@sigrun/sigrun 0.1.5 → 0.2.0

package/dist/server/images/ranges.js

@@ -0,0 +1,42 @@
+/**
+ * The refused-address ranges for image-proxy fetching (UI-blocks U7,
+ * spec §11.2 verbatim): loopback, `0.0.0.0/8`, RFC 1918 private,
+ * link-local, CGNAT `100.64.0.0/10`, unique-local `fc00::/7`,
+ * multicast, and the IPv4-mapped IPv6 forms of all of them.
+ *
+ * IPv4-mapped literals (`::ffff:10.0.0.1`) are normalized by
+ * `BlockList.check`, so the IPv4 rules cover every mapped form in
+ * both dotted and full 8-group notation. Anything that is not an IP
+ * literal at all is refused too (fail closed): the fetcher connects
+ * only to literals the vetting understood.
+ */
+import { BlockList, isIP } from "node:net";
+const REFUSED = new BlockList();
+// IPv4
+REFUSED.addSubnet("0.0.0.0", 8, "ipv4");
+REFUSED.addSubnet("127.0.0.0", 8, "ipv4");
+REFUSED.addSubnet("10.0.0.0", 8, "ipv4");
+REFUSED.addSubnet("172.16.0.0", 12, "ipv4");
+REFUSED.addSubnet("192.168.0.0", 16, "ipv4");
+REFUSED.addSubnet("169.254.0.0", 16, "ipv4");
+REFUSED.addSubnet("100.64.0.0", 10, "ipv4");
+REFUSED.addSubnet("224.0.0.0", 4, "ipv4");
+REFUSED.addAddress("255.255.255.255", "ipv4");
+// IPv6
+// (Spec-level gap, known: the deprecated IPv4-compatible form
+// `::127.0.0.1` is NOT refused — only the IPv4-mapped `::ffff:` form
+// normalizes into the IPv4 rules.)
+REFUSED.addSubnet("::", 128, "ipv6");
+REFUSED.addSubnet("::1", 128, "ipv6");
+REFUSED.addSubnet("fc00::", 7, "ipv6");
+REFUSED.addSubnet("fe80::", 10, "ipv6");
+REFUSED.addSubnet("ff00::", 8, "ipv6");
+/** True when `ip` is an address the image proxy must never connect to. */
+export function isRefusedAddress(ip) {
+    const family = isIP(ip);
+    if (family === 4)
+        return REFUSED.check(ip, "ipv4");
+    if (family === 6)
+        return REFUSED.check(ip, "ipv6");
+    return true;
+}

package/dist/server/images/rewrite.js

@@ -0,0 +1,94 @@
+/**
+ * The image-source rewriter (UI-blocks U7 Task 1, spec §11.1/§11.2):
+ * walks a tree or data JSON value and replaces `https://` image sources
+ * with the signer's proxy URL before the value leaves the server:
+ *
+ * - an `image` block's string `src` (literals only — a binding resolves
+ *   client-side against the data, whose own slots are rewritten below);
+ * - a card `image` slot (a string `image` prop), in a tree's item
+ *   template AND in data items (spec §5.5.1: the slot takes a binding
+ *   relative to the item, so the URL usually lives in the data);
+ * - `![alt](https://…)` markdown image links in any string (markdown
+ *   text, card/callout bodies, and the data strings they bind to).
+ *
+ * `asset:` and `data:` sources are untouched (§11.1). The walk is pure:
+ * the input is never mutated, and a branch is rebuilt only when a
+ * descendant changed (copy-on-write, the discipline of
+ * `shared/blocks/ops.ts`); an untouched subtree is returned by
+ * reference.
+ *
+ * Scope note (a spec-reading decision): the whole-string rewrite keys
+ * on the two shapes the block set defines for image sources — the
+ * `image` block's `src` prop and the card `image` prop — plus markdown
+ * image links. A binding that resolves to an https URL stored in data
+ * under any OTHER prop name is not rewritten (the walk cannot trace
+ * bindings); the webui's `img-src 'self' data:` CSP (Task 3) makes such
+ * a miss fail closed rather than load.
