@songsid/agend 2.2.0-beta.9 → 2.3.0-beta.1

package/dist/types.d.ts

@@ -345,6 +345,14 @@ export interface WebConfig {
     echo_to_channel?: boolean;
     /** Show the AI subscription usage panel on /view and serve /api/ai-usage (default true). */
     usage_panel?: boolean;
+    /**
+     * #1937: the largest file the web chat takes, in MB (whole number, 1–500; default 50). Never more than
+     * upload_max_total_mb; over the public link a file is at most 95 MB whatever this says (the quick tunnel's limit).
+     * Read on each upload: `agend reload` applies a change; an open page uses the new limits after it reloads.
+     */
+    upload_max_file_mb?: number;
+    /** #1937: all files on one web chat message together, in MB (whole number, 1–500; default 100). At most 5 files. */
+    upload_max_total_mb?: number;
     /**
      * #1218: the instance Log tab (紀錄) — each agent's steps (prompts, replies, tool calls and results, errors) read on
      * demand from its own transcript, secrets masked. Default false: off, it does no work at all. Turning it on is an
@@ -396,6 +404,19 @@ export interface WebConfig {
      * instead of it; web.preview: false turns previews off everywhere.
      */
     preview_on_public_link?: boolean;
+    /**
+     * #1629: agents' own web themes and effects. `agent_edit` (default true): false refuses every agent appearance write,
+     * fleet-wide; what is stored stays, and people can still reset and lock.
+     */
+    themes?: {
+        agent_edit?: boolean;
+    };
+    /**
+     * #1629 r4.1 Q3 (b): the identity card's upload limits and each agent's picture quota. Defaults: portrait
+     * 1024×1536 / 1536 KiB, banner 1600×600 / 768 KiB, quota 8 files / 4 MiB. A value outside its hard bound is clamped
+     * (and warned about); a change applies to new uploads only.
+     */
+    appearance?: import("./web-appearance-limits.js").AppearanceLimitsConfig;
 }
 /** `login:` section — remote /login behaviour. */
 export interface LoginConfig {

