@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/sandbox/worker.js

@@ -0,0 +1,281 @@
+/** Child entry: serve pi-durable's own environment over stdin/stdout. */
+import { BACKGROUND_CONTEXT, withAbortSignal } from "@earendil-works/chord/context";
+import { NodeExecutionEnv } from "@earendil-works/pi-durable/env/node";
+import { createCommandObserver } from "./command-observer.js";
+import { decodeValue, encodeMessage, encodeValue, errorReply, wireError, } from "./protocol.js";
+const environments = new Map();
+/** Exec requests that have not reached pi-durable's synchronous spawn yet. */
+const pendingSpawns = new Map();
+/** One ownership observer per environment, shared by all its execs. */
+const commandObservers = new Map();
+const handles = new Map();
+const active = new Map();
+let nextHandle = 1;
+let buffer = "";
+function environment(cwd) {
+    let env = environments.get(cwd);
+    if (env === undefined) {
+        env = new NodeExecutionEnv({ cwd });
+        observeCommands(env);
+        environments.set(cwd, env);
+    }
+    return env;
+}
+/**
+ * Install ONE permanent observer per environment. This deliberately depends
+ * on pi-durable 1.3.0's PRIVATE, UNDOCUMENTED activeChildPids field because
+ * ExecutionEnv exposes no spawn notification. An upgrade that removes or
+ * changes that field must update this observer; fail loudly rather than
+ * silently losing crash cleanup.
+ */
+function observeCommands(env) {
+    // SAFETY: this is the intentional private-field dependency described above.
+    const registry = env.activeChildPids;
+    if (!(registry instanceof Set)) {
+        throw new Error("pi-durable activeChildPids is unavailable; sandbox command cleanup cannot be tracked");
+    }
+    commandObservers.set(env, createCommandObserver({
+        registry,
+        pending: () => pendingSpawns.get(env) ?? new Set(),
+        active: () => new Set(active.keys()),
+        emit: ({ id, pid, phase }) => write({ id, event: "command", pid, phase }),
+    }));
+}
+function write(message) {
+    // SAFETY: skipped is the exact ShellOutputSkip shape emitted by pi-durable;
+    // JsonValue is only the wider transport representation accepted by the encoder.
+    process.stdout.write(encodeMessage(message));
+}
+function argsOf(request) {
+    return request.args.map((arg) => decodeValue(arg));
+}
+function handleId(value) {
+    const id = typeof value === "object" && value !== null && "$handle" in value
+        ? value.$handle
+        : value;
+    if (typeof id !== "number" || !handles.has(id))
+        throw new Error("worker handle is closed");
+    return id;
+}
+function openHandle(handle) {
+    const id = nextHandle++;
+    handles.set(id, handle);
+    return { $handle: id };
+}
+async function handleCall(request, args) {
+    const id = handleId(args[0]);
+    const handle = handles.get(id);
+    const method = request.op.slice("handle.".length);
+    if (method === "close") {
+        handles.delete(id);
+        await handle.value.close(BACKGROUND_CONTEXT);
+        return null;
+    }
+    if (handle.kind === "text" && method === "readLine") {
+        return handle.value.readLine(BACKGROUND_CONTEXT);
+    }
+    if (handle.kind === "binary" && method === "info") {
+        return handle.value.info(BACKGROUND_CONTEXT);
+    }
+    if (handle.kind === "binary" && method === "read") {
+        return handle.value.read(args[1], args[2], BACKGROUND_CONTEXT);
+    }
+    if (handle.kind === "binary" && method === "scanLines") {
+        return handle.value.scanLines(args[1], BACKGROUND_CONTEXT);
+    }
+    if (handle.kind === "dir" && method === "next") {
+        return handle.value.next(args[1], BACKGROUND_CONTEXT);
+    }
+    throw new TypeError(`unsupported handle operation ${request.op}`);
+}
+async function dispatch(request) {
+    const args = argsOf(request);
+    if (request.op.startsWith("handle."))
