@songsid/agend 2.2.0-beta.1 → 2.2.0-beta.11

package/dist/web-api.js

@@ -1,3 +1,5 @@
+import { webHumanOrigin } from "./human-delivery-receipts.js";
+import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { binaryProbe } from "./binary-probe.js";
 import { settingsRequestExecution, settingsWrite, isSettingsReplay } from "./settings-request-capability.js";
 import { readBoundedWebBody } from "./web-body.js";
@@ -16,7 +18,9 @@ import { shellRoute } from "./web-shell-routes.js";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CreateInstanceArgs, validateArgs } from "./outbound-schemas.js";
+import { CreateInstanceArgs, CreateScheduleArgs, UpdateScheduleArgs, validateArgs } from "./outbound-schemas.js";
+import { scheduleView } from "./web-schedules.js";
+import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
 import { readStatuslineModel, resolveInstanceContext } from "./topic-commands.js";
 import { z } from "zod";
 import { evaluateWebRequest, isPassiveWebRead, isSecureRequest, isWebRequestAuthorized, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
@@ -24,8 +28,13 @@ import { dashboardOriginFor } from "./web-preview.js";
 import { newWebMessageId, parseLastEventId } from "./web-chat-history.js";
 import { attachmentDelivery, displayName, INLINE_MIME, isFileId, MEDIA_RANGE_MAX, publicAttachment, sniffUpload, UPLOAD_LIMITS, wellFormed } from "./web-upload.js";
 import { getAgendHome } from "./paths.js";
+import { OPERATOR } from "./web-prefs.js";
+import { WEB_NAME_FALLBACK } from "./web-profile.js";
+import { commitTeamCreate, commitTeamUpdate } from "./outbound-handlers.js";
+import { parseMentionQuery } from "./web-mentions.js";
 import { authorizeExplicitInstanceRemoval } from "./instance-removal.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
+import { resolveTz } from "./tz-utils.js";
 // ── Strict public-facing schemas ────────────────────────────────────────────
 // web-api endpoints must reject unknown fields so the dashboard cannot inject
 // internal-only flags that would reach handleCreate/scheduler/config writers.
@@ -45,18 +54,17 @@ const TaskUpdateSchema = z.object({
     description: z.string().max(MAX_TEXT).optional(),
     priority: z.string().max(64).optional(),
 }).strict();
-const ScheduleCreateSchema = z.object({
-    cron: z.string().min(1).max(256),
-    message: z.string().min(1).max(MAX_TEXT),
-    target: z.string().min(1).max(256),
-    label: z.string().max(256).optional(),
-    timezone: z.string().max(128).optional(),
-}).strict();
 const TeamCreateSchema = z.object({
     name: z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/),
     members: z.array(z.string().min(1).max(256)).min(1).max(256),
     description: z.string().max(MAX_TEXT).optional(),
 }).strict();
+// #1689: an edit of a team — its members as they should be, and its description ("" clears it). No name: a team is
+// not renamed.
+const TeamEditSchema = z.object({
+    members: z.array(z.string().min(1).max(256)).min(1).max(256),
+    description: z.string().max(MAX_TEXT).optional(),
+}).strict();
 const ConfigUpdateSchema = z.object({
     channel: z.object({
         group_id: z.union([z.number(), z.string()]).optional(),
@@ -130,6 +138,49 @@ function json(res, status, data) {
     res.writeHead(status);
     res.end(JSON.stringify(data));
 }
+/**
+ * #1630 (#1635 review): an answer that waited on something (a list, a download) is sent only if the request is still
+ * allowed — the session not revoked meanwhile, a public link's exposure still current. Otherwise 401, and nothing.
+ */
+function stillAuthorized(req, res, url, ctx) {
+    if (!permitWebContinuation(req, res, ctx))
+        return false;
+    if (isWebRequestAuthorized(req, url, ctx.webToken, ctx.webSessions, { touch: false }))
+        return true;
+    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+    return false;
+}
+/**
+ * #1827: whose a request is, asked NOW (after its body arrived: a session revoked, expired or rotated away meanwhile is
+ * no one — `null`, never the operator). An authorized session is the account it was signed in as, or (an `agend web`
+ * session, the CLI's header token) none: the operator. For recognition only; nothing here authorizes anything.
+ */
+function webAccountOf(req, url, ctx) {
+    const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+    if (verdict.kind !== "allow")
+        return null;
+    return verdict.via === "session" && verdict.session?.owner ? { owner: verdict.session.owner } : {};
+}
+function webPersonOf(req, url, ctx) {
+    // No people kept here: everyone is "web-user", as before, and there is no identity to protect.
+    if (!ctx.webPerson)
+        return { key: OPERATOR, bound: false, userId: WEB_NAME_FALLBACK, voterKey: "web:operator", name: WEB_NAME_FALLBACK, set: false };
+    const who = webAccountOf(req, url, ctx);
+    return who ? ctx.webPerson(who.owner) : null;
+}
+/** #1827: the person, or the request is answered 401 here (it is no longer authorized) and null is returned. */
+function webPersonOr401(req, res, url, ctx) {
+    const p = webPersonOf(req, url, ctx);
+    if (!p)
+        json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+    return p;
+}
+/** #1827: what the page's profile card reads — the name they chose (or null), the one in use, and how agents know them. */
+function profileBody(p) {
+    return { name: p.set ? p.name : null, shown: p.name, id: p.userId, bound: p.bound, ...(p.platformName !== undefined ? { platform_name: p.platformName } : {}) };
+}
+/** #1823: an SSE frame with the server's clock (no id: it is not a message, and a reconnect gets a fresh one). */
+function sseClock() { return `event: clock\ndata: ${JSON.stringify({ now: Date.now() })}\n\n`; }
 /**
  * Handle a Web UI request. Returns true if handled, false to pass through.
