@rubytech/create-sitedesk-code 0.1.526 → 0.1.527

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-sitedesk-code",
-  "version": "0.1.526",
+  "version": "0.1.527",
   "description": "Install SiteDesk — automated back office for independent building contractors",
   "bin": {
     "create-sitedesk-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:15f533911e93c443dda2624cad785b44ee24ca5bcf5b992fbd96932226abd055
+content-hash: sha256:10d4f123ccb98ccdd68e27e8d22854fb1d9d5dfd985358ff1afa7f5361b25dfa
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -212,7 +212,7 @@ There is no dashboard, no settings panel, no menus. Everything is done through c
 
 The chat input auto-grows as you type — it expands to fit your message and shrinks back when you delete text. You can also drag the resize handle above the input to set a custom height.
 
-The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
+The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. The conversation column on the Chat page has its own width control: a small handle sits half way up the page just inside each side of the column, and dragging either one widens or narrows the reading measure. The column stays centred, so both handles do the same thing — dragging the left one out and the right one out by the same distance give the same width. It will not go below its default 760px and will not go wider than the chat panel itself; the messages, the input box and the jump-to-latest button all move together. Double-click either handle to go back to 760px. Your chosen width is remembered across reloads. The handles do not appear on a phone (below 640px), where the conversation already fills the width. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `SiteDesk`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.
 
@@ -4009,15 +4009,58 @@ button** while it holds text — clicking empties the input, clears results
 | Mount | Purpose |
 |---|---|
 | `/browser` | `POST /launch` — launches Chromium on the resolved transport (native display or VNC) on demand. Backs the standalone `/browser` operator page. Lifeline tag `[admin/browser/launch]`. |
+| `/browser` | `GET /screencast-targets` — the page-target list behind the screencast viewer. Server-side hop to the CDP HTTP surface, which is loopback-only; filtered to `type:'page'`. `501` off the Linux display stack, `502` when Chromium is unreachable. |
+| `/browser` | `POST /screencast-event` — relay for the client half of the `[browser/screencast]` lifeline. Accepts a fixed op allowlist (`request`, `screencast-started`, `frame`, `input`, `teardown`); the server-side ops are refused so a client cannot emit a line that reads as a server decision. |
 
 The in-chat / artefact-embedded brand-VNC iframe components and the
 `/browser-iframe` event-beacon route were retired and stay
 deleted; the `/device-browser` (navigate-the-device-tab) route was also
 removed and is not restored. The standalone `/browser` page is a
-sanctioned operator surface peer to `/graph` and `/data`: it embeds the live
-VNC viewer (`/vnc-viewer.html`, popout `/vnc-popout.html`) and calls
-`/api/admin/browser/launch`. On darwin (no noVNC asset) it shows a "VNC surface
-not available" state.
+sanctioned operator surface peer to `/graph` and `/data`.
+
+**The human view is a CDP screencast, not a framebuffer.** `/browser`
+renders `CdpScreencastSurface`: frames arrive as CDP `Page.screencastFrame` and
+paint to a canvas, and the operator's clicks, scrolling and typing leave as
+`Input.dispatch*`. Interaction therefore lands on page coordinates rather than
+screen pixels, and the view is one tab chosen from a strip rather than the whole
+X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
+nothing on `/browser` reaches them, and retiring that stack is separate work.
+
+The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
+by the edge listener before its `forwardUpgrade` catch-all. It is gated by
+`canAccessAdmin` and rejected on operator and public hosts (`reason` values
+`origin-operator-host` and `origin-public-host`, mirroring the websockify
+rejection), and it validates the target id against a fixed 32-hex charset because
+that id is interpolated into the upstream request line. Before replaying the
+upgrade to Chromium it drops the admin session cookie and the browser `Origin`:
+Chromium is launched with no `--remote-allow-origins`, so its DevTools endpoint
+has no allowlisted origin, and the proxy has already checked same-origin itself.
+
+Chromium's debugging port is bound to `127.0.0.1` on `${CDP_PORT}` and is never
+tunnelled or bound off-localhost. That port carries no authentication and total
+control of the browser, which is why the proxy is the only path to it. Per-brand
+isolation is the `CDP_PORT` import and nothing else, so two co-resident brands
+each view their own Chromium.
+
+Off the Linux display stack, and whenever Chromium is unreachable, the surface
+renders an explicit unavailable state. That is deliberate rather than cosmetic: a
+canvas that never receives a frame is indistinguishable from a black desktop,
+where the iframe it replaced failed visibly.
+
+Observability is `[browser/screencast]` correlated by `sid` across
+`request → gate → cdp-connected → screencast-started → frame → input → teardown
+→ socket-closed`, plus `[cdp-ws-census] liveSockets=<N> sessions=<M>` on every
+open and close. Diagnostic path:
+
+```
+logs-read.sh | grep -E '\[browser/screencast\]|\[cdp-ws-census\]'
+```
+
+then filter to one `sid` for a whole session. Frame lines are sampled, so a
+frozen `seq` against a live socket is the frozen-viewer signature. `liveSockets`
+climbing while `sessions` stays flat is the leak signature: an operator tab that
+closes without a clean teardown emits no action log of its own, so the standing
+reconcile pass closes client-dead sockets and reports `op=orphan-reap closed=<N>`.
 
