loadPty()),
+    waitingAgents: d.waitingAgents ?? (() => new Set<string>()),
   };
 }
 
@@ -189,7 +194,8 @@ export interface ListedSession {
 /** The list, from the host's sessions and the agent records. */
 export function listedSessions(
   sessions: SessionInfo[],
-  d: Pick<Resolved, "stateDir" | "dist" | "activeWorkspaces">,
+  d: Pick<Resolved, "stateDir" | "dist" | "activeWorkspaces"> &
+    Partial<Pick<Resolved, "waitingAgents">>,
   /** A workspace asked for by name (`?ws=`), listed even when inactive. */
   also?: string,
 ): ListedSession[] {
@@ -204,6 +210,7 @@ export function listedSessions(
     active.has(r.workspace),
   );
   const revoked = revokedAgentIds(d.stateDir());
+  const waiting = d.waitingAgents?.() ?? new Set<string>();
   const out: ListedSession[] = [];
   const agentSessions = new Set<string>();
   noteEnded(d.stateDir(), mine, records);
@@ -242,6 +249,7 @@ export function listedSessions(
       ...(r.interruptedAt ? { interruptedAt: r.interruptedAt } : {}),
       ...(r.rotation?.due ? { rotation: r.rotation } : {}),
       ...(revoked.has(rec.id) && s && !s.exited ? { tokenRevoked: true } : {}),
+      ...(waiting.has(rec.id) && s && !s.exited ? { waiting: true } : {}),
     });
   }
   for (const s of mine) {

package/src/ui/server/workspace-routes.ts

@@ -344,6 +344,25 @@ const availableReposCache = singleFlight<AvailableRepos>(2_000);
  * Same contract as the original inline handlers: uses return sendJson/send400
  * to end the response. Caller checks res.writableEnded to know if handled.
  */
+
+/**
+ * Why a workspace can't be created with this name, or null: the Workspaces
+ * page's create and ON-3's held workspace_create (approval-routes.ts) both
+ * ask this.
+ */
+export function workspaceCreateRefusal(
+  name: string | undefined,
+): string | null {
+  if (!name) return "name required";
+  // eslint-disable-next-line no-control-regex
+  if (/["'\\/<>\x00-\x1f]/.test(name))
+    return "name must not contain quotes, slashes, or control characters";
+  if (name.length > 64) return "name must be 64 characters or fewer";
+  if (readWorkspacesFile().workspaces[name])
+    return `workspace "${name}" already exists`;
+  return null;
+}
+
 export async function handleWorkspaceRoutes(
   req: http.IncomingMessage,
   res: http.ServerResponse,
@@ -639,16 +658,8 @@ export async function handleWorkspaceRoutes(
     try {
       const body = await readBody(req);
       const { name } = JSON.parse(body) as { name?: string };
-      if (!name) return send400(res, "name required");
-      // eslint-disable-next-line no-control-regex
-      if (/["'\\/<>\x00-\x1f]/.test(name))
-        return send400(
-          res,
-          "name must not contain quotes, slashes, or control characters",
-        );
-      const file = readWorkspacesFile();
-      if (file.workspaces[name])
-        return send400(res, `workspace "${name}" already exists`);
+      const refusal = workspaceCreateRefusal(name);
+      if (refusal || !name) return send400(res, refusal ?? "name required");
       createWorkspace(name, { services: {} });
       return sendJson(res, { ok: true, name });
     } catch (e) {

package/themes/den/den-theme.json

@@ -3,7 +3,7 @@
   "schema": "den.theme/v1",
   "id": "den",
   "name": "Den",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Den's default: a sheltered workspace in walnut and umber neutrals with a moss-green accent. System fonts.",
   "author": "Monster Orange",
   "license": "MIT",
@@ -37,13 +37,13 @@
       "border": "#dcd3c7",
       "border-strong": "#8d7f6d",
       "accent": "#557a2a",
-      "accent-text": "#4a6b23",
+      "accent-text": "#415e1f",
       "accent-fill": "#4a6b23",
       "on-accent": "#ffffff",
-      "ok": "#2e7246",
-      "warn": "#8c5a10",
-      "bad": "#b0392a",
-      "remote": "#23677a",
+      "ok": "#27613b",
+      "warn": "#774c0e",
+      "bad": "#983124",
+      "remote": "#205d6e",
       "shadow": "0 8px 24px rgb(48 36 24 / 0.14)",
       "bar": "linear-gradient(90deg, #557a2a 0%, #8a6a48 100%)"
     },