package/dist/ui/app-effects.js

@@ -0,0 +1,187 @@
+/** #1629: one session-only app effect owner. Importing this module starts nothing. */
+import { appStore } from "/assets/app-store.js";
+import { navStore } from "/assets/app-nav.js";
+import { onPrefsChanged, prefInForce } from "/assets/app-prefs.js";
+import { resolvedMode, themesStore } from "/assets/app-themes.js";
+import { ownerCssLifecycle, safeMode } from "/assets/owner-css.js";
+import { constrainedDevice } from "/assets/effect-policy.js";
+import { createAppEffectRuntime } from "/assets/effect-app-runtime.js";
+import { createEffectCursor } from "/assets/effect-cursor.js";
+import { createOwnerEffectRegions } from "/assets/effect-owner-regions.js";
+import { chatEffectIdentity } from "/assets/effect-chat-runtime.js";
+import { createEffectTrialController } from "./effect-trial-controller.js";
+import { effectTrialMessage } from "./effect-trial-offer.js";
+import { claimPanel, panelVersion, panelStore, openTrialPanel, closePanel } from "./preview-panel.js";
+const owners = new WeakMap();
+export function getAppEffects(host = window) { const value = owners.get(host); return value && !value.dead && value.api?.ok ? value : null; }
+
+/** Boot once with the page's Chat store, including when the first visible panel is Fleet. */
+export function startAppEffects({ store, window: host = window, factories = {} } = {}) {
+  const existing = owners.get(host);
+  if (existing) { if (!existing.dead) existing.bindStore(store); return getAppEffects(host); }
+  if (!chatEffectIdentity(host) || typeof host.AgendAuth?.onSessionEnd !== "function" || typeof host.AgendAuth?.sessionEnded !== "function") return null;
+  const doc = host.document, releases = [], ended = new Set(), updates = new Set(), trialUpdates = new Set(); let replyOff = null, replyStore = null, regions = null, cursor = null, cursorStamp = null, trialControl = null, trialIntent = null, trialHint = false, trialSerial = 0, trialStamp = null, chatBinding = null;
+  const safe = fn => { try { return fn(); } catch { return null; } };
+  const hold = off => { if (entry.dead) safe(() => off?.()); else releases.push(off); };
+  const entry = { dead: false, api: null,
+    cursorSnapshot: () => cursor?.snapshot() ?? { status: "unavailable", id: null },
+    gates: () => context(),
+    subscribe(fn) { if (typeof fn !== "function" || entry.dead) return () => {}; updates.add(fn); return () => updates.delete(fn); },
+    subscribeTrial(fn) { if (typeof fn !== "function" || entry.dead) return () => {}; trialUpdates.add(fn); return () => trialUpdates.delete(fn); },
+    onEnd(fn) { if (typeof fn !== "function") return () => {}; if (entry.dead) { safe(fn); return () => {}; } ended.add(fn); return () => ended.delete(fn); },
+    bindStore(value) {
+      if (entry.dead || value === replyStore) return;
+      safe(() => replyOff?.()); replyOff = null; replyStore = value;
+      trialControl?.stop(); chatBinding = null; entry.api?.detachChat();
+      if (typeof value?.onAgentReply === "function") {
+        const off = value.onAgentReply(event => { if (!entry.dead && replyStore === value) entry.api?.reply(event); });
+        if (entry.dead || replyStore !== value) safe(() => off?.()); else replyOff = off;
+      }
+    },
+    canTry(message) {
+      const offer = safe(() => effectTrialMessage(message)), nav = navStore.get();
+      return !entry.dead && !!chatBinding && safe(() => chatBinding.current()) === true && trialHint && trialControl?.ok === true && !!offer && message.instance === nav.route?.instance && nav.route?.panel === "chat"
+        && trialControl.snapshot().phase === "idle" && !trialControl.snapshot().busy && trialAllowed();
+    },
+    startTrial(message) {
+      if (!entry.canTry(message)) return Promise.resolve(false);
+      const nav = navStore.get(); trialIntent = { name: message.instance, seq: nav.seq, claim: claimPanel(), handle: null, chat: chatBinding };
+      return trialControl.start(message);
+    },
+    attachChat(options) {
+      const nav = navStore.get(), name = options?.name;
+      if (entry.dead || !entry.api?.ok || nav.route?.panel !== "chat" || nav.route.instance !== name || typeof options.current !== "function") return null;
+      const binding = { current: () => !entry.dead && host.document === doc && navStore.get().seq === nav.seq && navStore.get().route?.panel === "chat" && navStore.get().route?.instance === name && options.current() === true };
+      chatBinding = binding; trialControl?.stop();
+      if (entry.dead || chatBinding !== binding) return null;
+      const handle = entry.api.attachChat({ ...options, current: () => chatBinding === binding && binding.current() });
+      if (entry.dead || chatBinding !== binding) { safe(() => handle?.dispose()); return null; }
+      if (!handle) chatBinding = null;
+      return handle;
+    },
+    dispose() {
+      if (entry.dead) return; entry.dead = true;
+      safe(() => trialControl?.dispose()); safe(() => entry.api?.dispose()); safe(() => replyOff?.()); replyOff = null; replyStore = null;
+      for (const off of releases.splice(0)) safe(off);
+      updates.clear(); trialUpdates.clear(); const listeners = [...ended]; ended.clear(); for (const fn of listeners) safe(fn);
+    },
+  };
+  owners.set(host, entry); // Reentrant setup never constructs another owner.
+  let media, coarse, preview;
+  function context() {
+    let ready = false; try { ready = preview?.availability().ok === true; } catch { /* unavailable */ }
+    return { safe: safeMode(), publicLink: doc.body.dataset.publicLink === "1", reducedMotion: media?.matches !== false, saveData: host.navigator?.connection?.saveData === true,
+      hidden: doc.visibilityState !== "visible", enabled: typeof host.OffscreenCanvas === "function" && typeof host.Worker === "function" && typeof host.MutationObserver === "function" && typeof host.ResizeObserver === "function",
+      show: prefInForce("fx.show")?.value !== false, previewReady: ready,
+      optIn: prefInForce("preview.optIn")?.value === true && preview?.optedIn() === true && preview?.never() !== true,
+      constrained: constrainedDevice({ memory: host.navigator?.deviceMemory, cores: host.navigator?.hardwareConcurrency, coarse: coarse?.matches === true, width: host.innerWidth }),
+      modal: !!doc.querySelector("dialog[open],.menu-list,.pop,[role=alertdialog],.oc-keep,.shell.sb-open"), openInstance: null };
+  }
+  function trialCurrent(name) {
+    const intent = trialIntent, nav = navStore.get();
+    return !entry.dead && host.document === doc && !!intent && !!intent.chat && chatBinding === intent.chat && intent.chat.current() === true && intent.name === name && nav.seq === intent.seq && nav.route?.panel === "chat" && nav.route.instance === name
+      && (panelVersion() === intent.claim || intent.handle !== null && panelStore.get().open?.handle === intent.handle);
+  }
+  function trialAllowed() {
+    const c = context();
+    return !entry.dead && doc.visibilityState === "visible" && doc.hasFocus?.() === true && ownerCssLifecycle.get().state === "off"
+      && c.enabled && c.show && c.previewReady && c.optIn && !c.safe && !c.publicLink && !c.reducedMotion && !c.saveData && !c.hidden && !c.modal;