+        return handleCall(request, args);
+    if (request.op === "hello") {
+        return { capabilities: { listFiles: "listFiles" in NodeExecutionEnv.prototype } };
+    }
+    if (request.op === "pid")
+        return process.pid;
+    const cwd = args.at(-1);
+    if (typeof cwd !== "string")
+        throw new TypeError(`${request.op} requires cwd`);
+    const env = environment(cwd);
+    switch (request.op) {
+        case "absolutePath": return env.absolutePath(args[0], BACKGROUND_CONTEXT);
+        case "joinPath": return env.joinPath(args[0], BACKGROUND_CONTEXT);
+        case "readTextFile": return env.readTextFile(args[0], BACKGROUND_CONTEXT);
+        case "openTextLineReader": {
+            const result = await env.openTextLineReader(args[0], BACKGROUND_CONTEXT);
+            return result.ok ? { ok: true, value: openHandle({ kind: "text", value: result.value }) } : result;
+        }
+        case "readTextLines": return env.readTextLines(args[0], args[1], BACKGROUND_CONTEXT);
+        case "readBinaryFile": return env.readBinaryFile(args[0], BACKGROUND_CONTEXT);
+        case "openBinaryReader": {
+            const result = await env.openBinaryReader(args[0], args[1], BACKGROUND_CONTEXT);
+            return result.ok ? { ok: true, value: openHandle({ kind: "binary", value: result.value }) } : result;
+        }
+        case "writeFile": return env.writeFile(args[0], args[1], BACKGROUND_CONTEXT);
+        case "appendFile": return env.appendFile(args[0], args[1], BACKGROUND_CONTEXT);
+        case "truncateFile": return env.truncateFile(args[0], args[1], BACKGROUND_CONTEXT);
+        case "flushFile": return env.flushFile(args[0], BACKGROUND_CONTEXT);
+        case "renameFile": return env.renameFile(args[0], args[1], BACKGROUND_CONTEXT);
+        case "fileInfo": return env.fileInfo(args[0], BACKGROUND_CONTEXT);
+        case "listDir": return env.listDir(args[0], BACKGROUND_CONTEXT);
+        case "listFiles": {
+            // NodeExecutionEnv gained this optional member after 1.3.0; the
+            // structural view keeps this worker compatible with both shapes.
+            const listing = env;
+            if (listing.listFiles === undefined)
+                throw new Error("listFiles is not supported");
+            return listing.listFiles(args[0], args[1], BACKGROUND_CONTEXT);
+        }
+        case "openDirReader": {
+            const result = await env.openDirReader(args[0], BACKGROUND_CONTEXT);
+            return result.ok ? { ok: true, value: openHandle({ kind: "dir", value: result.value }) } : result;
+        }
+        case "watch": {
+            const result = await env.watch(args[0], (change) => write({ id: request.id, event: "watch", change: encodeValue("error" in change ? { error: wireError(change.error) } : change) }), BACKGROUND_CONTEXT);
+            return result.ok
+                ? { ok: true, value: { handle: openHandle({ kind: "watch", value: result.value }), mode: result.value.mode } }
+                : result;
+        }
+        case "canonicalPath": return env.canonicalPath(args[0], BACKGROUND_CONTEXT);
+        case "exists": return env.exists(args[0], BACKGROUND_CONTEXT);
+        case "createDir": return env.createDir(args[0], args[1], BACKGROUND_CONTEXT);
+        case "remove": return env.remove(args[0], args[1], BACKGROUND_CONTEXT);
+        case "createTempDir": return env.createTempDir(args[0], BACKGROUND_CONTEXT);
+        case "createTempFile": return env.createTempFile(args[0], BACKGROUND_CONTEXT);
+        default: throw new TypeError(`unknown sandbox operation ${request.op}`);
+    }
+}
+/** Both exec paths share this attribution; its finally emits no pid event. */
+async function runWithSpawnAttribution(env, requestId, run) {
+    let pending = pendingSpawns.get(env);
+    if (pending === undefined) {
+        pending = new Set();
+        pendingSpawns.set(env, pending);
+    }
+    pending.add(requestId);
+    try {
+        return await run();
+    }
+    finally {
+        // processRequest's settlement sweep owns end events, not this finally.
