@rubytech/create-sitedesk-code 0.1.525 → 0.1.527

package/dist/__tests__/samba-provision.test.js

@@ -6,7 +6,7 @@
 // style and runs under `node --test dist/__tests__/*.test.js` after build.
 import test from "node:test";
 import assert from "node:assert/strict";
-import { renderBrandStanza, renderGlobalSection, renderFullSmbConf, isPrivateIPv4, pickBindDecision, pickEdgeBindDecision, formatEdgeBindDecision, mergeSmbConf, removeBrandStanza, hasAnyBrandStanza, formatSambaMarker, SAMBA_STEPS, SAMBA_ENABLE_UNITS, } from "../samba-provision.js";
+import { renderBrandStanza, renderGlobalSection, renderFullSmbConf, isPrivateIPv4, pickBindDecision, pickEdgeBindDecision, formatEdgeBindDecision, pickWebsockifyBind, formatWebsockifyBindFile, mergeSmbConf, removeBrandStanza, hasAnyBrandStanza, formatSambaMarker, SAMBA_STEPS, SAMBA_ENABLE_UNITS, } from "../samba-provision.js";
 // ---------------------------------------------------------------------------
 // Fixtures
 // ---------------------------------------------------------------------------
@@ -384,6 +384,51 @@ test("formatSambaMarker emits the `[install-invariant] samba-provision-<step> <s
     assert.equal(formatSambaMarker("units", "fail: Job for smbd.service failed"), "[install-invariant] samba-provision-units fail: Job for smbd.service failed");
 });
 // ---------------------------------------------------------------------------
+// pickWebsockifyBind — the noVNC transport's host bind posture (Task 2089)
+//
+// The mapper reads the edge decision and nothing else, so a host can never end
+// up with a public noVNC page behind a loopback edge. The `kind` passthrough is
+// what lets the runtime log line distinguish `loopback-only` from `none`, which
+// map to the same address.
+// ---------------------------------------------------------------------------
+test("pickWebsockifyBind: LAN host keeps the wildcard bind", () => {
+    // Byte-identical to the pre-2089 behaviour. The Pi's `.local` noVNC page is
+    // reached over whichever family avahi resolved, so the wildcard stays `[::]`
+    // rather than narrowing to `0.0.0.0`.
+    assert.deepEqual(pickWebsockifyBind(pickEdgeBindDecision(PI_WLAN0_ONLY)), {
+        bind: "[::]",
+        kind: "lan",
+    });
+});
+test("pickWebsockifyBind: public-only host binds loopback", () => {
+    assert.deepEqual(pickWebsockifyBind(pickEdgeBindDecision(HETZNER_PUBLIC_ETH0_ONLY)), {
+        bind: "127.0.0.1",
+        kind: "loopback-only",
+    });
+});
+test("pickWebsockifyBind: dual-homed cloud host binds loopback despite a private iface", () => {
+    // The fail-open Task 2082 closed for the edge, closed here too: a provider
+    // private network alongside a public address must not keep a public bind.
+    // `kind` stays `lan` because pickBindDecision keys on the private interface;
+    // the bind address is what the edge decision, not `kind`, dictates.
+    assert.deepEqual(pickWebsockifyBind(pickEdgeBindDecision(HETZNER_CLOUD_PUBLIC_PLUS_PRIVNET)), {
+        bind: "127.0.0.1",
+        kind: "lan",
+    });
+});
+test("pickWebsockifyBind: no non-loopback IPv4 binds loopback", () => {
+    assert.deepEqual(pickWebsockifyBind(pickEdgeBindDecision(PI_LO_ONLY)), {
+        bind: "127.0.0.1",
+        kind: "none",
+    });
+});
+test("formatWebsockifyBindFile: one parseable line, trailing newline", () => {
+    // vnc.sh parses this with `head -n1` + two sed captures, so the shape is
+    // load-bearing: two `key=value` pairs, space-separated, one line.
+    assert.equal(formatWebsockifyBindFile({ bind: "127.0.0.1", kind: "loopback-only" }), "bind=127.0.0.1 kind=loopback-only\n");
+    assert.equal(formatWebsockifyBindFile({ bind: "[::]", kind: "lan" }), "bind=[::] kind=lan\n");
+});
+// ---------------------------------------------------------------------------
 // SAMBA_ENABLE_UNITS — the units step must never enable nmbd (Task 755)
 // ---------------------------------------------------------------------------
 test("SAMBA_ENABLE_UNITS enables smbd only — nmbd is never started", () => {