+  }
+  function mountTrial(handle) {
+    const intent = trialIntent; if (!intent || !trialCurrent(handle.instance) || !handle.current() || !Number.isSafeInteger(++trialSerial)) throw Error("trial_unavailable");
+    intent.handle = handle;
+    const binding = Object.freeze({ key: `trial:${trialSerial}:${handle.reply.trial}`, id: handle.reply.offer.id, run: handle.reply.trial, instance: handle.instance, generation: trialSerial });
+    let stage = null, source = null;
+    const cleanup = () => {
+      safe(() => source?.stop()); safe(() => stage?.dispose());
+      if (panelStore.get().open?.handle === handle) closePanel();
+    };
+    try {
+      openTrialPanel({ key: binding.key, instance: handle.instance, binding, handle, ownerCss: () => ownerCssLifecycle.get().state,
+        onStage(value) {
+          stage = value;
+          if (!handle.current()) { cleanup(); handle.stop(); return; }
+          source = entry.api.attachTrial({ reply: handle.reply, offer: handle.reply.offer.offer, startedAt: handle.startedAt, stage,
+            current: handle.current, onStop: handle.stop });
+          if (!source) { cleanup(); handle.stop(); }
+        },
+      });
+    } catch (error) { cleanup(); throw error; }
+    return cleanup;
+  }
+  function notifyTrial() {
+    if (entry.dead) return;
+    const nav = navStore.get(), next = JSON.stringify([trialHint, safe(() => chatBinding?.current()) === true, trialAllowed(), nav.route?.panel, nav.route?.instance, trialControl?.snapshot()]);
+    if (next === trialStamp) return; trialStamp = next;
+    for (const fn of [...trialUpdates]) safe(fn);
+  }
+  const notify = () => { if (!entry.dead) { trialControl?.sync(); notifyTrial(); for (const fn of [...updates]) safe(fn); } };
+  const cursorDragging = () => doc.body.classList?.contains("side-resizing") === true || !!doc.querySelector(".chat-split.resizing");
+  function syncCursor() {
+    if (entry.dead || !cursor) return;
+    const c = context();
+    cursor.update(entry.api?.cursorSelection?.() ?? null, c.enabled && c.show && c.previewReady && c.optIn && !c.safe && !c.publicLink && !c.reducedMotion && !c.saveData && !c.hidden && !c.modal && !cursorDragging());
+  }
+  try {
+    if (appStore.get().connection === "ended") { entry.dispose(); return null; }
+    preview = host.AgendPreview;
+    media = host.matchMedia?.("(prefers-reduced-motion: reduce)") ?? { matches: true };
+    coarse = host.matchMedia?.("(pointer: coarse)") ?? { matches: false };
+    entry.api = (factories.runtime ?? createAppEffectRuntime)({ window: host, current: () => !entry.dead && host.document === doc,
+      observe: () => ({ context: context(), ownerCss: ownerCssLifecycle.get().state, mode: resolvedMode() }), onDispose: () => entry.dispose(),
+      resolveOwnerTarget: (slot, manifest, proof) => !entry.dead ? regions?.resolve?.(slot, manifest.box, proof) ?? null : null,
+      onChange: () => { syncCursor(); notify(); } });
+    if (entry.dead || !entry.api.ok) { entry.dispose(); return null; }
+    trialControl = (factories.trialController ?? createEffectTrialController)({ window: host, current: trialCurrent, allowed: trialAllowed, onStart: mountTrial, onChange: notify });
+    hold(() => trialControl?.dispose());
+    if (typeof host.AgendAuth.trialSession === "function") Promise.resolve().then(() => host.AgendAuth.trialSession()).then(value => {
+      if (entry.dead) return; trialHint = value?.localAdmin === true && value.epoch === chatEffectIdentity(host)?.epoch; notify();
+    }).catch(() => {});
+    hold(panelStore.subscribe(() => { trialControl?.sync(); notifyTrial(); }));
+    const ownRegions = (factories.regions ?? createOwnerEffectRegions)({ window: host, current: () => !entry.dead && host.document === doc });
+    regions = ownRegions?.ok ? ownRegions : null; hold(() => ownRegions?.dispose?.());
+    if (entry.dead) return null;
+    const ownCursor = safe(() => (factories.cursor ?? createEffectCursor)({ window: host, current: () => !entry.dead && host.document === doc,
+      readImage: (selection, signal) => entry.api?.cursorImageSettled?.(selection, signal) ?? Promise.resolve(null),
+      onChange(value) { const next = JSON.stringify(value); if (next !== cursorStamp) { cursorStamp = next; notify(); } },
+    }));
+    cursor = ownCursor?.ok ? ownCursor : null; hold(() => ownCursor?.dispose?.());
+    if (entry.dead) return null;
+    const sync = () => { if (!entry.dead) { trialControl?.sync(); entry.api.sync(); syncCursor(); notifyTrial(); } };
+    let revision = appStore.get().themesRev, prefsRevision = appStore.get().prefsRev, navSeq = navStore.get().seq;
+    hold(navStore.subscribe(value => { if (entry.dead || value.seq === navSeq) return; navSeq = value.seq; trialControl?.stop(); chatBinding = null; entry.api.detachChat(); syncCursor(); }));
+    hold(appStore.subscribe(value => {
+      if (entry.dead) return;
+      if (value.connection === "ended") { entry.dispose(); return; }
+      const chatChanged = value.themesRev !== revision, ownerChanged = value.prefsRev !== prefsRevision;
+      revision = value.themesRev; prefsRevision = value.prefsRev;
+      if (chatChanged) entry.api.changedChat();
+      if (ownerChanged) entry.api.changedOwner();
+      if (!chatChanged && !ownerChanged) sync();
+    }));
+    hold(ownerCssLifecycle.subscribe(sync)); hold(themesStore.subscribe(sync)); hold(onPrefsChanged(sync));
+    if (typeof preview?.onChange === "function") hold(preview.onChange(sync));
+    if (typeof host.AgendTheme?.onChange === "function") hold(host.AgendTheme.onChange(sync));
+    for (const [target, type] of [[media, "change"], [coarse, "change"], [doc, "visibilitychange"], [host, "resize"], [host.navigator?.connection, "change"]]) {
+      if (target?.addEventListener) { target.addEventListener(type, sync); hold(() => target.removeEventListener(type, sync)); }
+    }
+    if (entry.dead) return null;
+    let modal = context().modal, dragging = cursorDragging(), queuedSurface = false;
+    // Panel commits can happen after navigation and contain no Chat lease. Reproject fixed owner targets
+    // once after stock DOM changes. Body-level effect roots/frames/rules do not schedule themselves.
+    const surfaceChanged = () => {
+      if (entry.dead || queuedSurface) return; queuedSurface = true;
+      Promise.resolve().then(() => { queuedSurface = false; sync(); });
+    };
+    const barriers = typeof host.MutationObserver === "function" ? new host.MutationObserver(records => {
+      if (entry.dead) return;
+      const value = context().modal, drag = cursorDragging(); if (value !== modal || drag !== dragging) { modal = value; dragging = drag; sync(); }
+      if (Array.isArray(records) && records.some(r => r.target?.closest?.("#app") || r.target === doc.getElementById?.("app"))) surfaceChanged();
+    }) : null;
+    hold(() => barriers?.disconnect());
+    if (entry.dead) return null;
+    barriers?.observe(doc.documentElement, { subtree: true, childList: true, attributes: true, attributeFilter: ["class", "open", "hidden", "role"] });
+    entry.bindStore(store); sync();
+    return getAppEffects(host);
+  } catch { entry.dispose(); return null; }
+}

