@songsid/agend 2.2.0 → 2.3.0-beta.1

package/dist/ui/shared/effect-runtime-loader.js

@@ -0,0 +1,234 @@
+/** #1629: bounded host HTTP projection. No product startup, frame, content event or retry. */
+import { checkStaticEffectPoster } from "./effect-poster-reader.js";
+const loaders = new WeakMap();
+const ID = /^[a-f0-9]{32}$/, EPOCH = /^[a-f0-9]{16}$/, PARAM = /^[a-z][a-z0-9_]{0,31}$/;
+const REGIONS = ["chat", "sidebar", "header", "page", "box"], WANTS = ["pointer", "state", "reply", "mention", "theme"];
+const SLOTS = ["fx.sidebar", "fx.header", "fx.page", "fx.box"];
+const MIB = 1048576, WIRE = 8 * MIB;
+const plain = x => !!x && (Object.getPrototypeOf(x) === Object.prototype || Object.getPrototypeOf(x) === null);
+const finite = x => typeof x === "number" && Number.isFinite(x);
+const integer = (x, lo, hi) => Number.isSafeInteger(x) && x >= lo && x <= hi;
+const exact = (o, keys) => plain(o) && Object.keys(o).sort().join(",") === [...keys].sort().join(",");
+const subset = (o, keys) => plain(o) && Object.keys(o).every(k => keys.includes(k));
+const instanceOK = x => typeof x === "string" && x.length >= 1 && x.length <= 128;
+const enumeration = (x, values, min = 0) => Array.isArray(x) && x.length >= min && x.length <= values.length && new Set(x).size === x.length && x.every(v => values.includes(v));
+/** Copy own data before inspecting it. Refuse accessors/symbols, non-finite values and unbounded trees. */
+function data(value, maxNodes = 1024) {
+  let nodes = 0;
+  function copy(x, depth) {
+    if (++nodes > maxNodes || depth > 8) throw Error("shape");
+    if (x === null || typeof x === "string" || typeof x === "boolean" || finite(x)) return x;
+    const array = Array.isArray(x);
+    if (array ? Object.getPrototypeOf(x) !== Array.prototype || x.length > 32 : !plain(x)) throw Error("shape");
+    const out = array ? [] : Object.create(null), keys = Reflect.ownKeys(x);
+    if (keys.length > 33) throw Error("shape");
+    for (const key of keys) {
+      if (array && key === "length") continue;
+      if (typeof key !== "string" || array && (!/^(0|[1-9][0-9]*)$/.test(key) || !Number.isSafeInteger(Number(key)) || Number(key) >= x.length)) throw Error("shape");
+      const d = Object.getOwnPropertyDescriptor(x, key); if (!d || !("value" in d)) throw Error("shape");
+      out[key] = copy(d.value, depth + 1);
+    }
+    if (array && Object.keys(out).length !== x.length) throw Error("shape");
+    return Object.freeze(out);
+  }
+  try { return copy(value, 0); } catch { return null; }
+}
+// Same normalized one-line contract as web-effect.ts text()/web-theme.ts canonicalText.
+const FORBIDDEN_TEXT = /(?!\u200d)[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+const VISIBLE_TEXT = /[^\p{M}\p{C}\p{Z}\u115f\u1160\u3164\uffa0\u2800]/u;
+let graphemes = null;
+function displayText(s, max, min = 1) {
+  if (typeof s !== "string" || s.length > max * 10) return false;
+  if (min === 0 && s === "") return true;
+  if (s.normalize("NFC") !== s || FORBIDDEN_TEXT.test(s) || s.trim() !== s || !VISIBLE_TEXT.test(s)) return false;
+  try {
+    graphemes ??= new Intl.Segmenter(undefined, { granularity: "grapheme" });
+    let count = 0; for (const _part of graphemes.segment(s)) if (++count > max) return false;
+    return count >= min;
+  } catch { return false; }
+}
+function manifest(x) {
+  if (!subset(x, ["v", "kind", "runtime", "worker", "name", "title", "description", "poster", "regions", "layer", "box", "cursor", "wants", "params"]) || x.v !== 1 || x.kind !== "effect" || x.runtime !== "canvas-worker-v1" || x.worker !== "worker.js"
+    || typeof x.name !== "string" || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(x.name) || !displayText(x.title, 40)
+    || x.description !== undefined && !displayText(x.description, 200, 0) || x.poster !== undefined && x.poster !== "poster.png"
+    || !enumeration(x.regions, REGIONS, 1) || !["behind", "front"].includes(x.layer) || !enumeration(x.wants, WANTS)) return false;
+  if (x.box !== undefined && (!exact(x.box, ["anchor", "width", "height", "offset"]) || !["top-left", "top-right", "bottom-left", "bottom-right", "center"].includes(x.box.anchor) || !integer(x.box.width, 32, 480) || !integer(x.box.height, 32, 480) || !integer(x.box.offset, 0, 64))) return false;
+  if (x.cursor !== undefined && (!exact(x.cursor, ["hotspot"]) || !Array.isArray(x.cursor.hotspot) || x.cursor.hotspot.length !== 2 || !x.cursor.hotspot.every(v => integer(v, 0, 63)))) return false;
+  if (x.params === undefined) return true;
