@songsid/agend 2.1.12 → 2.2.0-alpha.2

package/dist/web-chat-history.js

@@ -0,0 +1,184 @@
+/**
+ * What the web chat has said, kept so that a reload — or a dropped SSE stream — does not leave the chat empty.
+ *
+ * The browser used to hold the only copy (500 messages per instance, in memory): a reload showed nothing, and a
+ * stream that reconnected silently lost whatever was said while it was down. Now every chat message the fleet
+ * pushes over SSE is recorded here with a monotonically increasing id: `/ui/history` serves the recent messages
+ * of one instance, and an EventSource that reconnects with `Last-Event-ID` is sent what it missed.
+ *
+ * Bounded by count AND by bytes per instance, so a chatty agent cannot grow the fleet process without limit.
+ * In memory only: it survives a page reload, not a fleet restart (persisting chat text is a separate decision).
+ *
+ * Ids count from 1 in every fleet process, so an id alone is not an identity across a restart: each history
+ * has a random `boot` generation, every message carries it, and the SSE cursor is `<boot>-<id>`. A cursor
+ * from another boot is not compared with this boot's ids at all — that client gets this boot's backlog.
+ */
+import { randomBytes } from "node:crypto";
+/**
+ * Ranks for the order a message moves through. Events can arrive late or twice (a queued after the spawn
+ * settles, a retry): a tick never moves back. `delivered` and `failed` are final; `cancelled` is not, since
+ * a Stop races a delivery already under way — what the agent actually got wins.
+ */
+const DELIVERY_RANK = { queued: 1, processing: 2, cancelled: 3, delivered: 4, failed: 4 };
+/** The state after `next` arrives at a message in `prev`; `prev` itself when `next` would move it back. */
+export function nextDeliveryState(prev, next) {
+    // Own keys only: "__proto__" or "constructor" is in every object, and is no state.
+    if (!Object.hasOwn(DELIVERY_RANK, next))
+        return prev;
+    if (prev === undefined || !Object.hasOwn(DELIVERY_RANK, prev))
+        return next;
+    return DELIVERY_RANK[next] > DELIVERY_RANK[prev] ? next : prev;
+}
+const ROLES = new Set(["agent", "user", "status"]);
+export const WEB_CHAT_TEXT_MAX = 16_000;
+/**
+ * The `message_id` a message from the web chat is delivered under. Unique (two sends in one millisecond used
+ * to share `web-<ms>`), and never a platform id: Telegram and Discord ids are digits only.
+ */
+export function newWebMessageId() {
+    return `web-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
+}
+/** Whether a delivery report is about a message from the web chat rather than one on a platform. */
+export function isWebMessageId(messageId) {
+    return messageId.startsWith("web-");
+}
+export class WebChatHistory {
+    nextId = 1;
+    /** This process's generation: ids are only unique within it. */
+    boot;
+    byInstance = new Map();
+    perInstance;
+    perInstanceChars;
+    replayMax;
+    constructor(opts = {}) {
+        this.perInstance = opts.perInstance ?? 500;
+        this.perInstanceChars = opts.perInstanceChars ?? 1_000_000;
+        this.replayMax = opts.replayMax ?? 500;
+        this.boot = opts.boot ?? randomBytes(6).toString("hex");
+    }
+    /** The id the next message will get minus one: the newest id handed out so far (0 when none). */
+    get lastId() { return this.nextId - 1; }
+    /** Record one message; returns it with its id. Text beyond WEB_CHAT_TEXT_MAX is cut. */
+    record(msg) {
+        const entry = {
+            boot: this.boot,
+            id: this.nextId++,
+            instance: String(msg.instance),
+            // Anything not one of the three — or absent — is a person's message.
+            role: typeof msg.role === "string" && ROLES.has(msg.role) ? msg.role : "user",
+            sender: String(msg.sender),
+            text: String(msg.text ?? "").slice(0, WEB_CHAT_TEXT_MAX),
+            ts: String(msg.ts),
+            ...(msg.attachments && msg.attachments.length ? { attachments: msg.attachments.slice(0, 20).map(a => ({ id: a.id, kind: a.kind, name: a.name, size: a.size, mime: a.mime })) } : {}),
+            ...(typeof msg.messageId === "string" && msg.messageId ? { messageId: msg.messageId.slice(0, 64) } : {}),
+        };
+        let slot = this.byInstance.get(entry.instance);
+        if (!slot) {
+            slot = { messages: [], chars: 0 };
+            this.byInstance.set(entry.instance, slot);
+        }
+        slot.messages.push(entry);
+        slot.chars += entry.text.length;
+        while (slot.messages.length > 1 && (slot.messages.length > this.perInstance || slot.chars > this.perInstanceChars)) {
