@nelsonlongxiang/dsh-open-a2a-net 0.6.25 → 0.6.27

package/lib/owner-settings.js

@@ -0,0 +1,100 @@
+/**
+ * Owner-settings persistence (gh#34): the three unlock knobs a remote
+ * build-out needs — teamJoinAllowlist / teamScopeInfo / announce — written
+ * into the HOME patch layer (DSH_HOME/cordis.patch.yml), the authoritative
+ * config surface (the 3081 lesson: the home-level patch wins over the
+ * profile layer). A conservative line editor: it locates the a2a entry's
+ * config: block and sets exactly these three keys, never touching anything
+ * else; a missing entry is appended in the canonical short-id form.
+ * @module @nelsonlongxiang/dsh-open-a2a-net/owner-settings
+ */
+/** The exact keys this module may touch, in wire order. */
+const KEYS = ['teamJoinAllowlist', 'teamScopeInfo', 'announce'];
+export function applyOwnerSettings(patchYaml, changes) {
+    const lines = patchYaml.split('\n');
+    // Find the a2a entry: `- id: a2a` / `- id: 'a2a'` variants.
+    let entryStart = -1;
+    for (let i = 0; i < lines.length; i += 1) {
+        const m = /^(\s*)-\s*id:\s*'?(a2a)'?\s*$/.exec(lines[i] ?? '');
+        if (m !== null) {
+            entryStart = i;
+            break;
+        }
+    }
+    let restartNeeded = false;
+    if (changes.announce !== undefined)
+        restartNeeded = true;
+    const writes = [];
+    if (changes.teamJoinAllowlist !== undefined) {
+        writes.push(changes.teamJoinAllowlist.length === 0
+            ? '    teamJoinAllowlist: []'
+            : `    teamJoinAllowlist: [${changes.teamJoinAllowlist.map(name => `'${name.replace(/'/g, "''")}'`).join(', ')}]`);
+    }
+    if (changes.teamScopeInfo !== undefined)
+        writes.push(`    teamScopeInfo: ${changes.teamScopeInfo ? 'true' : 'false'}`);
+    if (changes.announce !== undefined)
+        writes.push(`    announce: ${changes.announce ? 'true' : 'false'}`);
+    if (writes.length === 0)
+        return { yaml: patchYaml, restartNeeded };
+    if (entryStart === -1) {
+        // Append a canonical entry (the home patch is a top-level list).
+        const trailing = patchYaml.endsWith('\n') ? '' : '\n';
+        return { yaml: `${patchYaml}${trailing}- id: a2a\n  config:\n${writes.join('\n')}\n`, restartNeeded };
+    }
+    // Locate the config: block inside the entry (the entry's own indentation
+    // is two spaces under the `- id:` line).
+    let i = entryStart + 1;
+    let configAt = -1;
+    while (i < lines.length) {
+        const line = lines[i] ?? '';
+        if (/^\S/.test(line))
+            break; // next top-level entry
+        if (/^\s{2}config:\s*$/.test(line)) {
+            configAt = i;
+            break;
+        }
+        i += 1;
+    }
+    if (configAt === -1) {
+        // Insert a config: block right after the id line.
+        lines.splice(entryStart + 1, 0, '  config:', ...writes);
+        return { yaml: lines.join('\n'), restartNeeded };
+    }
+    // Rewrite exactly our keys inside the block; keep foreign lines verbatim.
+    const blockIndent = '    ';
+    let insertAt = configAt + 1;
+    for (const key of KEYS) {
+        let found = false;
+        let j = configAt + 1;
+        while (j < lines.length) {
+            const line = lines[j] ?? '';
+            if (/^\S/.test(line) || /^\s{2}\S/.test(line) && !/^\s{4}/.test(line) && !/^\s{2}config:/.test(lines[configAt] ?? '')) {
+                if (!line.startsWith(blockIndent) && !/^\s*$/.test(line) && j > configAt) {
+                    // leaving the block when a line is less indented than the keys
+                    if (!line.startsWith('    '))
+                        break;
+                }
+            }
+            const kv = new RegExp(`^\\s*${key}:`).exec(line);
+            if (kv !== null) {
+                const write = writes.find(w => w.trim().startsWith(`${key}:`));
+                if (write !== undefined) {
+                    lines[j] = write;
+                    found = true;
+                }
+                break;
+            }
+            if (/^\s*-\s*id:/.test(line))
+                break;
+            j += 1;
+        }
+        if (!found) {
+            const write = writes.find(w => w.trim().startsWith(`${key}:`));
+            if (write !== undefined) {
+                lines.splice(insertAt, 0, write);
+                insertAt += 1;
+            }
+        }
+    }
+    return { yaml: lines.join('\n'), restartNeeded };
+}

