@monster-orange/den 0.4.14 → 0.4.16

package/src/ui/server/public/shell.js

@@ -366,12 +366,18 @@
     "err.signin.title": "Sign in to {name}",
     "err.signin.where":
       "You're opening {name} from another computer. {name} runs on {host}, so it needs to know this is you.",
-    "err.signin.githubNote":
-      "Uses your GitHub account. The owner of this {name} has to have linked theirs.",
-    "err.signin.githubNoOwner":
-      "Sign in with GitHub needs an owner, and this {name} has none yet. On {host} (not this computer), run:",
+    "err.signin.ghStep1":
+      "On {host}, run {cmd}, or use Settings › Access there.",
+    "err.signin.ghStep2":
+      "It shows a code. Enter it at github.com/login/device and approve.",
+    "err.signin.ghStep3":
+      "Then come back here and press Sign in with GitHub, with the same GitHub account.",
+    "err.signin.ghOwner": "Owner: @{login}",
+    "err.signin.ghOnly":
+      "Only the owner's GitHub account can sign in this way. For anyone else, use Approve this computer.",
+    "err.signin.ghLearn": "Learn more",
     "err.signin.githubRefused":
-      "@{login} isn't the owner of this {name}. Ask the owner to add you, or use 'Approve this computer'.",
+      "@{login} isn't the owner of this {name}. Only the owner's account can use Sign in with GitHub. Use Approve this computer instead.",
     "err.signin.approveOr": "Or approve this computer",
     "err.signin.approve": "Approve this computer",
     "err.signin.step1": "On {host} (not this computer), run:",
@@ -383,6 +389,8 @@
     "err.signin.noTerminal":
       "Don't have a terminal on {host}? From this computer, run:",
     "err.signin.openTerminal": "Open Terminal",
+    "err.signin.sshUserNote":
+      "Log in with your {host} account ({user}) and its password, or an SSH key.",
     "err.signin.sshNote":
       "Open Terminal opens ssh://{target} in your terminal app. It needs SSH access to {target}.",
     "err.signin.whyTitle": "Why?",
@@ -569,6 +577,11 @@
     "ag.new.name": "Name (optional)",
     "ag.new.as": "Starts as {id}",
     "ag.new.openRunning": "Open the running one",
+    "ag.new.isRunning": "{id} is already running",
+    "ag.new.openIt": "Open it",
+    "ag.new.isStopped": "{id} is stopped",
+    "ag.new.resumeIt": "Resume it",
+    "ag.new.orNext": "or Start makes {id}",
     "ag.new.taskPh":
       "e.g. Take the empty-state story. Match the design and add a test.",
     "ag.new.adv": "Advanced: model and permissions",
@@ -592,12 +605,56 @@
     "ag.bring.agent": "Agent {id}",
     "ag.bring.note":
       "Continues it in the folder it ran in, with Den's tools and guards from now on. It keeps running if you close the pane. Close it in any other terminal first: Den only sees a conversation as open if it was written in the last minute.",
+    "ag.keep.model": "Keeps {m} from the conversation.",
+    "ag.keep.modelNew": "Runs on {m} from now on.",
+    "ag.keep.from":
+      "From now on it works as {p}: its role, its permissions ({mode}), Den's tools and guards. Its history stays.",
+    "ag.keep.lost":
+      "It won't have: {s}. Den runs agents with Den's tools only.",
+    "ag.keep.opt": "Keep {m}",
+    "ag.keep.optNone": "Keep the model it runs",
+    "ag.keep.advNote":
+      "The model it runs stays unless you pick another here. Permissions come from the persona.",
+    "ag.pc.item": "Change persona…",
+    "ag.pc.title": "Change {id}'s persona",
+    "ag.pc.note":
+      "Den stops it and resumes the same conversation as the new persona. Its id, name, folder and tab stay.",
+    "ag.pc.go": "Change persona",
+    "ag.pc.going": "Changing…",
+    "ag.pc.current": "current",
+    "ag.pc.busy": "It's working. Change after this turn, or stop it now?",