 ### Diagnostics
 
@@ -4318,6 +4361,29 @@ on every admin page; double-click resets to half the available width
 (viewport minus sidebar), clamped to the per-pane min-width floors. The
 chosen width is remembered across reloads.
 
+**The /chat reading measure is operator-set.** `--webchat-measure` was a fixed
+760px; it is now the FLOOR of a range the operator drags, written inline on
+`.webchat-page` by `WebchatSplitter` so the message column, the composer and the
+jump-to-latest button — all three read the same property — stay aligned. Two
+handles, one just inside each column edge, vertically centred. The column is
+centre-aligned, so one symmetric rule drives both: `measure = 2 × |pointerX −
+panelCentreX|`, which is why the two handles are interchangeable. Envelope:
+760px ≤ measure ≤ the chat panel's own width; double-click either handle to
+revert to 760px and clear the stored value; the measure persists in
+`localStorage` under `maxy-webchat-measure-px` and re-clamps on window resize and
+on any panel-width change (sidebar drag, artefact open/close). No handle renders
+below a 640px viewport, where the media query already gives the column the full
+width. A measure wider than its panel does not overflow — the column just fills
+the panel — so that state emits nothing on its own; the standing check is
+`[admin-ui] op=webchat-measure-audit measurePx= panelPx= availPx= columnPx=
+handles= governed= fit=`, emitted on mount and on every re-clamp with identical
+consecutive readings suppressed. `columnPx` is the measured `.wa-thread-scroll`
+rect, not the property read back, so a property written to the wrong element
+shows as `measurePx=1200 columnPx=760`; `columnPx=-1` means no transcript is
+mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
+`governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
+px=<final>`; a bare click logs nothing.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:
@@ -5315,7 +5381,7 @@ For estate-agent client work surfaced on the `/tasks` operator page, `work-creat
 
 Two surfaces feed the gate. (1) **Workflow path:** `memory-write` accepts an optional `producedByTaskId` parameter. When set, an inbound `:PRODUCED` edge from that Task is composed into the write's relationships before the gate runs — the typical agent-side pattern is to call `work-create` at the start of an autonomous flow, capture `taskId`, and pass it as `producedByTaskId` on every subsequent `memory-write` for a gated label. The gate verifies Task and write share the same `accountId`; mismatch is rejected loud. (2) **Direct-ask path:** the admin server resolves the active `:AdminConversation`'s `sessionId` UUID and stamps it as `SESSION_NODE_ID` in the spawn env at PTY-spawn time. The same stamp propagates onto specialist subagent spawns the admin dispatches so listing-curator, content-producer, database-operator etc. inherit the same conversation anchor. The `contact-create` and `memory-write` wrappers call `injectConversationProvenance` (exported from [`@maxy/graph-write`](../../../lib/graph-write/src/conversation-provenance.ts)) which MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is part of the natural key, not a separate gate — and prepends the synthetic `:PRODUCED` edge (composed by Neo4j elementId, which the helper reads off the MATCH). No agent-visible schema field changes. `memory-write` uses the env-stamp only as a fallback when `producedByTaskId` is unset; `contact-create` has no `producedByTaskId` parameter today and relies on the env-stamp alone. Autonomous (cron-driven) specialists with no parent conversation legitimately have no env-stamp; those must thread `producedByTaskId`.
 