package/lib/peer-store.js

@@ -48,8 +48,38 @@ export class PeerStore {
             // The config is authoritative for a seed: it is (re)marked as one —
             // immune to eviction — and restarts from the initial score regardless
             // of the persisted one. Replacing the record wholesale keeps PeerRecord
-            // fields readonly.
-            this.peers.set(seed, { url: seed, score: INITIAL_SCORE, seed: true });
+            // fields readonly. The contact stamps are observations, not config:
+            // they carry over, so a restart does not blank a seed's lamp (gh#24).
+            const prior = this.peers.get(seed);
+            this.peers.set(seed, {
+                url: seed,
+                score: INITIAL_SCORE,
+                seed: true,
+                ...(prior?.lastContactAt !== undefined ? { lastContactAt: prior.lastContactAt } : {}),
+                ...(prior?.lastContactOk !== undefined ? { lastContactOk: prior.lastContactOk } : {}),
+            });
+        }
+        // The config is authoritative BOTH ways (board-stale-peer fix, 0.6.26):
+        // a persisted record may carry seed:true from an OLD config generation
+        // whose operator already removed the URL — left alone, a dead URL keeps
+        // its immunity forever and the workbench board shows a peer that can
+        // never evict (owner sighting: `.157:13082` survived its config removal
+        // for days). Downgrade those to referral-learned, keeping the score so
+        // noteFailure can decay and evict them honestly.
+        const current = new Set(seeds.filter(seed => seed !== ''));
+        for (const [url, peer] of this.peers) {
+            if (peer.seed && !current.has(url)) {
+                // Downgrade keeps every learned fact (score, session, contact
+                // stamps) — only the immunity bit changes.
+                this.peers.set(url, {
+                    url,
+                    score: peer.score,
+                    seed: false,
+                    ...(peer.session !== undefined ? { session: peer.session } : {}),
+                    ...(peer.lastContactAt !== undefined ? { lastContactAt: peer.lastContactAt } : {}),
+                    ...(peer.lastContactOk !== undefined ? { lastContactOk: peer.lastContactOk } : {}),
+                });
+            }
         }
     }
     /**
@@ -106,18 +136,24 @@ export class PeerStore {
         this.persist();
     }
     /**
-     * Note a failed fetch of one peer. A non-seed's score drops; an
-     * at-or-below-floor peer is evicted, so a bad referral disappears rather
-     * than degrading forever. Seeds are config-owned and never penalized.
+     * Note a failed fetch of one peer. Every peer records the failed attempt
+     * (the host-rail lamp turns red for a seed and a learned peer alike,
+     * gh#24); only a non-seed's score drops, and an at-or-below-floor peer is
+     * evicted, so a bad referral disappears rather than degrading forever.
+     * Seeds are config-owned and never penalized.
      * @param url - the peer that failed.
      */
     noteFailure(url) {
         const peer = this.peers.get(url);
-        if (peer === undefined || peer.seed)
+        if (peer === undefined)
             return;
-        peer.score -= FAILURE_PENALTY;
-        if (peer.score <= EVICTION_FLOOR)
-            this.peers.delete(url);
+        peer.lastContactAt = Date.now();
+        peer.lastContactOk = false;
+        if (!peer.seed) {
+            peer.score -= FAILURE_PENALTY;
+            if (peer.score <= EVICTION_FLOOR)
+                this.peers.delete(url);
+        }
         this.persist();
     }
     /**
@@ -129,8 +165,24 @@ export class PeerStore {
         if (peer === undefined)
             return;
         peer.score += SUCCESS_REWARD;
+        peer.lastContactAt = Date.now();
+        peer.lastContactOk = true;
         this.persist();
     }
+    /**
+     * The epoch ms of the last contact attempt with one tracked peer (#20 W-C
+     * host-rail health lamp), or undefined when the store never touched it.
+     */
+    lastContact(url) {
+        return this.peers.get(url)?.lastContactAt;
+    }
+    /**
+     * Whether the last contact attempt succeeded (gh#24) — undefined when no
+     * attempt was ever recorded.
+     */
+    lastContactOk(url) {
+        return this.peers.get(url)?.lastContactOk;
+    }
     /**
      * The current quality score of one tracked peer, for state reporting.
      * @param url - the peer URL.
@@ -189,6 +241,10 @@ export class PeerStore {
                     score: typeof peer.score === 'number' && Number.isFinite(peer.score) ? peer.score : INITIAL_SCORE,
                     seed: peer.seed === true,
                     ...(typeof peer.session === 'string' && peer.session !== '' ? { session: peer.session } : {}),
+                    // gh#24: the contact stamp round-trips (a restart must not forget
+                    // when we last reached the peer, nor whether it answered).
+                    ...(typeof peer.lastContactAt === 'number' && Number.isFinite(peer.lastContactAt) ? { lastContactAt: peer.lastContactAt } : {}),
+                    ...(typeof peer.lastContactOk === 'boolean' ? { lastContactOk: peer.lastContactOk } : {}),
                 });
             }
         }