+        pending.delete(requestId);
+    }
+}
+async function execute(request) {
+    const args = argsOf(request);
+    const command = args[0];
+    const supplied = (args[1] ?? {});
+    const options = {
+        ...supplied,
+        // The worker's process.env is the already-scrubbed per-user allowlist,
+        // so inheriting it is the point. The caller's env remains the override.
+        onOutput: (text, _context, info) => {
+            write({ id: request.id, event: "output", stream: info.stream, text, ...(info.skipped === undefined ? {} : { skipped: encodeValue(info.skipped) }) });
+        },
+    };
+    const cwd = args[2];
+    if (typeof cwd !== "string")
+        throw new TypeError("exec requires cwd");
+    const env = environment(cwd);
+    const result = await runWithSpawnAttribution(env, request.id, () => env.exec(command, options, active.get(request.id) === undefined ? BACKGROUND_CONTEXT : withAbortSignal(active.get(request.id).signal, BACKGROUND_CONTEXT)));
+    write(result.ok ? { id: request.id, ok: true, value: encodeValue(result.value) } : errorReply(request.id, result.error, "exec"));
+}
+async function dispatchResult(request, controller) {
+    const [op, rawArgs, cwd] = request.args;
+    if (typeof op !== "string" || !Array.isArray(rawArgs) || typeof cwd !== "string") {
+        throw new TypeError("result requires op, args and cwd");
+    }
+    if (op === "exec") {
+        const args = rawArgs.map((arg) => decodeValue(arg));
+        const supplied = (args[1] ?? {});
+        const options = {
+            ...supplied,
+            onOutput: (text, _context, info) => {
+                write({ id: request.id, event: "output", stream: info.stream, text, ...(info.skipped === undefined ? {} : { skipped: encodeValue(info.skipped) }) });
+            },
+        };
+        const env = environment(cwd);
+        return runWithSpawnAttribution(env, request.id, () => env.exec(args[0], options, withAbortSignal(controller.signal, BACKGROUND_CONTEXT)));
+    }
+    return dispatch({ id: request.id, op, args: [...rawArgs, cwd] });
+}
+function operationResultValue(result, fallbackKind) {
+    if (typeof result === "object" && result !== null && "ok" in result && typeof result.ok === "boolean") {
+        if (result.ok)
+            return result;
+        if ("error" in result)
+            return { ok: false, error: wireError(result.error, fallbackKind) };
+    }
+    if (result === undefined)
+        return null;
+    if (typeof result === "string" || typeof result === "number" || typeof result === "boolean" || typeof result === "object")
+        return result;
+    throw new TypeError("unsupported operation result");
+}
+async function processRequest(request) {
+    if (request.id === 0 && request.op === "abort") {
+        const target = request.args[0];
+        if (typeof target === "number")
+            active.get(target)?.abort();
+        return;
+    }
+    const controller = new AbortController();
+    active.set(request.id, controller);
+    try {
+        if (request.op === "result") {
+            const forwarded = { id: request.id, op: "result.dispatch", args: request.args };
+            const result = await dispatchResult(forwarded, controller);
+            write({ id: request.id, ok: true, value: encodeValue(operationResultValue(result, forwarded.args[0] === "exec" ? "exec" : "file")) });
+            return;
+        }
+        if (request.op === "exec") {
+            await execute(request);
+            return;
+        }
+        const result = await dispatch(request);
+        write({ id: request.id, ok: true, value: encodeValue(operationResultValue(result, request.op === "exec" ? "exec" : "file")) });
+    }
+    catch (error) {
+        write(errorReply(request.id, error, request.op === "exec" ? "exec" : "file"));
+    }
+    finally {
+        active.delete(request.id);
+        // pi-durable removes a pid BEFORE the exec promise resolves. The
+        // registry hook therefore sees the request still active; this is the
+        // settlement boundary that forgets ordinary pids and emits their end.