+    "ag.pc.after": "After this turn",
+    "ag.pc.now": "Stop it now",
+    "ag.pc.done": "{id} is now {p}",
+    "ag.pc.pending": "{id} becomes {p} when this turn ends",
+    "ag.more": "More for {id}",
     "ag.bring.go": "Bring in",
     "ag.bring.going": "Bringing in…",
     "ag.bring.done": "Brought in as {id}",
     "ag.bring.now": "just now",
     "ag.bring.min": "{n} min ago",
     "ag.bring.h": "{n} h ago",
+    "ap.title": "{agent} wants to:",
+    "ap.agent": "The {name} agent",
+    "ap.noAgent": "Something on this machine (no agent identity)",
+    "ap.noAgentWarn": "If you didn't ask an agent to do this, Deny.",
+    "ap.signin.title": "Something is waiting for your approval.",
+    "ap.signin": "Sign in to see it: run {cmd} and open the link.",
+    "ap.do.workspace_create": 'Create the workspace "{name}"',
+    "ap.do.repo_add": 'Add the repo at {path} to workspace "{workspace}"',
+    "ap.do.repo_add.new":
+      'Add the repo at {path} to a new workspace "{workspace}"',
+    "ap.do.service_try": "Start {service}",
+    "ap.says": "Agent says:",
+    "ap.review": "Review",
+    "ap.hide": "Hide details",
+    "ap.later": "Later",
+    "ap.deny": "Deny",
+    "ap.allow": "Allow",
+    "ap.waits": "Nothing changes until you allow it. It waits until {time}.",
+    "ap.more": "{n} more waiting",
+    "ap.failed": "It ran, and failed: {error}",
+    "ap.done": "Done: {what}",
     "ag.new.note":
       "Starts in the workspace folder. It keeps running if you close the pane.",
     "ag.new.started": "Started {p} in {w}",
@@ -717,6 +774,7 @@
       "Its token was revoked (web logout --all): stop and resume it, or start it again, to give it a new one",
     "ag.ended":
       "This session has ended. Its record stays until it is resumed or removed.",
+    "ag.switched": "Switched to {p}",
     "ag.exitedLine": "[the session exited{code}]",
     "ag.lost": "[disconnected: {why}]",
     "ag.reconnect": "Reconnect",
@@ -3852,6 +3910,37 @@
   // server start: a 403 `csrf` (the server restarted) fetches a fresh one
   // and retries once. Never sent to another origin.
   var CSRF_METHODS = { POST: 1, PUT: 1, PATCH: 1, DELETE: 1 };
+  // 0.4.15: the approval key (web-session.ts). A sign-in's 303 carries it
+  // in the URL fragment (#ak=…), which never reaches a server: keep it in
+  // this origin's localStorage (other localhost ports can't read it),
+  // strip it from the address bar, and send it with every same-origin
+  // change as X-Den-Approve-Key. Only approving needs it.
+  var APPROVE_KEY_STORE = "den.approveKey";
+  (function takeApproveKey() {
+    var m = /(?:^#|&)ak=([A-Za-z0-9_-]{43})(?:&|$)/.exec(location.hash || "");
+    if (!m) return;
+    try {
+      localStorage.setItem(APPROVE_KEY_STORE, m[1]);
+    } catch (e) {
+      /* storage blocked: this browser signs in again to approve */
+    }
+    try {
+      history.replaceState(
+        history.state,
+        "",
+        location.pathname + location.search,
+      );
+    } catch (e) {
+      location.hash = "";
+    }
+  })();
+  function approveKey() {
+    try {
+      return localStorage.getItem(APPROVE_KEY_STORE);
+    } catch (e) {
+      return null;
+    }
+  }
   var csrf = { token: null, pending: null };
   function csrfToken(fresh) {
     if (fresh) csrf.token = null;
@@ -3890,6 +3979,9 @@
       (init && init.headers) || (isRequest(input) ? input.headers : undefined),
     );
     headers.set("X-Den-CSRF", token);
+    var ak = approveKey();
+    if (ak && !headers.has("X-Den-Approve-Key"))
+      headers.set("X-Den-Approve-Key", ak);
     return Object.assign({}, init || {}, { headers: headers });
   }
   function csrfFetch(input, init) {
@@ -3958,6 +4050,257 @@
     if (!apiOffPage) csrfToken(false);
   }
 