package/lib/task-ledger.js

@@ -60,6 +60,29 @@ export function briefOf(message) {
  * lazy — every read/write entry point sweeps first.
  */
 export const TASK_STALE_TTL_MS = 24 * 60 * 60_000;
+const ARCHIVE_ENDS = ['receipt', 'echo', 'abandoned', 'cancelled'];
+/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
+const ECHO_SUMMARY = '(settled by content echo)';
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export function archivedEndedBy(row) {
+    if (row.endedBy !== undefined)
+        return row.endedBy;
+    const summary = row.summary ?? '';
+    if (summary.startsWith('caller-cancelled'))
+        return 'cancelled';
+    if (summary.startsWith('caller-abandoned'))
+        return 'abandoned';
+    if (summary === ECHO_SUMMARY)
+        return 'echo';
+    return 'receipt';
+}
 /**
  * Bounded outbound-task ledger with whole-file persistence. Pure of any
  * routing knowledge: callers {@link track} a task when a route leaves it
@@ -247,6 +270,8 @@ export class TaskLedger {
                 resolvedAt,
                 summary: `caller-abandoned${cause}`,
                 outcome: 'abandoned',
+                endedBy: 'abandoned',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             this.persist();
             return { outcome: 'cleared', taskId, archivedAt: resolvedAt };
@@ -286,6 +311,8 @@ export class TaskLedger {
                 resolvedAt,
                 summary: `caller-cancelled${cause}`,
                 outcome: 'abandoned',
+                endedBy: 'cancelled',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             this.persist();
             return {
@@ -334,6 +361,8 @@ export class TaskLedger {
                 ...(summary !== '' ? { summary } : {}),
                 ...(envelopeOutcome !== undefined ? { outcome: envelopeOutcome } : {}),
                 ...(elapsedMs !== undefined ? { elapsedMs } : {}),
+                endedBy: 'receipt',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             this.persist();
             return {
@@ -354,7 +383,11 @@ export class TaskLedger {
         // rewrite the abandonment outcome — the caller stopped waiting by choice.
         // Record that the target did answer later; keep the decision verbatim and
         // pin the projected verdict to 'abandoned'.
-        const callerEnded = CALLER_ENDED_PREFIX.test(settled.summary ?? '');
+        // gh#31: the recorded end wins; the summary prefix only decides legacy
+        // rows (a receipt-settled row's summary is the peer's own text).
+        const callerEnded = settled.endedBy !== undefined
+            ? settled.endedBy === 'abandoned' || settled.endedBy === 'cancelled'
+            : CALLER_ENDED_PREFIX.test(settled.summary ?? '');
         this.archived = [
             {
                 ...settled,
@@ -409,7 +442,9 @@ export class TaskLedger {
                 startedAt: record.startedAt,
                 ...(record.contextId !== undefined ? { contextId: record.contextId } : {}),