+            slot.chars -= slot.messages.shift().text.length;
+        }
+        return entry;
+    }
+    /** The most recent `limit` messages of one instance, oldest first. */
+    list(instance, limit = this.perInstance) {
+        const slot = this.byInstance.get(instance);
+        if (!slot)
+            return [];
+        const n = Math.max(0, Math.min(Math.floor(limit), this.perInstance));
+        return n === 0 ? [] : slot.messages.slice(-n);
+    }
+    /**
+     * Every message newer than `lastId`, across instances, oldest first, at most `replayMax` (the newest ones).
+     * Ids are this boot's: a cursor from another boot goes through replayFor(), never straight here.
+     */
+    after(lastId) {
+        if (!Number.isFinite(lastId) || lastId < 0)
+            return [];
+        const out = [];
+        for (const slot of this.byInstance.values()) {
+            for (const m of slot.messages)
+                if (m.id > lastId)
+                    out.push(m);
+        }
+        out.sort((a, b) => a.id - b.id);
+        return out.length > this.replayMax ? out.slice(-this.replayMax) : out;
+    }
+    /**
+     * A delivery report for one of this instance's messages. Returns the message when its state changed (so the
+     * caller tells the pages), null when there is no such message or the report would move it back.
+     */
+    setDelivery(instance, messageId, state) {
+        const messages = this.byInstance.get(instance)?.messages ?? [];
+        let m;
+        for (let i = messages.length - 1; i >= 0 && !m; i--)
+            if (messages[i].messageId === messageId)
+                m = messages[i];
+        if (!m)
+            return null;
+        const next = nextDeliveryState(m.delivery, state);
+        if (next === m.delivery)
+            return null;
+        m.delivery = next;
+        return m;
+    }
+    /**
+     * A Stop on this instance: the web user's messages still waiting (nothing reported, or queued) were dropped
+     * from the queue. The queue is first in, first out, so nothing older than a message that got further can
+     * still be waiting: the walk goes back from the newest and stops there. Returns the messages it changed.
+     */
+    /**
+     * Where every retained web message got — the ticks — in one list. A delivery report has no cursor of its own and
+     * changes a message already sent, so a page that missed one (a dropped stream, a poll) catches up from this:
+     * the stream sends it on every (re)connect and each poll carries it (#1253 review). Ticks only move forward on
+     * the page, so receiving it twice changes nothing.
+     */
+    deliveries() {
+        const out = [];
+        for (const [instance, slot] of this.byInstance) {
+            for (const m of slot.messages)
+                if (m.messageId !== undefined && m.delivery !== undefined)
+                    out.push({ instance, messageId: m.messageId, delivery: m.delivery });
+        }
+        return out;
+    }
+    cancelPending(instance) {
+        const changed = [];
+        const messages = this.byInstance.get(instance)?.messages ?? [];
+        for (let i = messages.length - 1; i >= 0; i--) {
+            const m = messages[i];
+            if (m.messageId === undefined)
+                continue;
+            if (m.delivery !== undefined && m.delivery !== "queued")
+                break;
+            m.delivery = "cancelled";
+            changed.push(m);
+        }
+        return changed.reverse();
+    }
+    /** Forget an instance (deleted). */
+    forget(instance) { this.byInstance.delete(instance); }
+    /** The SSE cursor for one message: `<boot>-<id>`. */
+    cursorOf(m) { return `${m.boot}-${m.id}`; }
+    /**
+     * What a reconnecting stream with this `Last-Event-ID` should be sent. A cursor of this boot replays what
+     * came after it; a cursor of another boot (the fleet restarted) gets this boot's whole retained backlog,
+     * since none of it can have been seen; no cursor, or one that is not ours in shape, gets nothing.
+     */
+    replayFor(cursor) {
+        if (!cursor)
+            return [];
+        return cursor.boot === this.boot ? this.after(cursor.id) : this.after(0);
+    }
+}
+/** `Last-Event-ID` as `<boot>-<id>`, or null when absent or not that shape. */
+export function parseLastEventId(header) {
+    const raw = (Array.isArray(header) ? header[0] : header)?.trim();
+    const m = raw === undefined ? null : /^([0-9a-f]{1,32})-(\d{1,15})$/.exec(raw);
+    return m ? { boot: m[1], id: Number(m[2]) } : null;
+}
+//# sourceMappingURL=web-chat-history.js.map

