@sigrun/sigrun 0.1.4 → 0.1.5

package/dist/server/helpers.js

@@ -273,6 +273,32 @@ export async function conversationEnv(opened, conversation) {
 }
 /** The upload read cap for `files/content` (binary-safe; 1 MiB). */
 export const FILE_CONTENT_MAX_BYTES = 1024 * 1024;
+/**
+ * The served model catalog as picker entries (gateway C4b): the ONE
+ * construction behind `GET /v1/models` `.models` AND the host's
+ * `models.list()` — id/provider/modelId/name/contextWindow/maxTokens/
+ * reasoning/input plus the four rate fields (tiers dropped for v1, the
+ * picker doesn't use them — no unsound cast). Provider internals
+ * (baseUrl/headers/auth) never cross either surface.
+ */
+export function listModels(opened) {
+    return opened.models.getModels().map((model) => ({
+        id: `${model.provider}/${model.id}`,
+        provider: model.provider,
+        modelId: model.id,
+        name: model.name,
+        contextWindow: model.contextWindow,
+        maxTokens: model.maxTokens,
+        reasoning: model.reasoning,
+        input: model.input,
+        cost: {
+            input: model.cost.input,
+            output: model.cost.output,
+            cacheRead: model.cost.cacheRead,
+            cacheWrite: model.cost.cacheWrite,
+        },
+    }));
+}
 /**
  * One provider's auth readiness, derived from boot-retained state (spec
  * §6.4 + provider plugins Task 6): the same three-priority chain