                 resolvedAt: this.now(),
-                summary: '(settled by content echo)',
+                summary: ECHO_SUMMARY,
+                endedBy: 'echo',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             settled.push(record.taskId);
         }
@@ -468,6 +503,8 @@ export class TaskLedger {
                             ...(typeof entry.summary === 'string' && entry.summary !== '' ? { summary: entry.summary } : {}),
                             ...(typeof entry.outcome === 'string' && RECEIPT_OUTCOMES.includes(entry.outcome) ? { outcome: entry.outcome } : {}),
                             ...(typeof entry.lateReceiptAt === 'number' && Number.isFinite(entry.lateReceiptAt) ? { lateReceiptAt: entry.lateReceiptAt } : {}),
+                            ...(typeof entry.endedBy === 'string' && ARCHIVE_ENDS.includes(entry.endedBy) ? { endedBy: entry.endedBy } : {}),
+                            ...(entry.direction === 'inbound' || entry.direction === 'outbound' ? { direction: entry.direction } : {}),
                         });
                         continue;
                     }
@@ -478,7 +515,9 @@ export class TaskLedger {
                         startedAt: typeof entry.startedAt === 'number' && Number.isFinite(entry.startedAt) ? entry.startedAt : this.now(),
                         ...(typeof entry.contextId === 'string' && entry.contextId !== '' ? { contextId: entry.contextId } : {}),
                         ...(typeof entry.brief === 'string' && entry.brief !== '' ? { brief: entry.brief } : {}),
-                        ...(entry.direction === 'inbound' ? { direction: 'inbound' } : {}),
+                        // gh#31: both sides round-trip — /state omits direction only when
+                        // it is unknown, so a restored outbound row must not lose it.
+                        ...(entry.direction === 'inbound' || entry.direction === 'outbound' ? { direction: entry.direction } : {}),
                         ...(entry.receiptExpected === false ? { receiptExpected: false } : {}),
                         status: entry.status === 'dead' ? 'dead' : 'pending',
                         ...(entry.status === 'dead'
@@ -509,6 +548,8 @@ export class TaskLedger {
                         ...(typeof entry.summary === 'string' && entry.summary !== '' ? { summary: entry.summary } : {}),
                         ...(typeof entry.outcome === 'string' && RECEIPT_OUTCOMES.includes(entry.outcome) ? { outcome: entry.outcome } : {}),
                         ...(typeof entry.lateReceiptAt === 'number' && Number.isFinite(entry.lateReceiptAt) ? { lateReceiptAt: entry.lateReceiptAt } : {}),
+                        ...(typeof entry.endedBy === 'string' && ARCHIVE_ENDS.includes(entry.endedBy) ? { endedBy: entry.endedBy } : {}),
+                        ...(entry.direction === 'inbound' || entry.direction === 'outbound' ? { direction: entry.direction } : {}),
                     });
                 }
             }