package/dist/web-chat-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-chat-history.js","sourceRoot":"","sources":["../src/web-chat-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C;;;;GAIG;AACH,MAAM,aAAa,GAAqC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAE5H,2GAA2G;AAC3G,MAAM,UAAU,iBAAiB,CAAC,IAAkC,EAAE,IAAsB;IAC1F,mFAAmF;IACnF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAGD,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAmCxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,MAAM,GAAG,CAAC,CAAC;IACnB,gEAAgE;IACvD,IAAI,CAAS;IACL,UAAU,GAAG,IAAI,GAAG,EAAyD,CAAC;IAC9E,WAAW,CAAS;IACpB,gBAAgB,CAAS;IACzB,SAAS,CAAS;IAEnC,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC;QAC3C,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,iGAAiG;IACjG,IAAI,MAAM,KAAa,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAEhD,wFAAwF;IACxF,MAAM,CAAC,GAAyI;QAC9I,MAAM,KAAK,GAAmB;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;YACjB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,qEAAqE;YACrE,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAmB,CAAC,CAAC,CAAC,MAAM;YAC5F,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC;YACxD,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpL,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzG,CAAC;QACF,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnH,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,QAAgB,EAAE,KAAK,GAAG,IAAI,CAAC,WAAW;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAc;QAClB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACtD,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,QAAgB,EAAE,SAAiB,EAAE,KAAuB;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC/D,IAAI,CAA6B,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,SAAS,KAAK,SAAS;gBAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;OAIG;IACH;;;;;OAKG;IACH,UAAU;QACR,MAAM,GAAG,GAA+E,EAAE,CAAC;QAC3F,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC/D,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM;YAC/D,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,oCAAoC;IACpC,MAAM,CAAC,QAAgB,IAAU,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEpE,qDAAqD;IACrD,QAAQ,CAAC,CAAiB,IAAY,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEnE;;;;OAIG;IACH,SAAS,CAAC,MAA2C;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,MAAqC;IACpE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,CAAC,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC"}