-A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one, which is how a resume the session manager redirected to a live fork re-points itself rather than staying on the dead source. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
+A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one. The link route runs only on a first click, when the task has no session yet; a click on an already-linked task navigates straight to `/chat?session=<id>` and writes nothing, so an edge is never re-pointed after it is first written. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
 
 Operator audit cyphers:
 - "What entities did this conversation's actions produce?" — `MATCH (c:AdminConversation {sessionId:$id})<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e) RETURN labels(e), e.name, t.kind, t.status`

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,13 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-30 (0.1.527)
+
+- The remote browser page now shows a live picture of the browser you can click and type into directly, replacing the old screen-sharing view.
+- The Session button on an open task now opens the chat inside the dashboard instead of sending you out to a different site, and the new session starts already knowing the task's description and notes.
+- Posting to LinkedIn from the browser extension works again. It was being stopped before the post ever left the browser, and when it failed it blamed the wrong thing; a missing permission and an unreachable device are now reported as the different problems they are.
+- The page title is smaller and the chat column can be dragged wider or narrower.
+
 ## 2026-07-30 (0.1.526)
 
 - Asking WhatsApp to reconnect now answers as soon as the reconnect starts, instead of waiting on the old connection to die and leaving you with no reply at all.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -783,15 +783,58 @@ button** while it holds text — clicking empties the input, clears results
 | Mount | Purpose |
 |---|---|
 | `/browser` | `POST /launch` — launches Chromium on the resolved transport (native display or VNC) on demand. Backs the standalone `/browser` operator page. Lifeline tag `[admin/browser/launch]`. |
+| `/browser` | `GET /screencast-targets` — the page-target list behind the screencast viewer. Server-side hop to the CDP HTTP surface, which is loopback-only; filtered to `type:'page'`. `501` off the Linux display stack, `502` when Chromium is unreachable. |
+| `/browser` | `POST /screencast-event` — relay for the client half of the `[browser/screencast]` lifeline. Accepts a fixed op allowlist (`request`, `screencast-started`, `frame`, `input`, `teardown`); the server-side ops are refused so a client cannot emit a line that reads as a server decision. |
 
 The in-chat / artefact-embedded brand-VNC iframe components and the
 `/browser-iframe` event-beacon route were retired and stay
 deleted; the `/device-browser` (navigate-the-device-tab) route was also
 removed and is not restored. The standalone `/browser` page is a
-sanctioned operator surface peer to `/graph` and `/data`: it embeds the live
-VNC viewer (`/vnc-viewer.html`, popout `/vnc-popout.html`) and calls
-`/api/admin/browser/launch`. On darwin (no noVNC asset) it shows a "VNC surface
-not available" state.
+sanctioned operator surface peer to `/graph` and `/data`.
+
+**The human view is a CDP screencast, not a framebuffer.** `/browser`
+renders `CdpScreencastSurface`: frames arrive as CDP `Page.screencastFrame` and
+paint to a canvas, and the operator's clicks, scrolling and typing leave as
+`Input.dispatch*`. Interaction therefore lands on page coordinates rather than
+screen pixels, and the view is one tab chosen from a strip rather than the whole
+X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
+nothing on `/browser` reaches them, and retiring that stack is separate work.
+
+The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
+by the edge listener before its `forwardUpgrade` catch-all. It is gated by
+`canAccessAdmin` and rejected on operator and public hosts (`reason` values
+`origin-operator-host` and `origin-public-host`, mirroring the websockify
+rejection), and it validates the target id against a fixed 32-hex charset because
+that id is interpolated into the upstream request line. Before replaying the
+upgrade to Chromium it drops the admin session cookie and the browser `Origin`:
+Chromium is launched with no `--remote-allow-origins`, so its DevTools endpoint
+has no allowlisted origin, and the proxy has already checked same-origin itself.
+
+Chromium's debugging port is bound to `127.0.0.1` on `${CDP_PORT}` and is never
+tunnelled or bound off-localhost. That port carries no authentication and total
+control of the browser, which is why the proxy is the only path to it. Per-brand
+isolation is the `CDP_PORT` import and nothing else, so two co-resident brands
+each view their own Chromium.
+
+Off the Linux display stack, and whenever Chromium is unreachable, the surface
+renders an explicit unavailable state. That is deliberate rather than cosmetic: a
+canvas that never receives a frame is indistinguishable from a black desktop,
+where the iframe it replaced failed visibly.
+
+Observability is `[browser/screencast]` correlated by `sid` across
+`request → gate → cdp-connected → screencast-started → frame → input → teardown
+→ socket-closed`, plus `[cdp-ws-census] liveSockets=<N> sessions=<M>` on every
+open and close. Diagnostic path:
+
+```
+logs-read.sh | grep -E '\[browser/screencast\]|\[cdp-ws-census\]'
+```
+
+then filter to one `sid` for a whole session. Frame lines are sampled, so a
+frozen `seq` against a live socket is the frozen-viewer signature. `liveSockets`
+climbing while `sessions` stays flat is the leak signature: an operator tab that
+closes without a clean teardown emits no action log of its own, so the standing
+reconcile pass closes client-dead sockets and reports `op=orphan-reap closed=<N>`.
 