package/lib/types/cli-deposit.d.ts

@@ -0,0 +1,53 @@
+/** Owner ruling ③: the default AND maximum online window. */
+export declare const CLI_DEPOSIT_TTL_MS: number;
+/** Owner ruling ①: <agent-name>/<uuid·8B>. The name is [a-z0-9-]{1,32}. */
+export declare const CLI_HANDLE_RE: RegExp;
+/** One deposited CLI identity. */
+export interface CliDeposit {
+    readonly handle: string;
+    /** The bare agent-name zone (card.team). */
+    readonly name: string;
+    /** The CLI's signed card, verbatim wire JSON (served back as-is). */
+    readonly cardJson: string;
+    readonly depositedAt: number;
+    readonly expiresAt: number;
+}
+/** One mailbox entry for a deposited handle. */
+export interface CliMail {
+    readonly at: number;
+    readonly from: string;
+    readonly text: string;
+}
+export declare class CliDepositStore {
+    private readonly path;
+    private deposits;
+    private mailbox;
+    private now;
+    constructor(path: string, options?: {
+        now?: () => number;
+    });
+    /** Deposit (or refresh) one CLI card. TTL is clamped to the 4h ruling. */
+    deposit(cardJson: string): {
+        ok: true;
+        handle: string;
+        expiresAt: number;
+    } | {
+        ok: false;
+        error: string;
+    };
+    revoke(handle: string): boolean;
+    /** Active deposits (sweeping expired ones — ruling ③ auto-deregister). */
+    list(): readonly CliDeposit[];
+    get(handle: string): CliDeposit | undefined;
+    /** Card-serve rows: the handle + display name, marked cli (no wake). */
+    cardRows(): Array<{
+        team: string;
+        name: string;
+        description: string;
+    }>;
+    mail(handle: string, from: string, text: string): void;
+    readMail(handle: string): readonly CliMail[];
+    private sweep;
+    private persist;
+    private restore;
+}

package/lib/types/owner-settings.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Owner-settings persistence (gh#34): the three unlock knobs a remote
+ * build-out needs — teamJoinAllowlist / teamScopeInfo / announce — written
+ * into the HOME patch layer (DSH_HOME/cordis.patch.yml), the authoritative
+ * config surface (the 3081 lesson: the home-level patch wins over the
+ * profile layer). A conservative line editor: it locates the a2a entry's
+ * config: block and sets exactly these three keys, never touching anything
+ * else; a missing entry is appended in the canonical short-id form.
+ * @module @nelsonlongxiang/dsh-open-a2a-net/owner-settings
+ */
+export interface OwnerSettings {
+    teamJoinAllowlist?: string[];
+    teamScopeInfo?: boolean;
+    announce?: boolean;
+}
+export declare function applyOwnerSettings(patchYaml: string, changes: OwnerSettings): {
+    yaml: string;
+    restartNeeded: boolean;
+};

package/lib/types/peer-store.d.ts

@@ -25,6 +25,13 @@ export interface PeerRecord {
     readonly seed: boolean;
     /** The signed-card session the peer served last, when a fetch revealed it. */
     readonly session?: string;
+    /** Epoch ms of the last contact attempt (success or failure) — the host
+     *  rail's health lamp reads the recency of this (#20 W-C). */
+    lastContactAt?: number;
+    /** Whether that last attempt SUCCEEDED (gh#24): the lamp distinguishes a
+     *  fresh success (green) from a fresh failure (red); recency alone made
+     *  a dead peer glow green. */
+    lastContactOk?: boolean;
 }
 /** The persisted store document (whole-file read/write, small by design). */
 export interface PeerStoreSnapshot {
@@ -77,9 +84,11 @@ export declare class PeerStore {
      */
     drop(url: string): void;
     /**
-     * Note a failed fetch of one peer. A non-seed's score drops; an
-     * at-or-below-floor peer is evicted, so a bad referral disappears rather
-     * than degrading forever. Seeds are config-owned and never penalized.
+     * Note a failed fetch of one peer. Every peer records the failed attempt
+     * (the host-rail lamp turns red for a seed and a learned peer alike,
+     * gh#24); only a non-seed's score drops, and an at-or-below-floor peer is
+     * evicted, so a bad referral disappears rather than degrading forever.
+     * Seeds are config-owned and never penalized.
      * @param url - the peer that failed.
      */
     noteFailure(url: string): void;
@@ -88,6 +97,16 @@ export declare class PeerStore {
      * @param url - the peer that answered with a verified card.
      */
     noteSuccess(url: string): void;
+    /**
+     * The epoch ms of the last contact attempt with one tracked peer (#20 W-C
+     * host-rail health lamp), or undefined when the store never touched it.
+     */
+    lastContact(url: string): number | undefined;
+    /**
+     * Whether the last contact attempt succeeded (gh#24) — undefined when no
+     * attempt was ever recorded.
+     */
+    lastContactOk(url: string): boolean | undefined;
     /**
      * The current quality score of one tracked peer, for state reporting.
      * @param url - the peer URL.