package/dist/web-commands.d.ts

@@ -0,0 +1,77 @@
+/**
+ * #1269 (4): an instance's chat commands, run from the web chat. Only what the instance's own Discord/Telegram topic
+ * already accepts, through the same handlers (topic-commands.ts / FleetManager) and the same table (command-table.ts,
+ * #754/#1148): nothing here is a capability the platforms do not have.
+ *
+ * - Who: a signed-in web session holds the full-fleet credential, issued only to a fleet admin (/dashboard is
+ *   fleet-admin only), so the table's admin levels are met — exactly as a web click on a mirrored prompt is answered
+ *   "as a fleet admin on the platform". The table can still refuse a command in a kind of channel; that stands.
+ * - What: instance commands only. Fleet-level ones (/status, /restart, /update, /login, …) stay in General
+ *   (Discord-first), and /raw is not a command here (it bypasses the [user:] envelope).
+ * - The public link (a gateway request) is the outward-facing surface: /save is refused there — it makes the CLI
+ *   write a file under a name the caller picks, outside the agent's own judgement.
+ * - /clear asks first, as on the platforms: the first call answers a confirmation token; only the second, with that
+ *   token, clears — and only if the instance is still the one that was asked about.
+ */
+import { type CommandScope } from "./command-table.js";
+export declare const WEB_COMMANDS: readonly ["ctx", "compact", "clear", "model", "effort", "cancel", "btw", "steer", "pause", "wake", "save"];
+export type WebCommand = typeof WEB_COMMANDS[number];
+/** Refused on the public link (see the header). */
+export declare const PUBLIC_LINK_REFUSED: ReadonlySet<WebCommand>;
+export declare const MAX_COMMAND_ARGS = 4000;
+export interface WebChoices {
+    current: string | null;
+    options: Array<{
+        id: string;
+        label: string;
+    }>;
+}
+export interface WebCommandDeps {
+    /** The instance is one the web chat may command (a fleet instance or a ClassicBot room), and in which scope. */
+    scope(instance: string): CommandScope | null;
+    ctx(instance: string): Promise<string>;
+    compact(instance: string, instructions: string | undefined): Promise<string>;
+    applyModel(instance: string, name: string): Promise<string>;
+    /** The model menu from the cached catalog only (never a live probe on this path); null: no list to offer. */
+    modelChoices(instance: string): WebChoices | null;
+    applyEffort(instance: string, level: string): Promise<string>;
+    effortChoices(instance: string): WebChoices | null;
+    cancel(instance: string): boolean;
+    steer(instance: string, text: string): string;
+    btw(instance: string, text: string): string;
+    pauseWake(instance: string, action: "pause" | "wake"): Promise<string>;
+    save(instance: string, filename: string): Promise<string>;
+    /** Ask: a confirmation token (or why not). Confirm: clear, if the token is live and the instance unchanged. */
+    clearAsk(instance: string): {
+        token: string;
+        message: string;
+    } | {
+        refused: string;
+    };
+    clearConfirm(instance: string, token: string): Promise<{
+        status: number;
+        text: string;
+    }>;
+    t(key: string, ...args: string[]): string;
+}
+export interface WebCommandInput {
+    instance: string;
+    command: string;
+    args?: string;
+    confirm?: string;
+}
+export interface WebCommandResult {
+    status: number;
+    body: {
+        text?: string;
+        error?: string;
+        choices?: WebChoices;
+        confirm?: {
+            token: string;
+            message: string;
+        };
+    };
+}
+export declare function runWebCommand(deps: WebCommandDeps, input: WebCommandInput, opts: {
+    publicLink: boolean;
+}): Promise<WebCommandResult>;

