@monster-orange/den 0.4.2 → 0.4.3

package/src/ui/server/edge-exposure.ts

@@ -0,0 +1,143 @@
+/**
+ * The edge counts as local (0.4.3): with no sign-in through the edge, who
+ * can reach the edge can use terminals. When Den can tell the edge is
+ * reachable beyond this machine it says so, once in web.log and in a
+ * banner on every page (the shell, dismissible per browser).
+ *
+ * How it tells (read-only, once at start):
+ *  - an edge hostname that routes to Den resolves to an address that isn't
+ *    loopback (a LAN or a VPN address, such as Tailscale's 100.x); or
+ *  - the edge's container publishes a port on every interface (a
+ *    PortBindings HostIp of "", 0.0.0.0 or ::), from `docker inspect`.
+ * Neither (an edge on `*.localhost`, published on 127.0.0.1, or not
+ * running): no warning.
+ */
+import { execFile } from "child_process";
+import { promises as dns } from "dns";
+import { isLoopbackAddress } from "./request-guard.js";
+
+export const EDGE_EXPOSED_MESSAGE =
+  "Your edge is reachable from other machines; anyone who can reach it can use terminals. Auth is coming.";
+
+export interface ExposureDeps {
+  /** Every address a hostname resolves to (none when it doesn't). */
+  lookup?: (host: string) => Promise<string[]>;
+  /** The edge container's `docker inspect` PortBindings, or null. */
+  portBindings?: (container: string) => Promise<unknown>;
+}
+
+async function lookupAll(host: string): Promise<string[]> {
+  try {
+    return (await dns.lookup(host, { all: true })).map((a) => a.address);
+  } catch {
+    return [];
+  }
+}
+
+function inspectPortBindings(container: string): Promise<unknown> {
+  return new Promise((resolve) => {
+    execFile(
+      "docker",
+      ["inspect", "--format", "{{json .HostConfig.PortBindings}}", container],
+      { timeout: 5000 },
+      (err, stdout) => {
+        if (err) return resolve(null);
+        try {
+          resolve(JSON.parse(String(stdout)));
+        } catch {
+          resolve(null);
+        }
+      },
+    );
+  });
+}
+
+/** A published port bound on every interface, from PortBindings. */
+export function publishedOnAllInterfaces(bindings: unknown): string | null {
+  if (!bindings || typeof bindings !== "object") return null;
+  for (const [port, list] of Object.entries(bindings as object)) {
+    if (!Array.isArray(list)) continue;
+    for (const b of list as { HostIp?: string; HostPort?: string }[]) {
+      const ip = String(b?.HostIp ?? "");
+      if (ip === "" || ip === "0.0.0.0" || ip === "::")
+        return `the edge publishes ${b?.HostPort || port} on every interface`;
+    }
+  }
+  return null;
+}
+
+/**
+ * Why the edge is reachable beyond this machine, or null when Den can't
+ * tell that it is.
+ */
+export async function edgeExposure(
+  hosts: readonly string[],
+  container: string | null,
+  deps: ExposureDeps = {},
+): Promise<string | null> {
+  const lookup = deps.lookup ?? lookupAll;
+  for (const h of hosts) {
+    const away = (await lookup(h)).find((a) => !isLoopbackAddress(a));
+    if (away) return `${h} resolves to ${away}`;
+  }
+  if (!container || hosts.length === 0) return null;
+  const bindings = await (deps.portBindings ?? inspectPortBindings)(container);
+  return publishedOnAllInterfaces(bindings);
+}
+
+/**
+ * The IPv4 subnets of the edge's Docker networks (`<org>-edge` and the
+ * external networks it joins), from `docker network inspect`, read-only,
+ * once at start. On OrbStack and Docker Desktop a user-defined network is
+ * no host interface, so localNet can't see it: a proxy container on it, or
+ * its gateway, is this machine's container network ("can't tell", so
+ * local), not another machine. None when Docker or the network isn't
+ * there.
+ */
+export async function edgeNetworkSubnets(
+  names: readonly string[],
+  inspect: (name: string) => Promise<unknown> = inspectNetworkIpam,
+): Promise<{ address: string; netmask: string }[]> {
+  const out: { address: string; netmask: string }[] = [];
+  for (const n of [...new Set(names)]) {
+    const ipam = await inspect(n);
+    if (!Array.isArray(ipam)) continue;
+    for (const c of ipam as { Subnet?: unknown }[]) {
+      const s = cidrToSubnet(String(c?.Subnet ?? ""));
+      if (s) out.push(s);
+    }
+  }
+  return out;
+}
+
+/** "192.168.214.0/24" → { address, netmask }; null for IPv6 or junk. */
+export function cidrToSubnet(
+  cidr: string,
+): { address: string; netmask: string } | null {
+  const m = /^(\d{1,3}(?:\.\d{1,3}){3})\/(\d{1,2})$/.exec(cidr.trim());
+  if (!m) return null;
+  const bits = Number(m[2]);
+  if (bits < 8 || bits > 32) return null;
+  if (m[1].split(".").some((o) => Number(o) > 255)) return null;
+  const mask = (0xffffffff << (32 - bits)) >>> 0;
+  const netmask = [24, 16, 8, 0].map((s) => (mask >>> s) & 255).join(".");
+  return { address: m[1], netmask };
+}
+
+function inspectNetworkIpam(name: string): Promise<unknown> {
+  return new Promise((resolve) => {
+    execFile(
+      "docker",
+      ["network", "inspect", "--format", "{{json .IPAM.Config}}", name],
+      { timeout: 5000 },
+      (err, stdout) => {
+        if (err) return resolve(null);
+        try {
+          resolve(JSON.parse(String(stdout)));
+        } catch {
+          resolve(null);
+        }
+      },
+    );
+  });
+}