+        for (const observer of commandObservers.values())
+            observer.settleRequest(request.id);
+    }
+}
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+    buffer += chunk;
+    for (;;) {
+        const newline = buffer.indexOf("\n");
+        if (newline < 0)
+            break;
+        const line = buffer.slice(0, newline);
+        buffer = buffer.slice(newline + 1);
+        if (line.trim() === "")
+            continue;
+        try {
+            void processRequest(JSON.parse(line));
+        }
+        catch (error) {
+            process.stderr.write(`sandbox worker request error: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+    }
+});
+process.stdin.on("end", () => {
+    for (const controller of active.values())
+        controller.abort();
+    for (const env of environments.values())
+        void env.cleanup(BACKGROUND_CONTEXT);
+    for (const handle of handles.values())
+        void handle.value.close(BACKGROUND_CONTEXT);
+    process.exit(0);
+});

package/dist/serve.js

@@ -32,10 +32,27 @@ import { startGateway } from "./server/gateway.js";
 import { SIGRUN_VERSION } from "./server/schema-fixture.js";
 import { createServer } from "./server/index.js";
 import { createShutdown } from "./server/shutdown.js";
+/**
+ * The deploy entry's default listen host: the IPv6 wildcard, which is a
+ * DUAL-STACK listener on Linux (`net.ipv6.bindv6only` is 0) — it accepts
+ * the pod's IPv4 connections AND its IPv6 ones.
+ *
+ * `0.0.0.0` is the WRONG default for a dual-stack cluster: it is a
+ * v4-only socket, so it refuses every IPv6 connection, while a Service
+ * whose `ipFamilies` is `["IPv6"]` advertises only the pod's IPv6
+ * address in its EndpointSlice. The gateway dials that address, gets
+ * connection-refused, and answers the browser with "upstream connect
+ * error or disconnect/reset before headers. reset reason: remote
+ * connection failure". (This cluster's ClusterIP range is
+ * `fd00:beef:cafe::/…`, so a chart-default Service is IPv6-only — the
+ * mismatch is the DEFAULT shape, not an edge case.)
+ */
+export const DEFAULT_LISTEN_HOST = "::";
 /**
  * Boot the harness + server composition and listen on
- * `options.host ?? "0.0.0.0"` + `<port>` (the default is the container's
- * address — loopback-only would be unreachable behind the Service;
+ * `options.host ?? "::"` + `<port>` (the default is the container's
+ * dual-stack wildcard — loopback-only would be unreachable behind the
+ * Service, and a v4-only bind is unreachable on an IPv6 endpoint;
  * `loadConfig` refuses port 0, so a real port is always bound).
  * The CLI's `run` additionally launches the TUI against the loopback URL
  * on {@link BootedServer.port}.
@@ -89,22 +106,71 @@ export async function serve(env, options) {
     // 404s forever (the directory was never created).
     const { mkdir } = await import("node:fs/promises");
     await mkdir(config.workspace.path, { recursive: true });
-    const opened = await openHarness(config, { extensionEntries: extensionResolutions });
+    // The serve env threads into boot so boot-time env reads (store
+    // roots, the provider collector, the U4 scheduler cadence resolution
+    // in `resolveRefreshMinutes`) see the SAME env `loadConfig` just
+    // resolved — a serve-harness env override must win over process.env
+    // here exactly like it does in the config.
