@songsid/agend 2.2.0-beta.10 → 2.2.0-beta.12

package/dist/update-launch.js

@@ -1,9 +1,141 @@
 /** Chat updates must survive the fleet's service cgroup being stopped (#1490 row 37). */
 import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
+import { appendFileSync, existsSync, fchmodSync, openSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { promisify } from "node:util";
 import { updateCommand } from "./update-dispatch.js";
+import { maskSecrets } from "./log-steps.js";
+/** How many bytes to read from the tail of the log when extracting a cause after the updater exits. */
+const CAUSE_TAIL_BYTES = 8 * 1024;
+/** How many bytes to cap the update.log file at (across all runs). */
+export const UPDATE_LOG_FILE_CAP = 400 * 1024;
+/**
+ * Path of the update log file (mode 0600; raw updater output is written directly — secrets are
+ * masked only when extracting the short cause shown in chat; the file itself is owner-readable only).
+ */
+export function updateLogPath(dataDir) {
+    return join(dataDir, "update.log");
+}
+/**
+ * Extract a short human-readable cause from raw updater output.
+ * Prefers the last `npm ERR!`/`npm error` summary line or the last `✗` line.
+ * Falls back to the last non-blank line. Masks secrets and caps at ~300 chars.
+ */
+export function extractUpdateCause(output) {
+    // Lines starting with --- are log headers, not updater output.
+    const lines = output.split("\n").map(l => l.trimEnd()).filter(l => Boolean(l) && !l.startsWith("---"));
+    if (!lines.length)
+        return null;
+    // npm ERR! ends with !, a non-word char: \b does not anchor here. Use (?:\s|$) instead.
+    const npmErrRe = /^npm (ERR!|error)(?:\s|$)/i;
+    const npmLines = lines.filter(l => npmErrRe.test(l));
+    if (npmLines.length) {
+        // npm 10 always ends with "A complete log of this run can be found in: …". Skip that footer.
+        // Prefer the first `npm error code` line plus the next for context.
+        const codeIdx = npmLines.findIndex(l => /^npm (ERR!|error) code\s/i.test(l));
+        if (codeIdx >= 0) {
+            const summary = [npmLines[codeIdx], npmLines[codeIdx + 1]].filter(Boolean).join(" — ");
+            return maskSecrets(summary).slice(0, 300);
+        }
+        const meaningful = npmLines.filter(l => !/A complete log of this run can be found in/i.test(l));
+        const pick = meaningful.length ? meaningful[meaningful.length - 1] : npmLines[npmLines.length - 1];
+        return maskSecrets(pick).slice(0, 300);
+    }
+    const cross = lines.filter(l => /^\s*[✗✕×✘]/.test(l));
+    if (cross.length)
+        return maskSecrets(cross[cross.length - 1]).slice(0, 300);
+    return maskSecrets(lines[lines.length - 1]).slice(0, 300);
+}
+/** A version or dist-tag as the updater printed it, safe to put in a suggested command; else a placeholder. */
+function updateTarget(output) {
+    const to = /Updating AgEnD v\S+ → v(\S+?)\.\.\./.exec(output)?.[1] ?? /Updating AgEnD to (\S+?)\.\.\./.exec(output)?.[1];
+    return to && /^[0-9A-Za-z][0-9A-Za-z.+-]*$/.test(to) ? to : "<version>";
+}
+/**
+ * #1829: the one-line fix for a failure AgEnD knows, from this run's output (a small lookup; anything else: null).
+ * - `agendGone`: the launched `agend` is no longer there (an install that removed it and did not put it back).
+ * - npm `ENOTEMPTY` on its rename: a staging directory left by an interrupted install. npm names the same one on every
+ *   retry, so the retry fails the same way until it is removed — only that exact directory, and only when it is one of
+ *   AgEnD's own (`@songsid/.agend…`), never a pattern.
+ * - "systemd does not know …": the activation proof could not read the user manager (#1804): the one-time manual hop.