+  // ── ON-3: an agent's held write waits for the person ─────────────────
+  // (approval-routes.ts) Every page asks GET /api/approvals every few
+  // seconds while it is in view, and opens the oldest request: Den's own
+  // words for it (the agent's note only quoted), Review (what it will do),
+  // Later, Deny, Allow. Allow and Deny go through the wrapped fetch above,
+  // so they carry the CSRF token and the approval key; the server decides
+  // who may approve (a browser that isn't signed in is told to sign in).
+  // The frame is the Start dialog's (persona-ui.css's .pe-dlg).
+  var ap = { dlg: null, shown: null, later: {}, busy: false, css: null };
+  function apCss() {
+    if (ap.css) return ap.css;
+    ap.css = new Promise(function (done) {
+      if (document.querySelector('link[href="/persona-ui.css"]')) return done();
+      var l = document.createElement("link");
+      l.rel = "stylesheet";
+      l.href = "/persona-ui.css";
+      l.onload = l.onerror = function () {
+        done();
+      };
+      document.head.appendChild(l);
+    });
+    return ap.css;
+  }
+  function apWhat(a) {
+    var p = a.params || {};
+    var key = "ap.do." + a.action + (p.isNew ? ".new" : "");
+    var s = t(key, p);
+    if (s !== key) return s;
+    s = String(a.summary || a.action);
+    return s.charAt(0).toUpperCase() + s.slice(1);
+  }
+  function apDialog() {
+    if (ap.dlg) return ap.dlg;
+    var d = document.createElement("dialog");
+    d.className = "pe-dlg den-ap-dlg";
+    d.id = "den-ap-dlg";
+    d.setAttribute("aria-labelledby", "den-ap-h");
+    d.innerHTML =
+      '<form method="dialog">' +
+      '<h2 id="den-ap-h"></h2>' +
+      '<p class="help den-ap-who" id="den-ap-who" hidden></p>' +
+      '<p class="den-ap-what" id="den-ap-what"></p>' +
+      '<p class="help" id="den-ap-note" hidden></p>' +
+      '<pre class="den-ap-det" id="den-ap-det" hidden></pre>' +
+      '<p class="help" id="den-ap-waits"></p>' +
+      '<p class="err" id="den-ap-err" role="alert" hidden></p>' +
+      '<div class="btns">' +
+      '<button type="button" class="den-btn" id="den-ap-review" aria-expanded="false" aria-controls="den-ap-det"></button>' +
+      '<span class="sp help" id="den-ap-more"></span>' +
+      '<button type="button" class="den-btn" id="den-ap-later"></button>' +
+      '<button type="button" class="den-btn" id="den-ap-deny"></button>' +
+      '<button type="button" class="den-btn primary" id="den-ap-allow"></button>' +
+      "</div></form>";
+    document.body.appendChild(d);
+    var $ = function (id) {
+      return d.querySelector("#" + id);
+    };
+    $("den-ap-review").addEventListener("click", function () {
+      var det = $("den-ap-det");
+      det.hidden = !det.hidden;
+      $("den-ap-review").textContent = t(det.hidden ? "ap.review" : "ap.hide");
+      $("den-ap-review").setAttribute("aria-expanded", String(!det.hidden));
+    });
+    $("den-ap-later").addEventListener("click", function () {
+      apLater();
+    });
+    // Esc is Later: the request keeps waiting (and the agent with it).
+    d.addEventListener("cancel", function (e) {
+      e.preventDefault();
+      apLater();
+    });
+    $("den-ap-deny").addEventListener("click", function () {
+      apDecide("deny");
+    });
+    $("den-ap-allow").addEventListener("click", function () {
+      apDecide("allow");
+    });
+    ap.dlg = d;
+    return d;
+  }
+  function apLater() {
+    if (ap.shown) ap.later[ap.shown.id] = 1;
+    apClose();
+  }
+  function apClose() {
+    ap.shown = null;
+    if (ap.dlg && ap.dlg.open) ap.dlg.close();
+  }
+  function apShow(a, more) {
+    var d = apDialog();
+    var $ = function (id) {
+      return d.querySelector("#" + id);
+    };
+    var same = ap.shown && ap.shown.id === a.id;
+    ap.shown = a;
+    // No agent token: say so, and what to do if no agent was asked.
+    $("den-ap-h").textContent = t("ap.title", {
+      agent: a.agent ? t("ap.agent", { name: a.agent }) : t("ap.noAgent"),
+    });
+    $("den-ap-who").hidden = !!a.agent;
+    $("den-ap-who").textContent = a.agent ? "" : t("ap.noAgentWarn");
+    $("den-ap-what").textContent = apWhat(a);
+    var note = $("den-ap-note");
+    note.hidden = !a.note;
+    note.textContent = a.note ? t("ap.says") + " “" + a.note + "”" : "";
+    $("den-ap-det").textContent = (a.details || []).join("\n");
+    var time = new Date(a.expiresAt);
+    $("den-ap-waits").textContent = t("ap.waits", {
+      time: isNaN(time)
+        ? ""
+        : time.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" }),
+    });
+    $("den-ap-more").textContent = more ? t("ap.more", { n: more }) : "";