 ### Diagnostics
 
@@ -1092,6 +1135,29 @@ on every admin page; double-click resets to half the available width
 (viewport minus sidebar), clamped to the per-pane min-width floors. The
 chosen width is remembered across reloads.
 
+**The /chat reading measure is operator-set.** `--webchat-measure` was a fixed
+760px; it is now the FLOOR of a range the operator drags, written inline on
+`.webchat-page` by `WebchatSplitter` so the message column, the composer and the
+jump-to-latest button — all three read the same property — stay aligned. Two
+handles, one just inside each column edge, vertically centred. The column is
+centre-aligned, so one symmetric rule drives both: `measure = 2 × |pointerX −
+panelCentreX|`, which is why the two handles are interchangeable. Envelope:
+760px ≤ measure ≤ the chat panel's own width; double-click either handle to
+revert to 760px and clear the stored value; the measure persists in
+`localStorage` under `maxy-webchat-measure-px` and re-clamps on window resize and
+on any panel-width change (sidebar drag, artefact open/close). No handle renders
+below a 640px viewport, where the media query already gives the column the full
+width. A measure wider than its panel does not overflow — the column just fills
+the panel — so that state emits nothing on its own; the standing check is
+`[admin-ui] op=webchat-measure-audit measurePx= panelPx= availPx= columnPx=
+handles= governed= fit=`, emitted on mount and on every re-clamp with identical
+consecutive readings suppressed. `columnPx` is the measured `.wa-thread-scroll`
+rect, not the property read back, so a property written to the wrong element
+shows as `measurePx=1200 columnPx=760`; `columnPx=-1` means no transcript is
+mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
+`governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
+px=<final>`; a bare click logs nothing.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:

package/payload/platform/plugins/docs/references/internals.md

@@ -560,7 +560,7 @@ For estate-agent client work surfaced on the `/tasks` operator page, `work-creat
 
 Two surfaces feed the gate. (1) **Workflow path:** `memory-write` accepts an optional `producedByTaskId` parameter. When set, an inbound `:PRODUCED` edge from that Task is composed into the write's relationships before the gate runs — the typical agent-side pattern is to call `work-create` at the start of an autonomous flow, capture `taskId`, and pass it as `producedByTaskId` on every subsequent `memory-write` for a gated label. The gate verifies Task and write share the same `accountId`; mismatch is rejected loud. (2) **Direct-ask path:** the admin server resolves the active `:AdminConversation`'s `sessionId` UUID and stamps it as `SESSION_NODE_ID` in the spawn env at PTY-spawn time. The same stamp propagates onto specialist subagent spawns the admin dispatches so listing-curator, content-producer, database-operator etc. inherit the same conversation anchor. The `contact-create` and `memory-write` wrappers call `injectConversationProvenance` (exported from [`@maxy/graph-write`](../../../lib/graph-write/src/conversation-provenance.ts)) which MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is part of the natural key, not a separate gate — and prepends the synthetic `:PRODUCED` edge (composed by Neo4j elementId, which the helper reads off the MATCH). No agent-visible schema field changes. `memory-write` uses the env-stamp only as a fallback when `producedByTaskId` is unset; `contact-create` has no `producedByTaskId` parameter today and relies on the env-stamp alone. Autonomous (cron-driven) specialists with no parent conversation legitimately have no env-stamp; those must thread `producedByTaskId`.
 