package/src/ui/server/index.ts

@@ -184,8 +184,10 @@ import {
   bindRefusal,
   checkRequest,
   isEdgePeer,
+  isDockerBridgeAddress,
   isLoopbackAddress,
   isLoopbackBind,
+  localNet,
   newCsrfToken,
   principalOf,
   requestIsHttps,
@@ -549,6 +551,13 @@ setHtmlFill((html) => {
         () => '<div id="den-shell" data-config-invalid="1"',
       );
   }
+  // 0.4.3: every page says when the edge is reachable from other machines.
+  if (EDGE_EXPOSED)
+    out = out.replace(
+      '<div id="den-shell"',
+      () =>
+        `<div id="den-shell" data-edge-exposed="${escAttr(EDGE_EXPOSED_MESSAGE)}"`,
+    );
   // MD-2: every page says when the engine on disk is not the one running.
   const engine = engineCheck();
   if (engine.stale)
@@ -773,7 +782,17 @@ import {
 import { refuseUpgrade } from "./websocket.js";
 import { isLifecycleExecCmd, streamLifecycleExec } from "./lifecycle-exec.js";
 import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
-import { edgeDomains, edgeHttps, routeHost } from "../../shared/edge/render.js";
+import {
+  edgeHttps,
+  edgeNames,
+  webRouteHosts,
+} from "../../shared/edge/render.js";
+import {
+  EDGE_EXPOSED_MESSAGE,
+  edgeExposure,
+  edgeNetworkSubnets,
+} from "./edge-exposure.js";
+import { initLoginPath } from "../../shared/agents/runtime-search.js";
 import {
   linksFor,
   openUrlFor,
@@ -904,24 +923,8 @@ function denEdgeHosts(): string[] {
   } catch {
     return [];
   }
-  const ports = new Set([PORT, readWebPortSafe()]);
-  const names = Object.entries(cfg.routes)
-    .filter(([, upstream]) => {
-      try {
-        const u = new URL(upstream);
-        return (
-          ports.has(Number(u.port || (u.protocol === "https:" ? 443 : 80))) &&
-          ["host.docker.internal", "localhost", "127.0.0.1"].includes(
-            u.hostname,
-          )
-        );
-      } catch {
-        return false;
-      }
-    })
-    .map(([name]) => name);
-  return names.flatMap((n) =>
-    edgeDomains(cfg).map((d) => routeHost(n, d).toLowerCase()),
+  return webRouteHosts(cfg, new Set([PORT, readWebPortSafe()])).map(
+    (r) => r.host,
   );
 }
 
