@monster-orange/den 0.4.3 → 0.4.5

package/src/ui/server/public/settings.html

@@ -95,7 +95,9 @@
         top: 0;
         z-index: 4;
         background: var(--bg);
-        box-shadow: 0 -20px 0 0 var(--bg), 0 12px 0 0 var(--bg);
+        box-shadow:
+          0 -20px 0 0 var(--bg),
+          0 12px 0 0 var(--bg);
       }
       .ph .act {
         margin-left: auto;
@@ -352,6 +354,93 @@
         border-radius: 999px;
         padding: 0 6px;
       }
+      /* Settings › Agents › Runtimes (AG-0.5): one row per runtime. */
+      .set-custom {
+        flex: 1 1 100%;
+        min-width: 0;
+      }
+      .rt-scope {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+        flex-wrap: wrap;
+        font-size: 13px;
+        color: var(--muted);
+        margin-bottom: 6px;
+      }
+      .rt-list {
+        display: grid;
+        border: 1px solid var(--border);
+        border-radius: var(--radius-button);
+      }
+      .rt {
+        display: grid;
+        grid-template-columns: minmax(0, 1.2fr) minmax(0, 0.8fr) minmax(
+            0,
+            2fr
+          ) auto;
+        align-items: center;
+        gap: 4px 12px;
+        padding: 8px 10px;
+        font-size: 13px;
+      }
+      .rt + .rt {
+        border-top: 1px solid var(--border);
+      }
+      .rt-v {
+        color: var(--muted);
+      }
+      .rt-n .set-tag {
+        white-space: nowrap;
+      }
+      .rt-ok {
+        color: var(--ok);
+      }
+      .rt-bad {
+        color: var(--muted);
+        overflow-wrap: anywhere;
+      }
+      .rt-w {
+        min-width: 0;
+        overflow-wrap: anywhere;
+      }
+      .rt-p {
+        font-size: 12px;
+      }
+      .rt-f {
+        grid-column: 1 / -1;
+        display: flex;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: 6px;
+      }
+      .rt-f[hidden],
+      .rt-err[hidden] {
+        display: none;
+      }
+      .rt-fl {
+        flex-basis: 100%;
+        color: var(--muted);
+        font-size: 12.5px;
+      }
+      .rt-f input {
+        flex: 1 1 260px;
+        min-width: 0;
+      }
+      .rt-err {
+        flex-basis: 100%;
+        color: var(--bad);
+        font-size: 12.5px;
+        overflow-wrap: anywhere;
+      }
+      @media (max-width: 640px) {
+        .rt {
+          grid-template-columns: minmax(0, 1fr) auto;
+        }
+        .rt-w {
+          grid-column: 1 / -1;
+        }
+      }
       .set-langs {
         display: grid;
         gap: 4px;

package/src/ui/server/public/shell.js

@@ -22,10 +22,10 @@
  *            each part an .ib button with a .pop menu (an ARIA menu: ↑/↓,
  *            Home, End, Enter; Escape and a click outside close it) ·
  *            the ⌘K search field (R5) · the status chip (R6) · the Runs
- *            chip (R7) · the lock chip (R8) · What's new · ◐ ▾ (R10).
+ *            chip (R7) · the sudo chip (R8, only while asked) · What's new · ◐ ▾ (R10).
  *            shell.js draws them; topbar.js (through header.js) drives the
  *            chips, the command palette (R17), the status drawer (R15) and
- *            the lock popover; appearance.js the user menu (dev.20).
+ *            the admin-password prompt; appearance.js the user menu (dev.20).