  */
@@ -242,6 +293,8 @@ export function handleWebRequest(req, res, url, ctx) {
             // #1577: the newest message this answer accounts for — after a restart, the last restored one until this process
             // records its own (`<boot>-0` would be after(0): the whole restored history again on every poll).
             cursor: history ? history.pollCursor() : null,
+            // #1823 (#1830 review): the server's clock now, for the page's poll countdown (a poll's deadline is the server's).
+            now: Date.now(),
         });
         return true;
     }
@@ -255,7 +308,9 @@ export function handleWebRequest(req, res, url, ctx) {
             "Cache-Control": "no-cache",
             Connection: "keep-alive",
         });
-        res.write(`event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n`);
+        // #1823 (#1830 review): with the status, the server's clock — now and with every heartbeat — that the page counts a
+        // poll down by (one write: the frames a connect sends are unchanged in number).
+        res.write(`event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n${sseClock()}`);
         // An EventSource that reconnects says what it last saw: send what it missed, before anything new.
         const lastSeen = parseLastEventId(req.headers["last-event-id"]);
         if (lastSeen !== null && ctx.webChatHistory) {
@@ -291,7 +346,7 @@ export function handleWebRequest(req, res, url, ctx) {
             }
             try {
                 // Every open dashboard tab, every 10 s: the status of every instance, serialized on the fleet's loop (#1235).
-                res.write(measureSyncWork("web.sseStatus", () => `event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n`));
+                res.write(measureSyncWork("web.sseStatus", () => `event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n`) + sseClock());
             }
             catch {
                 cleanup();
@@ -328,6 +383,45 @@ export function handleWebRequest(req, res, url, ctx) {
         json(res, 200, { messages: ctx.webChatHistory?.list(instance, limit) ?? [], boot: ctx.webChatHistory?.boot ?? null, lastId: ctx.webChatHistory?.lastId ?? 0 });
         return true;
     }
+    // ── #1218: the Log tab ─────────────────────────────────
+    // An instance's steps, read on demand from its own transcript (log-service.ts). Read-only, and offered on the public
+    // link on purpose (the user's decision): the same masking applies to every viewer. Passive (web-auth.ts).
+    if (method === "GET" && path === "/ui/steps") {
+        const p = url.searchParams;
+        const instance = p.get("instance") ?? "";
+        const num = (k) => {
+            const v = p.get(k);
+            if (v === null)
+                return undefined;
+            const n = Number(v);
+            return /^\d{1,15}$/.test(v) && Number.isSafeInteger(n) ? n : null;
+        };
+        const after = num("after"), before = num("before"), ev = num("ev"), limit = num("limit");
+        const key = p.get("key");
+        if (!instance || instance.length > 128 || after === null || before === null || ev === null || limit === null
+            || (limit !== undefined && (limit < 1 || limit > 200)) || (key !== null && !/^\d{1,20}-\d{1,20}$/.test(key))) {
+            json(res, 400, { error: "instance (1-128 chars); after, before, ev: offsets; limit 1-200; key: <dev>-<ino>" });
+            return true;
+        }
+        if (!ctx.logSteps) {
+            json(res, 404, { error: "not available" });
+            return true;
+        }
+        ctx.logSteps(instance, {
+            ...(after !== undefined ? { after } : {}), ...(before !== undefined ? { before } : {}), ...(ev !== undefined ? { ev } : {}),
+            ...(limit !== undefined ? { limit } : {}), ...(key !== null ? { key } : {}),
+            skip: p.get("skip") === "1", watch: p.get("watch") === "1",
+        }).then(answer => {
+            if (answer === null)
+                json(res, 404, { error: `Instance not found: ${instance}` });
+            else
+                json(res, 200, answer);
+        }).catch(err => {
+            ctx.logger.error({ err: err.message, instance }, "Log steps read failed");
+            json(res, 500, { error: "could not read the steps" });
+        });
+        return true;
+    }
     // ── Send message ───────────────────────────────────────
     if (method === "POST" && path === "/ui/send") {
         handleSendMessage(req, res, ctx);
@@ -365,6 +459,66 @@ export function handleWebRequest(req, res, url, ctx) {
         res.end(bytes);
         return true;
     }
+    // ── #1630: avatars and Discord server emoji, same-origin (the page never loads a platform's CDN; img-src stays 'self') ──
+    const imageMatch = path.match(/^\/ui\/img\/(bot|avatar|emoji)\/([^/]+)$/);
+    if (method === "GET" && imageMatch) {
+        const kind = imageMatch[1];
+        let key;
+        try {
+            key = decodeURIComponent(imageMatch[2]);
+        }
+        catch {
+            json(res, 404, { error: "No such image" });
+            return true;
+        }
+        const send = (image) => {
+            if (res.headersSent || res.destroyed)
+                return;
+            if (!stillAuthorized(req, res, url, ctx))
+                return;
+            if (!image) {
+                json(res, 404, { error: "No such image" });
+                return;
+            }
+            res.setHeader("Content-Type", image.mime);
+            res.setHeader("X-Content-Type-Options", "nosniff");
+            // A changed avatar is a new URL (?v=); an emoji id is one picture for good.