+ */
+export function updateFixHint(output, opts = {}) {
+    const target = updateTarget(output);
+    if (opts.agendGone)
+        return `\`npm install -g @songsid/agend@${target}\``;
+    if (/^npm (?:ERR!|error) code ENOTEMPTY\b/im.test(output)) {
+        const named = /^npm (?:ERR!|error) dest (.+)$/im.exec(output)?.[1] ?? /ENOTEMPTY[^\n]*rename '[^'\n]+' -> '([^'\n]+)'/.exec(output)?.[1];
+        const ours = named && isAbsolute(named) && !/['"\s\\`$]/.test(named)
+            && basename(dirname(named)) === "@songsid" && /^\.agend[A-Za-z0-9._-]*$/.test(basename(named));
+        if (ours)
+            return `remove the directory an interrupted install left, then update again: \`rm -rf '${named}' && agend update\``;
+        return null;
+    }
+    if (/systemd does not know /.test(output))
+        return `\`npm i -g @songsid/agend@${target} && agend restart\``;
+    return null;
+}
+/**
+ * Rotate the log file if needed, write a run header, and return an open file descriptor
+ * for the child process to write to directly — not a pipe.
+ *
+ * Using an fd instead of a pipe means the updater can keep writing after the fleet process
+ * that spawned it has been stopped: there is no read end to close, so no EPIPE.
+ * The caller must closeSync(fd) after spawn so the parent's copy of the fd is released.
+ *
+ * Returns `null` when the log file cannot be opened (dataDir unwritable, disk full, etc.).
+ * In that case the caller should fall back to `stdio: "ignore"` and omit the log note.
+ */
+export function openUpdateLog(logPath, header) {
+    // Rotate BEFORE opening the fd the child will use (never write to the same inode concurrently).
+    try {
+        if (existsSync(logPath) && statSync(logPath).size > UPDATE_LOG_FILE_CAP / 2) {
+            const old = readFileSync(logPath);
+            writeFileSync(logPath, old.subarray(Math.max(0, old.length - UPDATE_LOG_FILE_CAP / 2)));
+        }
+    }
+    catch { /* best-effort */ }
+    try {
+        appendFileSync(logPath, `${header}\n`, { mode: 0o600 });
+    }
+    catch { /* best-effort */ }
+    let fd;
+    try {
+        fd = openSync(logPath, "a", 0o600);
+    }
+    catch {
+        return null; // caller falls back to stdio: "ignore" and no log note
+    }
+    // fchmod: mode param of openSync only applies to new files; existing files keep their mode.
+    try {
+        fchmodSync(fd, 0o600);
+    }
+    catch { /* best-effort */ }
+    // Record the offset so readRunCause only reads this run's output, not previous runs.
+    const offset = (() => { try {
+        return statSync(logPath).size;
+    }
+    catch {
+        return 0;
+    } })();
+    return { fd, offset };
+}
+/**
+ * Read only this run's output from the log (from `offset`): its tail, for the cause and the fix.
+ * Prevents a run with no output from picking up the previous run's error as the cause.
+ */
+function readRunTail(logPath, offset) {
+    try {
+        const buf = readFileSync(logPath);
+        const runBytes = buf.subarray(offset);
+        return runBytes.subarray(Math.max(0, runBytes.length - CAUSE_TAIL_BYTES)).toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
 export const defaultUpdateLaunchDeps = {
     platform: process.platform,
     cgroup: async () => {
@@ -89,18 +221,29 @@ export async function resolveUpdateLaunch(agend, deps = defaultUpdateLaunchDeps)
         ] };
 }
 /** Spawn/manager refusal and nonzero updater exit are visible; exit 75 is the existing pending hand-off. */
-export function watchUpdateLaunch(child, fail) {
+export function watchUpdateLaunch(child, fail, logPath, 
+/** Byte offset into the log file at which this run's output begins. */
+logOffset, 
+/** The `agend` the updater runs: there at launch and gone after a failure → reinstalling is the fix (#1829). */
+agendPath) {
     let reported = false;
+    const agendAtLaunch = agendPath !== undefined && existsSync(agendPath);
     const report = (reason) => {
         if (reported)
             return;
         reported = true;
-        fail(`/update could not complete (${reason}). Run \`agend update\` from a host shell.`);
+        const tail = logPath != null && logOffset != null ? readRunTail(logPath, logOffset) : null;
+        const cause = tail === null ? null : extractUpdateCause(tail);
+        const logNote = logPath ? ` Full log: ${logPath}.` : "";
+        const detail = cause ? ` Cause: ${cause}.${logNote}` : logNote;
+        const fix = updateFixHint(tail ?? "", { agendGone: agendAtLaunch && !existsSync(agendPath) });
+        fail(`/update could not complete (${reason}).${detail} ${fix ? `Fix: ${fix}` : "Run `agend update` from a host shell."}`);
     };
     child.once("error", () => report("updater launch failed"));
     child.once("exit", (code, signal) => {
-        if (signal || (code !== 0 && code !== 75))
+        if (signal || (code !== 0 && code !== 75)) {
             report(signal ? "updater was interrupted" : `updater exited ${code ?? "without a status"}`);
+        }
     });
 }
 //# sourceMappingURL=update-launch.js.map