  *   rail     Pinned, then the NAV registry by GROUPS (Develop, Verify,
  *            Ship, a distribution's own), then Settings and the collapse
  *            toggle. One tab stop (the current page); ↑/↓, Home and End
@@ -132,7 +132,9 @@
     "org.title": "Org: {title}",
     "org.titleId": "Org: {title} ({id})",
     "ws.all": "All active",
-    "ws.focus": "focus",
+    "ws.focus": "CLI default",
+    "ws.focusTip":
+      "CLI commands run here when you don't name a workspace. Picking a workspace in the top bar only changes what pages show.",
     "ws.none": "No active workspaces",
     "ws.manage": "Manage workspaces…",
     "ws.allN": "All active ({n})",
@@ -142,12 +144,12 @@
     "ws.viewTitle":
       "View: what every page shows ({ws}). A view filter only: it starts, stops and routes nothing.",
     "ws.viewTitleFocus":
-      "View: what every page shows ({ws}). A view filter only: it starts, stops and routes nothing, and focus ({focus}) stays the target for commands.",
-    "ws.setFocus": "Set {ws} as focus",
+      "View: what every page shows ({ws}). A view filter only: it starts, stops and routes nothing, and the CLI default ({focus}) stays the target for commands.",
+    "ws.setFocus": "Make {ws} the CLI default",
     "ws.setFocusTip":
-      "Make it the default target for commands (writes workspaces.yml)",
+      "CLI commands run in it when you don't name a workspace (writes workspaces.yml)",
     "ws.viewFailed": "Could not change the view: {msg}",
-    "ws.focusFailed": "Could not set the focus: {msg}",
+    "ws.focusFailed": "Could not change the CLI default: {msg}",
     // A count's singular is its .one (0.3.0-dev.40: en had none, so the org
     // menu said "1 workspaces").
     "org.n": "{n} workspaces",
@@ -251,24 +253,20 @@
     "dock.err": "failed",
     "dock.last": "Last run: {s} ↗",
     "dock.resize": "Drag to resize",
-    // The lock chip and its popover (R8).
-    "lock.locked": "Locked",
-    "lock.unlocked": "Unlocked",
-    "lock.title": "Unlock to start, stop and restart services and agents",
-    "lock.nopw": "Passwordless sudo (NOPASSWD): no admin password needed",
-    "lock.session": "Unlocked for this session",
-    "lock.sessionDesc":
-      "Unlocked for this session: start, stop and restart work on every page.",
+    // The admin password, asked only when a command needs sudo (R8, LK-0).
+    "lock.waiting": "Admin password needed",
+    "lock.needs": "{cmd} needs your admin password",
+    "lock.cmd": "A command",
     "lock.cfg":
       "Saving the password is off: set secrets.provider and secrets.refs.sudo in {file}.",
     "lock.update": "Update stored password",
     "lock.saveTo": "Save to {s}",
     "lock.pw": "Admin password",
-    "lock.go": "Unlock",
+    "lock.go": "Continue",
     "lock.checking": "Checking…",
-    "lock.note": "Den asks once per session. Agents can't unlock.",
-    "lock.again": "Enter the password again…",
-    "lock.saveFailed": "Unlocked, but saving to {s} failed: {err}",
+    "lock.note": "Den uses it only for sudo. Agents can't enter it.",
+    "lock.saved": "Admin password kept for this session",
+    "lock.saveFailed": "Kept for this session, but saving to {s} failed: {err}",
     "lock.wrong": "Incorrect password — try again",
     "lock.reqFailed": "Request failed — is the server running?",
     // What's new (R9) and the stale-server pill.
@@ -358,19 +356,71 @@
       "This server answers only on its own addresses, so a page on another name can't reach it.",
     "err.421.open": "Open on localhost",
     "err.refused.title": "Request refused",
-    "err.signin.title": "Sign in to use {name}",
     "err.signin.terminal": "Sign in to use the terminal",
     "err.signin.agents": "Sign in to start agents",
     "err.signin.sub": "This browser isn't signed in",
     "err.signin.lead": "Run {cmd} and open the link.",
     "err.signin.expiredTitle": "Sign-in link expired",
-    "err.signin.expired":
-      "That sign-in link expired or was used. Run {cmd} for a new one.",
     "err.signin.local":
       "A sign-in belongs to one address. This page is on {host}: open the same page on localhost, where this browser is signed in.",
-    "err.signin.why":
-      "There is no password: the link comes from a file only your user account can read.",
     "err.signin.copy": "Copy command",
+    "err.signin.title": "Sign in to {name}",
+    "err.signin.where":
+      "You're opening {name} from another computer. {name} runs on {host}, so it needs to know this is you.",
+    "err.signin.githubNote":
+      "Uses your GitHub account. The owner of this {name} has to have linked theirs.",
+    "err.signin.githubNoOwner":