package/dist/__tests__/websockify-bind-wiring.test.js

@@ -0,0 +1,47 @@
+// Nothing else in the repo ties vnc.sh's websockify invocation to the installer
+// that writes the file it reads, so either half could ship alone with the whole
+// suite green. Two silent failures this closes:
+//
+//   - installer writes the file, vnc.sh still hardcodes `[::]` → the Task 2089
+//     fix ships inert on every host, with every pickWebsockifyBind test passing;
+//   - vnc.sh reads the file, installer never writes it → resolve_websockify_bind
+//     exits 1 and the whole VNC stack is down on every host, not just cloud ones.
+//
+// Both files are read from disk at runtime, the same pattern as
+// edge-bind-template-wiring.test.ts, which closes the equivalent gap for Task
+// 2082's edge unit.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+// dist/__tests__/websockify-bind-wiring.test.js → ../../src/index.ts
+const here = dirname(fileURLToPath(import.meta.url));
+const INDEX_TS = resolve(here, "../../src/index.ts");
+// dist/__tests__ → up four is the maxy-code root that holds platform/.
+const VNC_SH = resolve(here, "../../../../platform/scripts/vnc.sh");
+const SRC = readFileSync(INDEX_TS, "utf-8");
+const VNC = readFileSync(VNC_SH, "utf-8");
+test("vnc.sh no longer hardcodes the wildcard websockify bind", () => {
+    assert.doesNotMatch(VNC, /websockify --web \S+ "\[::\]:\$\{WEBSOCKIFY_PORT\}"/, "vnc.sh must take the websockify bind from platform/config/websockify-bind, not a literal [::]");
+});
+test("vnc.sh binds the resolved address and logs the decision", () => {
+    assert.match(VNC, /websockify --web \S+ "\$\{WEBSOCKIFY_BIND\}:\$\{WEBSOCKIFY_PORT\}"/, "the websockify invocation must interpolate the resolved bind address");
+    assert.match(VNC, /log "websockify-bind address=\$\{WEBSOCKIFY_BIND\} kind=\$\{WEBSOCKIFY_BIND_KIND\}/, "the websockify-bind token is the task's diagnostic grep — it must survive any edit");
+});
+test("vnc.sh resolves the bind before starting websockify", () => {
+    const resolveAt = VNC.indexOf("resolve_websockify_bind\n");
+    const startAt = VNC.indexOf("websockify --web");
+    assert.ok(resolveAt > 0, "vnc.sh must call resolve_websockify_bind");
+    assert.ok(resolveAt < startAt, "resolve_websockify_bind must run before the websockify invocation, or WEBSOCKIFY_BIND is unset");
+});
+test("vnc.sh refuses a bind address outside the two the mapper can produce", () => {
+    // The allow-list is what stops a hand-edited or half-written file handing
+    // websockify a wildcard on a cloud host.
+    assert.match(VNC, /"\[::\]"\|"127\.0\.0\.1"\) ;;/, "resolve_websockify_bind must allow-list the two addresses pickWebsockifyBind can emit");
+});
+test("the installer writes the file vnc.sh reads", () => {
+    assert.match(VNC, /config\/websockify-bind/, "vnc.sh must read platform/config/websockify-bind");
+    assert.match(SRC, /join\(configDir, "websockify-bind"\)/, "index.ts must write that same filename");
+    assert.match(SRC, /^\s*writeWebsockifyBindFile\(\);$/m, "index.ts defines the writer but never calls it — the file would never be written");
+});

package/dist/index.js

@@ -29,7 +29,7 @@ import { classifyPortHolder } from "./preflight-port-classifier.js";
 import { memoryControllerMissing, cmdlineAlreadyPatched, patchCmdline } from "./cgroup-memory-controller.js";
 import { parsePluginList, computeInstallActions, parseExternalPlugins, findUnregisteredResyncs, discoverMarketplaceCandidateDirs, } from "./lib/plugin-install.js";
 import { findPremiumMcpDirs } from "./lib/premium-mcp-discover.js";
-import { pickBindDecision, pickEdgeBindDecision, formatEdgeBindDecision, mergeSmbConf, formatSambaMarker, SAMBA_ENABLE_UNITS, } from "./samba-provision.js";
+import { pickBindDecision, pickEdgeBindDecision, formatEdgeBindDecision, pickWebsockifyBind, formatWebsockifyBindFile, mergeSmbConf, formatSambaMarker, SAMBA_ENABLE_UNITS, } from "./samba-provision.js";
 import { networkInterfaces, userInfo, cpus } from "node:os";
 const PAYLOAD_DIR = resolve(import.meta.dirname, "../payload");
 // Brand manifest — read from payload to derive all brand-specific installation values.
@@ -641,6 +641,41 @@ function writeChromiumBinaryPathFile() {
     console.log(`  Wrote ${target} → ${RESOLVED_CHROMIUM_BIN}`);
     logFile(`  [snap-chromium] wrote ${target} contents=${RESOLVED_CHROMIUM_BIN}`);
 }
+/**
+ * Write the websockify bind address to
+ * `<INSTALL_DIR>/platform/config/websockify-bind` so vnc.sh gives the noVNC
+ * transport the same host posture the edge got in Task 2082. Task 2089.
+ *
+ * The carrier is a file rather than a unit environment variable because
+ * `vnc.sh start` has two callers and only one of them is the edge. The other is
+ * `ensureVnc()` (platform/ui/app/lib/vnc.ts), which shells the script from the
+ * maxy-ui process; the maxy-ui unit carries no EDGE_HOSTNAME, so an env-var
+ * carrier would silently restore a wildcard bind on every X-down recovery. A
+ * file is also correct for a hand-run `bash vnc.sh start`, which no unit
+ * environment reaches at all.
+ *
+ * Called immediately after writeChromiumBinaryPathFile for the same reason it
+ * is: platform/config is a payload subdirectory, so this must run after
+ * deployPayload. Linux-only — darwin runs no VNC stack (installServiceDarwin
+ * excludes every VNC/X11 variable for that reason).
+ *
+ * Idempotent: re-running the installer on an unchanged host rewrites the same
+ * bytes. A host that gains or loses an interface gets the new decision on the
+ * next install, which the console and install-log lines below make visible.
+ */
+function writeWebsockifyBindFile() {
+    if (process.platform !== "linux") {
+        logFile(`  writeWebsockifyBindFile skipped: platform=${process.platform}`);
+        return;
+    }
+    const decision = pickWebsockifyBind(pickEdgeBindDecision(networkInterfaces()));
+    const configDir = resolve(INSTALL_DIR, "platform/config");
+    mkdirSync(configDir, { recursive: true });
+    const target = join(configDir, "websockify-bind");
+    writeFileSync(target, formatWebsockifyBindFile(decision), { mode: 0o644 });
+    console.log(`  Wrote ${target} → bind=${decision.bind} kind=${decision.kind}`);
+    logFile(`  [websockify-bind] wrote ${target} bind=${decision.bind} kind=${decision.kind}`);
+}
 // Scrub any hardware-watchdog drop-in this installer (or an earlier version)
 // left on the box, then daemon-reexec so the live RuntimeWatchdogUSec returns
 // to systemd's default (0 = off). The hardware-watchdog feature is retired:
@@ -5333,6 +5368,9 @@ try {
     // value. Must run after deployPayload (config dir is
     // a payload subdirectory). Linux-only; no-op on darwin/non-linux.
     writeChromiumBinaryPathFile();
+    // Same install-time-file pattern and the same post-deployPayload
+    // requirement: vnc.sh reads this to decide the websockify bind. Task 2089.
+    writeWebsockifyBindFile();
     // scrub plaintext neo4j passwords from any pre-fix install-*.log.
     // Idempotent — re-running on already-redacted logs is a no-op. Runs after
     // payload deploy so the bundled redact-install-logs.sh is on disk.