+    const opened = await openHarness(config, {
+        extensionEntries: extensionResolutions,
+        env,
+        listenHost: options?.host ?? "0.0.0.0",
+    });
     // The gateway handle (gateway C2) exists BEFORE the server: the meta
     // route reaches it through ServerContext, so the engine's health is
     // reportable from the first request. The ENGINE STARTS after listen
     // (below) — an engine supervising chat transports starts once the
     // server it delivers through is up.
     const gateway = startGateway(opened);
+    // The booted handle the restart callback defers to: `createServer`
+    // needs the callback BEFORE `serve` can build the BootedServer (the
+    // shutdown composition lives at the bottom of this function), so the
+    // handle is promised here and RESOLVED at return time; `onRestart`
+    // awaits the resolution. Between `app.listen` + `gateway.started` and
+    // the assignment below a supervised admin POST can already land (202
+    // answered, callback deferred) — awaiting the promise holds that
+    // window open instead of dropping the restart on the floor (a `?.`
+    // on an unassigned ref made 202-with-no-restart reachable).
+    let resolveBooted;
+    const bootedReady = new Promise((resolve) => {
+        resolveBooted = resolve;
+    });
     // The contributed-bundle registry (build-and-webui Task 6): boot folded
     // the loader's extension contributions into the name-keyed registry;
     // the server's serve-time NAME-selector resolution reads it here.
     const app = await createServer(opened, config, opened.webuiBundles, {
-        listenHost: options?.host ?? "0.0.0.0",
+        listenHost: options?.host ?? DEFAULT_LISTEN_HOST,
         env,
         gateway,
+        // U4 Task 2 (spec §13.3): the admin restart route's callback runs
+        // EXACTLY the SIGTERM path (the ordered shutdown), then exits 0 —
+        // the supervisor (chart/compose, `server.supervised`) brings the
+        // process back. `shutdownOnce` is the same re-entry guard the
+        // signal path uses; `stopping` is assigned by closure below, so
+        // the callback defers to it (the route fires post-listen).
+        onRestart: () => bootedReady
+            .then(async (handle) => {
+            // Force-exit lever (the review's finding 4): the ordered
+            // shutdown's drain is unbounded — a wedged close would be
+            // an unrecoverable outage (the supervisor never sees the
+            // process die, so it never restarts it). The watchdog is
+            // unref'd: the normal path (shutdown settles, exit below)
+            // is unaffected.
+            const watchdog = setTimeout(() => {
+                console.error("sigrun: restart shutdown exceeded 30s; forcing exit");
+                process.exit(1);
+            }, 30_000);
+            watchdog.unref();
+            await handle.shutdownOnce();
+            clearTimeout(watchdog);
+            process.exit(0);
+        })
+            .catch((error) => {
+            console.error("sigrun restart error:", error);
+            process.exit(1);
+        }),
     });
-    const host = options?.host ?? "0.0.0.0";
+    const host = options?.host ?? DEFAULT_LISTEN_HOST;
     await app.listen({ port: config.port, host });
     // The engine starts with the listener live (gateway C2's lifecycle:
     // start after listen — a failed start latches degraded inside the
@@ -115,7 +181,10 @@ export async function serve(env, options) {
     // Machine-greppable: the deploy-entry test waits for this line, and an
     // operator reading pod logs sees the bound port without guessing. The
     // version rides the same line (what an operator quotes in a bug report).
-    console.log(`sigrun v${SIGRUN_VERSION} listening on http://${host}:${config.port}`);
+    // An IPv6 host is bracketed — the URL form (`http://[::]:3000`), not the
+    // ambiguous `http://:::3000`.