package/dist/update-launch.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-launch.js","sourceRoot":"","sources":["../src/update-launch.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AASrD,MAAM,CAAC,MAAM,uBAAuB,GAAqB;IACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,MAAM,EAAE,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,KAAK,IAAI,EAAE;QAClB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE;gBACzE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI;aACtD,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC1B,CAAC;IACD,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;CAC7C,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,0EAA0E;QAC1E,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,OAAyB,uBAAuB;IACvG,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7D,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IAAC,CAAC;IACrC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAAC,CAAC;IACjF,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IACjG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IAC5C,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACjE,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wEAAwE,EAAE,CAAC;IAC1I,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC7G,IAAI,CAAC;QACH,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;IACnI,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAAC,CAAC;IACtF,MAAM,KAAK,GAAG,iBAAiB,KAAK,QAAQ,CAAC;IAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;YACtD,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,KAAK,EAAE;YACnF,GAAG,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI;SACjD,EAAE,CAAC;AACN,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,iBAAiB,CAAC,KAA8D,EAAE,IAA+B;IAC/H,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE;QAChC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,+BAA+B,MAAM,4CAA4C,CAAC,CAAC;IAC1F,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAClC,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,IAAI,IAAI,kBAAkB,EAAE,CAAC,CAAC;IACzI,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"update-launch.js","sourceRoot":"","sources":["../src/update-launch.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EAAE,QAAQ,EAAqB,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAa,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7H,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,uGAAuG;AACvG,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AAClC,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACvG,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,wFAAwF;IACxF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,6FAA6F;QAC7F,oEAAoE;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnG,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,+GAA+G;AAC/G,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,EAAE,GAAG,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzH,OAAO,EAAE,IAAI,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAgC,EAAE;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,mCAAmC,MAAM,IAAI,CAAC;IACzE,IAAI,wCAAwC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,gDAAgD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzI,MAAM,IAAI,GAAG,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;eAC/D,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,UAAU,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACjG,IAAI,IAAI;YAAE,OAAO,kFAAkF,KAAK,qBAAqB,CAAC;QAC9H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,6BAA6B,MAAM,qBAAqB,CAAC;IAC3G,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc;IAC3D,gGAAgG;IAChG,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAClC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,cAAc,CAAC,OAAO,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uDAAuD;IACtE,CAAC;IACD,4FAA4F;IAC5F,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1D,qFAAqF;IACrF,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AASD,MAAM,CAAC,MAAM,uBAAuB,GAAqB;IACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,MAAM,EAAE,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,KAAK,IAAI,EAAE;QAClB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE;gBACzE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI;aACtD,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC1B,CAAC;IACD,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;CAC7C,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,0EAA0E;QAC1E,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,OAAyB,uBAAuB;IACvG,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7D,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IAAC,CAAC;IACrC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAAC,CAAC;IACjF,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IACjG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IAC5C,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACjE,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wEAAwE,EAAE,CAAC;IAC1I,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC7G,IAAI,CAAC;QACH,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;IACnI,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAAC,CAAC;IACtF,MAAM,KAAK,GAAG,iBAAiB,KAAK,QAAQ,CAAC;IAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;YACtD,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,KAAK,EAAE;YACnF,GAAG,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI;SACjD,EAAE,CAAC;AACN,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,iBAAiB,CAC/B,KAAiC,EACjC,IAA+B,EAC/B,OAAgB;AAChB,uEAAuE;AACvE,SAAkB;AAClB,gHAAgH;AAChH,SAAkB;IAElB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,aAAa,GAAG,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE;QAChC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC,UAAU,CAAC,SAAU,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,+BAA+B,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,uCAAuC,EAAE,CAAC,CAAC;IAC5H,CAAC,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAClC,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,IAAI,IAAI,kBAAkB,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web-api.d.ts

@@ -10,6 +10,7 @@ import { type WebChatHistory } from "./web-chat-history.js";
 import { type WebFileLedger } from "./web-upload.js";
 import type { WebSessionStore } from "./web-session.js";
 import { type WebPrefsStore } from "./web-prefs.js";
+import { type WebAccount } from "./web-profile.js";
 import { type MentionNames, type MentionQuery } from "./web-mentions.js";
 import type { ExplicitInstanceRemoval } from "./instance-removal.js";
 /**
@@ -104,7 +105,7 @@ export interface WebApiContext {
      * (#1320 part B). Resolves the entries and adapters itself; returns how
      * many channels were posted to. Never rejects the web send on failure.