+      "Sign in with GitHub needs an owner, and this {name} has none yet. On {host} (not this computer), run:",
+    "err.signin.githubRefused":
+      "@{login} isn't the owner of this {name}. Ask the owner to add you, or use 'Approve this computer'.",
+    "err.signin.approveOr": "Or approve this computer",
+    "err.signin.approve": "Approve this computer",
+    "err.signin.step1": "On {host} (not this computer), run:",
+    "err.signin.step1Or":
+      "Or open {name} on {host} itself and go to Settings › Access › Waiting devices.",
+    "err.signin.step2":
+      "This page signs you in by itself once approved. The code expires in 10 minutes.",
+    "err.signin.waiting": "Waiting for approval…",
+    "err.signin.noTerminal":
+      "Don't have a terminal on {host}? From this computer, run:",
+    "err.signin.openTerminal": "Open Terminal",
+    "err.signin.sshNote":
+      "Open Terminal opens ssh://{target} in your terminal app. It needs SSH access to {target}.",
+    "err.signin.whyTitle": "Why?",
+    "err.signin.whyText":
+      "{name} can start terminals and agents on {host}, so it only lets in people who prove they're the owner. You only do this once per computer: you stay signed in.",
+    "err.signin.other": "Other ways (the one-time link with {cmd})",
+    "err.signin.otherStep":
+      "On {host} (not this computer), run this, then open the link it prints in this browser:",
+    "err.signin.codeExpired": "This code expired.",
+    "err.signin.codeDenied": "This computer was denied on {host}.",
+    "err.signin.codeFailed": "{name} didn't give this page a code. Try again.",
+    "err.signin.newCode": "Get a new code",
+    "err.signin.youreIn": "You're in.",
+    "err.signin.expiredLead":
+      "That sign-in link expired or was used. Sign in again below.",
+    "err.signin.confirmLead":
+      "Enter the code that web login printed on {host}:",
+    "err.signin.confirmGo": "Sign in",
+    "err.signin.confirmWrong":
+      "That code isn't right. Check what web login printed and try again.",
+    "err.signin.confirmBusy": "Too many tries. Wait a minute and try again.",
+    "err.signin.confirmGone":
+      "This link no longer works. On {host}, run web login again for a new one.",
+    "err.signin.confirmWhy":
+      "The link alone isn't enough: it needs the code shown on {host} too, so a link someone else sees can't sign them in.",
+    "err.signin.github": "Sign in with GitHub",
+    "err.signin.githubEnter": "Enter this code at {url}:",
+    "err.signin.githubOpen": "Open GitHub",
+    "err.signin.githubCopy": "Copy code",
+    "err.signin.githubWaiting": "Waiting for you to approve it on GitHub…",
+    "err.signin.githubDone": "Signed in. Loading…",
+    "err.signin.githubExpired": "The code expired before it was approved.",
+    "err.signin.githubDenied": "The request was cancelled on GitHub.",
+    "err.signin.githubBusy":
+      "Too many sign-ins are in progress. Try again in a few minutes.",
+    "err.signin.githubFailed": "GitHub couldn't be reached. Try again.",
+    "err.signin.githubAgain": "Start again",
     "err.422.title": "Config is invalid",
     "err.422.sub": "The distribution config fails validation",
     "err.422.lead":
@@ -402,11 +452,21 @@
     "set.graph.density": "Cards",
     "set.graph.panelWidth": "Details panel",
     "set.workspace.editor": "IDE for this workspace",
+    "set.agents.runtimes": "Runtimes",
     "set.cli.local_dev": "Local environment",
     "set.cli.cli_tabs": "Terminal tabs",
     "set.cli.log_window_lines": "Log pane lines",
     "set.cli.web_port": "Your web port",
     "set.cli.signin": "Browser sign-in",
+    "set.cli.sudo": "Admin password",
+    "set.access.owner": "Owner",
+    "set.access.devices": "Linked devices",
+    "ident.local": "Local",
+    "ident.device": "Signed in · this device",
+    "ident.toast": "This device is signed in to {name} on {host}",
+    "set.access.waiting": "Waiting devices",
+    "set.access.machine_name": "Machine name",
+    "set.access.pair": "Pair a device",
     "set.distribution.brand": "Product name",
     "set.distribution.github_org": "GitHub org",
     "set.distribution.orgs": "Org labels",
@@ -495,6 +555,11 @@
     "ag.rt.fix":
       "Install it, or set {key} to its path in {file}, or run {cmd}.",
     "ag.rt.unknown": "No runtime {id} here.",
+    "ag.rt.denTools": "Den tools: coming",
+    "ag.rt.ownCli":
+      "It runs as its own CLI in the workspace: Den's tools and permission modes are coming for it.",
+    "ag.rt.notInstalled": "not installed",
+    "ag.rt.needsArgv": "the persona has no argv template",
   };
   // The languages the UI has a catalog for, each named in itself (a name is
   // never translated). The server's list is ui-language.ts's UI_LANGUAGES.