+            res.setHeader("Cache-Control", "private, max-age=86400");
+            res.setHeader("Content-Security-Policy", "default-src 'none'; sandbox");
+            res.writeHead(200);
+            res.end(image.bytes);
+        };
+        if (kind === "emoji") {
+            (ctx.webEmoji ? ctx.webEmoji(key) : Promise.resolve(null)).then(send, () => send(null));
+            return true;
+        }
+        send(ctx.webImage?.(kind, key) ?? null);
+        return true;
+    }
+    if (method === "GET" && path === "/ui/emojis") {
+        const answer = (emojis) => { if (!res.headersSent && !res.destroyed && stillAuthorized(req, res, url, ctx))
+            json(res, 200, { emojis }); };
+        (ctx.webEmojiList ? ctx.webEmojiList() : Promise.resolve([])).then(answer, () => answer([]));
+        return true;
+    }
+    // #1682: the names of the mention ids a page found in what it rendered (at most MAX_MENTION_IDS, digits only) — only
+    // those, so no page (the public link included) ever gets a directory; from memory, never a request.
+    if (method === "GET" && path === "/ui/mentions") {
+        const parsed = parseMentionQuery(url.searchParams);
+        if (!parsed.ok) {
+            json(res, 400, { error: parsed.error });
+            return true;
+        }
+        let names = { u: {}, r: {}, c: {} };
+        try {
+            names = ctx.webMentionNames?.(parsed.query) ?? names;
+        }
+        catch (err) {
+            ctx.logger.debug({ err: err.message }, "mention names unavailable");
+        }
+        json(res, 200, names);
+        return true;
+    }
     // ── Fleet prompts (C4): the hang / exit / interactive-prompt buttons, answerable here too ──
     if (method === "GET" && path === "/ui/prompts") {
         json(res, 200, { prompts: ctx.listWebPrompts?.() ?? [] });
@@ -409,6 +563,63 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // #1827: the person's own name — the one agents and chats see for their web messages. Their own profile, so the public
+    // link may read and set it too (profile edits are allowed there); a read-only session may as well: it is about them.
+    if (path === "/ui/profile" && method === "GET") {
+        if (!ctx.webPerson) {
+            json(res, 404, { error: "Profiles are not kept on this fleet" });
+            return true;
+        }
+        const p = webPersonOr401(req, res, url, ctx);
+        if (p)
+            json(res, 200, profileBody(p));
+        return true;
+    }
+    if (path === "/ui/profile" && method === "POST") {
+        if (!ctx.setWebPersonName) {
+            json(res, 404, { error: "Profiles are not kept on this fleet" });
+            return true;
+        }
+        const set = ctx.setWebPersonName.bind(ctx);
+        (async () => {
+            let body;
+            try {
+                body = await parseBody(req);
+            }
+            catch {
+                json(res, 400, { error: "Invalid JSON" });
+                return;
+            }
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            if (!body || typeof body !== "object" || Array.isArray(body) || !Object.hasOwn(body, "name")) {
+                json(res, 400, { error: "name required (text, or null to clear)" });
+                return;
+            }
+            // Whose: asked once the body is in. A session revoked, expired or rotated away meanwhile writes nothing — it is
+            // not the operator (#1833 review).
+            const who = webAccountOf(req, url, ctx);
+            if (!who) {
+                json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                return;
+            }
+            const r = set(who.owner, body.name);
+            if (!r.ok) {
+                json(res, r.status, { error: r.error });
+                return;
+            }
+            // The person's other devices read it at their next status (the prefs rev moved).
+            ctx.emitSseEvent("status", ctx.getUiStatus());
+            json(res, 200, profileBody(r.person));
+        })().catch(err => {
+            ctx.logger.error({ err: err.message }, "Saving the web name failed");
+            try {
+                json(res, 500, { error: "Saving the name failed" });
+            }
+            catch { /* already answered */ }
+        });
+        return true;
+    }
     // #1266: a click on an agent reply's button. The set id travels in the body; the public link may click too (a click
     // is a message, and the public link may send messages).
     if (method === "POST" && path === "/ui/reply-button") {
@@ -433,8 +644,14 @@ export function handleWebRequest(req, res, url, ctx) {
                 json(res, 400, { error: "instance, id and index required" });
                 return;
             }
-            const r = await click(instance, id, index);
-            json(res, r.status, r.status === 200 ? { answered: true } : { error: r.error ?? "Refused", ...(r.status === 409 ? { gone: true } : {}) });
+            // #1823/#1827: the click is this page's person's — on a poll their vote (one per person, on every device of
+            // theirs), on one-click buttons their choice — under their web id and name. A request that no longer passes the
+            // gate (a session revoked meanwhile) clicks nothing as anyone.