+ */
+/** A markdown image link: `![alt](https://…)`. */
+const MARKDOWN_IMAGE = /(!\[[^\]]*\]\()(https:\/\/[^)\s]+)(\))/g;
+/** Whether `s` is an https image source the rewriter replaces. */
+function isHttps(s) {
+    return s.startsWith("https://");
+}
+/**
+ * Rewrite one string's markdown image links; `null` when nothing
+ * matched (so the caller keeps the original reference).
+ */
+function rewriteMarkdown(text, sign) {
+    let changed = false;
+    const out = text.replace(MARKDOWN_IMAGE, (_all, pre, url, post) => {
+        changed = true;
+        return `${pre}${sign(url)}${post}`;
+    });
+    return changed ? out : null;
+}
+/**
+ * Rewrite every https image source in a tree or data value. Pure; see
+ * the module docstring for the three rewrite shapes and the scope note.
+ */
+export function rewriteImages(value, sign) {
+    return rewrite(value, sign);
+}
+/** The structural walk (copy-on-write: `null`-free, returns a value). */
+function rewrite(value, sign) {
+    if (typeof value === "string") {
+        const md = rewriteMarkdown(value, sign);
+        return md === null ? value : md;
+    }
+    if (Array.isArray(value)) {
+        let changed = false;
+        const out = [];
+        for (const entry of value) {
+            const rewritten = rewrite(entry, sign);
+            if (rewritten !== entry)
+                changed = true;
+            out.push(rewritten);
+        }
+        return changed ? out : value;
+    }
+    if (typeof value === "object" && value !== null) {
+        let changed = false;
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            let rewritten;
+            if (typeof entry === "string" &&
+                (key === "src" || key === "image") &&
+                isHttps(entry)) {
+                // The two whole-string shapes: an image block's `src` and a
+                // card's `image` slot. Markdown links inside the string (none
+                // in a bare URL) are covered by the string branch below, so
+                // rewrite directly.
+                rewritten = sign(entry);
+            }
+            else {
+                rewritten = rewrite(entry, sign);
+            }
+            if (rewritten !== entry)
+                changed = true;
+            out[key] = rewritten;
+        }
+        return changed ? out : value;
+    }
+    return value;
+}

package/dist/server/images/sign.js

@@ -0,0 +1,84 @@
+/**
+ * The signing half of the image proxy (UI-blocks U7 Task 1, spec §11.2
+ * verbatim):
+ *
+ * - `s` is HMAC-SHA256 (hex) over the exact bytes `u + "\n" + e`, where
+ *   `u` is the URL string as it appeared in the tree — the server never
+ *   re-parses or re-encodes it between verifying and fetching.
+ * - `e` is an expiry 24 hours after signing (epoch milliseconds).
+ * - The key is 32 random bytes at `<stateDir>/image-proxy.key`, mode
+ *   0600, created at first boot and reused after. Deleting the file
+ *   rotates it: old signatures fail and channels re-fetch the surface,
+ *   which re-signs.
+ * - Signatures are not bound to a user; a copied signed URL works for
+ *   any signed-in user until it expires (spec: that reveals nothing the
+ *   URL didn't already).
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+/** The key file's name under the state dir. */
+export const IMAGE_PROXY_KEY_FILE = "image-proxy.key";
+/** The signature lifetime (spec §11.2): 24 hours. */
+export const SIGNATURE_TTL_MS = 24 * 60 * 60 * 1000;
+/** The proxy path every signed URL is rooted at. */
+const PROXY_PATH = "/v1/image";
+/** Load (or create) the proxy key at `<stateDir>/image-proxy.key`. */
+export async function loadOrCreateKey(stateDir) {
+    const path = join(stateDir, IMAGE_PROXY_KEY_FILE);
+    try {
+        return await readFile(path);
+    }
+    catch (cause) {
+        if (cause.code !== "ENOENT")
+            throw cause;
+    }
+    // First boot: create the key atomically (stage + chmod + rename, the
+    // same discipline as the stores' `writeFileAtomic` — chmod BEFORE the
+    // rename so there is no window at the wrong mode, and a chmod beats
+    // writeFile's `mode` option because umask masks the latter).