package/dist/server/host-bridge.js

@@ -18,9 +18,25 @@
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { accessOf as accessOfShared, } from "@sigrun/shared/access";
 import { isSuperuser } from "./auth/principal.js";
-import { createConversationOp, listConversationsOp, readMetaOp, submitOp, } from "./conversation-ops.js";
+import { abortOp, compactOp, configureOp, ConversationOpError, createConversationOp, forkOp, listConversationsOp, patchMetaOp, readFileOp, readMetaOp, submitOp, uploadOp, } from "./conversation-ops.js";
+import { listModels } from "./helpers.js";
 import { SessionMetaDoc } from "./session-meta.js";
 import { serializeConversationView } from "./views.js";
+/**
+ * The effective-admin projection of one directory user (gateway C8):
+ * host-side callers (chat commands, no request headers) see the STORED
+ * flag OR the persisted group grant, plus the raw `groupAdmin` as a
+ * definite boolean. The `/v1/users` wire keeps `admin` = the stored
+ * flag (the users-admin UI toggles that one); the two surfaces are
+ * deliberately different.
+ */
+function effectiveAdminOf(record) {
+    return {
+        ...record,
+        admin: record.admin || record.groupAdmin === true,
+        groupAdmin: record.groupAdmin === true,
+    };
+}
 /** Build the host bridge over one server context. */
 export function createHostBridge(ctx) {
     const { opened } = ctx;
@@ -93,16 +109,78 @@ export function createHostBridge(ctx) {
                 await conversationOf(id);
                 return await readMetaOp(opened, id);
             },
+            // Gateway C4a: the remaining conversation ops, each the SAME op
+            // its HTTP route runs — resolved through conversationOf (unknown id
+            // → the bridge's loud `conversation <id> not found`).
+            async abort(id) {
+                const conversation = await conversationOf(id);
+                // `/stop` on an idle chat is not an error (the plan's ruling): the
+                // op's 404 no_active_submission resolves instead — the HTTP route
+                // keeps its exact 404.
+                try {
+                    await abortOp(ctx, conversation);
+                }
+                catch (error) {
+                    if (error instanceof ConversationOpError &&
+                        error.status === 404 &&
+                        error.body.error === "no_active_submission") {
+                        return;
+                    }
+                    throw error;
+                }
+            },
+            async configure(id, opts = {}) {
+                const conversation = await conversationOf(id);
+                // Thin over the op (host inputs are typed — the op still
+                // validates exactly like the route's body).
+                await configureOp(ctx, conversation, {
+                    ...(opts.model === undefined ? {} : { model: opts.model }),
+                    ...(opts.thinking === undefined ? {} : { thinking: opts.thinking }),
+                });
+            },
+            async compact(id) {
+                const conversation = await conversationOf(id);
+                await compactOp(ctx, conversation);
+            },
+            async fork(id, opts = {}) {
+                const conversation = await conversationOf(id);
+                const forked = await forkOp(ctx, conversation, {
+                    ...(opts.at === undefined ? {} : { at: opts.at }),
+                    ...(opts.owner === undefined ? {} : { owner: opts.owner }),
+                });
+                return forked.id;
+            },
+            async patchMeta(id, patch) {
+                const conversation = await conversationOf(id);
+                // No principal: host callers are trusted — the sharing gate is
+                // the HTTP route's own concern (the plan's ruling).
+                return await patchMetaOp(ctx, conversation, patch);
+            },
+            // Gateway C4b: the files routes' ops, each the SAME op its HTTP
+            // route runs — the upload routes' shared write core and the
+            // files/raw route's confinement + cap (the host sees the op's own
+            // error vocabulary: invalid_field name / invalid_path / not_found /
+            // too_large).
+            async upload(id, file) {
+                const conversation = await conversationOf(id);
+                return await uploadOp(ctx, conversation, file);
+            },
+            async readFile(id, path) {
+                const conversation = await conversationOf(id);
+                return await readFileOp(ctx, conversation, path);
+            },
         },
         users: {
             // The directory in wire form (emails are admin material; the
             // bridge is in-process server code, the same trust as the
-            // admin-gated /v1/users routes).
+            // admin-gated /v1/users routes) — with EFFECTIVE admin (gateway
+            // C8): a persisted group grant counts for host-side checks.
             async list() {
-                return opened.identity.users.list();
+                return opened.identity.users.list().map(effectiveAdminOf);
             },
             async get(user) {
-                return opened.identity.users.get(user);
+                const record = opened.identity.users.get(user);
+                return record === undefined ? undefined : effectiveAdminOf(record);
             },
         },
         access: {
@@ -127,5 +205,64 @@ export function createHostBridge(ctx) {
                 return meta?.owner;
             },
         },
+        // Gateway C4b: the model catalog — the SAME source function the
+        // `GET /v1/models` route serves (one construction, never two).
+        models: {
+            async list() {
+                return listModels(opened);
+            },
+        },
+        commands: {
+            // The merged catalog rows (`GET /v1/commands`' core + extension
+            // half — the live skill/template expand entries are the composer's
+            // per-request concern, not this surface's).
+            async list() {
+                return ctx.commandCatalog.commands;
+            },
+            // The invoke route's resolution, in-process: the runnable map
+            // (core names and dropped/collided losers throw), the principal
+            // built from the directory with EFFECTIVE admin and method "host",
+            // and the extension's seam host exactly as the route passes it. A
+            // throwing run PROPAGATES (the HTTP route maps 500 command_failed;
+            // the host caller owns its own handling).
+            async run(conversationId, name, args, opts) {
+                const merged = ctx.commandCatalog.runnable.get(name);
+                if (merged === undefined) {
+                    throw new Error(`command_not_found: ${name}`);
+                }
+                const record = opened.identity.users.get(opts.user);
+                if (record === undefined) {
+                    throw new Error(`unknown user "${opts.user}"`);
+                }
+                // Effective admin (gateway C8): the stored flag OR the persisted
+                // group grant — host-side code has no request headers to
+                // recompute one.
+                const principal = {
+                    user: record.user,
+                    ...(record.name === undefined ? {} : { name: record.name }),
+                    ...(record.email === undefined ? {} : { email: record.email }),
+                    admin: effectiveAdminOf(record).admin,
+                    service: false,
+                    method: "host",
+                };
+                const host = ctx.opened.seamHosts.get(merged.extension);
+                const result = await merged.run({
+                    conversationId,
+                    args,
+                    principal,
+                    host: host,
+                });
+                return result === undefined || result.notice === undefined
+                    ? {}
+                    : { notice: result.notice };
+            },
+        },
+        surfaces: {
+            // UI-blocks U3 Task 4 (spec §7.3): the same bumpRev the actions
+            // route takes — the rev advance and the hub event are one step.
+            changed(slug, id, key, update) {
+                ctx.surfaces.bumpRev(slug, id, key, update);
+            },
+        },
     };
 }