package/dist/web-commands.js

@@ -0,0 +1,81 @@
+/**
+ * #1269 (4): an instance's chat commands, run from the web chat. Only what the instance's own Discord/Telegram topic
+ * already accepts, through the same handlers (topic-commands.ts / FleetManager) and the same table (command-table.ts,
+ * #754/#1148): nothing here is a capability the platforms do not have.
+ *
+ * - Who: a signed-in web session holds the full-fleet credential, issued only to a fleet admin (/dashboard is
+ *   fleet-admin only), so the table's admin levels are met — exactly as a web click on a mirrored prompt is answered
+ *   "as a fleet admin on the platform". The table can still refuse a command in a kind of channel; that stands.
+ * - What: instance commands only. Fleet-level ones (/status, /restart, /update, /login, …) stay in General
+ *   (Discord-first), and /raw is not a command here (it bypasses the [user:] envelope).
+ * - The public link (a gateway request) is the outward-facing surface: /save is refused there — it makes the CLI
+ *   write a file under a name the caller picks, outside the agent's own judgement.
+ * - /clear asks first, as on the platforms: the first call answers a confirmation token; only the second, with that
+ *   token, clears — and only if the instance is still the one that was asked about.
+ */
+import { commandSpec, decideCommand } from "./command-table.js";
+import { SAVE_FILENAME_RE } from "./topic-commands.js";
+export const WEB_COMMANDS = ["ctx", "compact", "clear", "model", "effort", "cancel", "btw", "steer", "pause", "wake", "save"];
+/** Refused on the public link (see the header). */
+export const PUBLIC_LINK_REFUSED = new Set(["save"]);
+export const MAX_COMMAND_ARGS = 4000;
+const isWebCommand = (c) => WEB_COMMANDS.includes(c);
+export async function runWebCommand(deps, input, opts) {
+    const { instance } = input;
+    const command = input.command.replace(/^\//, "");
+    if (!isWebCommand(command))
+        return { status: 400, body: { error: deps.t("web.command_unknown", `/${command}`) } };
+    if (opts.publicLink && PUBLIC_LINK_REFUSED.has(command))
+        return { status: 403, body: { error: deps.t("web.command_public_refused", `/${command}`) } };
+    const scope = deps.scope(instance);
+    if (!scope)
+        return { status: 404, body: { error: deps.t("instance.not_found", instance) } };
+    // The same table the platforms use; the session is fleet-admin level, so only a scope refusal can stand.
+    const spec = commandSpec(command);
+    if (!spec)
+        return { status: 400, body: { error: deps.t("web.command_unknown", `/${command}`) } };
+    const decision = decideCommand(spec, scope, { fleetAdmin: () => "ok", channelAdmin: () => true, classicAdmin: () => true });
+    if (!decision.allow)
+        return { status: 403, body: { error: deps.t(...decision.reply) } };
+    const args = (input.args ?? "").trim();
+    const ok = (text) => ({ status: 200, body: { text } });
+    switch (command) {
+        case "ctx": return ok(await deps.ctx(instance));
+        case "compact": return ok(await deps.compact(instance, args || undefined));
+        case "model": {
+            if (args)
+                return ok(await deps.applyModel(instance, args));
+            const choices = deps.modelChoices(instance);
+            return choices ? { status: 200, body: { choices } } : ok(deps.t("model.list_unavailable", instance));
+        }
+        case "effort": {
+            if (args)
+                return ok(await deps.applyEffort(instance, args));
+            const choices = deps.effortChoices(instance);
+            return choices ? { status: 200, body: { choices } } : { status: 400, body: { error: deps.t("web.command_no_choices", "/effort") } };
+        }
+        case "cancel": return ok(deps.cancel(instance) ? deps.t("cancel.sent", instance) : deps.t("cancel.not_running", instance));
+        case "steer":
+        case "btw":
+            if (!args)
+                return { status: 400, body: { error: deps.t(`${command}.usage`) } };
+            return ok(command === "steer" ? deps.steer(instance, args) : deps.btw(instance, args));
+        case "pause":
+        case "wake": return ok(await deps.pauseWake(instance, command));
+        case "save":
+            if (!args)
+                return { status: 400, body: { error: deps.t("save.usage") } };
+            if (!SAVE_FILENAME_RE.test(args))
+                return { status: 400, body: { error: deps.t("filename.invalid") } };
+            return ok(await deps.save(instance, args));
+        case "clear": {
+            if (input.confirm) {
+                const r = await deps.clearConfirm(instance, input.confirm);
+                return { status: r.status, body: r.status === 200 ? { text: r.text } : { error: r.text } };
+            }
+            const asked = deps.clearAsk(instance);
+            return "token" in asked ? { status: 200, body: { confirm: asked } } : { status: 409, body: { error: asked.refused } };
+        }
+    }
+}
+//# sourceMappingURL=web-commands.js.map

package/dist/web-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-commands.js","sourceRoot":"","sources":["../src/web-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAEvI,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAA4B,IAAI,GAAG,CAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AA+BrC,MAAM,YAAY,GAAG,CAAC,CAAS,EAAmB,EAAE,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAoB,EAAE,KAAsB,EAAE,IAA6B;IAC7G,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,qBAAqB,EAAE,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;IAClH,IAAI,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,4BAA4B,EAAE,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;IACtJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC5F,yGAAyG;IACzG,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,qBAAqB,EAAE,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC;QAC3E,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,IAAI;gBAAE,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC5C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,IAAI;gBAAE,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,wBAAwB,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;QACtI,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3H,KAAK,OAAO,CAAC;QACb,KAAK,KAAK;YACR,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC/E,OAAO,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACzF,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM;YACT,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACzE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC;YACtG,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAAC,CAAC;YAC9K,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACxH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/web-continuation.d.ts

@@ -0,0 +1,7 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { WebSessionStore } from "./web-session.js";
+/** Recheck AFTER a body/authorization await and BEFORE admitting a new public mutation. */
+export declare function permitWebContinuation(req: IncomingMessage, res: ServerResponse, ctx: {
+    readonly webToken?: string | null;
+    readonly webSessions?: WebSessionStore | null;
+}): boolean;