+    await mkdir(stateDir, { recursive: true });
+    const key = randomBytes(32);
+    const staged = `${path}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(staged, key, { mode: 0o600 });
+        await chmod(staged, 0o600);
+        await rename(staged, path);
+    }
+    catch (cause) {
+        await rm(staged, { force: true });
+        throw cause;
+    }
+    return key;
+}
+/** Sign one URL at time `now`: `/v1/image?u=…&e=…&s=…`. */
+export function signUrl(key, u, now) {
+    const e = String(now + SIGNATURE_TTL_MS);
+    const s = signature(key, u, e);
+    return `${PROXY_PATH}?u=${encodeURIComponent(u)}&e=${e}&s=${s}`;
+}
+/**
+ * Verify a signed URL's parts at time `now`: the HMAC matches (constant
+ * time) AND `now <= e`. Malformed parts (a non-numeric `e`, a wrong-length
+ * or non-hex `s`) reject instead of throwing.
+ */
+export function verify(key, u, e, s, now) {
+    if (!/^\d+$/.test(e))
+        return false;
+    if (!/^[0-9a-f]+$/.test(s))
+        return false;
+    const expected = signature(key, u, e);
+    // Constant-time over the fixed 64-byte hex digests; the length check
+    // first because timingSafeEqual throws on a length mismatch.
+    if (s.length !== expected.length)
+        return false;
+    if (!timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(s, "utf8"))) {
+        return false;
+    }
+    return now <= Number(e);
+}
+/** The HMAC hex digest over the exact bytes `u + "\n" + e`. */
+function signature(key, u, e) {
+    return createHmac("sha256", key).update(`${u}\n${e}`, "utf8").digest("hex");
+}

package/dist/server/images/sniff.js

@@ -0,0 +1,62 @@
+/**
+ * Content sniffing for image-proxy responses (UI-blocks U7, spec
+ * §11.2): the body must sniff as PNG, JPEG, GIF or WebP — the
+ * `Content-Type` header is never trusted. SVG and AVIF are refused
+ * even when the header says `image/png` (SVG can carry script; AVIF
+ * has no decoder in pi-tui).
+ */
+/**
+ * Sniff `bytes` by magic prefix. Returns `"svg"` / `"avif"` for the
+ * refused-but-recognizable types (so callers can name the reason),
+ * and `undefined` when nothing matches.
+ */
+export function sniffImage(bytes) {
+    if (bytes.length >= 8) {
+        // PNG: 89 50 4E 47 0D 0A 1A 0A
+        if (bytes[0] === 0x89 &&
+            bytes[1] === 0x50 &&
+            bytes[2] === 0x4e &&
+            bytes[3] === 0x47 &&
+            bytes[4] === 0x0d &&
+            bytes[5] === 0x0a &&
+            bytes[6] === 0x1a &&
+            bytes[7] === 0x0a) {
+            return "png";
+        }
+        // GIF: GIF87a / GIF89a
+        if (bytes.subarray(0, 3).toString("latin1") === "GIF" &&
+            (bytes.subarray(3, 6).toString("latin1") === "87a" ||
+                bytes.subarray(3, 6).toString("latin1") === "89a")) {
+            return "gif";
+        }
+    }
+    // JPEG: FF D8 FF
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+        return "jpeg";
+    }
+    // WebP: "RIFF" + len + "WEBP"
+    if (bytes.length >= 12 &&
+        bytes.subarray(0, 4).toString("latin1") === "RIFF" &&
+        bytes.subarray(8, 12).toString("latin1") === "WEBP") {
+        return "webp";
+    }
+    // AVIF/HEIF: "ftyp" box at offset 4; the brand at offset 8 is
+    // avif/avis (or the heic family — refused all the same, but named
+    // avif only for actual avif brands so the reason is honest).