package/dist/ui/chat-commands.js

@@ -9,6 +9,7 @@ export const CHAT_COMMANDS = [
   { name: "compact", arg: "[instructions]" },
   { name: "clear", arg: "" },
   { name: "model", arg: "[name]" },
+  { name: "backend", arg: "[backend] [model] [effort]" },
   { name: "effort", arg: "[level]" },
   { name: "cancel", arg: "" },
   { name: "btw", arg: "<question>" },

package/dist/ui/chat-effect-posters.js

@@ -0,0 +1,42 @@
+/** #1629: static Chat fallback. It requires no preview origin, device consent, Worker or personal identity. */
+import { useLayoutEffect } from "/assets/app-html.js";
+import { appStore } from "/assets/app-store.js";
+import { onPrefsChanged, prefInForce } from "/assets/app-prefs.js";
+import { themesShown, themesStore } from "/assets/app-themes.js";
+import { ownerCssLifecycle } from "/assets/owner-css.js";
+import { chatEffectIdentity } from "/assets/effect-chat-runtime.js";
+import { createChatPosters } from "/assets/effect-posters.js";
+
+export function ChatEffectPosters({ name, lease, element }) {
+  useLayoutEffect(() => {
+    let live = true, api = null;
+    const releases = [], host = window;
+    const current = () => live && lease.current();
+    const cleanup = () => { if (!live) return; live = false; try { api?.dispose?.(); } catch { /* optional */ } for (const off of releases) { try { off?.(); } catch { /* release all */ } } };
+    lease.hold(cleanup);
+    try {
+      const preview = host.AgendPreview, motion = host.matchMedia?.("(prefers-reduced-motion: reduce)") ?? { matches: true };
+      const observe = () => {
+        let previewReady = false; try { previewReady = preview?.availability().ok === true; } catch { /* fallback */ }
+        // This is a surface fallback, not a replacement for an explicit Pause, queued effect or failed live read.
+        const playback = chatEffectIdentity(host) && typeof host.Worker === "function" && typeof host.OffscreenCanvas === "function" && previewReady &&
+          prefInForce("preview.optIn")?.value === true && preview?.optedIn() === true && preview?.never() !== true && !motion.matches && host.navigator?.connection?.saveData !== true;
+        return { shown: themesShown(), fallback: !playback, ownerCss: ownerCssLifecycle.get().state };
+      };
+      api = createChatPosters({ window: host, name, element: element.current, current, observe });
+      if (!api.ok) return cleanup;
+      const sync = () => { if (current()) api.sync(); };
+      let revision = appStore.get().themesRev;
+      releases.push(appStore.subscribe(s => {
+        if (!current()) return;
+        if (s.connection === "ended") { api.dispose(); return; }
+        if (s.themesRev !== revision) { revision = s.themesRev; api.changed(); } else sync();
+      }));
+      releases.push(ownerCssLifecycle.subscribe(sync)); releases.push(themesStore.subscribe(sync)); releases.push(onPrefsChanged(sync));
+      if (typeof preview?.onChange === "function") releases.push(preview.onChange(sync));
+      for (const target of [motion, host.navigator?.connection]) if (target?.addEventListener) { target.addEventListener("change", sync); releases.push(() => target.removeEventListener("change", sync)); }
+      sync(); return cleanup;
+    } catch { cleanup(); return cleanup; }
+  }, [name, lease]);
+  return null;
+}