package/dist/samba-provision.js

@@ -224,6 +224,43 @@ export function formatEdgeBindDecision(d) {
     return `[edge-bind-decision] kind=${d.kind} iface=${d.iface ?? "none"} ` +
         `private=${list(d.privateAddresses)} public=${list(d.publicAddresses)} EDGE_HOSTNAME=${d.hostname}`;
 }
+/**
+ * Map the edge's bind decision onto websockify. Task 2089.
+ *
+ * This deliberately takes `EdgeBindDecision` rather than the interface table:
+ * the noVNC page and the admin edge must never disagree about whether the box
+ * is publicly reachable, and reading the same decision is the only way to
+ * guarantee that. It is not a third classifier — `pickBindDecision` (Samba) and
+ * `pickEdgeBindDecision` (edge) remain the only two.
+ *
+ * The LAN outcome is the literal `[::]`, which is what shipped before this
+ * task, not `0.0.0.0`. avahi publishes an AAAA for `.local` names, so a client
+ * may reach the page over IPv6; narrowing the family would be a behaviour
+ * change this task did not ask for. `[::]` accepts IPv4 as well under the
+ * default `net.ipv6.bindv6only=0`, which is exactly why the loopback outcome
+ * has to be an explicit `127.0.0.1`.
+ *
+ * The loopback outcome binds `127.0.0.1` only, not `[::1]` and not both.
+ * websockify takes one bind address per process, so "both" would mean two
+ * processes. Measured on the netcup box 2026-07-29: `localhost` there resolves
+ * `::1` first (its image ships no `localhost` line in `/etc/hosts`), and a
+ * listener bound to `127.0.0.1` alone still served a request forwarded by
+ * `ssh -L <port>:localhost:<port>` — OpenSSH falls back from the refused `::1`.
+ * So the SSH-forward recovery path the installer prints keeps working.
+ */
+export function pickWebsockifyBind(d) {
+    return { bind: d.hostname === "0.0.0.0" ? "[::]" : "127.0.0.1", kind: d.kind };
+}
+/**
+ * Render the install-time carrier file read by `platform/scripts/vnc.sh`.
+ *
+ * The shape is load-bearing: vnc.sh takes `head -n1` and captures `bind=` and
+ * `kind=` with two seds, so this must stay one line of space-separated
+ * `key=value` pairs with a trailing newline.
+ */
+export function formatWebsockifyBindFile(d) {
+    return `bind=${d.bind} kind=${d.kind}\n`;
+}
 // ---------------------------------------------------------------------------
 // smb.conf merge / remove
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-sitedesk-code",
-  "version": "0.1.525",
+  "version": "0.1.527",
   "description": "Install SiteDesk — automated back office for independent building contractors",
   "bin": {
     "create-sitedesk-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:c1dc0d24b2faa821b80ec583a83b5828393886fbda1963cfb874401d4137cd03
+content-hash: sha256:10d4f123ccb98ccdd68e27e8d22854fb1d9d5dfd985358ff1afa7f5361b25dfa
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -212,7 +212,7 @@ There is no dashboard, no settings panel, no menus. Everything is done through c
 
 The chat input auto-grows as you type — it expands to fit your message and shrinks back when you delete text. You can also drag the resize handle above the input to set a custom height.
 