package/dist/server/index.js

@@ -46,6 +46,7 @@ import { registerConversationRoutes } from "./routes/conversations.js";
 import { registerEventRoutes } from "./routes/events.js";
 import { registerExtensionRoutes as registerExtensionSettingsRoutes } from "./routes/extensions.js";
 import { registerExtensionRoutes as mountExtensionRoutes } from "./routes/extension-routes.js";
+import { registerExtAssetRoutes } from "./routes/ext-assets.js";
 import { registerFileRoutes } from "./routes/files.js";
 import { registerJobRoutes } from "./routes/jobs.js";
 import { registerInteractionRoutes } from "./routes/interactions.js";
@@ -58,6 +59,8 @@ import { registerSettingsRoutes } from "./routes/settings.js";
 import { registerStreamRoutes } from "./routes/stream.js";
 import { startNotifications } from "./notifications.js";
 import { registerSubmissionRoutes } from "./routes/submissions.js";
+import { registerSurfaceRoutes } from "./routes/surfaces.js";
+import { SurfaceService } from "./surfaces/service.js";
 import { registerUserRoutes } from "./routes/users.js";
 import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
 /**
@@ -164,6 +167,20 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // OUTSIDE before app.close() — a decoration is the typed, discoverable
     // way to hand that handle up without widening ServerContext's consumers.
     app.decorate("sse", sse);
+    const surfacesService = new SurfaceService(opened.extensionSurfaces, {
+        maxUploadBytes: config.maxUploadBytes,
+        // Task 4: bumpRev (actions AND the host seam's changed()) fans the
+        // surface.changed event out to the hub; the events route's
+        // visibility case delivers it to watching streams only.
+        publishChanged: (event) => {
+            // SAFETY: the hub is typed on the wire union; surface.changed's
+            // hub copy carries the internal `streams` field the events route
+            // reads and strips before delivery (spec §7.3's routing can never
+            // reverse the hashed k).
+            opened.events.publish(event);
+        },
+    });
+    app.decorate("surfaces", surfacesService);
     const ctx = {
         opened,
         config,
@@ -174,7 +191,9 @@ export async function createServer(opened, config, contributedBundles = [], opti
         methods,
         env,
         watchersByConversation: new Map(),
+        surfaces: surfacesService,
         sse,
+        ...(options?.gateway === undefined ? {} : { gateway: options.gateway }),
     };
     // The host bridge (W5 Task 5, spec §9.5/§9.7): ONE bridge over this
     // server's context, bound onto every seam host — the extension-facing
@@ -217,6 +236,14 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // web-standard Request/Response adapter — per-route auth rides the
     // pipeline's stage-4b public skip and this module's admin check.
     mountExtensionRoutes(app, ctx);
+    // The extension surface routes (UI-blocks U3 Task 2, spec §7.2):
+    // render/data/actions under the reserved `surfaces/` prefix, over the
+    // shared SurfaceService's access cache and revision state.
+    registerSurfaceRoutes(app, ctx);
+    // The extension asset route (UI-blocks U3 Task 3, spec §11.1/§7.2):
+    // `/v1/ext/<slug>/assets/*` serves the package's declared
+    // `sigrun.assets` dir, realpath-contained, sniffed content types.
+    registerExtAssetRoutes(app, ctx);
     // The jobs routes (W4 Task 4, spec §8.4): the access-scoped CRUD +
     // run-now + history surface over `OpenedHarness.jobs` (Task 3's
     // service). Hidden-is-404 per §5.9; `file:`/`ext:` ids are immutable