+            const person = webPersonOr401(req, res, url, ctx);
+            if (!person)
+                return;
+            const r = await click(instance, id, index, { key: person.voterKey, userId: person.userId, name: person.name });
+            json(res, r.status, r.status === 200 ? { answered: true, ...(r.options ? { options: r.options } : {}) } : { error: r.error ?? "Refused", ...(r.status === 409 ? { gone: true } : {}) });
         })().catch(err => {
             ctx.logger.error({ err: err.message }, "Web reply-button click failed");
             try {
@@ -444,6 +661,97 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // #1723: the public link page's preview, asked while it says "Preview is starting…" — its state and, once up, its
+    // origin and boot. Public link only: a local page's preview is decided by its own load.
+    if (path === "/ui/preview-status" && method === "GET") {
+        const gateway = gatewayRequestContext(req);
+        if (!gateway || !ctx.publicPreviewForUi) {
+            json(res, 404, { error: "not offered here" });
+            return true;
+        }
+        const p = ctx.publicPreviewForUi(gateway.exposureId, gateway.expectedOrigin);
+        json(res, 200, { code: p.code, previewOrigin: p.previewOrigin, boot: p.previewOrigin ? p.boot : null, detail: p.detail ?? null });
+        return true;
+    }
+    // #1665: the web preferences that follow the person between devices. Read by any page of the panel, the public link
+    // included (it reads what is in force); written only by a signed-in admin session or the CLI's header token — never
+    // over the public link (absent from its route manifest, and refused here too), never by a read-only session.
+    if (path === "/ui/prefs" && method === "GET") {
+        if (!ctx.webPrefs) {
+            json(res, 404, { error: "Preferences are not kept on this fleet" });
+            return true;
+        }
+        json(res, 200, ctx.webPrefs.read(OPERATOR));
+        return true;
+    }
+    if (path === "/ui/prefs" && method === "POST") {
+        const prefs = ctx.webPrefs;
+        if (!prefs) {
+            json(res, 404, { error: "Preferences are not kept on this fleet" });
+            return true;
+        }
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "prefs_not_over_public_link" });
+            return true;
+        }
+        // Who may write, asked now and again once the body is in: a session revoked or expired, or a token rotated, while
+        // the body was on its way writes nothing and announces nothing.
+        const writer = () => {
+            const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+            if (verdict.kind !== "allow")
+                return 401;
+            return verdict.via === "session" && verdict.session?.tier !== "admin" ? 403 : 200;
+        };
+        const refuse = (code) => json(res, code, code === 401 ? { error: WEB_TOKEN_INVALID_MESSAGE } : { error: "prefs_read_only" });
+        const first = writer();
+        if (first !== 200) {
+            refuse(first);
+            return true;
+        }
+        (async () => {
+            let body;
+            try {
+                body = await parseBody(req);
+            }
+            catch {
+                json(res, 400, { error: "Invalid JSON" });
+                return;
+            }
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            if (!body || typeof body !== "object" || Array.isArray(body)) {
+                json(res, 400, { error: "set required" });
+                return;
+            }
+            const parsed = prefs.parsePatch(body.set);
+            if (!parsed.ok) {
+                json(res, 400, { error: parsed.error });
+                return;
+            }
+            const now = writer();
+            if (now !== 200) {
+                refuse(now);
+                return;
+            }
+            const onlyIfUnset = body.onlyIfUnset === true;
+            const written = prefs.write(OPERATOR, parsed.patch, { onlyIfUnset });
+            if (!written.ok) {
+                json(res, written.status, { error: written.error });
+                return;
+            }
+            // Another device sees the new rev in the next status frame — at once on the live stream.
+            if (written.changed.length)
+                ctx.emitSseEvent("status", ctx.getUiStatus());
+            json(res, 200, { ...written.view, changed: written.changed });
+        })().catch(err => {
+            ctx.logger.error({ err: err.message }, "Saving web preferences failed");
+            try {
+                json(res, 500, { error: "Saving preferences failed" });
+            }
+            catch { /* already answered */ }
+        });
+        return true;
+    }
     // #1386: Acknowledge a "Needs you" delivery item — a session write (CSRF, checked by the gate) or the CLI's header
     // token. Who did it is recorded by principal: the session's public handle, never the session id or a credential.