+    const shownHost = host.includes(":") ? `[${host}]` : host;
+    console.log(`sigrun v${SIGRUN_VERSION} listening on http://${shownHost}:${config.port}`);
     // The ordered shutdown (gateway C2's extraction of the inline original
     // into src/server/shutdown.ts): SSE streams FIRST, the app drain, the
     // engine's intake close, the event-bus sequence (drain + flush), the
@@ -126,6 +195,10 @@ export async function serve(env, options) {
         closeApp: () => app.close(),
         gateway,
         eventBusShutdown: () => opened.eventBus.shutdownSequence(BACKGROUND_CONTEXT),
+        stopSandboxWorkers: async () => {
+            await opened.sandboxPool.stopAll();
+            await opened.userServices.stopAll();
+        },
         stopProviderRefresh: async () => {
             // The interval refresh scheduler (provider plugins Task 5) stops
             // BEFORE the harness closes. The T4 boot refresh promise is raced
@@ -155,7 +228,7 @@ export async function serve(env, options) {
         closeHarness: () => opened.harness.close(BACKGROUND_CONTEXT),
     });
     let stopping;
-    return {
+    const booted = {
         port: config.port,
         shutdown,
         shutdownOnce: () => {
@@ -163,4 +236,6 @@ export async function serve(env, options) {
             return stopping;
         },
     };
+    resolveBooted(booted);
+    return booted;
 }

package/dist/server/auth/access-principal.js

@@ -0,0 +1,16 @@
+/** Project the authenticated caller into the shared access rule. */
+import { storedGroups } from "../../harness/identity/groups.js";
+import { isSuperuser } from "./principal.js";
+/**
+ * Read the CURRENT directory record on every access decision: stored group
+ * changes therefore apply immediately. Absent records (including anonymous
+ * callers) contribute no groups.
+ */
+export function accessPrincipalOf(principal, users) {
+    const record = principal.user === undefined ? undefined : users.get(principal.user);
+    return {
+        user: principal.user,
+        superuser: isSuperuser(principal),
+        ...(record === undefined ? {} : { groups: storedGroups(record) }),
+    };
+}

package/dist/server/auth/pipeline.js

@@ -42,6 +42,8 @@
 import { timingSafeEqual } from "node:crypto";
 import { ipAllowed } from "./ip.js";
 import { isLoopbackHost } from "./loopback.js";
+import { AdmissionRefusedError } from "../../harness/identity/users.js";
+import { effectiveAdmin } from "../../harness/identity/groups.js";
 /** One header read: Fastify headers may be string | string[]; first wins. */
 function headerOf(request, name) {
     const value = request.headers[name.toLowerCase()];
@@ -57,7 +59,7 @@ function timingSafeStringEqual(a, b) {
     return timingSafeEqual(left, right);
 }
 /** The request's Bearer credential, if the Authorization header carries one. */
-function bearerOf(request) {
+export function bearerOf(request) {
     const value = headerOf(request, "authorization");
     if (value === undefined)
         return undefined;
@@ -65,7 +67,7 @@ function bearerOf(request) {
     return match?.[1]?.trim() || undefined;
 }
 /** The `sigrun_session` cookie value (naive parse; the cookie is ours). */
-function sessionCookieOf(request) {
+export function sessionCookieOf(request) {
     const raw = headerOf(request, "cookie");
     if (raw === undefined)
         return undefined;
@@ -160,6 +162,15 @@ function isPublicPath(request, ctx) {
         return true;
     if (pattern === "/v1/auth/logout" && request.method === "POST")
         return true;
+    if (pattern === "/v1/auth/providers" && request.method === "GET")
+        return true;
+    if (pattern === "/v1/auth/login/:provider" && request.method === "GET")
+        return true;
+    if (pattern === "/v1/auth/login/code" && request.method === "POST")
+        return true;
+    if (pattern === "/v1/auth/callback/:provider" &&
+        (request.method === "GET" || request.method === "POST"))
+        return true;
     if (pattern === "/v1/onboarding" || pattern?.startsWith("/v1/onboarding/")) {
         return true;
     }
@@ -209,45 +220,43 @@ async function resolveProxy(request, ctx) {
     if (existing === undefined && !proxy.autoProvision) {
         return { status: 403, error: "user_not_provisioned" };
     }
-    const groupAdmin = groups.some((group) => adminGroups.includes(group));
-    const record = existing ??