package/dist/server/notifications.js

@@ -73,6 +73,7 @@ export function startNotifications(ctx) {
                 type: base.type,
                 conversationId: base.conversationId,
                 jobId: base.jobId,
+                ...(base.callId === undefined ? {} : { callId: base.callId }),
                 user,
                 title: base.title,
                 body: base.body,
@@ -100,7 +101,7 @@ export function startNotifications(ctx) {
         }
     };
     /** interaction.pending → the owner plus every directory user with write. */
-    const handleInteraction = async (conversationId) => {
+    const handleInteraction = async (conversationId, callId) => {
         const meta = await metaOf(conversationId);
         const owner = meta?.owner;
         const sharing = meta?.sharing;
@@ -116,6 +117,7 @@ export function startNotifications(ctx) {
             type: "interaction.pending",
             conversationId,
             jobId: undefined,
+            callId,
             title: "Sigrun needs you",
             body: displayName(meta, conversationId),
         }, recipients);
@@ -136,6 +138,7 @@ export function startNotifications(ctx) {
             type: "run.settled",
             conversationId,
             jobId: undefined,
+            callId: undefined,
             title: "Reply ready",
             body: displayName(meta, conversationId),
         }, [meta?.owner]);
@@ -159,6 +162,7 @@ export function startNotifications(ctx) {
             type: "job.failed",
             conversationId: run.conversationId,
             jobId: job.id,
+            callId: undefined,
             title: `Job ${job.name} failed`,
             // The observer always settles a failed run with its error
             // text; the fallback only covers a hand-corrupted record.
@@ -170,7 +174,7 @@ export function startNotifications(ctx) {
         // the bus's bounded side lane (resolution + delivery alike never
         // run inline here).
         if (event.type === "interaction.pending") {
-            void bus.runBounded("notifications interaction.pending", () => handleInteraction(event.conversationId));
+            void bus.runBounded("notifications interaction.pending", () => handleInteraction(event.conversationId, event.callId));
         }
         else if (event.type === "run.settled") {
             void bus.runBounded("notifications run.settled", () => handleRunSettled(event.conversationId));