package/dist/web-continuation.js

@@ -0,0 +1,22 @@
+import { settingsRequestExecution } from "./settings-request-capability.js";
+import { evaluateWebRequest } from "./web-auth.js";
+import { gatewayRequestContext } from "./web-request-context.js";
+/** Recheck AFTER a body/authorization await and BEFORE admitting a new public mutation. */
+export function permitWebContinuation(req, res, ctx) {
+    const execution = settingsRequestExecution(req);
+    if (execution) {
+        execution.assert();
+        return !res.destroyed;
+    }
+    if (!gatewayRequestContext(req))
+        return true;
+    const verdict = evaluateWebRequest(req, new URL(req.url ?? "/", "http://localhost"), ctx.webToken ?? null, ctx.webSessions, { touch: false });
+    if (verdict.kind === "allow" && !res.destroyed)
+        return true;
+    if (!res.headersSent && !res.destroyed) {
+        res.writeHead(verdict.kind === "reject" ? verdict.status : 401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "public request no longer authorized" }));
+    }
+    return false;
+}
+//# sourceMappingURL=web-continuation.js.map

package/dist/web-continuation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-continuation.js","sourceRoot":"","sources":["../src/web-continuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,GAAoB,EAAE,GAAmB,EAC7E,GAAyF;IACzF,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAAC,CAAC;IAC7D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9I,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/web-host-guard.d.ts

@@ -26,6 +26,23 @@ export declare const LOOPBACK_HOST_NAMES: readonly string[];
  * mistaken for it.
  */
 export declare function hostnameOf(value: string): string | null;
+/**
+ * What a page served here may load and where it may send anything.
+ *
+ * `script-src` is this origin only — no `'unsafe-inline'` (#1268): a panel's own inline
+ * script runs because the panel is served with a per-response nonce for it
+ * (sendPanelHtml), and no panel has an inline `on*=` handler. Injected markup can
+ * therefore not run script. `connect-src`, `img-src` and `form-action` are this
+ * origin, so nothing read can be posted elsewhere, and `base-uri`, `object-src` and
+ * `frame-ancestors` are closed. Styles are the same (#1300): `style-src 'self'`, and a
+ * panel's own `<style>` block carries the response's nonce. No panel has a `style="…"`
+ * attribute — what a script colours or sizes at run time goes through the style object
+ * (CSSOM), which the policy does not govern — so injected markup cannot add inline styles of its
+ * own (it can still carry the page's existing class names).
+ *
+ * Fonts, scripts and styles are all served from here; nothing loads from a CDN.
+ */
+export declare const WEB_CONTENT_SECURITY_POLICY: string;
 export interface HostGuardConfig {
     hostname?: string;
     web?: {
@@ -45,3 +62,20 @@ export declare function isHostAllowed(hostHeader: string | string[] | undefined,
  * Node merges `writeHead` headers over `setHeader` ones.
  */
 export declare function applyWebSecurityHeaders(res: ServerResponse): void;
+/**
+ * The panel policy for one response: WEB_CONTENT_SECURITY_POLICY with this response's nonce for scripts and styles,
+ * and — for /ui only, when a preview origin was chosen for this load (#1306) — `frame-src <preview origin>/frame`:
+ * path-scoped, so nothing else of that origin can be framed or navigated to. Without it, frames fall back to
+ * default-src 'self'.
+ */
+export declare function panelContentSecurityPolicy(nonce: string, opts?: {
+    frameSrc?: string;
+}): string;
+/**
+ * Send a panel page (/ui, /view, /settings, the sign-in page). Its own inline `<script>` and `<style>` blocks get a
+ * fresh nonce, and the response's CSP names that nonce and nothing else inline (#1268, #1300): a script or a style
+ * that was not in the file as served — anything injected into the page — has no nonce and does not apply.
+ */
+export declare function sendPanelHtml(res: ServerResponse, html: string, status?: number, headers?: Record<string, string>, csp?: {
+    frameSrc?: string;
+}): void;