+    if (bytes.length >= 12 && bytes.subarray(4, 8).toString("latin1") === "ftyp") {
+        const brand = bytes.subarray(8, 12).toString("latin1").toLowerCase();
+        if (brand === "avif" || brand === "avis")
+            return "avif";
+    }
+    // SVG: an XML prolog or an `<svg` opening anywhere in the first
+    // 512 bytes (handles BOM, XML decl, comments, and DOCTYPE).
+    const head = bytes.subarray(0, 512).toString("utf8");
+    if (/^\uFEFF?\s*(<\?xml[\s\S]*?\?>\s*)?(<!--[\s\S]*?-->\s*)*(!DOCTYPE[\s\S]*?\]\s*)?<svg/i.test(head)) {
+        return "svg";
+    }
+    return undefined;
+}
+/** True only for the four accepted types (the refused ones reject). */
+export function isAcceptedImageType(type) {
+    return type === "png" || type === "jpeg" || type === "gif" || type === "webp";
+}

package/dist/server/index.js

@@ -31,6 +31,8 @@
  * enumeration; the storage scan is authoritative.
  */
 import Fastify from "fastify";
+import { join } from "node:path";
+import { LoginFlows } from "./login/flows.js";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { buildCommandCatalog, SLASH_COMMANDS } from "./commands.js";
 import { effectiveMethods } from "../config.js";
@@ -41,7 +43,9 @@ import { storeAgentChange } from "./helpers.js";
 import { registerCoreOwnershipParticipant } from "./ownership.js";
 import { createHostBridge } from "./host-bridge.js";
 import { registerJobsOwnershipParticipant } from "../jobs/transfer.js";
+import { registerAdminRoutes } from "./routes/admin.js";
 import { registerAuthRoutes } from "./routes/auth.js";
+import { registerLoginRoutes } from "./routes/login.js";
 import { registerConversationRoutes } from "./routes/conversations.js";
 import { registerEventRoutes } from "./routes/events.js";
 import { registerExtensionRoutes as registerExtensionSettingsRoutes } from "./routes/extensions.js";
@@ -50,17 +54,26 @@ import { registerExtAssetRoutes } from "./routes/ext-assets.js";
 import { registerFileRoutes } from "./routes/files.js";
 import { registerJobRoutes } from "./routes/jobs.js";
 import { registerInteractionRoutes } from "./routes/interactions.js";
+import { registerMeRoutes } from "./routes/me.js";
 import { registerMetaRoutes } from "./routes/meta.js";
 import { registerMetricsRoutes } from "./routes/metrics.js";
 import { registerOnboardingRoutes } from "./routes/onboarding.js";
 import { registerProbeRoutes } from "./routes/probes.js";
 import { registerProviderRoutes } from "./routes/providers.js";
 import { registerSettingsRoutes } from "./routes/settings.js";
+import { registerSettingsSectionsRoutes } from "./routes/settings-sections.js";
 import { registerStreamRoutes } from "./routes/stream.js";
 import { startNotifications } from "./notifications.js";
+import { selfPackageRoot } from "../harness/packages.js";
 import { registerSubmissionRoutes } from "./routes/submissions.js";
 import { registerSurfaceRoutes } from "./routes/surfaces.js";
+import { subscribeChatSurfaceChanged } from "../harness/blocks/tools.js";
+import { loadOrCreateKey, signUrl } from "./images/sign.js";
+import { ImageCache } from "./images/cache.js";
+import { registerImageRoutes } from "./routes/images.js";
 import { SurfaceService } from "./surfaces/service.js";
+import { settingsSurfaceFor } from "./surfaces/settings-surfaces.js";
+import { CORE_SETTINGS_SECTIONS } from "../settings/core-sections.js";
 import { registerUserRoutes } from "./routes/users.js";
 import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
 /**
@@ -79,8 +92,9 @@ import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
  * checks, the public surface, the env service token, the setup gate,
  * then the configured methods — the resolved principal stamps
  * `SessionMeta.owner` at create/fork/import.