package/dist/ui/chat-effects.js

@@ -0,0 +1,72 @@
+// #1629: Chat contributes a committed lease to the one app owner; no private pool or server polling.
+import { html, useLayoutEffect, useRef, useState } from "/assets/app-html.js";
+import { register, t } from "/assets/app-i18n.js";
+import { appStore, useStore } from "/assets/app-store.js";
+import { ownerCssLifecycle } from "/assets/owner-css.js";
+import { chatEffectState, chatEffectIdentity } from "/assets/effect-chat-runtime.js";
+import { Dialog } from "/assets/ui-dialog.js";
+import { navigate } from "/assets/app-nav.js";
+import { toast } from "/assets/ui-toast.js";
+import { getAppEffects } from "./app-effects.js";
+
+register("chatFx", {
+  en: { title: "Effects", loading: "Checking effects…", empty: "No effects in this chat.", failed: "Effects stopped because their resources could not be verified. Reload the page to try again.", reload: "Reload page", pause: "Pause", resume: "Resume", remove: "Remove from chat", removeFailed: "Could not remove this effect. Reload the page to check its state.", css: "Agent foreground effects are paused while your custom CSS is on or cannot be verified.", setting: "Open Appearance settings", running: "Running", starting: "Starting", off: "Stopped", resumeFailed: "This effect cannot resume: the page or its safety history is not ready. Reload the page or choose another effect.", queued: "Waiting for a slot", unknown: "Playback is off or unavailable here.", budget: "Paused to protect page responsiveness. Resume keeps the three-pauses safety limit.", paused: "Paused", low: "Reduced quality" },
+  "zh-TW": { title: "效果", loading: "正在確認效果…", empty: "這個聊天沒有放置效果。", failed: "無法確認效果資源，已停止播放。重新載入頁面後再試。", reload: "重新載入頁面", pause: "暫停", resume: "恢復", remove: "從聊天移除", removeFailed: "無法移除效果。請重新載入頁面確認狀態。", css: "自訂 CSS 開啟或無法確認時，代理的前景效果會暫停。", setting: "開啟外觀設定", running: "播放中", starting: "啟動中", off: "已停止", resumeFailed: "頁面或安全紀錄尚未就緒，無法恢復此效果。請重新載入頁面，或選擇其他效果。", queued: "等待空位", unknown: "這裡已關閉播放，或無法播放效果。", budget: "為維持頁面順暢，已暫停效果。恢復仍保留三次暫停的安全上限。", paused: "已暫停", low: "降低畫質" },
+});
+
+/** Local read/admin sessions keep controls; public, View, poll and header-only pages have no runtime identity. */
+export function chatEffectsMenuAvailable() { return chatEffectIdentity(window) !== null; }
+
+export function ChatEffects({ name, lease, element, store, open, onClose }) {
+  const cssLife = useStore(ownerCssLifecycle);
+  const runtime = useRef(null), [state, setState] = useState(null), [canWrite, setCanWrite] = useState(false), [busy, setBusy] = useState(false);
+  useLayoutEffect(() => {
+    let live = true, api = null;
+    const releases = [];
+    // Effects are optional: a failed setup must release its partial ownership without breaking Chat.
+    const cleanup = () => {
+      if (!live) return;
+      live = false;
+      try { api?.dispose?.(); } catch { /* continue releasing partial setup */ }
+      for (const off of releases) { try { if (typeof off === "function") off(); } catch { /* release the rest */ } }
+      if (runtime.current === api) runtime.current = null;
+    };
+    lease.hold(cleanup);
+    try {
+      setBusy(false); onClose(); setCanWrite(false); setState(null);
+      const host = window, owner = getAppEffects(host);
+      const current = () => live && lease.current();
+      if (!owner) { setState({ error: null, rows: [], effects: [], unavailable: true }); return cleanup; }
+      releases.push(owner.onEnd(() => { if (current()) setState({ error: "resource_unavailable", rows: [], effects: [], unavailable: true }); }));
+      const changed = value => {
+        if (!current()) return;
+        const g = owner.gates();
+        setState({ ...value, unavailable: !g.enabled || !g.show || !g.previewReady || !g.optIn || g.safe || g.publicLink || g.reducedMotion || g.saveData });
+      };
+      api = owner.attachChat({ name, element: element.current, current,
+        observe: () => ({ state: chatEffectState(appStore.get(), name) }), onChange: changed });
+      runtime.current = api;
+      if (!api?.ok) { setState({ error: null, rows: [], effects: [], unavailable: true }); return cleanup; }
+      host.AgendAuth?.canWrite?.().then(value => { if (current()) setCanWrite(value === true); }).catch(() => {});
+      api.sync();
+      return cleanup;
+    } catch {
+      cleanup();
+      if (lease.current()) setState({ error: "runtime_unavailable", rows: [], effects: [] });
+      return cleanup;
+    }
+  }, [name, lease]);
+  const rows = state?.rows ?? [], effects = state?.effects ?? [];
+  const css = cssLife.state !== "off" && effects.some(p => p.by !== "human" && p.manifest.layer === "front");
+  const remove = async id => { if (busy) return; setBusy(true); const api = runtime.current; const ok = await api?.remove?.(id); if (!lease.current() || runtime.current !== api) return; setBusy(false); if (!ok) toast(t("chatFx.removeFailed"), false); };
+  return html`${open ? html`<${Dialog} title=${t("chatFx.title")} onClose=${onClose} busy=${busy}>
+      ${state?.error ? html`<p>${t("chatFx.failed")}</p><button type="button" class="btn" onClick=${() => location.reload()}>${t("chatFx.reload")}</button>` : null}
+      ${css ? html`<p>${t("chatFx.css")}</p><button type="button" class="btn" onClick=${() => { onClose(); navigate("/settings/appearance"); }}>${t("chatFx.setting")}</button>` : null}
+      ${!effects.length && !state?.error ? html`<p>${t(state?.unavailable ? "chatFx.unknown" : state?.loading || !state ? "chatFx.loading" : "chatFx.empty")}</p>` : null}
+      ${effects.map(p => { const row = rows.find(r => r.id === p.id), phase = row?.phase; return html`<section key=${p.id}><h3>${p.manifest.title}</h3><p>${t(row?.reason === "paused" || row?.reason === "host_budget" ? "chatFx.paused" : phase === "running" ? "chatFx.running" : phase ? "chatFx.starting" : row?.verdict === "queued" ? "chatFx.queued" : "chatFx.off")}${row?.quality === "low" ? ` · ${t("chatFx.low")}` : ""}</p>
+        ${row?.reason === "host_budget" ? html`<p>${t("chatFx.budget")}</p>` : null}
+        <button type="button" class="btn" disabled=${busy} onClick=${() => runtime.current?.pause?.(p.id)}>${t("chatFx.pause")}</button>
+        <button type="button" class="btn" disabled=${busy} onClick=${() => { if (!runtime.current?.resume?.(p.id)) toast(t("chatFx.resumeFailed"), false); }}>${t("chatFx.resume")}</button>
+        ${canWrite ? html`<button type="button" class="btn" disabled=${busy} onClick=${() => remove(p.id)}>${t("chatFx.remove")}</button>` : null}</section>`; })}
+    </${Dialog}>` : null}`;
+}