package/dist/web-host-guard.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 export const WEB_HOST_REJECTED_MESSAGE = "Host not allowed — if you reach AgEnD through a reverse proxy or another name, add it to web.allowed_hosts in fleet.yaml";
 /** Names a browser on this machine uses for a loopback listener. */
 export const LOOPBACK_HOST_NAMES = ["localhost", "127.0.0.1", "[::1]"];
@@ -30,6 +31,34 @@ export function hostnameOf(value) {
     // either direction.
     return match[1].replace(/\.$/, "") || null;
 }
+/**
+ * What a page served here may load and where it may send anything.
+ *
+ * `script-src` is this origin only — no `'unsafe-inline'` (#1268): a panel's own inline
+ * script runs because the panel is served with a per-response nonce for it
+ * (sendPanelHtml), and no panel has an inline `on*=` handler. Injected markup can
+ * therefore not run script. `connect-src`, `img-src` and `form-action` are this
+ * origin, so nothing read can be posted elsewhere, and `base-uri`, `object-src` and
+ * `frame-ancestors` are closed. Styles are the same (#1300): `style-src 'self'`, and a
+ * panel's own `<style>` block carries the response's nonce. No panel has a `style="…"`
+ * attribute — what a script colours or sizes at run time goes through the style object
+ * (CSSOM), which the policy does not govern — so injected markup cannot add inline styles of its
+ * own (it can still carry the page's existing class names).
+ *
+ * Fonts, scripts and styles are all served from here; nothing loads from a CDN.
+ */
+export const WEB_CONTENT_SECURITY_POLICY = [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "connect-src 'self'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+].join("; ");
 /** Loopback names, the `hostname:` handed out in /dashboard links, and `web.allowed_hosts`. */
 export function allowedHostNames(config) {
     const names = new Set(LOOPBACK_HOST_NAMES);
@@ -67,9 +96,36 @@ export function applyWebSecurityHeaders(res) {
     // These pages have buttons that restart instances and change configuration;
     // a page that can be framed can be clicked through.
     res.setHeader("X-Frame-Options", "DENY");
-    res.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
+    res.setHeader("Content-Security-Policy", WEB_CONTENT_SECURITY_POLICY);
     // Authorization now depends on a cookie, so a shared cache (a tunnel, a
     // corporate proxy) must not keep or replay any of it.
     res.setHeader("Cache-Control", "no-store");
 }
+/**
+ * The panel policy for one response: WEB_CONTENT_SECURITY_POLICY with this response's nonce for scripts and styles,
+ * and — for /ui only, when a preview origin was chosen for this load (#1306) — `frame-src <preview origin>/frame`:
+ * path-scoped, so nothing else of that origin can be framed or navigated to. Without it, frames fall back to
+ * default-src 'self'.
+ */
+export function panelContentSecurityPolicy(nonce, opts = {}) {
+    const policy = WEB_CONTENT_SECURITY_POLICY
+        .replace("script-src 'self'", `script-src 'self' 'nonce-${nonce}'`)
+        .replace("style-src 'self'", `style-src 'self' 'nonce-${nonce}'`);
+    return opts.frameSrc ? `${policy}; frame-src ${opts.frameSrc}` : policy;
+}
+/**
+ * Send a panel page (/ui, /view, /settings, the sign-in page). Its own inline `<script>` and `<style>` blocks get a
+ * fresh nonce, and the response's CSP names that nonce and nothing else inline (#1268, #1300): a script or a style
+ * that was not in the file as served — anything injected into the page — has no nonce and does not apply.
+ */
+export function sendPanelHtml(res, html, status = 200, headers = {}, csp = {}) {
+    const nonce = randomBytes(18).toString("base64");
+    res.setHeader("Content-Security-Policy", panelContentSecurityPolicy(nonce, csp));
+    res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", ...headers });
+    // Exactly the page's own bare `<script>` / `<style>` tags, as written in our files, get the nonce: a plain string
+    // match, not a tag filter. Any other spelling (`<SCRIPT>`, `<script src=…>`, `<script type=module>`) is left as is
+    // and so has no nonce: inline it is blocked, `src=` scripts load by 'self'. Widening the match would hand the
+    // nonce to more spellings; nothing here sanitises input.
+    res.end(html.split("<script>").join(`<script nonce="${nonce}">`).split("<style>").join(`<style nonce="${nonce}">`));
+}
 //# sourceMappingURL=web-host-guard.js.map