package/lib/types/task-ledger.d.ts

@@ -52,6 +52,8 @@ export declare const TASK_STALE_TTL_MS: number;
 export type TaskStatus = 'pending' | 'dead';
 /** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
 export type DeadReason = 'fire-forget' | 'unconsumed';
+/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
+export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled';
 /** One tracked outbound task still in the owed book (unsettled). */
 export interface TaskRecord {
     readonly taskId: string;
@@ -111,7 +113,23 @@ export interface ArchivedRecord {
      * recorded as metadata only, never promoted to resolution.
      */
     readonly lateReceiptAt?: number;
+    /**
+     * gh#31: which archive path ended the row, recorded at archive time. Absent
+     * on rows archived before the field — {@link archivedEndedBy} derives it.
+     */
+    readonly endedBy?: ArchiveEnd;
+    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
+    readonly direction?: 'inbound' | 'outbound';
 }
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
 /** Result of an explicit caller-side abandon. Total and never-thrown. */
 export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
 /** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */

package/lib/types/types.d.ts

@@ -21,6 +21,16 @@ export interface A2aPeerCard {
      * not by this card's signature.
      */
     readonly peers?: readonly string[];
+    /**
+     * gh#41 fleet planning: this host's own canvas-team organization, served
+     * fresh on the FULL card (linked callers only) — each entry names a team
+     * and its member handles so any linked peer's board can render the org.
+     */
+    readonly canvasOrg?: ReadonlyArray<{
+        name: string;
+        team: string;
+        members: readonly string[];
+    }>;
     /**
      * Joined session teams this peer currently dispatches. Unsigned and
      * optional: served fresh at read time, each entry is a team name the

package/nexus-stage/src/canvas-ops.ts

@@ -20,8 +20,8 @@ export type RosterOp = { op: 'remove' | 'add'; id: string }
 /** The five user-facing write actions (one per design.md §3.3 row), plus the two network join/leave actions the panel-slim migration moved into the planning view. */
 export type CanvasAction =
   | { type: 'create-team'; name: string; ids: readonly string[]; /** true when the model had no such team before this action (a serial failure then leaves a ghost EMPTY team on the host — the wire compensates with a remove). */ created?: boolean }
-  | { type: 'add-member'; team: string; ids: readonly string[] }
-  | { type: 'remove-member'; team: string; ids: readonly string[] }
+  | { type: 'add-member'; team: string; ids: readonly string[]; /** gh#41: set when the target frame is a REMOTE peer's team — the wire routes the op through the host fleet relay. */ fleetPeer?: string }
+  | { type: 'remove-member'; team: string; ids: readonly string[]; /** gh#41: see add-member. */ fleetPeer?: string }
   | { type: 'remove-team'; name: string }
   /** `ops` comes from reorderOps() at emit time; the wire stays model-free. */
   | { type: 'reorder'; team: string; ops: ReadonlyArray<RosterOp> }

package/nexus-stage/src/federation.ts

@@ -26,6 +26,12 @@ export interface InFlightRow {
 export interface PeerRow {
   url: string
   score?: number
+  /** gh#20 W-A: this host's link view — 'linked' (operator-established
+   * basis holds) | 'stranger' (no link); absent = the host predates the
+   * field (render neutral). */
+  link?: 'linked' | 'stranger'
+  /** Signature-valid cached card held (the badge tick/cross). */
+  verified?: boolean
 }
 