+    $("den-ap-later").textContent = t("ap.later");
+    $("den-ap-deny").textContent = t("ap.deny");
+    $("den-ap-allow").textContent = t("ap.allow");
+    if (!same) {
+      $("den-ap-det").hidden = true;
+      $("den-ap-review").textContent = t("ap.review");
+      $("den-ap-review").setAttribute("aria-expanded", "false");
+      $("den-ap-err").hidden = true;
+    }
+    if (!d.open)
+      apCss().then(function () {
+        if (ap.shown && ap.shown.id === a.id && !d.open) d.showModal();
+      });
+  }
+  function apError(msg) {
+    var e = apDialog().querySelector("#den-ap-err");
+    e.textContent = msg;
+    e.hidden = false;
+  }
+  function apDecide(decision) {
+    var a = ap.shown;
+    if (!a || ap.busy) return;
+    ap.busy = true;
+    var btns = ap.dlg.querySelectorAll("button");
+    for (var i = 0; i < btns.length; i++) btns[i].disabled = true;
+    fetch("/api/approvals/" + encodeURIComponent(a.id) + "/decide", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ decision: decision }),
+    })
+      .then(function (r) {
+        return r.json().then(
+          function (b) {
+            return { ok: r.ok, b: b || {} };
+          },
+          function () {
+            return { ok: false, b: {} };
+          },
+        );
+      })
+      .then(
+        function (x) {
+          if (!x.ok) {
+            apError(x.b.error || t("ap.failed", { error: x.b.code || "?" }));
+            return;
+          }
+          var res = x.b.result;
+          if (decision === "allow" && res && res.ok === false)
+            toast(t("ap.failed", { error: res.error || "?" }));
+          else if (decision === "allow")
+            toast(t("ap.done", { what: apWhat(a) }));
+          apClose();
+          apPoll();
+        },
+        function (e) {
+          apError(String((e && e.message) || e));
+        },
+      )
+      .then(function () {
+        ap.busy = false;
+        for (var j = 0; j < btns.length; j++) btns[j].disabled = false;
+      });
+  }
+  // Reading what waits needs what approving needs (approvals.ts): the
+  // session's CSRF token and the approval key, on a GET too. A browser
+  // without them is told only that something waits, and to sign in.
+  function apList(fresh) {
+    var ak = approveKey();
+    // No approval key: only the count, to say "sign in to see it".
+    if (!ak)
+      return rawFetch("/api/approvals?count=1", {
+        cache: "no-store",
+        credentials: "same-origin",
+      }).then(function (r) {
+        return r.ok
+          ? r.json().then(function (b) {
+              return { code: "signin_to_approve", waiting: b && b.waiting };
+            })
+          : null;
+      });
+    return csrfToken(fresh).then(function (token) {
+      var h = { "X-Den-Approve-Key": ak };
+      if (token) h["X-Den-CSRF"] = token;
+      return rawFetch("/api/approvals", {
+        cache: "no-store",
+        credentials: "same-origin",
+        headers: h,
+      }).then(function (r) {
+        return r.json().then(
+          function (b) {
+            if (!fresh && r.status === 403 && b && b.code === "csrf")
+              return apList(true);
+            return b;
+          },
+          function () {
+            return null;
+          },
+        );
+      });
+    });
+  }
+  function apSignin(b) {
+    if (b && b.code === "signin_to_approve" && b.waiting > 0)
+      showBanner("approvals", {
+        title: t("ap.signin.title"),
+        text: t("ap.signin", { cmd: "__DEN_CLI__ web login" }),
+      });
+    else hideBanner("approvals");
+  }
+  function apPoll() {
+    if (document.hidden || ap.busy) return;
+    apList(false).then(
+      function (b) {
+        apSignin(b);
+        var list = (b && b.ok && b.pending) || [];
+        var open = list.filter(function (a) {
+          return !ap.later[a.id];
+        });
+        if (!open.length) return apClose();
+        var cur =
+          (ap.shown &&
+            open.filter(function (a) {
+              return a.id === ap.shown.id;
+            })[0]) ||
+          open[0];
+        apShow(cur, open.length - 1);
+      },
+      function () {},
+    );
+  }
+  if (!apiOffPage && !configBad && rawFetch) {
+    setInterval(apPoll, 3000);
+    document.addEventListener("visibilitychange", function () {
+      if (!document.hidden) apPoll();
+    });
+    setTimeout(apPoll, 300);
+  }
+
   // ── the UI language (R19): a user pref ───────────────────────────────
   // /api/settings `language` (user.yml), then a reload: the server serves
   // every page with that language's catalog from its first paint.