@@ -1016,6 +1019,36 @@ function sessionCookie(req: http.IncomingMessage): string | undefined {
 }
 
 const LAN_HOSTS = lanHosts();
+/** This machine's addresses (localNet), re-read at most every 10 s. */
+let LOCAL_NET = { at: 0, net: localNet() };
+/** The edge's Docker networks' subnets (edgeNetworkSubnets), once at start. */
+let EDGE_NETS: { address: string; netmask: string }[] = [];
+function currentLocalNet(): ReturnType<typeof localNet> {
+  if (Date.now() - LOCAL_NET.at > 10_000) {
+    const here = localNet();
+    LOCAL_NET = {
+      at: Date.now(),
+      net: { own: here.own, bridges: [...here.bridges, ...EDGE_NETS] },
+    };
+  }
+  return LOCAL_NET.net;
+}
+/** Read the edge's Docker networks' subnets in the background (no edge: none). */
+function readEdgeNetworks(): void {
+  let names: string[];
+  try {
+    const cfg = readEdgeConfig();
+    names = [edgeNames(cfg.org).network, ...cfg.networks];
+  } catch {
+    return;
+  }
+  void edgeNetworkSubnets(names)
+    .then((nets) => {
+      EDGE_NETS = nets;
+      LOCAL_NET = { at: 0, net: LOCAL_NET.net }; // re-read on the next request
+    })
+    .catch(() => undefined);
+}
 const GUARD: GuardContext = {
   port: PORT,
   loopbackNames: loopbackNames(),
@@ -1044,8 +1077,43 @@ const GUARD: GuardContext = {
   peerIsLoopback: (req) => isLoopbackAddress(req.socket?.remoteAddress),
   // The edge hostname only from the edge's own peers (loopback, Docker).
   peerIsEdge: (req) => isEdgePeer(req.socket?.remoteAddress),
+  // 0.4.3: the edge from this machine counts as local (edgeClientIsLocal).
+  localNet: currentLocalNet,
+  // A deliberate exposure (DEN_BIND_HOST beyond loopback, other than the
+  // Linux edge's Docker bridge): the edge needs a sign-in too.
+  exposed: !isLoopbackBind(BIND_HOST) && !isDockerBridgeAddress(BIND_HOST),
 };
 
+/**
+ * 0.4.3: why the edge is reachable beyond this machine (edge-exposure.ts),
+ * once at start; null until known, or when Den can't tell.
+ */
+let EDGE_EXPOSED: string | null = null;
+function checkEdgeExposure(): void {
+  // `docker inspect` only when the edge publishes host ports itself
+  // (edge.publish); behind another proxy, only the hostnames tell.
+  let container: string | null = null;
+  try {
+    const cfg = readEdgeConfig();
+    container = cfg.ports ? edgeNames(cfg.org).container : null;
+  } catch {
+    return; // no edge
+  }
+  const hosts = denEdgeHosts();
+  if (hosts.length === 0) return;
+  void edgeExposure(hosts, container)
+    .then((why) => {
+      if (!why) return;
+      EDGE_EXPOSED = why;
+      // The in-app log, and stderr, which is web.log even when `web up`
+      // starts this --silent (stdout is not written then).
+      const line = `  ⚠ ${EDGE_EXPOSED_MESSAGE} (${why})`;
+      pushLog("warn", line);
+      if (!outputLost()) process.stderr.write(line + "\n");
+    })
+    .catch(() => undefined);
+}
+
 /**
  * The Set-Cookie for a session: HttpOnly, SameSite=Strict, Path=/, Secure
  * when the request came over HTTPS (requestIsHttps: the edge's own header
@@ -4572,6 +4640,11 @@ try {
 } catch (e) {
   serverLog(`  ⚠ web.secret could not be created: ${(e as Error).message}`);
 }
+// AG-0.1: the login shell's PATH, once, in the background (3 s at most),
+// so agents find their CLI as the person's terminal would: a launchd
+// service's PATH leaves out ~/.local/bin. Until (or unless) it answers, the
+// search is this PATH and the runtimes' install directories.
+void initLoginPath();
 server.listen(PORT, BIND_HOST, () => {
   const hosts = fs.existsSync("/etc/hosts")
     ? fs.readFileSync("/etc/hosts", "utf-8")
@@ -4594,6 +4667,8 @@ server.listen(PORT, BIND_HOST, () => {
   console.log();
   // Once per start: a secrets config that leaves Den's own features off.
   for (const w of secretsConfigWarnings()) serverLog(`  ⚠ ${w}`);
+  checkEdgeExposure();
+  readEdgeNetworks();
 });
 