- * @param options.listenHost the host the server will bind (default
- * `"0.0.0.0"`); the pipeline's Host check and the default method list
+ * @param options.listenHost the host the server will bind (fallback
+ * `"0.0.0.0"` when omitted; `serve()` passes the dual-stack `::`);
+ * the pipeline's Host check and the default method list
  * (`effectiveMethods`) both derive from it.
  * @param contributedBundles the extension-contributed webui-bundle registry
  * (build-and-webui Task 6 threads it here from boot; the serve-time
@@ -93,7 +107,17 @@ import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
  * env-less boot).
  */
 export async function createServer(opened, config, contributedBundles = [], options) {
-    const app = Fastify({ logger: false });
+    const app = Fastify({
+        logger: false,
+        // U7 Task 3: the image route's GET `src=data:` form carries up to
+        // 192 KiB of base64 in the query string, which counts toward
+        // Node's 16 KiB default header cap and would be 431-rejected at
+        // the HTTP layer before the route's own §11.1 413 could answer.
+        // 256 KiB admits the cap-sized URL; the route enforces the real
+        // limit (192 KiB) itself. The POST form (the body path) stays the
+        // recommended shape for long data URLs.
+        http: { maxHeaderSize: 256 * 1024 },
+    });
     const listenHost = options?.listenHost ?? "0.0.0.0";
     const env = options?.env ?? {};
     // The one body-limit error shape (spec §6.2, W2): Fastify's
@@ -162,13 +186,38 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // effective method list), and the boot env (the settings routes'
     // `effective` block reads it).
     const sse = new SseRegistry();
+    // The chat-surface seam's unsubscribe (filled in just below, after
+    // the events hub exists to publish onto; never reassigned after).
+    let unsubscribeChatSurfaceChanged = () => { };
     // Decorated for the shutdown path (serve.ts): fastify's own drain waits
     // on in-flight requests, so the SSE registry must be endable from the
     // OUTSIDE before app.close() — a decoration is the typed, discoverable
     // way to hand that handle up without widening ServerContext's consumers.
     app.decorate("sse", sse);
+    // The image-proxy signer (U7 Task 1, spec §11.2): the key is loaded
+    // (created at first boot) from the state dir — deleting the file
+    // rotates it — and every surface tree/data answer rewrites https
+    // image sources through it at serve time.
+    const imageKey = await loadOrCreateKey(config.stateDir);
+    const imageSign = (u) => signUrl(imageKey, u, Date.now());
+    // The proxy cache + fetch deps (U7 Task 3, spec §11.2): the on-disk
+    // LRU under `<cacheDir>/images/`; the deps are the real resolver +
+    // clock unless a test injects its own.
+    const imageCache = new ImageCache(config.cacheDir);
+    const imageDeps = {
+        resolve: async (host) => {
+            const { lookup } = await import("node:dns/promises");
+            const addresses = await lookup(host, { all: true, verbatim: true });
+            return addresses.map((entry) => entry.address);
+        },
+        now: Date.now,
+        ...options?.imageFetch,
+    };
     const surfacesService = new SurfaceService(opened.extensionSurfaces, {
         maxUploadBytes: config.maxUploadBytes,
+        // Signs https image URLs into expiring proxy URLs (U7 Task 1,
+        // spec §11.2) on every tree/data response.
+        imageSign,
         // Task 4: bumpRev (actions AND the host seam's changed()) fans the
         // surface.changed event out to the hub; the events route's
         // visibility case delivers it to watching streams only.