@@ -581,6 +646,9 @@
     agents:
       '<rect x="3" y="5" width="18" height="14" rx="2"/><path d="M7 10l3 2-3 2M12 15h5"/>',
     edge: '<path d="M12 3l8 4v5c0 4.5-3.4 8.3-8 9-4.6-.7-8-4.5-8-9V7z"/><path d="M8 12h8M12 8v8"/>',
+    // SEC-2a: who this browser is (the rail footer's identity chip).
+    person:
+      '<circle cx="12" cy="8" r="3.5"/><path d="M5 20c.8-3.6 3.6-5.5 7-5.5s6.2 1.9 7 5.5"/>',
   };
   function icon(name) {
     var d = ICONS[name] || (/^</.test(name || "") ? name : ICONS.page);
@@ -871,6 +939,9 @@
     // Whether the edge is configured (the Edge page's when): null until
     // known, the last answer cached so the rail doesn't jump.
     edge: null,
+    // SEC-2a: who this browser is (GET /api/session `identity`): local,
+    // a signed-in device, or a GitHub login. Null until known.
+    identity: null,
   };
   try {
     var cached = JSON.parse(localStorage.getItem(LS) || "{}");
@@ -1347,9 +1418,9 @@
 
   // ── the frame ──────────────────────────────────────────────────────────
   // The top bar after the scope, in the prototype's order (dev.20): the ⌘K
-  // search field (R5), then .chips: status (R6), Runs (R7), the lock (R8),
+  // search field (R5), then .chips: status (R6), Runs (R7), the sudo ask (R8),
   // What's new (R9) and ◐ ▾ (R10, appearance.js fills #den-user). The
-  // chips start neutral ("Checking…", "Runs", "Locked") and topbar.js
+  // chips start neutral ("Checking…", "Runs"; the sudo chip hidden) and topbar.js
   // paints them: a cold load never shows a partial red.
   var chips =
     '<button type="button" class="den-search" id="den-search" aria-haspopup="dialog" aria-keyshortcuts="Meta+K Control+K" aria-label="' +
@@ -1366,10 +1437,10 @@
     '<span class="den-dot off" aria-hidden="true"></span><span class="den-n den-lbl-l">' +
     esc(t("runs.title")) +
     "</span></button>" +
-    '<button type="button" class="den-chip" id="den-lock" aria-haspopup="dialog" aria-expanded="false" title="' +
-    esc(t("lock.title")) +
-    '"><span class="den-lock-ic" aria-hidden="true">🔒</span><span class="den-lbl-l">' +
-    esc(t("lock.locked")) +
+    // LK-0: shown only while a run waits for the admin password (topbar.js).
+    '<button type="button" class="den-chip" id="den-lock" aria-haspopup="dialog" aria-expanded="false" hidden>' +
+    '<span class="den-lock-ic" aria-hidden="true">🔑</span><span class="den-lbl-l">' +
+    esc(t("lock.waiting")) +
     "</span></button>" +
     '<button class="den-ib v-pill" id="version-pill" onclick="openChangelog()" title="' +
     esc(t("v.title")) +
@@ -1777,6 +1848,7 @@
       },
       page === SETTINGS.id,
     );
+    html += identityChip();
     html +=
       '<button class="den-ni den-collapse-btn" type="button" data-act="collapse" aria-expanded="' +
       (state.collapsed ? "false" : "true") +
@@ -1790,6 +1862,49 @@
     return html;
   }
 
+  /**
+   * SEC-2a: the rail footer's identity chip: "Local" (this machine, no
+   * sign-in), "Signed in · this device" (a one-time link or a code) or
+   * "@login" (GitHub). A rail item like Settings (the same .den-ni
+   * metrics), opening Settings › Access.