package/dist/server/routes/conversations.js

@@ -8,10 +8,9 @@
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { isSuperuser } from "../auth/principal.js";
-import { createConversationOp, listConversationsOp, readMetaOp, } from "../conversation-ops.js";
+import { ConversationOpError, createConversationOp, forkOp, listConversationsOp, patchMetaOp, readMetaOp, } from "../conversation-ops.js";
 import { loadConversation } from "../conversation-handler.js";
 import { ID_PARAMS_SCHEMA, readView, stampSessionOwner, storeAgentChange, } from "../helpers.js";
-import { applySessionMetaPatch, DEFAULT_SESSION_META, SessionMetaDoc, validateSessionMetaPatch, } from "../session-meta.js";
 import { JSONL_CONTENT_TYPE, } from "../views.js";
 import { base64BodyLimit } from "../../config.js";
 /** Register the conversation lifecycle + session-meta routes. */
@@ -82,16 +81,16 @@ export function registerConversationRoutes(app, ctx) {
         return readView(conversation);
     });
     // Fork: a history fork at one visible entry (spec §5 session
-    // management). `at` is the LAST entry id the fork keeps; absent = the
-    // newest entry (resolved through the entries query — never 0, which is
-    // not a real entry id). The fork inherits the parent's agent model and
-    // the same ownerless ownership the create route uses; the response is
-    // the create shape: 201 `{id, view}`.
+    // management). The shared fork op (gateway C4a) is the SAME code path
+    // the host bridge drives — `at` validation against the parent history,
+    // the empty_conversation guard, the agent-model inherit, and the fork
+    // meta commit (owner reset + "<source> (fork)" autoName +
+    // lastActivityAt) live in the op; this route owns the body shape and
+    // the 201. The response is the create shape: `{id, view}`.
     app.post("/v1/conversations/:id/fork", {
         schema: { params: ID_PARAMS_SCHEMA },
         preHandler: loadConversation(ctx, "write"),
     }, async (request, reply) => {
-        const conversation = request.conversation;
         // Absent body is valid (`at` defaults to the newest entry); the
         // object may carry ONLY `at` — the compact/configure convention.
         const body = request.body;
@@ -107,73 +106,30 @@ export function registerConversationRoutes(app, ctx) {
                     .code(400)
                     .send({ error: "invalid_field", field: unknownKey });
             }
-            if (record.at !== undefined &&
-                typeof record.at !== "number") {
+            at = record.at;
+            if (at !== undefined && typeof at !== "number") {
                 return await reply
                     .code(400)
                     .send({ error: "invalid_field", field: "at" });
             }
-            at = record.at;
         }
-        if (at === undefined) {
-            // The entries query is newest-first: the first item of the first
-            // page is the newest entry. An empty page means there is nothing
-            // to fork — the parent conversation has no history at all.
-            const page = await conversation.entries({}, 1, undefined, BACKGROUND_CONTEXT);
-            if (page.items.length === 0) {
-                return await reply.code(400).send({ error: "empty_conversation" });
-            }
-            at = page.items[0].id;
+        try {
+            // The route passes the principal's user as the fork's owner (the
+            // host passes its own opts.owner; undefined = the key removed).
+            const forked = await forkOp(ctx, request.conversation, {
+                ...(at === undefined ? {} : { at }),
+                ...(request.principal.user === undefined
+                    ? {}
+                    : { owner: request.principal.user }),
+            });
+            return await reply.code(201).send(forked);
         }
-        else {
-            // Validate `at` against the parent's own history: `fork()` accepts
-            // any EntryId, but an id this conversation never had is a client
-            // error, not a silent empty fork.
-            const page = await conversation.entries({ maxEntryId: at }, 1, undefined, BACKGROUND_CONTEXT);
-            const newest = page.items[0];
-            if (newest === undefined || newest.id !== at) {
-                return await reply
-                    .code(400)
-                    .send({ error: "invalid_field", field: "at" });
+        catch (error) {
+            if (error instanceof ConversationOpError) {
+                return await reply.code(error.status).send(error.body);
             }
+            throw error;
         }
-        // The fork inherits the parent's agent model — read the resolved
-        // agent, fall back to the boot default like create.
-        const agent = await conversation.agent(BACKGROUND_CONTEXT);
-        const fork = await conversation.fork(at, {
-            ownership: { kind: "ownerless" },
-            agent: { model: agent.model ?? opened.defaultModel },
-        }, BACKGROUND_CONTEXT);
-        // The fork's sidebar identity: the copied meta doc
-        // carries the source's name/autoName and the namer's attempt count;
-        // ONE commit drops all three (a fork is a new conversation, not the
-        // source's name — and it starts naming-fresh: inheriting an exhausted
-        // attempt count would make the fork forever unnameable), re-seeds
-        // it with "<source display name> (fork)"
-        // as its AUTO name when the source had one, and stamps activity so
-        // the fresh fork sorts where it happened.
-        // §5.9 (Review Focus 3): the doc copied the source's `owner` and
-        // `sharing` (fork: "current") — the SAME commit resets them: a fork
-        // is the FORKER's private copy (owner = the caller, sharing deleted;
-        // a header-less caller means no owner at all — the key is removed).
-        const sourceMeta = await opened.harness.snapshot(SessionMetaDoc, conversation.id, BACKGROUND_CONTEXT);
-        const sourceName = sourceMeta?.name ?? sourceMeta?.autoName;
-        await fork.commit(async (tx) => {
-            const draft = await tx.doc(SessionMetaDoc, fork.id);
-            delete draft.name;
-            delete draft.autoName;
-            delete draft.autoNameAttempts;
-            delete draft.sharing;
-            if (request.principal.user === undefined)
-                delete draft.owner;
-            else
-                draft.owner = request.principal.user;
-            if (sourceName !== undefined)
-                draft.autoName = `${sourceName} (fork)`;
-            draft.lastActivityAt = opened.now().toISOString();
-        }, BACKGROUND_CONTEXT);
-        const view = await readView(fork);
-        return await reply.code(201).send({ id: fork.id, view });
     });
     // Export: the conversation's history as JSONL — pi's portable
     // format. One entry JSON object per line (the same per-entry
@@ -308,34 +264,22 @@ export function registerConversationRoutes(app, ctx) {
         schema: { params: ID_PARAMS_SCHEMA },
         preHandler: loadConversation(ctx, "write"),
     }, async (request, reply) => {
-        const conversation = request.conversation;
-        // Validate FIRST — a rejected patch never touches the doc.
-        const validated = validateSessionMetaPatch(request.body);
-        if ("error" in validated) {
-            return await reply.code(400).send(validated);
+        // The shared patch op (gateway C4a) is the SAME code path the
+        // host bridge drives — validate-first, the owner-or-superuser
+        // sharing gate (the route passes its principal; the host passes
+        // none, trusted), the one-commit merge, and the post-commit
+        // snapshot response all live in the op. This route owns the HTTP
+        // mapping only.
+        try {
+            return await patchMetaOp(ctx, request.conversation, request.body, {
+                principal: request.principal,
+            });
         }
-        // §5.9: `sharing` additionally requires the OWNER or a superuser —
-        // write access (granted by a share) must not let a recipient
-        // re-share the resource.
-        if (validated.sharing !== undefined) {
-            const meta = await opened.harness.snapshot(SessionMetaDoc, conversation.id, BACKGROUND_CONTEXT);
-            const isOwner = request.principal.user !== undefined &&
-                request.principal.user === meta?.owner;
-            if (!isOwner && !isSuperuser(request.principal)) {
-                return await reply.code(403).send({ error: "forbidden" });
+        catch (error) {
+            if (error instanceof ConversationOpError) {
+                return await reply.code(error.status).send(error.body);
             }
+            throw error;
         }
-        // Read-modify-write inside ONE commit: tx.doc materializes the doc
-        // (initial()) when absent and the patch mutates the tracked draft.
-        await conversation.commit(async (tx) => {
-            const draft = await tx.doc(SessionMetaDoc, conversation.id);
-            applySessionMetaPatch(draft, validated);
-        }, BACKGROUND_CONTEXT);
-        // The response is a FRESH snapshot, not a draft projection:
-        // reading a newly-SET nested draft value (`sharing`, §5.9) trips
-        // chord's settled-overlay rule, so the reply must never read the
-        // mutated draft — a post-commit snapshot is exactly what was
-        // stored.
-        return ((await opened.harness.snapshot(SessionMetaDoc, conversation.id, BACKGROUND_CONTEXT)) ?? DEFAULT_SESSION_META);
     });
 }