     if (method === "POST" && path === "/ui/needs/ack") {
@@ -519,7 +827,10 @@ export function handleWebRequest(req, res, url, ctx) {
                 json(res, 400, { error: "invalid confirmation" });
                 return;
             }
-            const r = await run({ instance, command, args: str(body.args, MAX_COMMAND_ARGS), confirm: body.confirm }, { publicLink: !!gatewayRequestContext(req) });
+            const person = webPersonOr401(req, res, url, ctx); // #1827: asked again, now the body is in
+            if (!person)
+                return;
+            const r = await run({ instance, command, args: str(body.args, MAX_COMMAND_ARGS), confirm: body.confirm }, { publicLink: !!gatewayRequestContext(req), person });
             json(res, r.status, r.body);
         })().catch(err => {
             ctx.logger.error({ err: err.message }, "Web command failed");
@@ -553,7 +864,7 @@ export function handleWebRequest(req, res, url, ctx) {
             json(res, 409, { error: `${name} is not running` });
             return true;
         }
-        ctx.eventLog?.logActivity("cancel", "web-user", "stop the current reply", name);
+        ctx.eventLog?.logActivity("cancel", webPersonOf(req, url, ctx)?.name ?? WEB_NAME_FALLBACK, "stop the current reply", name);
         json(res, 200, { cancelled: name });
         return true;
     }
@@ -586,13 +897,18 @@ export function handleWebRequest(req, res, url, ctx) {
         }
         const topicMode = ctx.fleetConfig?.channel?.mode === "topic";
         (async () => {
+            let held = false;
             try {
-                await ctx.startInstance(name, config, topicMode ?? false);
+                await withSpawnHoldReply(async (message) => { held = true; json(res, 202, { held: true, message, instance: name }); }, () => ctx.startInstance(name, config, topicMode ?? false));
                 ctx.emitSseEvent("status", ctx.getUiStatus());
-                json(res, 200, { started: name });
+                if (!held)
+                    json(res, 200, { started: name });
             }
             catch (err) {
-                json(res, 500, { error: err.message });
+                if (!held)
+                    json(res, 500, { error: err.message });
+                else
+                    ctx.logger.error({ err, name }, "Held instance action failed");
             }
         })();
         return true;
@@ -705,14 +1021,19 @@ export function handleWebRequest(req, res, url, ctx) {
     if (method === "POST" && restartMatch) {
         const name = decodeURIComponent(restartMatch[1]);
         (async () => {
+            let held = false;
             try {
-                await ctx.restartSingleInstance(name, { explicit: true });
+                await withSpawnHoldReply(async (message) => { held = true; json(res, 202, { held: true, message, instance: name }); }, () => ctx.restartSingleInstance(name, { explicit: true }));
                 ctx.emitSseEvent("status", ctx.getUiStatus());
-                json(res, 200, { restarted: name });
+                if (!held)
+                    json(res, 200, { restarted: name });
             }
             catch (err) {
                 const status = err.message.includes("not found") ? 404 : 500;
-                json(res, status, { error: err.message });
+                if (!held)
+                    json(res, status, { error: err.message });
+                else
+                    ctx.logger.error({ err, name }, "Held instance action failed");
             }
         })();
         return true;
@@ -774,12 +1095,15 @@ export function handleWebRequest(req, res, url, ctx) {
                 const parsed = parseOrReject(TaskCreateSchema, body, res);
                 if (!parsed)
                     return;
+                const person = webPersonOr401(req, res, url, ctx); // #1827: asked again, now the body is in
+                if (!person)
+                    return;
                 const task = ctx.scheduler.db.createTask({
                     title: parsed.title,
                     description: parsed.description,
                     priority: parsed.priority,
                     assignee: parsed.assignee,
-                    created_by: "web-user",
+                    created_by: person.name, // #1827
                 });
                 json(res, 200, task);
             }
@@ -806,7 +1130,10 @@ export function handleWebRequest(req, res, url, ctx) {
                     return;
                 let result;
                 if (parsed.action === "claim") {
-                    result = ctx.scheduler.db.claimTask(id, parsed.assignee || "web-user");
+                    const person = parsed.assignee ? null : webPersonOr401(req, res, url, ctx); // #1827: the default is the person
+                    if (!parsed.assignee && !person)
+                        return;
+                    result = ctx.scheduler.db.claimTask(id, parsed.assignee || person.name);
                 }
                 else if (parsed.action === "complete") {
                     result = ctx.scheduler.db.completeTask(id, parsed.result);
@@ -830,10 +1157,28 @@ export function handleWebRequest(req, res, url, ctx) {
             json(res, 200, { schedules: [] });
             return true;
         }
-        json(res, 200, { schedules: ctx.scheduler.list() });
+        // #1724: each row with its next run and one-shot time in the fleet's zone — worked out here, not on the page.
+        const scheduler = ctx.scheduler;
+        const now = Date.now();
+        json(res, 200, {
+            schedules: scheduler.list().map((s) => scheduleView(s, scheduler.getRetry?.(s.id) ?? null, now)),
+            // The zone a new schedule (and a "Once" date and time typed without one) is read in.
+            default_timezone: ctx.fleetConfig?.defaults?.scheduler?.default_timezone
+                ?? DEFAULT_SCHEDULER_CONFIG.default_timezone,
+        });
         return true;
     }
+    // #1724: who may write a schedule, asked again once the body is in (a session revoked meanwhile, a non-admin tier).
+    const scheduleWriterGone = () => {
+        const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+        return verdict.kind !== "allow" || (verdict.via === "session" && verdict.session?.tier !== "admin");
+    };
     if (method === "POST" && path === "/ui/schedules") {
+        // #1724: schedules are not created, edited or deleted over the public link (absent from its manifest too, #1689).
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "schedule_not_over_public_link" });
+            return true;
+        }
         if (!ctx.scheduler) {
             json(res, 500, { error: "Scheduler not initialized" });
             return true;
@@ -843,10 +1188,23 @@ export function handleWebRequest(req, res, url, ctx) {
                 const body = await parseBody(req);
                 if (!permitWebContinuation(req, res, ctx))
                     return;
-                const parsed = parseOrReject(ScheduleCreateSchema, body, res);
+                if (scheduleWriterGone()) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
+                // #1724: the create_schedule tool's own schema — cron or at (exactly one) — plus a target, which the web names.