 /** A team frame's titlebar anchor {fx + fw/2, fy + 11} (edges.ts lockstep). */

package/nexus-stage/src/main.ts

@@ -19,10 +19,52 @@ const app = document.getElementById('app')!
 // gh#9 §10: the host injects the control-plane key into the shell when
 // apiKey is configured — stamp it on every /__dsh_a2a write so the GUI
 // survives a keyed host (same-origin disclosure only, see the serve site).
-const CONTROL_KEY = (window as unknown as { __DSH_A2A_KEY__?: string }).__DSH_A2A_KEY__ ?? ''
+// gh#40: a REMOTE face (LAN-bound test host, tunnel) serves the shell
+// WITHOUT the injected key by design — the credential must not leak to any
+// network fetcher. The operator still needs the panel there, so the key
+// can be typed once: sessionStorage is browser-local (never transmitted in
+// the page), stamped on the same X-API-Key header thereafter.
+const storedKey = (() => { try { return window.sessionStorage.getItem('dsh_a2a_key') ?? '' } catch { return '' } })()
+const CONTROL_KEY = (window as unknown as { __DSH_A2A_KEY__?: string }).__DSH_A2A_KEY__ ?? storedKey
 const controlFetch = (path: string, init: RequestInit = {}): Promise<Response> =>
   fetch(path, { ...init, headers: { ...(init.headers as Record<string, string> | undefined ?? {}), ...(CONTROL_KEY !== '' ? { 'X-API-Key': CONTROL_KEY } : {}) } })
 
+// gh#40: key-entry affordance — mounts BEFORE the panel when the shell came
+// keyless (remote face) and the control plane answers 401. One input, one
+// submit; the stored key survives until the tab closes.
+if (CONTROL_KEY === '') {
+  void controlFetch('/__dsh_a2a/owner-settings').then(res => {
+    if (res.status !== 401) return
+    const gate = document.createElement('div')
+    gate.className = 'nexus-keygate'
+    gate.style.cssText = 'position:fixed;inset:0;display:flex;align-items:center;justify-content:center;flex-direction:column;gap:10px;background:#fff;z-index:9999;font:14px/1.5 system-ui,sans-serif;color:#000'
+    const label = document.createElement('div')
+    label.textContent = '此面板经远程面打开（密钥不随页面下发）——输入控制密钥'
+    const input = document.createElement('input')
+    input.type = 'password'
+    input.placeholder = 'X-API-Key'
+    input.setAttribute('aria-label', '控制密钥')
+    const submit = document.createElement('button')
+    submit.type = 'button'
+    submit.textContent = '进入面板'
+    const err = document.createElement('div')
+    err.style.color = '#b00'
+    const tryKey = (): void => {
+      const v = input.value.trim()
+      if (v === '') return
+      void fetch('/__dsh_a2a/owner-settings', { headers: { 'X-API-Key': v } }).then(r => {
+        if (r.status === 401) { err.textContent = '密钥不对，再试一次'; return }
+        try { window.sessionStorage.setItem('dsh_a2a_key', v) } catch { /* blocked site data: keep in-page */ }
+        window.location.reload()
+      })
+    }
+    submit.addEventListener('click', tryKey)
+    input.addEventListener('keydown', ev => { if (ev.key === 'Enter') tryKey() })
+    gate.append(label, input, submit, err)
+    document.body.appendChild(gate)
+  })
+}
+
 const faultBadge = document.createElement('div')
 faultBadge.className = 'nexus-fault'
 app.appendChild(faultBadge)
@@ -113,6 +155,23 @@ const canvasWire = createCanvasWire({
 })
 