package/dist/web-host-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-host-guard.js","sourceRoot":"","sources":["../src/web-host-guard.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,yBAAyB,GACpC,0HAA0H,CAAC;AAE7H,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAE1F;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,0EAA0E;IAC1E,oBAAoB;IACpB,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAOD,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,MAA0C;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,SAAkB,EAAQ,EAAE;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,UAAyC,EAAE,OAA4B;IACnG,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAmB;IACzD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,4EAA4E;IAC5E,oDAAoD;IACpD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IACnE,wEAAwE;IACxE,sDAAsD;IACtD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"web-host-guard.js","sourceRoot":"","sources":["../src/web-host-guard.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,yBAAyB,GACpC,0HAA0H,CAAC;AAE7H,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAE1F;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,0EAA0E;IAC1E,oBAAoB;IACpB,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB;IACpB,mBAAmB;IACnB,kBAAkB;IAClB,4BAA4B;IAC5B,uBAAuB;IACvB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,wBAAwB;CACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAOb,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,MAA0C;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,SAAkB,EAAQ,EAAE;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,UAAyC,EAAE,OAA4B;IACnG,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAmB;IACzD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,4EAA4E;IAC5E,oDAAoD;IACpD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IACtE,wEAAwE;IACxE,sDAAsD;IACtD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,OAA8B,EAAE;IACxF,MAAM,MAAM,GAAG,2BAA2B;SACvC,OAAO,CAAC,mBAAmB,EAAE,4BAA4B,KAAK,GAAG,CAAC;SAClE,OAAO,CAAC,kBAAkB,EAAE,2BAA2B,KAAK,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,IAAY,EAAE,MAAM,GAAG,GAAG,EAAE,UAAkC,EAAE,EAAE,MAA6B,EAAE;IAClJ,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAClF,kHAAkH;IAClH,mHAAmH;IACnH,8GAA8G;IAC9G,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC;AACtH,CAAC"}

package/dist/web-login.d.ts

@@ -0,0 +1,72 @@
+import type { SessionTier } from "./web-session.js";
+export declare const LOGIN_CODE_TTL_MS: number;
+/** Same reasoning as setup: eight characters on a phone get mistyped. */
+export declare const MAX_LOGIN_CODE_ATTEMPTS = 5;
+export declare const LOGIN_BREAKER_WINDOW_MS: number;
+export declare const LOGIN_BREAKER_THRESHOLD = 20;
+export declare const LOGIN_BREAKER_PAUSE_MS: number;
+export interface LoginCodeOwner {
+    /** Server-owned live adapter identity; never accepted from HTTP. */
+    readonly binding?: object;
+    readonly adapterId: string;
+    readonly userId: string;
+    readonly chatId: string;
+    readonly threadId?: string;
+}
+export interface IssuedLoginCode {
+    readonly issuanceId: string;
+    /** As typed: `ABCD-EFGH`. */
+    readonly display: string;
+    readonly expiresAt: number;
+    readonly tier: SessionTier;
+}
+export type LoginRedeemResult = {
+    readonly kind: "ok";
+    readonly tier: SessionTier;
+    readonly owner?: LoginCodeOwner;
+}
+/** Wrong, expired, spent, or none issued — deliberately indistinguishable. */
+ | {
+    readonly kind: "invalid";
+}
+/** The breaker is open. Even a correct code is refused until it closes. */
+ | {
+    readonly kind: "paused";
+    readonly retryAfterMs: number;
+};
+export interface WebLoginCodesOptions {
+    readonly now?: () => number;
+    /** For tests that need a known code. */
+    readonly generate?: () => string;
+    readonly onEvent?: (event: "issued" | "spent" | "burned" | "breaker-open") => void;
+}
+export declare class WebLoginCodes {
+    private outstanding;
+    private failures;
+    private pausedUntil;
+    private readonly now;
+    private readonly generate;
+    private readonly onEvent;
+    constructor(opts?: WebLoginCodesOptions);
+    /**
+     * Issue a code, replacing any outstanding one. Only ever called from a channel the operator controls.
+     * `epoch` is the current web token's (`tokenEpoch`): rotating the token — from this process or from
+     * `agend web-token rotate` in another — withdraws an unused code, because redemption re-checks it.
+     */
+    issue(opts: {
+        tier?: SessionTier;
+        epoch: string;
+        audience?: string;
+        owner?: LoginCodeOwner;
+    }): IssuedLoginCode;
+    /** Whether a redemption right now would be compared against anything. */
+    get hasOutstandingCode(): boolean;
+    /** Withdraw the outstanding code without spending it (`/dashboard revoke`). */
+    revoke(): void;
+    /** `currentEpoch` is the web token's epoch NOW: a code issued under another token is gone. */
+    revokeIfCurrent(issuanceId: string): void;
+    revokeAudience(audience: string): void;
+    redeem(input: string, currentEpoch: string, audience?: string): LoginRedeemResult;
+    private activeCode;
+    private recordFailure;
+}