+                const parsed = parseOrReject(CreateScheduleArgs, body, res);
                 if (!parsed)
                     return;
-                const schedule = ctx.scheduler.create(parsed);
+                if (typeof parsed.target !== "string" || !parsed.target) {
+                    json(res, 400, { error: "target: an instance is required" });
+                    return;
+                }
+                const schedule = ctx.scheduler.create({
+                    cron: parsed.cron, at: parsed.at, message: parsed.message, target: parsed.target, label: parsed.label, timezone: parsed.timezone,
+                    ...(parsed.silent !== undefined ? { silent: parsed.silent } : {}),
+                    source: "web", reply_chat_id: "", reply_thread_id: null,
+                });
                 json(res, 200, schedule);
             }
             catch (err) {
@@ -856,7 +1214,48 @@ export function handleWebRequest(req, res, url, ctx) {
         return true;
     }
     const schedDelMatch = path.match(/^\/ui\/schedules\/(.+)$/);
+    // #1724: Edit — the update_schedule tool's validation (UpdateScheduleArgs) and its call (scheduler.update): cron and at
+    // clear each other there; silent is not touched.
+    if (method === "PATCH" && schedDelMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "schedule_not_over_public_link" });
+            return true;
+        }
+        if (!ctx.scheduler || typeof ctx.scheduler.update !== "function") {
+            json(res, 500, { error: "Scheduler not initialized" });
+            return true;
+        }
+        const id = decodeURIComponent(schedDelMatch[1]);
+        (async () => {
+            try {
+                const body = await parseBody(req);
+                if (!permitWebContinuation(req, res, ctx))
+                    return;
+                if (scheduleWriterGone()) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
+                if (!body || typeof body !== "object" || Array.isArray(body) || Object.hasOwn(body, "id")) {
+                    json(res, 400, { error: "expected the fields to change (the id is the path's)" });
+                    return;
+                }
+                const parsed = parseOrReject(UpdateScheduleArgs, { ...body, id }, res);
+                if (!parsed)
+                    return;
+                const { id: _id, ...changes } = parsed;
+                json(res, 200, ctx.scheduler.update(id, changes));
+            }
+            catch (err) {
+                json(res, 400, { error: err.message });
+            }
+        })();
+        return true;
+    }
     if (method === "DELETE" && schedDelMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "schedule_not_over_public_link" });
+            return true;
+        }
         if (!ctx.scheduler) {
             json(res, 500, { error: "Scheduler not initialized" });
             return true;
@@ -893,26 +1292,82 @@ export function handleWebRequest(req, res, url, ctx) {
         return true;
     }
     if (method === "POST" && path === "/ui/teams") {
+        // #1689: not over the public link (absent from its manifest too), like editing and deleting a team.
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "teams_not_over_public_link" });
+            return true;
+        }
         (async () => {
             try {
                 const body = await parseBody(req);
                 if (!permitWebContinuation(req, res, ctx))
                     return;
+                // #1692: who may write, asked again once the body is in (as the edit does).
+                const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+                if (verdict.kind !== "allow" || (verdict.via === "session" && verdict.session?.tier !== "admin")) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
                 const parsed = parseOrReject(TeamCreateSchema, body, res);
                 if (!parsed)
                     return;
-                if (!ctx.fleetConfig) {
-                    json(res, 500, { error: "No fleet config" });
+                // #1692: the create_team path — members checked, an existing team never overwritten, a failed save undone.
+                const r = commitTeamCreate(ctx.fleetConfig, parsed, () => ctx.saveFleetConfig());
+                if (!r.ok) {
+                    json(res, r.status, { error: r.error });
                     return;
                 }
-                if (!ctx.fleetConfig.teams)
-                    ctx.fleetConfig.teams = {};
-                ctx.fleetConfig.teams[parsed.name] = {
-                    members: parsed.members,
-                    description: parsed.description,
-                };
-                ctx.saveFleetConfig();
-                json(res, 200, { created: parsed.name });
+                json(res, 200, r.result);
+            }
+            catch (err) {
+                json(res, 400, { error: err.message });
+            }
+        })();
+        return true;
+    }
+    // #1689: edit a team — the same update as the update_team tool (applyTeamUpdate), from the members the page sends:
+    // what to add and remove is worked out against the team as it is now. Never over the public link.
+    const teamEditMatch = path.match(/^\/ui\/teams\/(.+)$/);
+    if ((method === "PATCH" || method === "PUT") && teamEditMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "teams_not_over_public_link" });
+            return true;
+        }
+        const name = decodeURIComponent(teamEditMatch[1]);
+        // Who may write, asked again once the body is in (#1693 review): a session revoked or a token rotated meanwhile
+        // writes nothing.
+        const writerNow = () => {
+            const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+            return verdict.kind === "allow" && !(verdict.via === "session" && verdict.session?.tier !== "admin");
+        };
+        (async () => {
+            try {
+                const body = await parseBody(req);
+                if (!permitWebContinuation(req, res, ctx))
+                    return;
+                if (!writerNow()) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
+                const parsed = parseOrReject(TeamEditSchema, body, res);
+                if (!parsed)
+                    return;
+                const teams = ctx.fleetConfig?.teams;
+                const current = teams && Object.hasOwn(teams, name) ? teams[name].members : null;
+                if (!current) {
+                    json(res, 404, { error: `Team not found: ${name}` });
+                    return;
+                }
+                const want = [...new Set(parsed.members)];
+                // The update and its save as one: a failed save leaves the team as it was (500).