 // ── Graceful shutdown ─────────────────────────────────────────────────────────

package/src/ui/server/public/agent-start.js

@@ -0,0 +1,202 @@
+/**
+ * The Start agent form's choices (AG-10.0), shared by the Agents tab's
+ * dialog and the Workspaces page's agents section. DOM-free.
+ *
+ * A persona option shows its id only: its role sentence is the help line
+ * under the select (personaHelp), so a long role can't widen the select
+ * past the dialog. The runtime's first option names what it resolves to,
+ * "Claude Code (persona default)", from the persona picked; a runtime that
+ * can't run here says why, and one that can shows its version.
+ *
+ * AG-0.2, readiness before Start: the line under the runtime names the CLI
+ * it will run (its version and path); when that runtime can't run here,
+ * Start is disabled and the line says why and how to fix it (install it,
+ * or set agents.runtimes.<id>.bin in the user.yml it names, or run
+ * `<cli> agents doctor`). Nothing fails only after Start.
+ */
+
+function escHtml(s) {
+  return String(s ?? "").replace(
+    /[&<>"']/g,
+    (c) =>
+      ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[
+        c
+      ],
+  );
+}
+
+/** The persona select's options: the id only. */
+export function personaOptions(personas) {
+  return (personas ?? [])
+    .map((p) => `<option value="${escHtml(p.id)}">${escHtml(p.id)}</option>`)
+    .join("");
+}
+
+/** The help line under the persona select: the picked persona's role. */
+export function personaHelp(personas, id) {
+  return (personas ?? []).find((p) => p.id === id)?.role ?? "";
+}
+
+/** A runtime's name for people ("Claude Code"); its id when it has none. */
+export function runtimeName(runtimes, id) {
+  const r = (runtimes ?? []).find((x) => x.id === id);
+  return r?.label || r?.id || id || "";
+}
+
+/**
+ * The runtime a persona runs on when the agent names none: the persona's
+ * own, else the default runtime.
+ */
+export function defaultRuntimeOf(personas, runtimes, personaId) {
+  const p = (personas ?? []).find((x) => x.id === personaId);
+  if (p?.runtime) return p.runtime;
+  return (runtimes ?? []).find((r) => r.default)?.id ?? "";
+}
+
+/**
+ * The runtime select's options. The first ("" = the persona's) reads
+ * "<name> (persona default)"; one that can't run here is disabled and
+ * says why.
+ */
+export function runtimeOptions(personas, runtimes, personaId, t) {
+  const name = runtimeName(
+    runtimes,
+    defaultRuntimeOf(personas, runtimes, personaId),
+  );
+  const first = name ? t("ag.runtime.default", { name }) : t("ag.runtime.auto");
+  return (
+    `<option value="">${escHtml(first)}</option>` +
+    (runtimes ?? [])
+      .map((r) => {
+        const label = runtimeName(runtimes, r.id);
+        return r.available
+          ? `<option value="${escHtml(r.id)}">${escHtml(
+              r.version ? `${label} · ${r.version}` : label,
+            )}</option>`
+          : `<option value="${escHtml(r.id)}" disabled>${escHtml(
+              `${label} — ${r.why || t("ag.unavailable")}`,
+            )}</option>`;
+      })
+      .join("")
+  );
+}
+
+/** The most searched directories named inline; the rest are counted. */
+const SHOWN_DIRS = 4;
+
+/**
+ * Whether Start can run, and the line that says so (AG-0.2): for the
+ * runtime picked (`runtimeId`, "" = the persona's), { ok, tone, html }.
+ * `tone` is "" (ready), "warn" (can't start) or "none" (nothing to say).
+ */
+export function readiness(data, personaId, runtimeId, t) {
+  const personas = data?.personas ?? [];