package/dist/ui/chat-live-replies.js

@@ -0,0 +1,58 @@
+// #1629: transient host notifications, never message content or replay/history authority.
+const own = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
+function fields(value, keys, closed = false) {
+  try {
+    if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) return null;
+    if (closed && Reflect.ownKeys(value).length !== keys.length) return null;
+    const out = {};
+    for (const k of keys) { const d = Object.getOwnPropertyDescriptor(value, k); if (!d || !own(d, "value")) return null; out[k] = d.value; }
+    return out;
+  } catch { return null; }
+}
+const identity = x => !!x && typeof x.boot === "string" && /^[0-9a-f]{1,32}$/.test(x.boot)
+  && Number.isSafeInteger(x.id) && x.id > 0 && typeof x.instance === "string" && x.instance.length >= 1 && x.instance.length <= 128;
+const MAX_AGE = 5000, MAX_BOOTS = 64, MAX_PENDING = 64;
+export function createLiveAgentReplies(now) {
+  const seen = new Map(), pending = new Map(), listeners = new Set();
+  let last = null, revoked = false;
+  function time() {
+    if (revoked) return null;
+    let t; try { t = now(); } catch { t = null; }
+    if (typeof t !== "number" || !Number.isFinite(t) || t < 0 || last !== null && t < last) { revoked = true; pending.clear(); return null; }
+    last = t;
+    for (const [key, item] of pending) if (t - item.at > MAX_AGE) pending.delete(key);
+    return t;
+  }
+  function ingress(extra, t) {
+    const e = fields(extra, ["source", "receivedAt"], true);
+    return e && e.source === "sse" && typeof e.receivedAt === "number" && Number.isFinite(e.receivedAt) && e.receivedAt >= 0 && e.receivedAt <= t && t - e.receivedAt <= MAX_AGE ? e.receivedAt : null;
+  }
+  return {
+    // Record every accepted ingress, including history/poll, before its message-array merge/eviction.
+    message(value, extra) {
+      const m = fields(value, ["boot", "id", "instance"]); if (!identity(m)) return;
+      const role = fields(value, ["role"])?.role;
+      const t = time(); if (t === null) return;
+      const key = `${m.boot}:${m.id}`, previous = seen.get(m.boot) || 0;
+      pending.delete(key);
+      if (!seen.has(m.boot) && seen.size >= MAX_BOOTS) { revoked = true; pending.clear(); return; }
+      seen.set(m.boot, Math.max(previous, m.id));
+      const at = ingress(extra, t);
+      if (m.id <= previous || role !== "agent" || at === null) return;
+      // Reconnect replay has no receipts: discard old candidates, never the durable-in-page watermark.
+      if (pending.size >= MAX_PENDING) pending.delete(pending.keys().next().value);
+      pending.set(key, { instance: m.instance, at });
+    },
+    receipt(value, extra) {
+      const r = fields(value, ["v", "boot", "id", "instance"], true); if (!identity(r) || r.v !== 1) return false;
+      const t = time(); if (t === null) return false;
+      const at = ingress(extra, t); if (at === null) return false;
+      const key = `${r.boot}:${r.id}`, candidate = pending.get(key); pending.delete(key);
+      if (!candidate || candidate.instance !== r.instance || at < candidate.at || t - candidate.at > MAX_AGE) return false;
+      const event = Object.freeze({ v: 1, boot: r.boot, id: r.id, instance: r.instance });
+      for (const fn of [...listeners]) { try { fn(event); } catch { /* one host observer cannot suppress another */ } }
+      return true;
+    },
+    subscribe(fn) { if (typeof fn !== "function") return () => {}; listeners.add(fn); return () => listeners.delete(fn); },
+  };
+}

package/dist/ui/chat-render.js

@@ -36,7 +36,7 @@
   }
 
   function link(href, label) {
-    return '<a href="' + href + '" target="_blank" rel="noopener noreferrer">' + label + "</a>";
+    return '<a href="' + href + '" target="_blank" rel="noopener noreferrer" data-trust="link">' + label + "</a>";
   }
 