+                const r = commitTeamUpdate(ctx.fleetConfig, {
+                    name, add: want.filter(m => !current.includes(m)), remove: current.filter(m => !want.includes(m)), description: parsed.description,
+                }, () => ctx.saveFleetConfig());
+                if (!r.ok) {
+                    json(res, r.status, { error: r.error });
+                    return;
+                }
+                json(res, 200, { updated: r.result });
             }
             catch (err) {
                 json(res, 400, { error: err.message });
@@ -922,8 +1377,13 @@ export function handleWebRequest(req, res, url, ctx) {
     }
     const teamDelMatch = path.match(/^\/ui\/teams\/(.+)$/);
     if (method === "DELETE" && teamDelMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "teams_not_over_public_link" });
+            return true;
+        }
         const name = decodeURIComponent(teamDelMatch[1]);
-        if (!ctx.fleetConfig?.teams?.[name]) {
+        // Own keys (#1689): a team is one fleet.yaml defines — "__proto__" or "constructor" is not found.
+        if (!ctx.fleetConfig?.teams || !Object.hasOwn(ctx.fleetConfig.teams, name)) {
             json(res, 404, { error: `Team not found: ${name}` });
             return true;
         }
@@ -1062,6 +1522,14 @@ function handleSendMessage(req, res, ctx) {
                 return;
             }
             const message = typed;
+            // #1827: who is writing — the name agents and chats see, and the id they tell people apart by. Asked now that the
+            // body is in: a session revoked meanwhile sends nothing (not as the operator).
+            const person = webPersonOf(req, new URL(req.url ?? "/", "http://localhost"), ctx);
+            if (!person) {
+                ctx.webFiles?.release(files);
+                json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                return;
+            }
             const ts = new Date().toISOString();
             // The id the agent is given, and the one its delivery reports come back under: the page's ticks.
             const messageId = newWebMessageId();
@@ -1080,7 +1548,7 @@ function handleSendMessage(req, res, ctx) {
             // opt-in resolved at send time inside sendClassicWebEcho.
             const canClassicEcho = ctx.isClassicInstance?.(instance) === true && !!ctx.sendClassicWebEcho;
             const settleClassicEcho = canClassicEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
-                await ctx.sendClassicWebEcho(instance, formatWebChannelEcho("web-user", preview, t("web.echo_full_text")));
+                await ctx.sendClassicWebEcho(instance, formatWebChannelEcho(person.name, preview, t("web.echo_full_text")), person.name);
             }) : undefined;
             const settleEcho = canEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
                 // A replacement adapter or edited binding is not the route we reserved.
@@ -1088,18 +1556,21 @@ function handleSendMessage(req, res, ctx) {
                     || (ctx.getGroupIdForInstance?.(instance) ?? String(ctx.fleetConfig?.channel?.group_id ?? "")) !== groupId
                     || ctx.fleetConfig?.instances[instance]?.topic_id !== topicId)
                     return;
-                return syncAdapter.sendText(String(groupId), formatWebChannelEcho("web-user", preview, t("web.echo_full_text")), { threadId: String(topicId), format: "text", allowedMentions: { parse: [] } });
+                return syncAdapter.sendText(String(groupId), formatWebChannelEcho(person.name, preview, t("web.echo_full_text")), { threadId: String(topicId), format: "text", allowedMentions: { parse: [] } });
             }) : undefined;
             let delivered;
             try {
-                delivered = await ctx.deliverToInstance(instance, {
+                const deliver = (name, payload) => ctx.deliverHumanToInstance
+                    ? ctx.deliverHumanToInstance(name, payload, webHumanOrigin(), typed)
+                    : ctx.deliverToInstance(name, payload);
+                delivered = await deliver(instance, {
                     type: "fleet_inbound",
                     content: delivery.text,
                     targetSession: instance,
                     meta: {
                         chat_id: groupId ? String(groupId) : "",
                         message_id: messageId,
-                        user: "web-user", user_id: "web-user",
+                        user: person.name, user_id: person.userId,
                         ts,
                         thread_id: topicId != null ? String(topicId) : "",
                         source: "web",
@@ -1129,10 +1600,17 @@ function handleSendMessage(req, res, ctx) {
             }
             settleEcho?.(true);
             settleClassicEcho?.(true);
+            // #1666: the same cancel/progress bubble a platform inbound starts, in the topic the echo went to — a second turn
+            // on the echo's lane, so the topic reads "echo, then bubble" and a cancel in between drops it (the lane's epoch).
+            // Not a copy (#1668): a slow bubble never drops the next message's echo, and a slow echo never drops the bubble.