package/src/ui/server/request-guard.ts

@@ -110,6 +110,8 @@ export interface GuardSession {
   key: string;
   /** The session's own CSRF token. */
   csrf: string;
+  /** sha256 of its approval key (approvals.ts); unset before 0.4.15. */
+  approveKeyHash?: string;
 }
 
 /** How a request reached Den. `edge` and `lan` are beyond loopback. */

package/src/ui/server/route-classes.ts

@@ -95,7 +95,8 @@ export const ROUTES: readonly RouteEntry[] = [
     "/theme-favicon",
     "/theme-favicon/*",
     "/vendor/*",
-    "/report*",
+    "/report",
+    "/report/*",
     "/reports/security/*",
   ].map((p) => R(p)),
   R("/_den/throw", "a test-only route (DEN_DEBUG_ROUTES): it throws"),
@@ -174,6 +175,30 @@ export const ROUTES: readonly RouteEntry[] = [
   R("/api/health", "runs the manifests' health probes: read-only checks"),
   R("/api/test-sources", "git rev-parse in each repo: read-only"),
   R("/api/manifest/validate", "GET validates a file at a path: read-only"),
+  // ON-3 (onboard-routes.ts): reads only; nothing written, no repo tool run.
+  R("/api/onboard/status", "what's set up and the next step (file reads)"),
+  R(
+    "/api/onboard/repos",
+    "lists the git repos in a folder in home; never follows a symlink",
+  ),
+  R(
+    "/api/onboard/manifest",
+    "drafts and validates a side-car manifest; writes nothing",
+  ),
+  // ON-3's held writes (approval-routes.ts): asking runs nothing; Allow is
+  // the person's signed-in browser only (approvals.ts approverAllowed).
+  R("/api/approvals", "what waits for the person (never an agent's token)"),
+  R("/api/approvals/:id", "one held request: the asker's own, or the person's"),
+  M(
+    ["POST"],
+    "/api/approvals",
+    "holds an agent's write for the person; nothing runs until they allow it",
+  ),
+  M(
+    ["POST"],
+    "/api/approvals/:id/decide",
+    "the person's Allow runs the held write once; Deny runs nothing",
+  ),
   R("/api/service/logs", "reads (and follows) a service's log"),
   R("/api/service/taillog", "tails a service's log (tail, docker logs)"),
   R(
@@ -342,6 +367,11 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/workspaces/:ws/agents/:id/fresh",
     "starts an agent afresh: a runtime in a PTY",
   ),
+  S(
+    ["POST"],
+    "/api/workspaces/:ws/agents/:id/persona",
+    "changes an agent's persona (AG-18): its session stops and the same conversation resumes, a runtime in a PTY; a person's only",
+  ),
   S(
     ["POST"],
     "/api/workspaces/:ws/agents/:id/relaunch",
@@ -443,6 +473,7 @@ export const REGEX_ROUTES: Readonly<Record<string, readonly string[]>> = {
     "/api/workspaces/:ws/agents/:id/remove",
     "/api/workspaces/:ws/agents/:id/name",
     "/api/workspaces/:ws/agents/:id/paths",
+    "/api/workspaces/:ws/agents/:id/persona",
   ],
   "agent-routes.ts:RUNTIME_PATH": ["/api/agents/runtimes/:id/path"],
   "agent-routes.ts:PERSONA_PATH": ["/api/personas/:id"],
@@ -456,6 +487,8 @@ export const REGEX_ROUTES: Readonly<Record<string, readonly string[]>> = {
   "github-routes.ts:LINK_PATH": ["/api/web/owner/link/:id"],
   "pair-routes.ts:POLL_PATH": ["/api/signin/code/:id"],
   "index.ts:LOGIN_WAIT_PATH": ["/api/web/logins/:id"],
+  "approval-routes.ts:ONE_PATH": ["/api/approvals/:id"],
+  "approval-routes.ts:DECIDE_PATH": ["/api/approvals/:id/decide"],
 };
 