@@ -180,21 +229,90 @@ export async function createServer(opened, config, contributedBundles = [], opti
             opened.events.publish(event);
         },
     });
+    // The settings sections (UI-blocks U4 Task 3, spec §13.3): each
+    // declared section adapts to a settings-placement surface served under
+    // the declaring extension's own `/v1/ext/<slug>/surfaces/` mount. The
+    // save handlers close over the service (the optimistic-concurrency
+    // rev read), so the adaptation attaches AFTER the service exists.
+    surfacesService.attachSettingsSurfaces(opened.extensionSettingsSections.map((binding) => ({
+        extension: binding.extension,
+        defs: binding.defs.map((section) => settingsSurfaceFor(binding.extension, section, {
+            stores: opened.extensionStores,
+            publishSettingsChanged: opened.publishSettingsChanged,
+            service: surfacesService,
+        })),
+    })));
+    // The core settings sections (U4 Task 4, spec §13.4): the same
+    // renderer under the reserved `core` slug — core and extensions run
+    // ONE code path. The core saves write the core SettingsStore (dotted
+    // names land at their nested paths, apply-typed), not the extension
+    // settings dir.
+    surfacesService.attachSettingsSurfaces([
+        {
+            extension: "core",
+            defs: CORE_SETTINGS_SECTIONS.map((section) => settingsSurfaceFor("core", section, {
+                stores: opened.extensionStores,
+                publishSettingsChanged: opened.publishSettingsChanged,
+                service: surfacesService,
+                core: {
+                    settings: opened.settings,
+                    bootSnapshot: opened.settingsBootSnapshot,
+                    env,
+                    // The Tools section's default-tools options (the boot
+                    // registry's tool names, deduped — the roster the
+                    // checkbox list edits against).
+                    toolRoster: [
+                        ...new Set(opened.registry
+                            .snapshot()
+                            .tools()
+                            .map((entry) => entry.tool.name)),
+                    ],
+                },
+            })),
+        },
+    ]);
     app.decorate("surfaces", surfacesService);
+    // The chat-block change seam (UI-blocks U5 Task 2, spec §8.2):
+    // show_blocks/update_blocks AND the user-edit route publish
+    // `surface.changed` through the Task-1 in-process seam; binding it
+    // here forwards every event onto the hub, where the events route's
+    // exhaustive switch gives the CHAT shape the conversation-scoped
+    // delivery path (SessionMeta re-snapshot + accessOf per event).
+    unsubscribeChatSurfaceChanged = subscribeChatSurfaceChanged((event) => {
+        // SAFETY: the chat event IS the wire union's second surface.changed
+        // member (same declaration, re-exported through the seam type) —
+        // the publish types on the union the events switch discriminates.
+        opened.events.publish(event);
+    });
+    const roots = opened.extensionStores.roots;
     const ctx = {
         opened,
         config,
+        managedPaths: {
+            roots,
+            storagePath: config.storagePath,
+            coreRoot: selfPackageRoot() ?? process.cwd(),
+            userAreas: (user) => join(roots.dataDir, "users", user),
+        },
         rootId,
         webuiBundle,
         commandCatalog,
         listenHost,
         methods,
         env,
+        // U4 §13.2: the harness's settings-changed fan-out (hub publish +
+        // extension onSettingsChanged + the scheduler re-arm).
+        publishSettingsChanged: opened.publishSettingsChanged,
         watchersByConversation: new Map(),
         surfaces: surfacesService,
         sse,
+        imageProxy: { cache: imageCache, deps: imageDeps, key: imageKey },
         ...(options?.gateway === undefined ? {} : { gateway: options.gateway }),
+        ...(options?.onRestart === undefined
+            ? {}
+            : { requestRestart: options.onRestart }),
     };
+    app.decorate("sigrunContext", ctx);
     // The host bridge (W5 Task 5, spec §9.5/§9.7): ONE bridge over this
     // server's context, bound onto every seam host — the extension-facing
     // conversations/users/access/identity surface then runs the SAME
@@ -202,7 +320,11 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // implementation). Bound here, after the context exists and before any
     // route or extension code can serve a request; calls issued earlier
     // (a factory body) have been waiting on exactly this assignment.