   // Placeholders survive the later passes untouched (they contain no Markdown characters).
@@ -78,7 +78,9 @@
   function inline(escaped, store) {
     var s = escaped;
     // `code` first: nothing inside it is Markdown.
-    s = s.replace(/`([^`\n]+)`/g, function (_m, code) { return stash(store, "<code>" + code + "</code>"); });
+    // #1812: in a table cell a path may wrap after its separators — the cell keeps words whole, so without these a long
+    // path held its whole column wide.
+    s = s.replace(/`([^`\n]+)`/g, function (_m, code) { return stash(store, "<code>" + (store.inCell ? code.replace(/\//g, "/<wbr>") : code) + "</code>"); });
     var known = store.emojis;
     if (known) s = s.replace(EMOJI_RE, function (m, _a, name, id) { return known(id) ? stash(store, emojiImg(id, name)) : m; });
     var names = store.mentions;
@@ -180,7 +182,8 @@
   function renderTable(header, aligns, rows, store) {
     function cell(tag, text, i) {
       var a = aligns[i] ? ' class="al-' + aligns[i] + '"' : "";
-      return "<" + tag + a + ">" + inline(text, store) + "</" + tag + ">";
+      store.inCell = true;
+      try { return "<" + tag + a + ">" + inline(text, store) + "</" + tag + ">"; } finally { store.inCell = false; }
     }
     function row(tag, cells) {
       var out = "";
@@ -338,6 +341,22 @@
    * stream — and must show once.
    */
   function buttonsRank(b) { return b && b.state !== "open" ? 1 : 0; }
+  /**
+   * Whether `next` is an older view than `had` of the same buttons: they only go forward (open → ended), and a poll's
+   * views (#1823), which change while it is open, by their `rev`.
+   */
+  function olderButtons(next, had) {
+    var d = buttonsRank(next) - buttonsRank(had);
+    if (d) return d < 0;
+    return !!(next && had && next.poll && had.poll && next.poll.rev < had.poll.rev);
+  }
+  /** #1823: a poll's time left, counted down by the page every second: m:ss, or h:mm:ss. */
+  function pollRemaining(ms) {
+    var s = Math.max(0, Math.ceil(ms / 1000));
+    var h = Math.floor(s / 3600), m = Math.floor((s % 3600) / 60), r = s % 60;
+    var mm = h ? String(m).padStart(2, "0") : String(m);
+    return (h ? h + ":" : "") + mm + ":" + String(r).padStart(2, "0");
+  }
   /**
    * #1266: a reply's buttons changed (one was chosen, or they expired): the message carrying them, by its set id.
    * Returns the list unchanged when no message carries that set.
@@ -346,7 +365,7 @@
     if (!Array.isArray(list) || !buttons || typeof buttons.id !== "string") return list;
     var i = -1;
     for (var j = list.length - 1; j >= 0; j--) if (list[j] && list[j].buttons && list[j].buttons.id === buttons.id) { i = j; break; }
-    if (i < 0 || buttonsRank(list[i].buttons) > buttonsRank(buttons)) return list;
+    if (i < 0 || olderButtons(buttons, list[i].buttons)) return list;
     var out = list.slice();
     out[i] = Object.assign({}, list[i], { buttons: buttons });
     return out;
@@ -366,7 +385,7 @@
         var next = nextDeliveryState(had.delivery, m.delivery);
         if (next !== had.delivery) out[seen[k]] = had = Object.assign({}, had, { delivery: next });
         // #1266: …and the copy whose buttons got further (open → chosen / expired) shows them.
-        if (m.buttons && (!had.buttons || buttonsRank(m.buttons) > buttonsRank(had.buttons))) out[seen[k]] = Object.assign({}, had, { buttons: m.buttons });
+        if (m.buttons && (!had.buttons || buttonsRank(m.buttons) > buttonsRank(had.buttons) || (buttonsRank(m.buttons) === buttonsRank(had.buttons) && m.buttons.poll && had.buttons.poll && m.buttons.poll.rev > had.buttons.poll.rev))) out[seen[k]] = Object.assign({}, had, { buttons: m.buttons });
         return;
       }
       seen[k] = out.length;
@@ -470,8 +489,32 @@
     return draft ? failedText + "\n" + draft : failedText;
   }
 
-  /** The upload limits the server enforces (web-upload.ts UPLOAD_LIMITS); checked here first only to say so early. */
-  var FILE_LIMITS = { maxFileBytes: 10 * 1024 * 1024, maxFiles: 5, maxTotalBytes: 25 * 1024 * 1024 };
+  /** The defaults of the upload limits the server enforces (web-upload.ts UPLOAD_LIMITS), for a page that was given none. */
+  var FILE_LIMITS = { maxFileBytes: 50 * 1024 * 1024, maxFiles: 5, maxTotalBytes: 100 * 1024 * 1024 };
+  /**
+   * #1937: the limits in force for this page — the server's (web.upload_max_file_mb / _total_mb, and the public link's
+   * own cap), on <body data-upload-limits>. Checked here first only to say so early: the server checks every upload.
+   */
+  function fileLimits() {
+    try {
+      var raw = JSON.parse(document.body.dataset.uploadLimits || "null");
+      var ok = function (n) { return typeof n === "number" && isFinite(n) && n > 0; };
+      if (raw && ok(raw.maxFileBytes) && ok(raw.maxFiles) && ok(raw.maxTotalBytes)) {
+        return { maxFileBytes: raw.maxFileBytes, maxFiles: raw.maxFiles, maxTotalBytes: raw.maxTotalBytes, publicLinkCapped: raw.publicLinkCapped === true };
+      }
+    } catch (e) { /* no page, or no limits on it */ }
+    return { maxFileBytes: FILE_LIMITS.maxFileBytes, maxFiles: FILE_LIMITS.maxFiles, maxTotalBytes: FILE_LIMITS.maxTotalBytes, publicLinkCapped: false };
+  }
+  /** A size in MB as the limits are worded ("50", "2.5") — web-upload.ts mbText. */
+  function mbText(bytes) { return String(Math.round((bytes / 1024 / 1024) * 10) / 10); }
+  /** #1937: the words for a file checkFiles() refused — a chat string key and the numbers it says, from fileLimits(). */
+  function fileRejection(reason) {
+    var l = fileLimits();
+    if (reason === "too-large") return { key: l.publicLinkCapped ? "chat.file_too_large_public" : "chat.file_too_large", values: [mbText(l.maxFileBytes)] };
+    if (reason === "too-many") return { key: "chat.file_too_many", values: [l.maxFiles] };
+    if (reason === "too-much") return { key: "chat.file_too_much", values: [mbText(l.maxTotalBytes)] };
+    return { key: "chat.file_" + String(reason).replace(/-/g, "_"), values: [] };
+  }
 