      */
-    sendClassicWebEcho?(instance: string, text: string): Promise<number>;
+    sendClassicWebEcho?(instance: string, text: string, sender?: string): Promise<number>;
     /** false: definitely not delivered (the instance's IPC is gone, or it was restarted meanwhile). */
     deliverToInstance(instanceName: string, payload: Record<string, unknown>): Promise<boolean | void>;
     deliverHumanToInstance?(instanceName: string, payload: Record<string, unknown>, origin: HumanOrigin, originalBody: string): Promise<boolean | void>;
@@ -160,10 +161,25 @@ export interface WebApiContext {
         confirm?: string;
     }, opts: {
         publicLink: boolean;
+        person?: WebPerson;
     }): Promise<{
         status: number;
         body: unknown;
     }>;
+    /**
+     * #1827: a web person — for the account a session is bound to (none: the operator) — as agents and chats see them.
+     * Absent: everyone is "web-user", as before.
+     */
+    webPerson?(owner?: WebAccount): WebPerson;
+    /** #1827: set (or, with null, clear) a person's own name; refused with a reason. */
+    setWebPersonName?(owner: WebAccount | undefined, raw: unknown): {
+        ok: true;
+        person: WebPerson;
+    } | {
+        ok: false;
+        status: number;
+        error: string;
+    };
     /** #1386: the web's Acknowledge of a delivery item; `principal` is "web:<session handle>" or "cli". */
     acknowledgeNeedsItem?(id: string, principal: string): {
         status: number;
@@ -175,9 +191,14 @@ export interface WebApiContext {
         error?: string;
     }>;
     /** #1266: a click on an agent reply's button. */
-    clickWebReplyButton?(instance: string, id: string, index: number): Promise<{
+    clickWebReplyButton?(instance: string, id: string, index: number, voter?: {
+        key: string;
+        userId: string;
+        name: string;
+    }): Promise<{
         status: number;
         error?: string;
+        options?: number[];
     }>;
     /** Interrupt the current reply and drop what was queued for it; false when the instance is not running. */
     cancelInstance?(name: string): boolean;
@@ -232,6 +253,23 @@ export interface WebApiContext {
         delete(id: string): void;
     } | null;
 }
+/** #1827: a web person as the web chat shows them to agents and chats. */
+export interface WebPerson {
+    /** Their key in the web preferences (web-profile.ts webPersonKey): never shown. */
+    readonly key: string;
+    /** Signed in as an account (a sign-in code DMed to it), or the operator. */
+    readonly bound: boolean;
+    /** What agents see as the id: the bound account's user id on its platform (still `via web`), or "web-user". */
+    readonly userId: string;
+    /** Their poll ballot's key: the account's `<connection>:<user id>` (as on the platform), or the operator's. */
+    readonly voterKey: string;
+    /** The name in use: the one they chose, else their account's name at sign-in, else "web-user". */
+    readonly name: string;
+    /** Whether the name in use is one they chose. */
+    readonly set: boolean;
+    /** Their account's name at sign-in, made safe (bound only). */
+    readonly platformName?: string;
+}
 /**
  * Handle a Web UI request. Returns true if handled, false to pass through.
  */

package/dist/web-api.js

@@ -29,6 +29,7 @@ import { newWebMessageId, parseLastEventId } from "./web-chat-history.js";
 import { attachmentDelivery, displayName, INLINE_MIME, isFileId, MEDIA_RANGE_MAX, publicAttachment, sniffUpload, UPLOAD_LIMITS, wellFormed } from "./web-upload.js";
 import { getAgendHome } from "./paths.js";
 import { OPERATOR } from "./web-prefs.js";
+import { WEB_NAME_FALLBACK } from "./web-profile.js";
 import { commitTeamCreate, commitTeamUpdate } from "./outbound-handlers.js";
 import { parseMentionQuery } from "./web-mentions.js";
 import { authorizeExplicitInstanceRemoval } from "./instance-removal.js";
@@ -149,6 +150,37 @@ function stillAuthorized(req, res, url, ctx) {
     json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
     return false;
 }
+/**
+ * #1827: whose a request is, asked NOW (after its body arrived: a session revoked, expired or rotated away meanwhile is
+ * no one — `null`, never the operator). An authorized session is the account it was signed in as, or (an `agend web`
+ * session, the CLI's header token) none: the operator. For recognition only; nothing here authorizes anything.