-    opened.bindHostBridge(createHostBridge(ctx));
+    const hostBridge = createHostBridge(ctx);
+    opened.bindHostBridge(hostBridge);
+    // Decorated like `sse`/`surfaces`: the bridge is the server-owned
+    // handle tests (and only tests) reach the W5 bridge path through.
+    app.decorate("hostBridge", hostBridge);
     // The notifications surface (W5 Task 6, spec §9.6): one hub
     // subscription turning host events into per-recipient
     // NotificationEvents for every collected notifier contribution,
@@ -217,10 +339,16 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // `request.principal` before any route runs.
     registerAuthPipeline(app, ctx);
     registerAuthRoutes(app, ctx);
+    registerLoginRoutes(app, ctx, {
+        ...(options?.loginResolver === undefined ? {} : { resolver: options.loginResolver }),
+        ...(options?.loginNow === undefined ? {} : { flows: new LoginFlows(options.loginNow) }),
+    });
     registerOnboardingRoutes(app, ctx);
     registerUserRoutes(app, ctx);
+    registerMeRoutes(app, ctx);
     registerProbeRoutes(app, ctx);
     registerMetaRoutes(app, ctx);
+    registerAdminRoutes(app, ctx);
     registerMetricsRoutes(app, ctx);
     registerConversationRoutes(app, ctx);
     registerStreamRoutes(app, ctx);
@@ -230,6 +358,7 @@ export async function createServer(opened, config, contributedBundles = [], opti
     registerFileRoutes(app, ctx);
     registerProviderRoutes(app, ctx);
     registerSettingsRoutes(app, ctx);
+    registerSettingsSectionsRoutes(app, ctx);
     registerExtensionSettingsRoutes(app, ctx);
     // The extension HTTP routes (W5 Task 2, spec §9.2): every collected
     // `routes` contribution mounted at `/v1/ext/<slug>/<path>` behind the
@@ -244,6 +373,10 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // `/v1/ext/<slug>/assets/*` serves the package's declared
     // `sigrun.assets` dir, realpath-contained, sniffed content types.
     registerExtAssetRoutes(app, ctx);
+    // The image-proxy routes (UI-blocks U7 Task 3, spec §11.2): signed
+    // remote fetches through the on-disk LRU, the `src=` asset/data form,
+    // and the POST long-data-URL form.
+    registerImageRoutes(app, ctx);
     // The jobs routes (W4 Task 4, spec §8.4): the access-scoped CRUD +
     // run-now + history surface over `OpenedHarness.jobs` (Task 3's
     // service). Hidden-is-404 per §5.9; `file:`/`ext:` ids are immutable
@@ -263,5 +396,12 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // next boot's reconciliation warns (the declared owner no longer
     // exists — the job runs ownerless until the file is edited).
     registerJobsOwnershipParticipant(ctx);
+    // The chat-surface seam's teardown: the subscription lives for the
+    // app's lifetime (the module seam is process-global), but the
+    // unsubscribe is kept so a future embedder (a second createServer
+    // over one harness in tests) can detach a bound server cleanly.
+    app.addHook("onClose", async () => {
+        unsubscribeChatSurfaceChanged();
+    });
     return app;
 }

package/dist/server/login/flows.js

@@ -0,0 +1,126 @@
+import { randomBytes } from "node:crypto";
+const FLOW_TTL_MS = 600_000;
+/** Generous per-server ceiling; oldest entries are evicted under pressure. */
+export const MAX_ACTIVE_LOGIN_FLOWS = 10_000;
+/** One short-lived random browser/state credential. */
+function key() {
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * In-memory, per-server login flows. `take` is atomic and single-use: a
+ * replay, a different browser key, or an expired entry returns undefined.