 /** Whether `pathname` matches a table path. */

package/src/ui/server/session-routes.ts

@@ -9,8 +9,9 @@
  * `<cli> agents list` does (agent-ops.ts agentRows), and adds the plain
  * sessions (`sessions start`), labelled kind "session". An agent whose
  * actor token `web logout --all` revoked is marked (tokenRevoked). The
- * host knows nothing of approvals yet, so `waiting` is never set here
- * (AG-6a adds it). Asking never starts a session host.
+ * agent with one of Den's held writes waiting for the person (ON-3,
+ * approval-routes.ts) is `waiting` (AG-6a); a runtime's own permission
+ * prompts are not seen here yet. Asking never starts a session host.
  *
  * The io route bridges one WebSocket to one attachment on the session host
  * (its own connection to the host, so a browser and the CLI, or two
@@ -78,6 +79,8 @@ export interface SessionRouteDeps {
   /** Whether workspaces.yml names `ws` (active or not). */
   workspaceExists?: (ws: string) => boolean;
   pty?: () => PtyLoad;
+  /** The agent ids with an approval waiting for the person (AG-6a, ON-3). */
+  waitingAgents?: () => ReadonlySet<string>;
 }
 
 interface Resolved {
@@ -87,6 +90,7 @@ interface Resolved {
   activeWorkspaces: () => string[];
   workspaceExists: (ws: string) => boolean;
   pty: () => PtyLoad;
+  waitingAgents: () => ReadonlySet<string>;
 }
 
 /** A workspace name as `?ws=` may give it. */
@@ -116,6 +120,7 @@ function resolve(d: SessionRouteDeps = {}): Resolved {
           ws,
         )),
     pty: d.pty ?? (() => loadPty()),
+    waitingAgents: d.waitingAgents ?? (() => new Set<string>()),
   };
 }
 