-A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one, which is how a resume the session manager redirected to a live fork re-points itself rather than staying on the dead source. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
+A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one. The link route runs only on a first click, when the task has no session yet; a click on an already-linked task navigates straight to `/chat?session=<id>` and writes nothing, so an edge is never re-pointed after it is first written. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
 
 Operator audit cyphers:
 - "What entities did this conversation's actions produce?" — `MATCH (c:AdminConversation {sessionId:$id})<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e) RETURN labels(e), e.name, t.kind, t.status`

package/payload/platform/plugins/docs/references/platform.md

@@ -85,7 +85,7 @@ There is no dashboard, no settings panel, no menus. Everything is done through c
 
 The chat input auto-grows as you type — it expands to fit your message and shrinks back when you delete text. You can also drag the resize handle above the input to set a custom height.
 
-The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
+The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. The conversation column on the Chat page has its own width control: a small handle sits half way up the page just inside each side of the column, and dragging either one widens or narrows the reading measure. The column stays centred, so both handles do the same thing — dragging the left one out and the right one out by the same distance give the same width. It will not go below its default 760px and will not go wider than the chat panel itself; the messages, the input box and the jump-to-latest button all move together. Double-click either handle to go back to 760px. Your chosen width is remembered across reloads. The handles do not appear on a phone (below 640px), where the conversation already fills the width. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `SiteDesk`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.
 

package/payload/platform/plugins/linkedin-extension/extension/README.md

@@ -9,6 +9,7 @@ Unpacked-extension dev build. No Chrome Web Store publication.
 3. **Load unpacked** → select this `extension/` directory.
 4. Click the new puzzle icon → open **SiteDesk LinkedIn Ingest** options.
 5. Paste your admin host (e.g. `https://your-tunnel.example.com`) and your admin **session key** (the value of `session_key` on the cookie or query in your admin browser). Save.
+6. Chrome asks you to allow the extension to talk to that host. **Allow it.** The pill cannot post without it, so declining saves nothing.
 
 ## Use
 
@@ -16,7 +17,14 @@ Unpacked-extension dev build. No Chrome Web Store publication.
 - Click the **Add to SiteDesk** pill at the top of the page.
 - The pill turns green and writes one `:KnowledgeDocument` plus the entities the body assertively states.
 
-If the pill turns amber and shows **Sign in to SiteDesk**, your session key has expired — open the options page and paste a fresh one.
+The pill tells you which thing is wrong:
+
+| Pill | Meaning | Fix |
+|---|---|---|
+| **Sign in to SiteDesk** (amber) | the session key expired | open options, paste a fresh key |
+| **Grant access** (amber) | the admin host was never allowed, so the post never left the browser | open options, Save, allow the prompt |
+| **SiteDesk unreachable** (red) | the host was allowed but did not answer | check the tunnel and the admin server |
+| **Capture failed** (red) | the admin rejected the payload, or the extension's own service worker did not answer | read the service-worker console: `reason=extract` is a rejected payload, `reason=worker-unreachable` is the worker |
 