package/dist/server/routes/events.js

@@ -29,6 +29,7 @@
  * read-side posture.
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { randomUUID } from "node:crypto";
 import { accessOf } from "@sigrun/shared/access";
 import { SessionMetaDoc } from "../session-meta.js";
 /** The heartbeat cadence (the /stream pattern: proxy idle-timeout survival). */
@@ -53,6 +54,17 @@ export function registerEventRoutes(app, ctx) {
         const send = (event) => {
             raw.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
         };
+        // The W3 amendment (spec §7.3): the FIRST frame names this
+        // connection — `event: hello` / `data: {"streamId": "<uuid>"}`,
+        // written BEFORE the hub subscription. Channels send the id as
+        // `X-Sigrun-Stream` on surface/data fetches (the watcher registry's
+        // entry); after a reconnect (a NEW streamId) they re-fetch every
+        // visible surface, which re-registers the entries. The hello is a
+        // CONNECTION-LOCAL frame (channels ignore unknown event types), so
+        // it is deliberately NOT a HostEventWire member — the exhaustive
+        // visibility switch covers only principal-facing hub events.
+        const streamId = randomUUID();
+        send({ type: "hello", streamId }); // SAFETY: hello is a connection-local frame, not a hub event — the wire writer is typed on HostEventWire only because every OTHER frame is one.
         let finished = false;
         const heartbeat = setInterval(() => {
             raw.write(": ping\n\n");
@@ -117,6 +129,30 @@ export function registerEventRoutes(app, ctx) {
                 // principal-facing wire event.
                 case "taskSettled":
                     return undefined;
+                // UI-blocks U3 Task 4 (spec §7.3): delivered to a watching
+                // stream ONLY. The hub copy is the service's internal event
+                // (SurfaceChangedInternal) which carries the resolved stream
+                // list — the service computed it off the PLAIN key at publish
+                // time (the registry can never reverse the wire's hashed `k`).
+                // The DELIVERED frame is the wire shape (the internal field
+                // stripped — the stream list is routing metadata, never wire).
+                case "surface.changed": {
+                    // SAFETY: the hub carries the service's internal event (the
+                    // wire shape plus the publish-time stream list); every
+                    // surface.changed the hub sees comes from bumpRev, which
+                    // always attaches `streams`.
+                    const internal = event;
+                    if (!internal.streams.includes(streamId))
+                        return undefined;
+                    return {
+                        type: "surface.changed",
+                        slug: event.slug,
+                        id: event.id,
+                        k: event.k,
+                        rev: event.rev,
+                        treeRev: event.treeRev,
+                    };
+                }
                 // An unknown member is NEVER delivered — deny by construction,
                 // not by enumerating the leak shapes. The satisfies check keeps
                 // this arm exhaustive: a new HostEventWire member without a
@@ -146,6 +182,9 @@ export function registerEventRoutes(app, ctx) {
             finished = true;
             clearInterval(heartbeat);
             unsubscribe();
+            // The watcher registry's stream-close rule (spec §7.3): every
+            // entry this stream held drops with it.
+            ctx.surfaces.watcherRegistry.dropStream(streamId);
             raw.end();
         };
         // Client disconnect: `response` close (socket termination) — NOT