+ */
+export class LoginFlows {
+    #now;
+    #flows = new Map();
+    #consumed = new Map();
+    #pending = new Map();
+    constructor(now = Date.now) {
+        this.#now = now;
+    }
+    get size() {
+        return this.#flows.size;
+    }
+    get consumedSize() {
+        return this.#consumed.size;
+    }
+    start(provider, opts) {
+        this.#prune();
+        const state = key();
+        const browserKey = key();
+        const flow = {
+            provider,
+            state,
+            callbackUrl: "",
+            data: {},
+            returnTo: opts.returnTo,
+            ...(opts.link === undefined ? {} : { link: opts.link }),
+            browserKey,
+            expiresAt: this.#now() + FLOW_TTL_MS,
+        };
+        this.#flows.set(state, flow);
+        this.#evictOldest(this.#flows);
+        return flow;
+    }
+    /** Save provider scratch data and the callback URL after `begin` succeeds. */
+    save(state, flow) {
+        const stored = this.#flows.get(state);
+        if (stored === undefined)
+            return;
+        stored.callbackUrl = flow.callbackUrl;
+        stored.data = flow.data;
+    }
+    take(state, browserKey) {
+        this.#prune();
+        const flow = this.#flows.get(state);
+        if (flow === undefined || flow.browserKey !== browserKey)
+            return undefined;
+        this.#flows.delete(state);
+        this.#consumed.set(state, {
+            browserKey,
+            expiresAt: flow.expiresAt,
+        });
+        this.#evictOldest(this.#consumed);
+        return flow;
+    }
+    /** Park a verified proof for ten more minutes under a separate, single-use key. */
+    park(flow, result) {
+        this.#prune();
+        const pendingKey = key();
+        const pending = {
+            provider: flow.provider,
+            result,
+            returnTo: flow.returnTo,
+            expiresAt: this.#now() + FLOW_TTL_MS,
+        };
+        this.#pending.set(pendingKey, pending);
+        this.#evictOldest(this.#pending);
+        return { key: pendingKey, pending };
+    }
+    /** Put a pending proof back after a rejected code, preserving its original expiry. */
+    restorePending(pendingKey, pending) {
+        this.#prune();
+        this.#pending.set(pendingKey, pending);
+        this.#evictOldest(this.#pending);
+    }
+    /** Consume a code-resume key atomically; replay/expiry/restart all fail closed. */
+    takePending(pendingKey) {
+        this.#prune();
+        const pending = this.#pending.get(pendingKey);
+        if (pending !== undefined)
+            this.#pending.delete(pendingKey);
+        return pending;
+    }
+    /** Explain a failed take without exposing flow data (replay vs expired/unknown). */
+    failure(state, browserKey) {
+        this.#prune();
+        if (this.#flows.has(state))
+            return "invalid_state";
+        return this.#consumed.get(state)?.browserKey === browserKey
+            ? "invalid_state"
+            : "login_expired";
+    }
+    #evictOldest(entries) {
+        while (entries.size > MAX_ACTIVE_LOGIN_FLOWS) {
+            const oldest = entries.keys().next();
+            if (oldest.done === true)
+                break;
+            entries.delete(oldest.value);
+        }
+    }
+    #prune() {
+        const now = this.#now();
+        for (const [state, flow] of this.#flows) {
+            if (flow.expiresAt <= now)
+                this.#flows.delete(state);
+        }
+        for (const [state, consumed] of this.#consumed) {
+            if (consumed.expiresAt <= now)
+                this.#consumed.delete(state);
+        }
+        for (const [pendingKey, pending] of this.#pending) {
+            if (pending.expiresAt <= now)
+                this.#pending.delete(pendingKey);
+        }
+    }
+}