-The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
+The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. The conversation column on the Chat page has its own width control: a small handle sits half way up the page just inside each side of the column, and dragging either one widens or narrows the reading measure. The column stays centred, so both handles do the same thing — dragging the left one out and the right one out by the same distance give the same width. It will not go below its default 760px and will not go wider than the chat panel itself; the messages, the input box and the jump-to-latest button all move together. Double-click either handle to go back to 760px. Your chosen width is remembered across reloads. The handles do not appear on a phone (below 640px), where the conversation already fills the width. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `SiteDesk`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.
 
@@ -1215,7 +1215,7 @@ npx -y @rubytech/create-realagent-code@latest --uninstall
 - **No SCP / rsync.** Updates are `npx -y @rubytech/create-maxy-code@latest …` again, never a file push from the operator's laptop.
 - **Tunnel auth is OAuth; the API is permitted for the rest.** The tunnel's only auth path is `cloudflared tunnel login` in the noVNC browser over SSH forward. DNS, Pages, and D1 use the Cloudflare API with a short-lived narrow token the agent mints from an operator-provisioned master token (see the `cloudflare` plugin).
 - **No shared state across brands.** Two brands on one server each have their own Neo4j port, systemd unit, VNC display, websockify port, tunnel, and persist directory.
-- **No public IPv4 exposure.** The Hetzner firewall opens port 22 only; every operator-facing surface is fronted by the Cloudflare tunnel. The provider firewall is no longer the only thing making that true for the admin edge: this host carries a public IPv4, so the installer writes `EDGE_HOSTNAME=127.0.0.1` into the edge unit and the edge port is loopback-only by construction. That holds whether or not the box also has a Cloud Network attached. It covers the edge port only; see [netcup.md](netcup.md) for what a host without a provider firewall still depends on `ufw` for.
+- **No public IPv4 exposure.** The Hetzner firewall opens port 22 only; every operator-facing surface is fronted by the Cloudflare tunnel. The provider firewall is no longer the only thing making that true for the operator surfaces: this host carries a public IPv4, so the installer writes `EDGE_HOSTNAME=127.0.0.1` into the edge unit and records the same decision in `platform/config/websockify-bind`, which `vnc.sh` reads to bind the noVNC websockify transport. Both are loopback-only by construction, and that holds whether or not the box also has a Cloud Network attached. Confirm with `grep -E 'bind-decision|EDGE_HOSTNAME' $HOME/.<brand>/logs/install-*.log` and `grep websockify-bind $HOME/.<brand>/logs/vnc-boot.log`. Other listeners on the box are not covered; see [netcup.md](netcup.md) for what a host without a provider firewall still depends on `ufw` for.
 
 ## Smoke checklist
 
@@ -1415,21 +1415,22 @@ This stops and disables the systemd user-service, removes the unit file, removes
 - **No SCP / rsync.** Updates are `npx -y @rubytech/create-maxy-code@latest …` again, never a file push from the operator's laptop.
 - **Tunnel auth is OAuth; the API is permitted for the rest.** As on Hetzner.
 - **No shared state across brands.** Two brands on one server each have their own Neo4j port, systemd unit, VNC display, websockify port, tunnel, and persist directory.
-- **No provider firewall, so `ufw` is the only network-level layer.** On Hetzner Cloud the provider firewall opens 22 only; netcup has nothing in front of the server. What keeps the admin edge private here is the bind itself: the installer classifies the host from its interface table and, because this box carries a public IPv4, writes `EDGE_HOSTNAME=127.0.0.1` into the edge unit, so the edge port is loopback-only by construction and `ufw` is the backstop rather than the single control. Confirm which was written with `grep -E 'bind-decision|EDGE_HOSTNAME' $HOME/.<brand>/logs/install-*.log`. This covers the **edge port only**, not the whole box: the noVNC websockify transport still binds all interfaces, so `ufw` remains load-bearing for that port, and anything that clears the ruleset — a flushed nftables set after a kernel change, `ufw disable` during debugging, a CCP image reinstall — exposes it. Verify from **off** the box, not with `ufw status` on it.
+- **No provider firewall, so `ufw` is the only network-level layer.** On Hetzner Cloud the provider firewall opens 22 only; netcup has nothing in front of the server. What keeps the operator surfaces private here is the bind itself. The installer classifies the host from its interface table and, because this box carries a public IPv4, binds **both** operator-facing listeners to loopback: it writes `EDGE_HOSTNAME=127.0.0.1` into the edge unit, and it records the same decision in `platform/config/websockify-bind`, which `vnc.sh` reads to bind the noVNC websockify transport. Neither surface is reachable from off the box by construction, so `ufw` is the backstop rather than the single control. Confirm both with `grep -E 'bind-decision|EDGE_HOSTNAME' $HOME/.<brand>/logs/install-*.log` and `grep websockify-bind $HOME/.<brand>/logs/vnc-boot.log`; on this host class they read `EDGE_HOSTNAME=127.0.0.1` and `address=127.0.0.1`. Other services on the box still bind all interfaces and still depend on `ufw` — Samba and CUPS among them — so anything that clears the ruleset (a flushed nftables set after a kernel change, `ufw disable` during debugging, a CCP image reinstall) exposes those. Verify from **off** the box, not with `ufw status` on it.
 