+  const runtimes = data?.runtimes ?? [];
+  const id = runtimeId || defaultRuntimeOf(personas, runtimes, personaId);
+  const r = runtimes.find((x) => x.id === id);
+  if (!r)
+    return {
+      ok: false,
+      tone: "warn",
+      html: escHtml(t("ag.rt.unknown", { id: id || "?" })),
+    };
+  const name = runtimeName(runtimes, r.id);
+  const mono = (x) => `<span class="mono">${escHtml(x)}</span>`;
+  if (r.available) {
+    if (!r.path) return { ok: true, tone: "none", html: "" };
+    return {
+      ok: true,
+      tone: "",
+      html:
+        escHtml(
+          r.version
+            ? t("ag.rt.ready", { name, version: r.version })
+            : t("ag.rt.readyNoVer", { name }),
+        ) +
+        " " +
+        mono(r.path),
+    };
+  }
+  const file = data?.userConfig || "config/local/user.yml";
+  const fix = t("ag.rt.fix", {
+    key: "\u0000k",
+    file: "\u0000f",
+    cmd: "\u0000c",
+  });
+  const fixHtml = escHtml(fix)
+    .replace("\u0000k", mono(r.setting || `agents.runtimes.${r.id}.bin`))
+    .replace("\u0000f", mono(file))
+    .replace("\u0000c", mono("__DEN_CLI__ agents doctor"));
+  let what;
+  if (r.source === "setting" || !r.searched)
+    what = escHtml(t("ag.rt.refused", { name, why: r.why || "" }));
+  else {
+    const dirs = r.searched;
+    const shown = dirs.slice(0, SHOWN_DIRS).map(mono).join(", ");
+    const more =
+      dirs.length > SHOWN_DIRS
+        ? " " + escHtml(t("ag.rt.more", { n: dirs.length - SHOWN_DIRS }))
+        : "";
+    what =
+      escHtml(t("ag.rt.notFound", { name })) +
+      " " +
+      escHtml(t("ag.rt.searched")) +
+      " " +
+      (shown || escHtml(t("ag.rt.nowhere"))) +
+      more +
+      ".";
+  }
+  return { ok: false, tone: "warn", html: `${what} ${fixHtml}` };
+}
+
+/**
+ * Fill a form's persona and runtime selects, its help line and its
+ * readiness line ([data-runtime-ready]), keep them in step when the
+ * persona or the runtime changes, and disable its submit button while
+ * the runtime can't run. Returns nothing; idempotent per form (the
+ * change listeners are bound once).
+ */
+export function fillStartForm(form, data, t) {
+  const personas = data?.personas ?? [];
+  const runtimes = data?.runtimes ?? [];
+  const ps = form.querySelector('select[name="persona"]');
+  const rs = form.querySelector('select[name="runtime"]');
+  const help = form.querySelector("[data-persona-help]");
+  const ready = form.querySelector("[data-runtime-ready]");
+  const go = form.querySelector('button[type="submit"]');
+  ps.innerHTML = personaOptions(personas);
+  const check = () => {
+    const r = readiness(data, ps.value, rs.value, t);
+    if (ready) {
+      ready.innerHTML = r.html;
+      ready.hidden = !r.html;
+      ready.dataset.tone = r.tone;
+    }
+    if (go) {
+      go.disabled = !r.ok;
+      go.dataset.blocked = r.ok ? "" : "runtime";
+    }
+  };
+  const sync = () => {
+    const keep = rs.value;
+    rs.innerHTML = runtimeOptions(personas, runtimes, ps.value, t);
+    if ([...rs.options].some((o) => o.value === keep && !o.disabled))
+      rs.value = keep;
+    if (help) {
+      const role = personaHelp(personas, ps.value);
+      help.textContent = role;
+      help.hidden = !role;
+    }
+    check();
+  };
+  ps.onchange = sync;
+  rs.onchange = check;
+  sync();
+}
+
+/** Whether a form's Start is held back by its runtime (readiness). */
+export function blockedByRuntime(form) {
+  return (
+    form.querySelector('button[type="submit"]')?.dataset.blocked === "runtime"
+  );
+}