package/dist/server/routes/ext-assets.js

@@ -0,0 +1,84 @@
+/**
+ * Extension asset routes (UI-blocks U3 Task 3, spec §11.1/§7.2):
+ * `GET /v1/ext/<slug>/assets/<path>` serves files from the package's
+ * declared `sigrun.assets` directory to every signed-in user (assets
+ * are public to signed-in users, §11.1). The Content-Type is sniffed
+ * from the bytes (never the filename) and every response carries
+ * `X-Content-Type-Options: nosniff`.
+ *
+ * Containment: the requested path resolves against the assets dir and
+ * BOTH the dir and the target are `realpath`ed — a `..` segment or a
+ * symlink out of the dir answers 404, indistinguishable from a missing
+ * file. A package with no declared `sigrun.assets` answers 404 for
+ * every asset request.
+ */
+import { open, realpath } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { sniffMime } from "../surfaces/mime.js";
+/** One read's chunk size for the sniff buffer + small files. */
+const READ_CHUNK_BYTES = 1024 * 1024;
+/**
+ * Resolve one requested asset path inside the package's assets dir:
+ * the realpath'd absolute file, or `undefined` when the request escapes
+ * the dir (a `..` segment or a symlink out) or the file is missing.
+ */
+async function resolveContained(assetsDir, path) {
+    let realDir;
+    try {
+        realDir = await realpath(assetsDir);
+    }
+    catch {
+        return undefined; // the declared dir doesn't exist
+    }
+    const candidate = join(realDir, path);
+    let realFile;
+    try {
+        realFile = await realpath(candidate);
+    }
+    catch {
+        return undefined; // missing file (or a dangling symlink)
+    }
+    const rel = relative(realDir, realFile);
+    if (rel === "" || rel.startsWith("..") || rel.includes(`..${sep}`)) {
+        return undefined;
+    }
+    return realFile;
+}
+/** Register the asset route over the shared context's bindings. */
+export function registerExtAssetRoutes(app, ctx) {
+    app.get("/v1/ext/:slug/assets/*", async (request, reply) => {
+        const { slug } = request.params;
+        const path = request.params["*"];
+        const binding = ctx.opened.extensionSurfaces.find((entry) => entry.extension === slug);
+        // Unknown slug, or a package with no declared assets dir: 404.
+        if (binding?.assetsDir === undefined) {
+            return await reply.code(404).send({ error: "asset_not_found" });
+        }
+        const file = await resolveContained(binding.assetsDir, path);
+        if (file === undefined) {
+            return await reply.code(404).send({ error: "asset_not_found" });
+        }
+        const handle = await open(file, "r");
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile()) {
+                return await reply.code(404).send({ error: "asset_not_found" });
+            }
+            const bytes = Buffer.alloc(stat.size);
+            let offset = 0;
+            while (offset < bytes.byteLength) {
+                const { bytesRead } = await handle.read(bytes, offset, Math.min(READ_CHUNK_BYTES, bytes.byteLength - offset), offset);
+                if (bytesRead === 0)
+                    break;
+                offset += bytesRead;
+            }
+            return await reply
+                .header("content-type", sniffMime(new Uint8Array(bytes)))
+                .header("x-content-type-options", "nosniff")
+                .send(bytes);
+        }
+        finally {
+            await handle.close();
+        }
+    });
+}