   function formatSize(n) {
     var b = Number(n) || 0;
@@ -485,6 +528,7 @@
    * Returns the files kept (pending first, then the accepted new ones) and, for each refused one, why.
    */
   function checkFiles(pending, adding) {
+    var limits = fileLimits();
     var kept = (pending || []).slice();
     var total = 0;
     kept.forEach(function (f) { total += Number(f.size) || 0; });
@@ -492,9 +536,9 @@
     (adding || []).forEach(function (f) {
       var size = Number(f.size) || 0;
       if (size === 0) rejected.push({ name: f.name, reason: "empty" });
-      else if (size > FILE_LIMITS.maxFileBytes) rejected.push({ name: f.name, reason: "too-large" });
-      else if (kept.length >= FILE_LIMITS.maxFiles) rejected.push({ name: f.name, reason: "too-many" });
-      else if (total + size > FILE_LIMITS.maxTotalBytes) rejected.push({ name: f.name, reason: "too-much" });
+      else if (size > limits.maxFileBytes) rejected.push({ name: f.name, reason: "too-large" });
+      else if (kept.length >= limits.maxFiles) rejected.push({ name: f.name, reason: "too-many" });
+      else if (total + size > limits.maxTotalBytes) rejected.push({ name: f.name, reason: "too-much" });
       else { kept.push(f); total += size; }
     });
     return { kept: kept, rejected: rejected };
@@ -550,8 +594,8 @@
       if (cards && isHtmlAttachment(a)) after.push('<div class="html-card" data-att="' + a.id + '"></div>');
       var url = "/ui/file/" + a.id;
       var kind = inline ? attachmentPreviewType(a) : null;
-      if (kind === "video") after.push('<div class="att-media"><video class="att-video" controls preload="metadata" src="' + url + '"></video></div>');
-      else if (kind === "audio") after.push('<div class="att-media"><audio class="att-audio" controls preload="metadata" src="' + url + '"></audio></div>');
+      if (kind === "video") after.push('<div data-trust="media" class="att-media"><video class="att-video" controls preload="metadata" src="' + url + '"></video></div>');
+      else if (kind === "audio") after.push('<div data-trust="media" class="att-media"><audio class="att-audio" controls preload="metadata" src="' + url + '"></audio></div>');
       else if (kind) after.push('<div class="text-card" data-att="' + a.id + '" data-type="' + kind + '"></div>');
       var name = escapeHtml(a.name || "file");
       if (a.kind === "photo") {
@@ -560,13 +604,14 @@
         out.push('<a class="att-file" href="' + url + '" download="' + name + '">📎 ' + name + ' <span class="att-size">' + escapeHtml(formatSize(a.size)) + "</span></a>");
       }
     });
-    return (out.length ? '<div class="atts">' + out.join("") + "</div>" : "") + after.join("");
+    return (out.length ? '<div data-trust="attachment" class="atts">' + out.join("") + "</div>" : "") + after.join("");
   }
 
   return {
     renderMarkdown: renderMarkdown, escapeHtml: escapeHtml, mergeMessages: mergeMessages, applyReplyButtons: applyReplyButtons, composerKey: composerKey,
+    pollRemaining: pollRemaining,
     settleFailedSend: settleFailedSend, putBack: putBack,
-    FILE_LIMITS: FILE_LIMITS, formatSize: formatSize, checkFiles: checkFiles, attachmentsHtml: attachmentsHtml, isHtmlAttachment: isHtmlAttachment,
+    FILE_LIMITS: FILE_LIMITS, fileLimits: fileLimits, fileRejection: fileRejection, formatSize: formatSize, checkFiles: checkFiles, attachmentsHtml: attachmentsHtml, isHtmlAttachment: isHtmlAttachment,
     nextDeliveryState: nextDeliveryState, applyDelivery: applyDelivery, deliveryHtml: deliveryHtml, isBusy: isBusy,
     isNearBottom: isNearBottom, CODE_FOLD_LINES: CODE_FOLD_LINES, lineCount: lineCount,
     LONG_PASTE_CHARS: LONG_PASTE_CHARS, isLongPaste: isLongPaste, formatElapsed: formatElapsed,