+   */
+  function identityLabel(id) {
+    if (!id) return "";
+    if (id.kind === "local") return t("ident.local");
+    if (id.kind === "github" && id.login) return "@" + id.login;
+    if (id.kind === "github" || id.kind === "device") return t("ident.device");
+    return "";
+  }
+  function identityChip() {
+    var label = identityLabel(state.identity);
+    if (!label) return "";
+    return item(
+      {
+        id: "identity",
+        href: "/settings#access",
+        title: label,
+        icon: "person",
+      },
+      false,
+      "",
+      ' id="den-ident" data-ident="' + esc(state.identity.kind) + '"',
+    );
+  }
+  /** What GET /api/session said about this browser: the chip, and a toast once after a sign-in. */
+  function applyIdentity(b) {
+    if (!b || !b.identity) return;
+    var was = state.identity;
+    if (!was || was.kind !== b.identity.kind || was.login !== b.identity.login)
+      setState({ identity: b.identity });
+    if (b.justSignedIn)
+      toast(
+        t("ident.toast", {
+          name: b.product || "__DEN_TITLE__",
+          host: b.machine || "",
+        }),
+      );
+  }
+
   // One tab stop for the rail: the current page, else the first item.
   function rove() {
     var links = Array.prototype.slice.call(nav.querySelectorAll(".den-ni"));
@@ -3522,6 +3637,7 @@
           function (b) {
             csrf.pending = null;
             csrf.token = b && typeof b.csrf === "string" ? b.csrf : null;
+            applyIdentity(b);
             return csrf.token;
           },
           function () {
@@ -3853,7 +3969,7 @@
     "  max-height: calc(100vh - 72px); overflow-y: auto; box-sizing: border-box;",
     "  font: 14px/1.45 var(--sans); color: var(--text); }",
     ".den-pop:focus { outline: none; }",
-    // LK-1: the lock popover is a <dialog> in the top layer (a popover, or
+    // LK-1: the admin-password prompt is a <dialog> in the top layer (a popover, or
     // a modal over another modal): placed by its top/left, no UA box.
     "dialog.den-pop { margin: 0; inset: auto; max-width: none; }",
     "dialog.den-pop::backdrop { background: transparent; }",
@@ -3909,6 +4025,8 @@
     ".den-chip .den-n { font-variant-numeric: tabular-nums; }",
     ".den-chip .den-dot, .den-drawer .den-dot, .den-pal .den-dot { margin: 0; }",
     ".den-chip[aria-expanded='true'] { border-color: var(--border-strong); }",
+    ".den-chip[hidden] { display: none; }",
+    "#den-lock { border-color: color-mix(in srgb, var(--warn) 55%, var(--border)); }",
     ".den-dot.run { background: var(--accent); animation: den-pulse 1.2s infinite; }",
     ".den-dot.pending { background: var(--faint); animation: den-pulse 1.2s infinite; }",
     "@keyframes den-pulse { 50% { opacity: .35; } }",
@@ -3973,7 +4091,7 @@
     ".den-pal li.den-pal-empty { cursor: default; color: var(--muted); }",
     ".den-pal .den-foot { display: flex; gap: 14px; padding: 8px 14px; border-top: 1px solid var(--border);",
     "  color: var(--faint); font-size: 12px; flex-wrap: wrap; }",
-    // The lock popover (.pop form, .pop input, .note: R8)
+    // The admin-password prompt (.pop form, .pop input, .note: R8, LK-0)
     ".den-pop form { display: grid; gap: 8px; padding: 6px 8px 8px; width: 260px; box-sizing: content-box; margin: 0; }",
     ".den-pop input:not([type='checkbox']) { border: 1px solid var(--border); background: var(--bg); color: var(--text);",
     "  border-radius: var(--radius-button); padding: 6px 8px; font: inherit; font-size: 13.3333px; line-height: normal; }",
@@ -3982,7 +4100,7 @@
     ".den-pop .den-lock-save { display: flex; gap: 6px; align-items: center; color: var(--muted); font-size: 12.5px; }",
     ".den-pop .den-lock-save[hidden], .den-pop .den-lock-err[hidden], .den-mslot[hidden] { display: none; }",
     ".den-pop .den-lock-err { color: var(--bad); font-size: 12.5px; }",
-    ".den-pop .den-lock-desc { padding: 2px 8px 6px; color: var(--muted); font-size: 12.5px; max-width: 260px; }",
+    ".den-pop #den-lock-t { overflow-wrap: anywhere; }",
     // What's new (.ib.whatsnew + .badge-dot)
     "#den-shell .v-pill { font: inherit; padding: 4px 8px; border: 1px solid transparent;",
     "  border-radius: var(--radius-button); color: var(--muted); flex-shrink: 0; }",