-        (await users.add({
-            user,
-            ...(headerOf(request, proxy.nameHeader) === undefined
-                ? {}
-                : { name: headerOf(request, proxy.nameHeader) }),
-            ...(headerOf(request, proxy.emailHeader) === undefined
-                ? {}
-                : { email: headerOf(request, proxy.emailHeader) }),
-            admin: false,
-            // Gateway C8: the grant is stamped at provision — host-side
-            // checks (chat commands, no headers) read it from the record.
-            ...(adminGroups.length > 0 ? { groupAdmin } : {}),
-            source: "proxy",
-        }));
-    // Gateway C8 write-through: host-side code has no request headers, so
-    // the computed group grant must live on the directory record. Only a
-    // CHANGE writes (the steady state never rewrites the file), and only
-    // while `adminGroups` is configured — an empty list leaves the field
-    // untouched (a group-exit clears it at this user's next request under
-    // a non-empty list, never under an empty one). Absent counts as false;
-    // the auto-provisioned record was added with the flag already set, so
-    // the comparison is against the RESOLVED record, never `existing`.
-    if (adminGroups.length > 0 &&
-        (record.groupAdmin ?? false) !== groupAdmin) {
-        await users.update(user, { groupAdmin });
+    let record;
+    try {
+        record = existing ??
+            (await users.add({
+                user,
+                ...(headerOf(request, proxy.nameHeader) === undefined
+                    ? {}
+                    : { name: headerOf(request, proxy.nameHeader) }),
+                ...(headerOf(request, proxy.emailHeader) === undefined
+                    ? {}
+                    : { email: headerOf(request, proxy.emailHeader) }),
+                admin: false,
+                source: "proxy",
+            }));
+    }
+    catch (error) {
+        if (error instanceof AdmissionRefusedError) {
+            return { status: 403, error: error.code };
+        }
+        throw error;
     }
+    // Persist the authenticated source's groups on every proxy request;
+    // setGroups avoids the write when the values are unchanged. Effective
+    // admin is computed over the UPDATED record, so a group exit revokes
+    // the request's grant immediately and host-side checks agree.
+    record = await users.setGroups(user, "proxy", groups);
     return {
         user: record.user,
         ...(record.name === undefined ? {} : { name: record.name }),
         ...(record.email === undefined ? {} : { email: record.email }),
-        admin: record.admin || groupAdmin,
+        admin: effectiveAdmin(record, adminGroups),
         service: false,
         method: "proxy",
     };
 }
 /** Stage 5b (token): verify a presented credential against the token store. */
-function resolveToken(request, ctx) {
+export function resolveToken(request, ctx) {
     const presented = bearerOf(request) ?? sessionCookieOf(request);
     if (presented === undefined)
         return { status: 401 };
@@ -262,9 +271,14 @@ function resolveToken(request, ctx) {
         user: user.user,
         ...(user.name === undefined ? {} : { name: user.name }),
         ...(user.email === undefined ? {} : { email: user.email }),
-        admin: user.admin,
+        // Token/session credentials are not group sources: derive from the
+        // stored record without writing groups on this request path.