 function runCanvasAction(a: CanvasAction): Promise<boolean> {
+  // gh#41: a remote-frame drop forks to the fleet relay — THIS host signs
+  // the envelope and forwards; the peer's link gate authorizes the write.
+  if ((a.type === 'add-member' || a.type === 'remove-member') && a.fleetPeer !== undefined) {
+    return (async () => {
+      for (const id of a.ids) {
+        const r = await controlFetch('/__dsh_a2a/fleet-canvas-op', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ peer: a.fleetPeer, op: a.type === 'add-member' ? 'add-member' : 'remove-member', name: a.team, id }),
+          cache: 'no-store',
+        }).catch(() => undefined)
+        const body = r !== undefined ? await r.json().catch(() => undefined) : undefined
+        if (body?.ok !== true) return false
+      }
+      return true
+    })()
+  }
   switch (a.type) {
     case 'create-team': return canvasWire.createTeam(a.name, a.ids, a.created)
     case 'add-member': return canvasWire.addMembers(a.team, a.ids)
@@ -154,6 +213,27 @@ async function fetchLayout(): Promise<unknown> {
 // ─── The workbench ───
 const bench = createWorkbench({
   now: () => Date.now(),
+  // gh#34: the owner three-key panel rides the control face.
+  async ownerSettingsRead() {
+    try {
+      const res = await controlFetch('/__dsh_a2a/owner-settings')
+      return await res.json()
+    } catch {
+      return { ok: false, error: 'unreachable' }
+    }
+  },
+  async ownerSettingsWrite(changes) {
+    try {
+      const res = await controlFetch('/__dsh_a2a/owner-settings', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(changes),
+      })
+      return await res.json()
+    } catch {
+      return { ok: false, error: 'unreachable' }
+    }
+  },
   async abandon(taskId, reason) {
     try {
       const res = await controlFetch('/__dsh_a2a/tasks/abandon', {
@@ -231,8 +311,10 @@ const bench = createWorkbench({
     // sessions included; the network directory is not the reading gate.
     try {
       const res = await controlFetch('/__dsh_a2a/session-log')
-      const body = (await res.json().catch(() => ({}))) as { ok?: boolean; sessions?: Array<{ id: string; mtimeMs: number; sizeBytes: number }>; error?: string }
-      return { ok: res.ok && body.ok === true, sessions: body.sessions, error: body.error ?? (res.ok ? undefined : `HTTP ${res.status}`) }
+      const body = (await res.json().catch(() => ({}))) as { ok?: boolean; sessions?: Array<{ id: string; mtimeMs: number; sizeBytes: number }>; count?: number; error?: string }
+      // count: how many logs the host holds — the list face caps at 50, so the
+      // directory can say it is showing 50 of N instead of silently truncating.
+      return { ok: res.ok && body.ok === true, sessions: body.sessions, count: typeof body.count === 'number' ? body.count : undefined, error: body.error ?? (res.ok ? undefined : `HTTP ${res.status}`) }
     } catch (error) {
       return { ok: false, error: error instanceof Error ? error.message : String(error) }
     }
@@ -346,7 +428,18 @@ async function poll(): Promise<void> {
         ...(typeof r.origin === 'string' && r.origin !== '' ? { origin: r.origin } : {}),
         ...(Array.isArray(r.teams) && r.teams.length > 0 ? { teams: r.teams.filter((t): t is string => typeof t === 'string' && t !== '') } : {}),
       }))
-    planning.reconcile({ sessions: allSessions, teams, peerCount: peers.length, peers, inFlight, remoteTeams })
+    // gh#41: the peers' published canvas org rides the board (remote frames).
+    const peerOrg = (body.peerOrg as unknown[] ?? [])
+      .filter((r): r is { url?: unknown; org?: unknown } => r !== null && typeof r === 'object')
+      .filter(r => typeof r.url === 'string' && Array.isArray(r.org))
+      .map(r => ({
+        url: r.url as string,
+        org: (r.org as unknown[])
+          .filter((e): e is { name?: unknown; team?: unknown; members?: unknown } => e !== null && typeof e === 'object')
+          .filter(e => typeof e.team === 'string' && e.team !== '')
+          .map(e => ({ name: typeof e.name === 'string' ? e.name : '', team: e.team as string, members: Array.isArray(e.members) ? e.members.filter((m): m is string => typeof m === 'string') : [] })),
+      }))
+    planning.reconcile({ sessions: allSessions, teams, peerCount: peers.length, peers, inFlight, remoteTeams, peerOrg })
   } catch (err) {
     fault(`state 轮询失败：${String(err)}`)
   }