+  if (!plain(x.params) || Object.keys(x.params).length > 16) return false;
+  return Object.entries(x.params).every(([k, d]) => {
+    if (!PARAM.test(k) || !plain(d)) return false;
+    if (d.type === "number" || d.type === "int") return subset(d, ["type", "min", "max", "default", ...(d.type === "number" ? ["step"] : [])]) && [d.min, d.max, d.default].every(v => finite(v) && Math.abs(v) <= 1e9 && (d.type !== "int" || Number.isInteger(v)))
+      && d.min <= d.max && d.default >= d.min && d.default <= d.max && (d.step === undefined || finite(d.step) && d.step > 0 && d.step <= 2e9 && aligned(d.default, d));
+    if (d.type === "bool") return exact(d, ["type", "default"]) && typeof d.default === "boolean";
+    if (d.type === "color") return exact(d, ["type", "default"]) && typeof d.default === "string" && /^#[0-9a-f]{6}$/.test(d.default);
+    return d.type === "enum" && exact(d, ["type", "default", "values"]) && Array.isArray(d.values) && d.values.length >= 1 && d.values.length <= 16 && new Set(d.values).size === d.values.length && d.values.every(v => typeof v === "string" && /^[a-z0-9][a-z0-9-]{0,31}$/.test(v)) && d.values.includes(d.default);
+  });
+}
+function aligned(v, d) { const n = (v - d.min) / d.step; return Number.isFinite(n) && Math.abs(n - Math.round(n)) <= 1e-8; }
+function params(m, values) {
+  const defs = m.params ?? {};
+  return plain(values) && Object.keys(values).sort().join(",") === Object.keys(defs).sort().join(",") && Object.entries(defs).every(([key, d]) => {
+    const v = values[key];
+    if (d.type === "number" || d.type === "int") return finite(v) && v >= d.min && v <= d.max && (d.type !== "int" || Number.isSafeInteger(v)) && (d.step === undefined || aligned(v, d));
+    if (d.type === "bool") return typeof v === "boolean";
+    return d.type === "enum" ? d.values.includes(v) : typeof v === "string" && /^#[0-9a-f]{6}$/.test(v);
+  });
+}
+/** HTTP data only: authoritative provenance comes from the host's persisted placement, never a manifest. */
+export function checkEffectPlacements(input) {
+  const x = data(input); if (!exact(x, ["rev", "effects"]) || !integer(x.rev, 0, Number.MAX_SAFE_INTEGER) || !Array.isArray(x.effects) || x.effects.length > 2) return null;
+  const ids = new Set();
+  for (const p of x.effects) {
+    if (!exact(p, ["id", "by", "at", "manifest", "params"]) || typeof p.id !== "string" || !ID.test(p.id) || ids.has(p.id) || !["human", "agent"].includes(p.by) || !integer(p.at, 0, Number.MAX_SAFE_INTEGER) || !manifest(p.manifest) || !params(p.manifest, p.params)) return null;
+    ids.add(p.id);
+  }
+  return x;
+}
+/** Closed personal metadata. Uses the same CW1 manifest/text contract as resources, with no code or provenance grant. */
+export function checkEffectOwnerSlots(input) {
+  const x = data(input, 4096), keys = [...SLOTS, "fx.cursor"];
+  if (!exact(x, ["rev", "slots"]) || !integer(x.rev, 0, Number.MAX_SAFE_INTEGER) || !exact(x.slots, keys)) return null;
+  for (const key of keys) {
+    const row = x.slots[key];
+    if (!plain(row)) return null;
+    if (row.status === "none") { if (!exact(row, ["status", "id"]) || row.id !== null) return null; }
+    else if (row.status === "unavailable") { if (!exact(row, ["status", "id"]) || typeof row.id !== "string" || !ID.test(row.id)) return null; }
+    else if (row.status === "available") {
+      if (!exact(row, ["status", "id", "manifest"]) || typeof row.id !== "string" || !ID.test(row.id) || !manifest(row.manifest)) return null;
+      if (key === "fx.cursor" ? !row.manifest.cursor : !row.manifest.regions.includes(key.slice(3)) || key === "fx.box" && !row.manifest.box) return null;
+    } else return null;
+  }
+  return x;
+}
+/** Checked local-admin Start response only; this projection never starts or authorizes a trial. */
+export function checkEffectTrialStart(input, expectedOffer, expectedId) {
+  const x = data(input);
+  if (typeof expectedOffer !== "string" || !ID.test(expectedOffer) || typeof expectedId !== "string" || !ID.test(expectedId)
+    || !exact(x, ["trial", "offer", "remainingMs", "manifest", "params"]) || typeof x.trial !== "string" || !ID.test(x.trial)
+    || !integer(x.remainingMs, 1, 600000) || !exact(x.offer, ["v", "offer", "id", "title", "expiresAt"])
+    || x.offer.v !== 1 || x.offer.offer !== expectedOffer || x.offer.id !== expectedId || !displayText(x.offer.title, 40)
+    || !integer(x.offer.expiresAt, 0, Number.MAX_SAFE_INTEGER) || !manifest(x.manifest) || x.manifest.title !== x.offer.title || !params(x.manifest, x.params)) return null;
+  return x;
+}
+