@@ -169,6 +174,8 @@ export interface ListedSession {
   /** The host has it (running, or ended with its scrollback): a pane can attach. */
   attachable: boolean;
   resumable?: boolean;
+  /** AG-18: Change persona… applies (its runtime can resume). */
+  personaChange?: boolean;
   /** Why only Start fresh applies (AG-14.2): "<runtime> can't resume a conversation". */
   noResume?: string;
   /** When it was stopped, seen to end, or found interrupted (AG-14.1). */
@@ -189,7 +196,8 @@ export interface ListedSession {
 /** The list, from the host's sessions and the agent records. */
 export function listedSessions(
   sessions: SessionInfo[],
-  d: Pick<Resolved, "stateDir" | "dist" | "activeWorkspaces">,
+  d: Pick<Resolved, "stateDir" | "dist" | "activeWorkspaces"> &
+    Partial<Pick<Resolved, "waitingAgents">>,
   /** A workspace asked for by name (`?ws=`), listed even when inactive. */
   also?: string,
 ): ListedSession[] {
@@ -204,6 +212,7 @@ export function listedSessions(
     active.has(r.workspace),
   );
   const revoked = revokedAgentIds(d.stateDir());
+  const waiting = d.waitingAgents?.() ?? new Set<string>();
   const out: ListedSession[] = [];
   const agentSessions = new Set<string>();
   noteEnded(d.stateDir(), mine, records);
@@ -236,12 +245,14 @@ export function listedSessions(
       ...(r.startedAt ? { startedAt: r.startedAt } : {}),
       attachable: Boolean(s),
       resumable: r.resumable,
+      ...(r.personaChange ? { personaChange: true } : {}),
       ...(r.noResume ? { noResume: r.noResume } : {}),
       ...(r.stoppedAt ? { stoppedAt: r.stoppedAt } : {}),
       ...(r.endedAt ? { endedAt: r.endedAt } : {}),
       ...(r.interruptedAt ? { interruptedAt: r.interruptedAt } : {}),
       ...(r.rotation?.due ? { rotation: r.rotation } : {}),
       ...(revoked.has(rec.id) && s && !s.exited ? { tokenRevoked: true } : {}),
+      ...(waiting.has(rec.id) && s && !s.exited ? { waiting: true } : {}),
     });
   }
   for (const s of mine) {

package/src/ui/server/workspace-routes.ts

@@ -344,6 +344,25 @@ const availableReposCache = singleFlight<AvailableRepos>(2_000);
  * Same contract as the original inline handlers: uses return sendJson/send400
  * to end the response. Caller checks res.writableEnded to know if handled.
  */
+
+/**
+ * Why a workspace can't be created with this name, or null: the Workspaces
+ * page's create and ON-3's held workspace_create (approval-routes.ts) both
+ * ask this.
+ */
+export function workspaceCreateRefusal(
+  name: string | undefined,
+): string | null {
+  if (!name) return "name required";
+  // eslint-disable-next-line no-control-regex
+  if (/["'\\/<>\x00-\x1f]/.test(name))
+    return "name must not contain quotes, slashes, or control characters";
+  if (name.length > 64) return "name must be 64 characters or fewer";
+  if (readWorkspacesFile().workspaces[name])
+    return `workspace "${name}" already exists`;
+  return null;
+}
+
 export async function handleWorkspaceRoutes(
   req: http.IncomingMessage,
   res: http.ServerResponse,
@@ -639,16 +658,8 @@ export async function handleWorkspaceRoutes(
     try {
       const body = await readBody(req);
       const { name } = JSON.parse(body) as { name?: string };
-      if (!name) return send400(res, "name required");
-      // eslint-disable-next-line no-control-regex
-      if (/["'\\/<>\x00-\x1f]/.test(name))
-        return send400(
-          res,
-          "name must not contain quotes, slashes, or control characters",
-        );
-      const file = readWorkspacesFile();
-      if (file.workspaces[name])
-        return send400(res, `workspace "${name}" already exists`);
+      const refusal = workspaceCreateRefusal(name);
+      if (refusal || !name) return send400(res, refusal ?? "name required");
       createWorkspace(name, { services: {} });
       return sendJson(res, { ok: true, name });
     } catch (e) {

package/themes/den/den-theme.json

@@ -3,7 +3,7 @@
   "schema": "den.theme/v1",
   "id": "den",
   "name": "Den",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Den's default: a sheltered workspace in walnut and umber neutrals with a moss-green accent. System fonts.",
   "author": "Monster Orange",
   "license": "MIT",
@@ -37,13 +37,13 @@
       "border": "#dcd3c7",
       "border-strong": "#8d7f6d",
       "accent": "#557a2a",
-      "accent-text": "#4a6b23",
+      "accent-text": "#415e1f",
       "accent-fill": "#4a6b23",
       "on-accent": "#ffffff",
-      "ok": "#2e7246",
-      "warn": "#8c5a10",
-      "bad": "#b0392a",
-      "remote": "#23677a",
+      "ok": "#27613b",
+      "warn": "#774c0e",
+      "bad": "#983124",
+      "remote": "#205d6e",
       "shadow": "0 8px 24px rgb(48 36 24 / 0.14)",
       "bar": "linear-gradient(90deg, #557a2a 0%, #8a6a48 100%)"
     },