 ## File layout
 
@@ -26,7 +34,7 @@ If the pill turns amber and shows **Sign in to SiteDesk**, your session key has
 | `content/extractors.js` | Pure DOM extractor functions. Loaded first into each content-script context. |
 | `content/profile.js` | Profile pill + click handler. |
 | `content/thread.js` | Thread pill + click handler. |
-| `background/sw.js` | Service worker. POSTs envelopes to the admin route. |
+| `background/sw.js` | Service worker. Checks the admin-host grant, then POSTs envelopes to the admin route. |
 | `options/options.html` + `options/options.js` | Admin host + session-key entry. |
 | `assets/pill.css` | Pill styling. |
 | `__tests__/` | jsdom unit tests for the extractors, run via vitest from `platform/ui`. |

package/payload/platform/plugins/linkedin-extension/extension/background/sw.js

@@ -1,5 +1,16 @@
 // Service worker. Receives envelopes from content scripts, POSTs them
-// to the admin host with the bearer token stored in extension options.
+// to the admin host with the session key stored in extension options.
+//
+// Task 2185 — the manifest's static host_permissions cover linkedin.com only,
+// so the admin host has to be granted at runtime from the options page before
+// this fetch is permission-exempt. Without the grant Chrome treats the POST as
+// an ordinary cross-origin request and preflights it (the content type is
+// application/json, which is not CORS-safelisted); the admin route answers no
+// preflight, so the request dies in the browser and the server never sees it.
+//
+// The grant is checked BEFORE the fetch on purpose: a missing grant and an
+// unreachable host both surface as the same `TypeError: Failed to fetch`, so
+// asking first is the only way to tell an operator which one they have.
 
 const TAG = '[linkedin-ext-post]'
 
@@ -11,11 +22,30 @@ async function getConfig() {
   }
 }
 
+// Chrome match pattern covering every path on the admin host's origin.
+function originPattern(adminHost) {
+  return new URL(adminHost).origin + '/*'
+}
+
 async function postEnvelope(envelope) {
   const { adminHost, sessionKey } = await getConfig()
   if (!adminHost) return { ok: false, reason: 'auth', detail: 'admin-host-missing' }
   if (!sessionKey) return { ok: false, reason: 'auth', detail: 'session-key-missing' }
 
+  let origin
+  try {
+    origin = originPattern(adminHost)
+  } catch {
+    return { ok: false, reason: 'permission', detail: 'admin-host-not-a-url' }
+  }
+
+  const granted = await chrome.permissions.contains({ origins: [origin] })
+  console.log(
+    TAG + ' op=permission dispatchId=' + envelope.dispatchId +
+    ' origin=' + origin + ' granted=' + granted,
+  )
+  if (!granted) return { ok: false, reason: 'permission', detail: 'host-not-granted origin=' + origin }
+
   const url = adminHost + '/api/admin/linkedin-ingest'
   const started = Date.now()
   let res
@@ -26,12 +56,15 @@ async function postEnvelope(envelope) {
       body: JSON.stringify({ ...envelope, session_key: sessionKey }),
     })
   } catch (err) {
-    console.error(TAG + ' dispatchId=' + envelope.dispatchId + ' status=network ms=' + (Date.now() - started))
-    return { ok: false, reason: 'network', detail: err && err.message ? err.message : String(err) }
+    console.error(
+      TAG + ' op=fetch dispatchId=' + envelope.dispatchId +
+      ' status=unreachable ms=' + (Date.now() - started),
+    )
+    return { ok: false, reason: 'unreachable', detail: err && err.message ? err.message : String(err) }
   }
 
   const ms = Date.now() - started
-  console.log(TAG + ' dispatchId=' + envelope.dispatchId + ' status=' + res.status + ' ms=' + ms)
+  console.log(TAG + ' op=fetch dispatchId=' + envelope.dispatchId + ' status=' + res.status + ' ms=' + ms)
 
   if (res.status === 401) return { ok: false, reason: 'auth', detail: 'session-rejected' }
   if (res.status >= 500) return { ok: false, reason: 'server', detail: 'http-' + res.status }

package/payload/platform/plugins/linkedin-extension/extension/content/profile.js

@@ -38,13 +38,17 @@
     try {
       reply = await chrome.runtime.sendMessage({ type: 'linkedin-ingest', envelope: envelope })
     } catch (err) {
-      console.error(TAG_ERROR + ' reason=network detail=' + (err && err.message ? err.message : String(err)))
+      console.error(TAG_ERROR + ' reason=worker-unreachable detail=' + (err && err.message ? err.message : String(err)))
       setState(pill, 'error', 'Capture failed')
       return
     }
 