+ */
+function webAccountOf(req, url, ctx) {
+    const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+    if (verdict.kind !== "allow")
+        return null;
+    return verdict.via === "session" && verdict.session?.owner ? { owner: verdict.session.owner } : {};
+}
+function webPersonOf(req, url, ctx) {
+    // No people kept here: everyone is "web-user", as before, and there is no identity to protect.
+    if (!ctx.webPerson)
+        return { key: OPERATOR, bound: false, userId: WEB_NAME_FALLBACK, voterKey: "web:operator", name: WEB_NAME_FALLBACK, set: false };
+    const who = webAccountOf(req, url, ctx);
+    return who ? ctx.webPerson(who.owner) : null;
+}
+/** #1827: the person, or the request is answered 401 here (it is no longer authorized) and null is returned. */
+function webPersonOr401(req, res, url, ctx) {
+    const p = webPersonOf(req, url, ctx);
+    if (!p)
+        json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+    return p;
+}
+/** #1827: what the page's profile card reads — the name they chose (or null), the one in use, and how agents know them. */
+function profileBody(p) {
+    return { name: p.set ? p.name : null, shown: p.name, id: p.userId, bound: p.bound, ...(p.platformName !== undefined ? { platform_name: p.platformName } : {}) };
+}
+/** #1823: an SSE frame with the server's clock (no id: it is not a message, and a reconnect gets a fresh one). */
+function sseClock() { return `event: clock\ndata: ${JSON.stringify({ now: Date.now() })}\n\n`; }
 /**
  * Handle a Web UI request. Returns true if handled, false to pass through.
  */
@@ -261,6 +293,8 @@ export function handleWebRequest(req, res, url, ctx) {
             // #1577: the newest message this answer accounts for — after a restart, the last restored one until this process
             // records its own (`<boot>-0` would be after(0): the whole restored history again on every poll).
             cursor: history ? history.pollCursor() : null,
+            // #1823 (#1830 review): the server's clock now, for the page's poll countdown (a poll's deadline is the server's).
+            now: Date.now(),
         });
         return true;
     }
@@ -274,7 +308,9 @@ export function handleWebRequest(req, res, url, ctx) {
             "Cache-Control": "no-cache",
             Connection: "keep-alive",
         });
-        res.write(`event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n`);
+        // #1823 (#1830 review): with the status, the server's clock — now and with every heartbeat — that the page counts a
+        // poll down by (one write: the frames a connect sends are unchanged in number).
+        res.write(`event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n${sseClock()}`);
         // An EventSource that reconnects says what it last saw: send what it missed, before anything new.
         const lastSeen = parseLastEventId(req.headers["last-event-id"]);
         if (lastSeen !== null && ctx.webChatHistory) {
@@ -310,7 +346,7 @@ export function handleWebRequest(req, res, url, ctx) {
             }
             try {
                 // Every open dashboard tab, every 10 s: the status of every instance, serialized on the fleet's loop (#1235).
-                res.write(measureSyncWork("web.sseStatus", () => `event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n`));
+                res.write(measureSyncWork("web.sseStatus", () => `event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n`) + sseClock());
             }
             catch {
                 cleanup();
@@ -527,6 +563,63 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // #1827: the person's own name — the one agents and chats see for their web messages. Their own profile, so the public
+    // link may read and set it too (profile edits are allowed there); a read-only session may as well: it is about them.