+            if (settleEcho && ctx.startWebChatProgress) {
+                const startProgress = ctx.startWebChatProgress.bind(ctx);
+                ctx.reserveWebChannelEcho?.(instance, () => startProgress(instance), { copy: false })(true);
+            }
             ctx.webFiles?.commit(files);
-            ctx.lastInboundUser.set(instance, "web-user");
-            ctx.eventLog?.logActivity("message", "web-user", (message || `[${files.length} file(s)]`).slice(0, 200), instance);
-            ctx.emitSseEvent("message", { instance, sender: "web-user", role: "user", text: message, ts, attachments: files.map(publicAttachment), messageId });
+            ctx.lastInboundUser.set(instance, person.name);
+            ctx.eventLog?.logActivity("message", person.name, (message || `[${files.length} file(s)]`).slice(0, 200), instance);
+            ctx.emitSseEvent("message", { instance, sender: person.name, role: "user", text: message, ts, attachments: files.map(publicAttachment), messageId });
             json(res, 200, { sent: true, messageId });
         }
         catch {
@@ -1209,8 +1687,12 @@ function handleUpload(req, res, url, ctx) {
     });
 }
 function shellPreview(req, ctx, mode) {
-    if (mode !== "full" || gatewayRequestContext(req))
+    if (mode !== "full")
         return null;
+    // #1723: a page of the public link asks its own exposure's preview — never the local listener's Host-based choice.
+    const gateway = gatewayRequestContext(req);
+    if (gateway)
+        return ctx.publicPreviewForUi?.(gateway.exposureId, gateway.expectedOrigin) ?? null;
     return ctx.previewForUi?.(typeof req.headers.host === "string" ? req.headers.host : undefined, isSecureRequest(req)) ?? null;
 }
 /**
@@ -1259,6 +1741,21 @@ function serveMediaRange(req, res, files, id, file) {
     res.writeHead(ranged ? 206 : 200);
     res.end(got.bytes);
 }
+/**
+ * #1665: `<html>` carrying the host's preferences (data-prefs: `{"rev":n,"values":{…}}`, attribute-escaped). theme.js (a
+ * blocking script in <head>) and the app's dictionary take the theme and language from it over the browser's cache,
+ * and app-prefs.js copies every value into that cache before any panel reads it — so no device paints a stale theme
+ * or replays a tour already seen, a new device included. Only for the signed-in app (the public link reads what is in
+ * force too); the anonymous View reader and the sign-in page keep the browser's own.
+ */
+function shellHtmlTag(ctx, mode) {
+    if (mode !== "full" || !ctx.webPrefs)
+        return '<html lang="en">';
+    const view = ctx.webPrefs.read(OPERATOR);
+    const lang = view.values.lang === "zh-TW" ? "zh-Hant" : "en";
+    const attr = (v) => v.replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
+    return `<html lang="${lang}" data-prefs="${attr(JSON.stringify({ rev: view.rev, values: view.values }))}">`;
+}
 function shellBodyTag(req, ctx, mode) {
     const p = shellPreview(req, ctx, mode);
     const attr = (v) => String(v ?? "").replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
@@ -1266,8 +1763,14 @@ function shellBodyTag(req, ctx, mode) {
         + ` data-preview-boot="${attr(p?.previewOrigin ? p.boot : "")}" data-preview-reason="${attr(p ? p.reason : "Previews are not available on this fleet.")}"`
         // #1554: no availability asked (the public link, or not the full app) still says why, in the page's language.
         + ` data-preview-reason-code="${attr(p ? p.code ?? "" : gatewayRequestContext(req) ? "publicLink" : "notOffered")}"`
+        // #1723: why the public link's preview tunnel failed (a fixed reason the page words), when it did.
+        + `${p?.detail ? ` data-preview-detail="${attr(p.detail)}"` : ""}`
         // #1523 N3: whether the fleet serves /api/ai-usage (web.usage_panel), for every page's ◔.
         + ` data-usage-panel="${ctx.fleetConfig?.web?.usage_panel === false ? "0" : "1"}"`
+        // #1218: whether the Log tab is on (web.log_tab; off by default): the tab says so and offers to turn it on.
+        + ` data-log-tab="${ctx.fleetConfig?.web?.log_tab === true ? "1" : "0"}"`
+        // #1770: the fleet's zone (chat-logs' and fleet.log's), in which the chat reads its message times and days.
+        + ` data-fleet-tz="${attr(resolveTz())}"`
         // #1589: the public link shows attachments as downloads only (no inline text or media): its scope is unchanged.
         + `${gatewayRequestContext(req) ? ' data-public-link="1"' : ""}>`;
 }
@@ -1282,7 +1785,10 @@ export function serveAppShell(req, res, ctx, mode) {
         const own = mode === "full" && !gatewayRequestContext(req)
             ? dashboardOriginFor(typeof req.headers.host === "string" ? req.headers.host : undefined, isSecureRequest(req)) : null;
         const mediaSrc = own ? `${own}/ui/file/` : "'none'";
-        sendPanelHtml(res, html.replace("<body>", shellBodyTag(req, ctx, mode)), 200, {}, { ...(p?.previewOrigin ? { frameSrc: `${p.previewOrigin}/frame` } : {}), mediaSrc });
+        // A public-link page frames what its exposure's preview names (the quick-tunnel wildcard: its host is not known when
+        // the page may load); every other page frames exactly the origin this load chose (#1723).
+        const frameSrc = p && "frameSrc" in p ? p.frameSrc : p?.previewOrigin ? `${p.previewOrigin}/frame` : null;
+        sendPanelHtml(res, html.replace('<html lang="en">', shellHtmlTag(ctx, mode)).replace("<body>", shellBodyTag(req, ctx, mode)), 200, {}, { ...(frameSrc ? { frameSrc } : {}), mediaSrc });
     }
     catch {
         json(res, 500, { error: "app.html not found" });