package/src/ui/server/public/agents-page.js

@@ -15,8 +15,20 @@
  *
  * Nothing here keeps a session's state: the list is GET /api/sessions,
  * asked again every few seconds while the page is shown.
+ *
+ * Start agent (AG-0.2, LK-1): the lock is checked before the dialog opens
+ * (the server, then the vault: checkUnlock). Locked, the dialog asks for
+ * the password inline at its top, and Start unlocks, then starts, without
+ * closing anything. The runtime line says what will run, or why it
+ * can't, before Start (agent-start.js readiness).
  */
-import { requireUnlock } from "/topbar.js";
+import {
+  checkUnlock,
+  onLockChange,
+  requireUnlock,
+  unlockWith,
+} from "/topbar.js";
+import { fillStartForm } from "/agent-start.js";
 
 const t = (key, vars) => window.denShell?.t?.(key, vars) ?? key;
 const esc = (s) =>
@@ -477,7 +489,7 @@ function closePane(id, { quiet = false } = {}) {
 
 async function stopAgent(p, button) {
   const r = rowOf(p.id);
-  if (!r?.agent || !requireUnlock()) return;
+  if (!r?.agent || !(await requireUnlock())) return;
   button.disabled = true;
   try {
     await api(
@@ -515,28 +527,67 @@ async function openStart() {
     window.denShell?.errorToast?.(err);
     return;
   }
-  st.root.querySelector("#ag-persona").innerHTML = (data.personas ?? [])
-    .map(
-      (p) =>
-        `<option value="${esc(p.id)}">${esc(p.id)}${p.role ? ` — ${esc(p.role)}` : ""}</option>`,
-    )
-    .join("");
-  st.root.querySelector("#ag-runtime").innerHTML =
-    `<option value="">${esc(t("ag.runtime.auto"))}</option>` +
-    (data.runtimes ?? [])
-      .map(
-        (r) =>
-          `<option value="${esc(r.id)}"${r.available ? "" : " disabled"}>${esc(r.id)}${r.available ? "" : ` — ${esc(t("ag.unavailable"))}`}</option>`,
-      )
-      .join("");
+  fillStartForm(st.root.querySelector("#ag-form"), data, t);
+  // LK-1: the lock before the modal. Locked, its password is asked here.
+  paintInlineLock(!(await checkUnlock()));
+  if (dlg.open) return;
   if (typeof dlg.showModal === "function") dlg.showModal();
   else dlg.setAttribute("open", "");
+  st.root.querySelector("#ag-lock:not([hidden]) input")?.focus();
+}
+
+/** Show (or hide) the dialog's inline password field (LK-1). */
+function paintInlineLock(locked) {
+  const box = st.root?.querySelector("#ag-lock");
+  if (!box) return;
+  box.hidden = !locked;
+  const err = box.querySelector("#ag-lock-err");
+  if (!locked) {
+    box.querySelector("#ag-lock-pw").value = "";
+    err.hidden = true;
+  }
+}
+
+/**
+ * The lock, for Start: the dialog's own field when it shows one (unlock,
+ * then go on), else the shell's rule (its popover is in the top layer).
+ */
+async function unlockForStart(go) {
+  const box = st.root.querySelector("#ag-lock");
+  if (box.hidden) return requireUnlock();
+  if (await checkUnlock()) {
+    paintInlineLock(false);
+    return true;
+  }
+  const input = box.querySelector("#ag-lock-pw");
+  const err = box.querySelector("#ag-lock-err");
+  if (!input.value) {
+    err.textContent = t("lock.title");
+    err.hidden = false;
+    input.focus();
+    return false;
+  }
+  go.disabled = true;
+  go.textContent = t("lock.checking");
+  const r = await unlockWith(input.value);
+  go.disabled = false;
+  go.textContent = t("ag.go");
+  if (r.ok) {
+    paintInlineLock(false);
+    return true;
+  }
+  err.textContent = r.error;
+  err.hidden = false;
+  input.value = "";
+  input.focus();
+  return false;
 }
 
 async function submitStart(form) {
-  if (!requireUnlock()) return;
   const dlg = st.root.querySelector("#ag-dlg");
   const go = st.root.querySelector("#ag-go");
+  if (go.disabled) return;
+  if (!(await unlockForStart(go))) return;
   const ws = form.querySelector("#ag-ws").value || viewWorkspaces()[0];
   const persona = form.querySelector("#ag-persona").value;
   const runtime = form.querySelector("#ag-runtime").value;
@@ -579,6 +630,8 @@ function translateStatic(root) {
   set("#ag-r-t", "ag.runtime");
   set("#ag-cancel", "ag.cancel");
   set("#ag-go", "ag.go");
+  set("#ag-lock-t", "lock.pw");
+  set("#ag-lock-note", "lock.title");
   const h = root.querySelector("#ag-dlg-h");
   if (h) h.textContent = h.textContent.replace(/^\+\s*/, "");
 }
@@ -614,6 +667,10 @@ export async function mountAgentsPage(root) {
   root.querySelector("#ag-start").addEventListener("click", () => {
     void openStart();
   });
+  // Unlocked elsewhere (the chip, another tab): the field goes.
+  onLockChange((unlocked) => {
+    if (unlocked) paintInlineLock(false);
+  });
   root.querySelector("#ag-cancel").addEventListener("click", () => {
     root.querySelector("#ag-dlg").close?.();
   });
@@ -621,6 +678,15 @@ export async function mountAgentsPage(root) {
     e.preventDefault();
     void submitStart(e.currentTarget);
   });
+  // Enter starts from any field (a select doesn't submit on its own); Esc
+  // cancels (the dialog's own cancel). A button keeps its own Enter.
+  root.querySelector("#ag-form").addEventListener("keydown", (e) => {
+    if (e.key !== "Enter" || e.isComposing) return;
+    if (e.target.closest("button, textarea")) return;
+    e.preventDefault();
+    if (!st.root.querySelector("#ag-go").disabled)
+      e.currentTarget.requestSubmit();
+  });
   // The terminals follow the mode (light, dark) and the theme.
   new MutationObserver(() => {
     for (const p of st.panes.values())