 ## Smoke checklist
 
 Fresh-netcup smoke pass criteria:
 
 1. Provision an RS 8000 G12 with Ubuntu 24.04 x86_64 and an SSH key; SSH in as `root`, create `admin`, switch.
-2. **From a machine off the server**, port 22 answers and the edge port does not. Two independent things make that true here: the edge binds loopback on this host class, and `ufw` denies inbound. `ufw status` on the box states the intention; only an external probe confirms the outcome:
+2. **From a machine off the server**, port 22 answers and neither the edge port nor the noVNC websockify port does. Two independent things make that true here: both listeners bind loopback on this host class, and `ufw` denies inbound. `ufw status` on the box states the intention; only an external probe confirms the outcome:
 
    ```bash
    nc -z -w 5 <ipv4> 22 && echo "22 open (expected)"
-   nc -z -w 5 <ipv4> 19200 && echo "EDGE EXPOSED — check the bind, then ufw"
+   nc -z -w 5 <ipv4> <edge port> && echo "EDGE EXPOSED — check the bind, then ufw"
+   nc -z -w 5 <ipv4> <websockify port> && echo "noVNC EXPOSED — check the bind, then ufw"
    ```
 
-   If the edge port answers, read the bind first: `grep -E 'bind-decision|EDGE_HOSTNAME' $HOME/.<brand>/logs/install-*.log` should show `EDGE_HOSTNAME=127.0.0.1` on this host, and `ss -lntp` should show the edge on `127.0.0.1:19200`. A public bind there is a classification fault, not a firewall fault.
+   If either answers, read the bind before the firewall. `grep -E 'bind-decision|EDGE_HOSTNAME' $HOME/.<brand>/logs/install-*.log` should show `EDGE_HOSTNAME=127.0.0.1`, `grep websockify-bind $HOME/.<brand>/logs/vnc-boot.log` should show `address=127.0.0.1`, and `ss -lntp` should show both on `127.0.0.1`. A wildcard or public address on either line is a classification fault, not a firewall fault.
 
    Re-run this after every reboot, after any brand install, and after any CCP image reinstall.
 3. Snapshot taken with the OS prepared and nothing installed.
@@ -1437,7 +1438,7 @@ Fresh-netcup smoke pass criteria:
 5. `logs-read.sh --tail server 200 | grep 'op=capacity-resolved'` returns one line reporting `capacity=40`, with `totalMemGiB` matching the provisioned RAM. A `capacity=10` on a 64 GB box means the host resolved below the 56 GiB step and needs investigating before load.
 6. The noVNC page reached over `ssh -L` displays the admin UI.
 7. Cloudflare setup ends with `curl -I https://<hostname>.<your-zone>` returning `HTTP/2 200` from the operator's laptop.
-8. Reboot; both units come back up; the public URL is reachable again without any manual action; the step-2 external probe still shows the edge port closed.
+8. Reboot; both units come back up; the public URL is reachable again without any manual action; the step-2 external probe still shows the edge and noVNC ports closed.
 9. Install a second brand with a different `--hostname`; both admin UIs are reachable on their own public hostnames and neither has touched the other's state.
 10. Uninstall removes the systemd unit and the persist directory.
 
@@ -4008,15 +4009,58 @@ button** while it holds text — clicking empties the input, clears results
 | Mount | Purpose |
 |---|---|
 | `/browser` | `POST /launch` — launches Chromium on the resolved transport (native display or VNC) on demand. Backs the standalone `/browser` operator page. Lifeline tag `[admin/browser/launch]`. |
+| `/browser` | `GET /screencast-targets` — the page-target list behind the screencast viewer. Server-side hop to the CDP HTTP surface, which is loopback-only; filtered to `type:'page'`. `501` off the Linux display stack, `502` when Chromium is unreachable. |
+| `/browser` | `POST /screencast-event` — relay for the client half of the `[browser/screencast]` lifeline. Accepts a fixed op allowlist (`request`, `screencast-started`, `frame`, `input`, `teardown`); the server-side ops are refused so a client cannot emit a line that reads as a server decision. |
 