+    if (path === "/ui/profile" && method === "GET") {
+        if (!ctx.webPerson) {
+            json(res, 404, { error: "Profiles are not kept on this fleet" });
+            return true;
+        }
+        const p = webPersonOr401(req, res, url, ctx);
+        if (p)
+            json(res, 200, profileBody(p));
+        return true;
+    }
+    if (path === "/ui/profile" && method === "POST") {
+        if (!ctx.setWebPersonName) {
+            json(res, 404, { error: "Profiles are not kept on this fleet" });
+            return true;
+        }
+        const set = ctx.setWebPersonName.bind(ctx);
+        (async () => {
+            let body;
+            try {
+                body = await parseBody(req);
+            }
+            catch {
+                json(res, 400, { error: "Invalid JSON" });
+                return;
+            }
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            if (!body || typeof body !== "object" || Array.isArray(body) || !Object.hasOwn(body, "name")) {
+                json(res, 400, { error: "name required (text, or null to clear)" });
+                return;
+            }
+            // Whose: asked once the body is in. A session revoked, expired or rotated away meanwhile writes nothing — it is
+            // not the operator (#1833 review).
+            const who = webAccountOf(req, url, ctx);
+            if (!who) {
+                json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                return;
+            }
+            const r = set(who.owner, body.name);
+            if (!r.ok) {
+                json(res, r.status, { error: r.error });
+                return;
+            }
+            // The person's other devices read it at their next status (the prefs rev moved).
+            ctx.emitSseEvent("status", ctx.getUiStatus());
+            json(res, 200, profileBody(r.person));
+        })().catch(err => {
+            ctx.logger.error({ err: err.message }, "Saving the web name failed");
+            try {
+                json(res, 500, { error: "Saving the name failed" });
+            }
+            catch { /* already answered */ }
+        });
+        return true;
+    }
     // #1266: a click on an agent reply's button. The set id travels in the body; the public link may click too (a click
     // is a message, and the public link may send messages).
     if (method === "POST" && path === "/ui/reply-button") {
@@ -551,8 +644,14 @@ export function handleWebRequest(req, res, url, ctx) {
                 json(res, 400, { error: "instance, id and index required" });
                 return;
             }
-            const r = await click(instance, id, index);
-            json(res, r.status, r.status === 200 ? { answered: true } : { error: r.error ?? "Refused", ...(r.status === 409 ? { gone: true } : {}) });
+            // #1823/#1827: the click is this page's person's — on a poll their vote (one per person, on every device of
+            // theirs), on one-click buttons their choice — under their web id and name. A request that no longer passes the
+            // gate (a session revoked meanwhile) clicks nothing as anyone.
+            const person = webPersonOr401(req, res, url, ctx);
+            if (!person)
+                return;
+            const r = await click(instance, id, index, { key: person.voterKey, userId: person.userId, name: person.name });
+            json(res, r.status, r.status === 200 ? { answered: true, ...(r.options ? { options: r.options } : {}) } : { error: r.error ?? "Refused", ...(r.status === 409 ? { gone: true } : {}) });
         })().catch(err => {
             ctx.logger.error({ err: err.message }, "Web reply-button click failed");
             try {
@@ -728,7 +827,10 @@ export function handleWebRequest(req, res, url, ctx) {
                 json(res, 400, { error: "invalid confirmation" });
                 return;
             }
-            const r = await run({ instance, command, args: str(body.args, MAX_COMMAND_ARGS), confirm: body.confirm }, { publicLink: !!gatewayRequestContext(req) });
+            const person = webPersonOr401(req, res, url, ctx); // #1827: asked again, now the body is in
+            if (!person)
+                return;
+            const r = await run({ instance, command, args: str(body.args, MAX_COMMAND_ARGS), confirm: body.confirm }, { publicLink: !!gatewayRequestContext(req), person });
             json(res, r.status, r.body);
         })().catch(err => {
             ctx.logger.error({ err: err.message }, "Web command failed");
@@ -762,7 +864,7 @@ export function handleWebRequest(req, res, url, ctx) {
             json(res, 409, { error: `${name} is not running` });
             return true;
         }
-        ctx.eventLog?.logActivity("cancel", "web-user", "stop the current reply", name);
+        ctx.eventLog?.logActivity("cancel", webPersonOf(req, url, ctx)?.name ?? WEB_NAME_FALLBACK, "stop the current reply", name);
         json(res, 200, { cancelled: name });
         return true;
     }
@@ -993,12 +1095,15 @@ export function handleWebRequest(req, res, url, ctx) {
                 const parsed = parseOrReject(TaskCreateSchema, body, res);
                 if (!parsed)
                     return;
+                const person = webPersonOr401(req, res, url, ctx); // #1827: asked again, now the body is in
+                if (!person)
+                    return;
                 const task = ctx.scheduler.db.createTask({
                     title: parsed.title,
                     description: parsed.description,
                     priority: parsed.priority,
                     assignee: parsed.assignee,
-                    created_by: "web-user",
+                    created_by: person.name, // #1827
                 });
                 json(res, 200, task);
             }
@@ -1025,7 +1130,10 @@ export function handleWebRequest(req, res, url, ctx) {
                     return;
                 let result;
                 if (parsed.action === "claim") {
-                    result = ctx.scheduler.db.claimTask(id, parsed.assignee || "web-user");
+                    const person = parsed.assignee ? null : webPersonOr401(req, res, url, ctx); // #1827: the default is the person
+                    if (!parsed.assignee && !person)
+                        return;
+                    result = ctx.scheduler.db.claimTask(id, parsed.assignee || person.name);
                 }
                 else if (parsed.action === "complete") {
                     result = ctx.scheduler.db.completeTask(id, parsed.result);
@@ -1414,6 +1522,14 @@ function handleSendMessage(req, res, ctx) {
                 return;
             }
             const message = typed;
+            // #1827: who is writing — the name agents and chats see, and the id they tell people apart by. Asked now that the
+            // body is in: a session revoked meanwhile sends nothing (not as the operator).