     if (!reply || !reply.ok) {
-      const reason = (reply && reply.reason) || 'network'
+      // `worker-unreachable` is the extension's OWN service worker failing to
+      // answer. It is not `unreachable`, which means the admin host did not
+      // answer — blaming SiteDesk here sends the operator to check a tunnel that
+      // was never involved.
+      const reason = (reply && reply.reason) || 'worker-unreachable'
       const detail = (reply && reply.detail) || ''
       console.error(TAG_ERROR + ' reason=' + reason + ' detail=' + detail)
       if (reason === 'auth') {
@@ -52,6 +56,17 @@
         pill.onclick = function () { chrome.runtime.openOptionsPage() }
         return
       }
+      // Task 2185 — the admin host was never granted, so the POST never left
+      // the browser. Sending the operator to the options page is the fix.
+      if (reason === 'permission') {
+        setState(pill, 'auth', 'Grant access')
+        pill.onclick = function () { chrome.runtime.openOptionsPage() }
+        return
+      }
+      if (reason === 'unreachable') {
+        setState(pill, 'error', 'SiteDesk unreachable')
+        return
+      }
       setState(pill, 'error', 'Capture failed')
       return
     }

package/payload/platform/plugins/linkedin-extension/extension/content/thread.js

@@ -40,13 +40,17 @@
     try {
       reply = await chrome.runtime.sendMessage({ type: 'linkedin-ingest', envelope: envelope })
     } catch (err) {
-      console.error(TAG_ERROR + ' reason=network detail=' + (err && err.message ? err.message : String(err)))
+      console.error(TAG_ERROR + ' reason=worker-unreachable detail=' + (err && err.message ? err.message : String(err)))
       setState(pill, 'error', 'Capture failed')
       return
     }
 
     if (!reply || !reply.ok) {
-      const reason = (reply && reply.reason) || 'network'
+      // `worker-unreachable` is the extension's OWN service worker failing to
+      // answer. It is not `unreachable`, which means the admin host did not
+      // answer — blaming SiteDesk here sends the operator to check a tunnel that
+      // was never involved.
+      const reason = (reply && reply.reason) || 'worker-unreachable'
       const detail = (reply && reply.detail) || ''
       console.error(TAG_ERROR + ' reason=' + reason + ' detail=' + detail)
       if (reason === 'auth') {
@@ -54,6 +58,17 @@
         pill.onclick = function () { chrome.runtime.openOptionsPage() }
         return
       }
+      // Task 2185 — the admin host was never granted, so the POST never left
+      // the browser. Sending the operator to the options page is the fix.
+      if (reason === 'permission') {
+        setState(pill, 'auth', 'Grant access')
+        pill.onclick = function () { chrome.runtime.openOptionsPage() }
+        return
+      }
+      if (reason === 'unreachable') {
+        setState(pill, 'error', 'SiteDesk unreachable')
+        return
+      }
       setState(pill, 'error', 'Capture failed')
       return
     }

package/payload/platform/plugins/linkedin-extension/extension/manifest.json

@@ -5,6 +5,7 @@
   "description": "Add an Add-to-SiteDesk pill to LinkedIn profiles and DM threads. One click captures the page and posts to your SiteDesk admin.",
   "permissions": ["storage", "activeTab"],
   "host_permissions": ["https://www.linkedin.com/*"],
+  "optional_host_permissions": ["http://*/*", "https://*/*"],
   "background": {
     "service_worker": "background/sw.js"
   },

package/payload/platform/plugins/linkedin-extension/extension/options/options.html

@@ -18,6 +18,7 @@
   <body>
     <h1>SiteDesk LinkedIn Ingest</h1>
     <p>Point the extension at your SiteDesk admin host and paste your admin session key. The pill on LinkedIn will then post one-click captures to your admin.</p>
+    <p>On Save, Chrome asks you to allow this extension to talk to that host. The capture pill cannot post without it, so declining leaves the extension unconfigured.</p>
 
     <label for="admin-host">Admin host</label>
     <input id="admin-host" type="url" placeholder="https://your-tunnel.example.com" />