 The in-chat / artefact-embedded brand-VNC iframe components and the
 `/browser-iframe` event-beacon route were retired and stay
 deleted; the `/device-browser` (navigate-the-device-tab) route was also
 removed and is not restored. The standalone `/browser` page is a
-sanctioned operator surface peer to `/graph` and `/data`: it embeds the live
-VNC viewer (`/vnc-viewer.html`, popout `/vnc-popout.html`) and calls
-`/api/admin/browser/launch`. On darwin (no noVNC asset) it shows a "VNC surface
-not available" state.
+sanctioned operator surface peer to `/graph` and `/data`.
+
+**The human view is a CDP screencast, not a framebuffer.** `/browser`
+renders `CdpScreencastSurface`: frames arrive as CDP `Page.screencastFrame` and
+paint to a canvas, and the operator's clicks, scrolling and typing leave as
+`Input.dispatch*`. Interaction therefore lands on page coordinates rather than
+screen pixels, and the view is one tab chosen from a strip rather than the whole
+X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
+nothing on `/browser` reaches them, and retiring that stack is separate work.
+
+The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
+by the edge listener before its `forwardUpgrade` catch-all. It is gated by
+`canAccessAdmin` and rejected on operator and public hosts (`reason` values
+`origin-operator-host` and `origin-public-host`, mirroring the websockify
+rejection), and it validates the target id against a fixed 32-hex charset because
+that id is interpolated into the upstream request line. Before replaying the
+upgrade to Chromium it drops the admin session cookie and the browser `Origin`:
+Chromium is launched with no `--remote-allow-origins`, so its DevTools endpoint
+has no allowlisted origin, and the proxy has already checked same-origin itself.
+
+Chromium's debugging port is bound to `127.0.0.1` on `${CDP_PORT}` and is never
+tunnelled or bound off-localhost. That port carries no authentication and total
+control of the browser, which is why the proxy is the only path to it. Per-brand
+isolation is the `CDP_PORT` import and nothing else, so two co-resident brands
+each view their own Chromium.
+
+Off the Linux display stack, and whenever Chromium is unreachable, the surface
+renders an explicit unavailable state. That is deliberate rather than cosmetic: a
+canvas that never receives a frame is indistinguishable from a black desktop,
+where the iframe it replaced failed visibly.
+
+Observability is `[browser/screencast]` correlated by `sid` across
+`request → gate → cdp-connected → screencast-started → frame → input → teardown
+→ socket-closed`, plus `[cdp-ws-census] liveSockets=<N> sessions=<M>` on every
+open and close. Diagnostic path:
+
+```
+logs-read.sh | grep -E '\[browser/screencast\]|\[cdp-ws-census\]'
+```
+
+then filter to one `sid` for a whole session. Frame lines are sampled, so a
+frozen `seq` against a live socket is the frozen-viewer signature. `liveSockets`
+climbing while `sessions` stays flat is the leak signature: an operator tab that
+closes without a clean teardown emits no action log of its own, so the standing
+reconcile pass closes client-dead sockets and reports `op=orphan-reap closed=<N>`.
 
 ### Diagnostics
 
@@ -4317,6 +4361,29 @@ on every admin page; double-click resets to half the available width
 (viewport minus sidebar), clamped to the per-pane min-width floors. The
 chosen width is remembered across reloads.
 
+**The /chat reading measure is operator-set.** `--webchat-measure` was a fixed
+760px; it is now the FLOOR of a range the operator drags, written inline on
+`.webchat-page` by `WebchatSplitter` so the message column, the composer and the
+jump-to-latest button — all three read the same property — stay aligned. Two
+handles, one just inside each column edge, vertically centred. The column is
+centre-aligned, so one symmetric rule drives both: `measure = 2 × |pointerX −
+panelCentreX|`, which is why the two handles are interchangeable. Envelope:
+760px ≤ measure ≤ the chat panel's own width; double-click either handle to
+revert to 760px and clear the stored value; the measure persists in
+`localStorage` under `maxy-webchat-measure-px` and re-clamps on window resize and
+on any panel-width change (sidebar drag, artefact open/close). No handle renders
+below a 640px viewport, where the media query already gives the column the full
+width. A measure wider than its panel does not overflow — the column just fills
+the panel — so that state emits nothing on its own; the standing check is
+`[admin-ui] op=webchat-measure-audit measurePx= panelPx= availPx= columnPx=
+handles= governed= fit=`, emitted on mount and on every re-clamp with identical
+consecutive readings suppressed. `columnPx` is the measured `.wa-thread-scroll`
+rect, not the property read back, so a property written to the wrong element
+shows as `measurePx=1200 columnPx=760`; `columnPx=-1` means no transcript is
+mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
+`governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
+px=<final>`; a bare click logs nothing.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:
@@ -5314,7 +5381,7 @@ For estate-agent client work surfaced on the `/tasks` operator page, `work-creat
 
 Two surfaces feed the gate. (1) **Workflow path:** `memory-write` accepts an optional `producedByTaskId` parameter. When set, an inbound `:PRODUCED` edge from that Task is composed into the write's relationships before the gate runs — the typical agent-side pattern is to call `work-create` at the start of an autonomous flow, capture `taskId`, and pass it as `producedByTaskId` on every subsequent `memory-write` for a gated label. The gate verifies Task and write share the same `accountId`; mismatch is rejected loud. (2) **Direct-ask path:** the admin server resolves the active `:AdminConversation`'s `sessionId` UUID and stamps it as `SESSION_NODE_ID` in the spawn env at PTY-spawn time. The same stamp propagates onto specialist subagent spawns the admin dispatches so listing-curator, content-producer, database-operator etc. inherit the same conversation anchor. The `contact-create` and `memory-write` wrappers call `injectConversationProvenance` (exported from [`@maxy/graph-write`](../../../lib/graph-write/src/conversation-provenance.ts)) which MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is part of the natural key, not a separate gate — and prepends the synthetic `:PRODUCED` edge (composed by Neo4j elementId, which the helper reads off the MATCH). No agent-visible schema field changes. `memory-write` uses the env-stamp only as a fallback when `producedByTaskId` is unset; `contact-create` has no `producedByTaskId` parameter today and relies on the env-stamp alone. Autonomous (cron-driven) specialists with no parent conversation legitimately have no env-stamp; those must thread `producedByTaskId`.
 