+        admin: effectiveAdmin(user, ctx.config.auth.adminGroups),
         service: false,
-        method: "token",
+        method: record.kind === "session" ? "session" : "token",
+        ...(record.kind === "session" && record.provider !== undefined
+            ? { provider: record.provider }
+            : {}),
     };
 }
 /** The ONE request hook. Stages 1→5 in brief order; a stage replies or falls through. */

package/dist/server/blocks/answers.js

@@ -0,0 +1,94 @@
+/**
+ * The block answer (UI-blocks U5 Task 3, spec §8.4): a turn action
+ * (`submit`, default `turn: true`; any action with `turn: true`) makes
+ * core submit a user message for the acting user through the normal
+ * submission path (`submitOp`):
+ *
+ *   { type: "input",
+ *     content: textProjection,             // "Submitted 'Ranking': 1. …"
+ *     entry: { kind: "sigrun.blocks.answer",
+ *              data: { entryId, action, payload, state } },
+ *     requestId: "blocks:" + actionId }
+ *
+ * The surface's unnoted change records fold into `content` first and
+ * `notedThrough` advances BEFORE the §8.3 note step runs — so the turn
+ * sends no separate note for this surface, while changes on OTHER
+ * surfaces still note. `requestId` makes a double click one turn.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { toText } from "@sigrun/shared/blocks";
+import { submitOp } from "../conversation-ops.js";
+import { readChatBlock } from "./chat-surfaces.js";
+import { NOTE_HEADER } from "./notes.js";
+import { PROJECTION_LOCALE, PROJECTION_WIDTH, } from "../../harness/blocks/tools.js";
+import { BlocksAnswerEntry } from "../../harness/blocks/entries.js";
+import { BlocksStateDoc } from "../../harness/blocks/state.js";
+/**
+ * Submit one block answer: fold the surface's unnoted changes and its
+ * current projection into the user-visible content, advance the
+ * surface's `notedThrough`, then admit the input through `submitOp` with
+ * `skipNoteFor` (this surface notes no further this turn) and the
+ * answer entry. The route owns access gating and actionId dedup; this
+ * caller runs only for a located, write-accessible block whose handler
+ * starts a turn.
+ *
+ * The fold and the `notedThrough` advance run in ONE commit BEFORE the
+ * note step (§8.4: "The surface's unnoted change records are folded into
+ * `content` first, and `notedThrough` advances, before the §8.3 note
+ * step runs"), so the answer turn never double-reports its surface.
+ */
+export async function answerBlock(ctx, conversationId, entryId, action, payload, actionId) {
+    const { opened } = ctx;
+    const block = await readChatBlock(opened.harness, conversationId, entryId);
+    if (block === undefined) {
+        throw new Error(`answerBlock: block ${entryId} not found`);
+    }
+    const conversation = await opened.harness.conversation(conversationId, BACKGROUND_CONTEXT);
+    if (conversation === undefined) {
+        throw new Error(`answerBlock: conversation ${conversationId} not found`);
+    }
+    // The fold (one commit): read the CURRENT state, build the content
+    // (changes + projection), advance notedThrough past every record the
+    // fold covers.
+    const folded = await conversation.commit(async (tx) => {
+        const draft = await tx.doc(BlocksStateDoc, conversationId, entryId, entryId);
+        const pending = draft.changes.filter((record) => record.seq > draft.notedThrough);
+        const lines = [];
+        if (pending.length > 0) {
+            const byAuthor = new Map();
+            for (const record of pending) {
+                const list = byAuthor.get(record.by) ?? [];
+                list.push(record.summary);
+                byAuthor.set(record.by, list);
+            }
+            lines.push(NOTE_HEADER);
+            for (const [author, summaries] of byAuthor) {
+                lines.push(`• ${block.title} (${author}): ${summaries.join("; ")}`);
+            }
+        }
+        lines.push(`Submitted '${block.title}': ${toText(block.tree, draft.data, {
+            width: PROJECTION_WIDTH,
+            locale: PROJECTION_LOCALE,
+        })}`);
+        if (pending.length > 0) {
+            draft.notedThrough = pending[pending.length - 1].seq;
+        }
+        return {
+            content: lines.join("\n"),
+            state: JSON.parse(JSON.stringify(draft.data)),
+        };
+    }, BACKGROUND_CONTEXT);
+    await submitOp(ctx, conversation, folded.content, {
+        ...(actionId === undefined ? {} : { requestId: `blocks:${actionId}` }),
+        skipNoteFor: entryId,
+        entry: {
+            kind: BlocksAnswerEntry.kind,
+            data: {
+                entryId,
+                action,
+                payload,
+                state: folded.state,
+            },
+        },
+    });
+}