+            const person = webPersonOf(req, new URL(req.url ?? "/", "http://localhost"), ctx);
+            if (!person) {
+                ctx.webFiles?.release(files);
+                json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                return;
+            }
             const ts = new Date().toISOString();
             // The id the agent is given, and the one its delivery reports come back under: the page's ticks.
             const messageId = newWebMessageId();
@@ -1432,7 +1548,7 @@ function handleSendMessage(req, res, ctx) {
             // opt-in resolved at send time inside sendClassicWebEcho.
             const canClassicEcho = ctx.isClassicInstance?.(instance) === true && !!ctx.sendClassicWebEcho;
             const settleClassicEcho = canClassicEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
-                await ctx.sendClassicWebEcho(instance, formatWebChannelEcho("web-user", preview, t("web.echo_full_text")));
+                await ctx.sendClassicWebEcho(instance, formatWebChannelEcho(person.name, preview, t("web.echo_full_text")), person.name);
             }) : undefined;
             const settleEcho = canEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
                 // A replacement adapter or edited binding is not the route we reserved.
@@ -1440,7 +1556,7 @@ function handleSendMessage(req, res, ctx) {
                     || (ctx.getGroupIdForInstance?.(instance) ?? String(ctx.fleetConfig?.channel?.group_id ?? "")) !== groupId
                     || ctx.fleetConfig?.instances[instance]?.topic_id !== topicId)
                     return;
-                return syncAdapter.sendText(String(groupId), formatWebChannelEcho("web-user", preview, t("web.echo_full_text")), { threadId: String(topicId), format: "text", allowedMentions: { parse: [] } });
+                return syncAdapter.sendText(String(groupId), formatWebChannelEcho(person.name, preview, t("web.echo_full_text")), { threadId: String(topicId), format: "text", allowedMentions: { parse: [] } });
             }) : undefined;
             let delivered;
             try {
@@ -1454,7 +1570,7 @@ function handleSendMessage(req, res, ctx) {
                     meta: {
                         chat_id: groupId ? String(groupId) : "",
                         message_id: messageId,
-                        user: "web-user", user_id: "web-user",
+                        user: person.name, user_id: person.userId,
                         ts,
                         thread_id: topicId != null ? String(topicId) : "",
                         source: "web",
@@ -1492,9 +1608,9 @@ function handleSendMessage(req, res, ctx) {
                 ctx.reserveWebChannelEcho?.(instance, () => startProgress(instance), { copy: false })(true);
             }
             ctx.webFiles?.commit(files);
-            ctx.lastInboundUser.set(instance, "web-user");
-            ctx.eventLog?.logActivity("message", "web-user", (message || `[${files.length} file(s)]`).slice(0, 200), instance);
-            ctx.emitSseEvent("message", { instance, sender: "web-user", role: "user", text: message, ts, attachments: files.map(publicAttachment), messageId });
+            ctx.lastInboundUser.set(instance, person.name);
+            ctx.eventLog?.logActivity("message", person.name, (message || `[${files.length} file(s)]`).slice(0, 200), instance);
+            ctx.emitSseEvent("message", { instance, sender: person.name, role: "user", text: message, ts, attachments: files.map(publicAttachment), messageId });
             json(res, 200, { sent: true, messageId });
         }
         catch {