-A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one, which is how a resume the session manager redirected to a live fork re-points itself rather than staying on the dead source. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
+A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one. The link route runs only on a first click, when the task has no session yet; a click on an already-linked task navigates straight to `/chat?session=<id>` and writes nothing, so an edge is never re-pointed after it is first written. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
 
 Operator audit cyphers:
 - "What entities did this conversation's actions produce?" — `MATCH (c:AdminConversation {sessionId:$id})<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e) RETURN labels(e), e.name, t.kind, t.status`

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,19 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-30 (0.1.527)
+
+- The remote browser page now shows a live picture of the browser you can click and type into directly, replacing the old screen-sharing view.
+- The Session button on an open task now opens the chat inside the dashboard instead of sending you out to a different site, and the new session starts already knowing the task's description and notes.
+- Posting to LinkedIn from the browser extension works again. It was being stopped before the post ever left the browser, and when it failed it blamed the wrong thing; a missing permission and an unreachable device are now reported as the different problems they are.
+- The page title is smaller and the chat column can be dragged wider or narrower.
+
+## 2026-07-30 (0.1.526)
+
+- Asking WhatsApp to reconnect now answers as soon as the reconnect starts, instead of waiting on the old connection to die and leaving you with no reply at all.
+- The remote screen viewer is no longer reachable from every network the device sits on. It is now bound to the same posture chosen when the device was set up, and that choice is recorded so it stays put.
+- A repeating routine that has lost its next run time is now reported by a standing check, so a routine that has quietly stopped being scheduled shows up instead of staying invisible.
+
 ## 2026-07-29 (0.1.525)
 
 - A repeating routine whose start date had already gone by now runs on its next due occurrence instead of sitting silent forever. There is also a standing check that tells you when a routine has a start date that never fired.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -783,15 +783,58 @@ button** while it holds text — clicking empties the input, clears results
 | Mount | Purpose |
 |---|---|
 | `/browser` | `POST /launch` — launches Chromium on the resolved transport (native display or VNC) on demand. Backs the standalone `/browser` operator page. Lifeline tag `[admin/browser/launch]`. |
+| `/browser` | `GET /screencast-targets` — the page-target list behind the screencast viewer. Server-side hop to the CDP HTTP surface, which is loopback-only; filtered to `type:'page'`. `501` off the Linux display stack, `502` when Chromium is unreachable. |
+| `/browser` | `POST /screencast-event` — relay for the client half of the `[browser/screencast]` lifeline. Accepts a fixed op allowlist (`request`, `screencast-started`, `frame`, `input`, `teardown`); the server-side ops are refused so a client cannot emit a line that reads as a server decision. |
 
 The in-chat / artefact-embedded brand-VNC iframe components and the
 `/browser-iframe` event-beacon route were retired and stay
 deleted; the `/device-browser` (navigate-the-device-tab) route was also
 removed and is not restored. The standalone `/browser` page is a
-sanctioned operator surface peer to `/graph` and `/data`: it embeds the live
-VNC viewer (`/vnc-viewer.html`, popout `/vnc-popout.html`) and calls
-`/api/admin/browser/launch`. On darwin (no noVNC asset) it shows a "VNC surface
-not available" state.
+sanctioned operator surface peer to `/graph` and `/data`.
+
+**The human view is a CDP screencast, not a framebuffer.** `/browser`
+renders `CdpScreencastSurface`: frames arrive as CDP `Page.screencastFrame` and
+paint to a canvas, and the operator's clicks, scrolling and typing leave as
+`Input.dispatch*`. Interaction therefore lands on page coordinates rather than
+screen pixels, and the view is one tab chosen from a strip rather than the whole
+X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
+nothing on `/browser` reaches them, and retiring that stack is separate work.
+
+The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
+by the edge listener before its `forwardUpgrade` catch-all. It is gated by
+`canAccessAdmin` and rejected on operator and public hosts (`reason` values
+`origin-operator-host` and `origin-public-host`, mirroring the websockify
+rejection), and it validates the target id against a fixed 32-hex charset because
+that id is interpolated into the upstream request line. Before replaying the
+upgrade to Chromium it drops the admin session cookie and the browser `Origin`:
+Chromium is launched with no `--remote-allow-origins`, so its DevTools endpoint
+has no allowlisted origin, and the proxy has already checked same-origin itself.
+
+Chromium's debugging port is bound to `127.0.0.1` on `${CDP_PORT}` and is never
+tunnelled or bound off-localhost. That port carries no authentication and total
+control of the browser, which is why the proxy is the only path to it. Per-brand
+isolation is the `CDP_PORT` import and nothing else, so two co-resident brands
+each view their own Chromium.
+
+Off the Linux display stack, and whenever Chromium is unreachable, the surface
+renders an explicit unavailable state. That is deliberate rather than cosmetic: a
+canvas that never receives a frame is indistinguishable from a black desktop,
+where the iframe it replaced failed visibly.
+
+Observability is `[browser/screencast]` correlated by `sid` across
+`request → gate → cdp-connected → screencast-started → frame → input → teardown
+→ socket-closed`, plus `[cdp-ws-census] liveSockets=<N> sessions=<M>` on every
+open and close. Diagnostic path:
+
+```
+logs-read.sh | grep -E '\[browser/screencast\]|\[cdp-ws-census\]'
+```
+
+then filter to one `sid` for a whole session. Frame lines are sampled, so a
+frozen `seq` against a live socket is the frozen-viewer signature. `liveSockets`
+climbing while `sessions` stays flat is the leak signature: an operator tab that
+closes without a clean teardown emits no action log of its own, so the standing
+reconcile pass closes client-dead sockets and reports `op=orphan-reap closed=<N>`.
 
 ### Diagnostics
 
@@ -1092,6 +1135,29 @@ on every admin page; double-click resets to half the available width
 (viewport minus sidebar), clamped to the per-pane min-width floors. The
 chosen width is remembered across reloads.
 
+**The /chat reading measure is operator-set.** `--webchat-measure` was a fixed
+760px; it is now the FLOOR of a range the operator drags, written inline on
+`.webchat-page` by `WebchatSplitter` so the message column, the composer and the
+jump-to-latest button — all three read the same property — stay aligned. Two
+handles, one just inside each column edge, vertically centred. The column is
+centre-aligned, so one symmetric rule drives both: `measure = 2 × |pointerX −
+panelCentreX|`, which is why the two handles are interchangeable. Envelope:
+760px ≤ measure ≤ the chat panel's own width; double-click either handle to
+revert to 760px and clear the stored value; the measure persists in
+`localStorage` under `maxy-webchat-measure-px` and re-clamps on window resize and
+on any panel-width change (sidebar drag, artefact open/close). No handle renders
+below a 640px viewport, where the media query already gives the column the full
+width. A measure wider than its panel does not overflow — the column just fills
+the panel — so that state emits nothing on its own; the standing check is
+`[admin-ui] op=webchat-measure-audit measurePx= panelPx= availPx= columnPx=
+handles= governed= fit=`, emitted on mount and on every re-clamp with identical
+consecutive readings suppressed. `columnPx` is the measured `.wa-thread-scroll`
+rect, not the property read back, so a property written to the wrong element
+shows as `measurePx=1200 columnPx=760`; `columnPx=-1` means no transcript is
+mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
+`governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
+px=<final>`; a bare click logs nothing.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:

package/payload/platform/plugins/docs/references/internals.md

@@ -560,7 +560,7 @@ For estate-agent client work surfaced on the `/tasks` operator page, `work-creat
 
 Two surfaces feed the gate. (1) **Workflow path:** `memory-write` accepts an optional `producedByTaskId` parameter. When set, an inbound `:PRODUCED` edge from that Task is composed into the write's relationships before the gate runs — the typical agent-side pattern is to call `work-create` at the start of an autonomous flow, capture `taskId`, and pass it as `producedByTaskId` on every subsequent `memory-write` for a gated label. The gate verifies Task and write share the same `accountId`; mismatch is rejected loud. (2) **Direct-ask path:** the admin server resolves the active `:AdminConversation`'s `sessionId` UUID and stamps it as `SESSION_NODE_ID` in the spawn env at PTY-spawn time. The same stamp propagates onto specialist subagent spawns the admin dispatches so listing-curator, content-producer, database-operator etc. inherit the same conversation anchor. The `contact-create` and `memory-write` wrappers call `injectConversationProvenance` (exported from [`@maxy/graph-write`](../../../lib/graph-write/src/conversation-provenance.ts)) which MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is part of the natural key, not a separate gate — and prepends the synthetic `:PRODUCED` edge (composed by Neo4j elementId, which the helper reads off the MATCH). No agent-visible schema field changes. `memory-write` uses the env-stamp only as a fallback when `producedByTaskId` is unset; `contact-create` has no `producedByTaskId` parameter today and relies on the env-stamp alone. Autonomous (cron-driven) specialists with no parent conversation legitimately have no env-stamp; those must thread `producedByTaskId`.
 
-A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one, which is how a resume the session manager redirected to a live fork re-points itself rather than staying on the dead source. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
+A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one. The link route runs only on a first click, when the task has no session yet; a click on an already-linked task navigates straight to `/chat?session=<id>` and writes nothing, so an edge is never re-pointed after it is first written. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
 
 Operator audit cyphers:
 - "What entities did this conversation's actions produce?" — `MATCH (c:AdminConversation {sessionId:$id})<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e) RETURN labels(e), e.name, t.kind, t.status`

package/payload/platform/plugins/docs/references/platform.md

@@ -85,7 +85,7 @@ There is no dashboard, no settings panel, no menus. Everything is done through c
 
 The chat input auto-grows as you type — it expands to fit your message and shrinks back when you delete text. You can also drag the resize handle above the input to set a custom height.
 
-The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
+The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. The conversation column on the Chat page has its own width control: a small handle sits half way up the page just inside each side of the column, and dragging either one widens or narrows the reading measure. The column stays centred, so both handles do the same thing — dragging the left one out and the right one out by the same distance give the same width. It will not go below its default 760px and will not go wider than the chat panel itself; the messages, the input box and the jump-to-latest button all move together. Double-click either handle to go back to 760px. Your chosen width is remembered across reloads. The handles do not appear on a phone (below 640px), where the conversation already fills the width. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `SiteDesk`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.