+/** Never include host poster/cursor bytes in the Worker asset list. The factory snapshots again. */
+export function checkEffectResource(input, expectedId) {
+  const x = data(input); if (!exact(x, ["id", "manifest", "params", "wants", "code", "assets"]) || typeof expectedId !== "string" || !ID.test(expectedId) || x.id !== expectedId || !manifest(x.manifest) || !params(x.manifest, x.params)
+    || !enumeration(x.wants, WANTS) || JSON.stringify(x.wants) !== JSON.stringify(x.manifest.wants) || typeof x.code !== "string" || x.code.length > MIB || !Array.isArray(x.assets) || x.assets.length > 16) return null;
+  const encoder = new TextEncoder(), code = encoder.encode(x.code); let bytes = code.length + encoder.encode(JSON.stringify(x.params)).length;
+  if (bytes > MIB || new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(code) !== x.code) return null;
+  const names = new Set(), assets = [];
+  for (const a of x.assets) {
+    if (!exact(a, ["name", "mime", "data_b64"]) || typeof a.name !== "string" || !/^assets\/[a-z0-9][a-z0-9_-]{0,63}\.(png|jpe?g|webp|gif)$/.test(a.name) || names.has(a.name) || typeof a.data_b64 !== "string" || a.data_b64.length > Math.ceil(MIB / 3) * 4 || a.data_b64.length % 4 !== 0) return null;
+    const ext = a.name.slice(a.name.lastIndexOf(".") + 1), mime = ["jpg", "jpeg"].includes(ext) ? "image/jpeg" : `image/${ext}`;
+    if (a.mime !== mime) return null;
+    let raw; try { raw = atob(a.data_b64); if (btoa(raw) !== a.data_b64) return null; } catch { return null; }
+    if (!raw.length || (bytes += raw.length) > MIB) return null;
+    names.add(a.name); assets.push({ name: a.name, mime, bytes: Uint8Array.from(raw, c => c.charCodeAt(0)) });
+  }
+  return { id: x.id, manifest: x.manifest, params: x.params, wants: x.wants, code: x.code, assets };
+}
+
+/** Static host cursor only. Native decode/hotspot checks remain the mount controller's responsibility. */
+export function checkStaticEffectCursor(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length > 32768) return null;
+  const image = checkStaticEffectPoster(bytes); if (!image) return null;
+  const view = new DataView(image.buffer, image.byteOffset, image.byteLength), width = view.getUint32(16), height = view.getUint32(20);
+  return width >= 1 && width <= 64 && height === width ? image : null;
+}
+
+/** The host freezes ownerEpoch/current at page creation; neither is taken from a response or an effect. */
+export function createEffectRuntimeLoader({ window: host, ownerEpoch, current, onRevoke = () => {} } = {}) {
+  if (!host || typeof host !== "object" || loaders.has(host) || typeof host.fetch !== "function" || typeof host.AbortController !== "function" || typeof host.setTimeout !== "function" || typeof host.clearTimeout !== "function" || typeof ownerEpoch !== "string" || !EPOCH.test(ownerEpoch) || typeof current !== "function" || typeof onRevoke !== "function") return { ok: false };
+  const reservation = {}; loaders.set(host, reservation);
+  let dead = false, revoked = false, previous = null; const pending = new Set();
+  const releaseWindow = () => { if (dead && pending.size === 0 && loaders.get(host) === reservation) loaders.delete(host); };
+  // Terminal state is latched before callbacks. Abort releases logical callers, never physical reservations.
+  function revoke(reason) {
+    if (dead || revoked) return;
+    revoked = true;
+    try { onRevoke(Object.freeze({ reason })); } catch { /* host notification cannot preserve authority */ }
+    for (const p of [...pending]) { try { p.abort?.(); } catch { /* cancel the other operations */ } }
+  }
+  const now = () => { let t; try { t = host.performance.now(); } catch { revoke("clock_unavailable"); return null; } if (!finite(t) || t < 0 || previous !== null && t < previous) { revoke("clock_unavailable"); return null; } previous = t; return t; };
+  const alive = () => { if (dead || revoked) return false; try { if (current() === true) return !dead && !revoked; } catch { /* unknown */ } revoke("owner_unavailable"); return false; };
+  if (!alive() || now() === null) { dead = true; releaseWindow(); return { ok: false }; }
+  function run(kind, path, project, signal, settled = false, binary = false) {
+    if (dead || revoked) return Promise.resolve(null);
+    const began = now(); if (began === null) return Promise.resolve(null);
+    if (!alive() || signal?.aborted || [...pending].filter(p => p.kind === kind).length >= (kind === "resource" ? 3 : 1)) return Promise.resolve(null);
+    const controller = new host.AbortController(), op = { kind, controller, abort: null }, limit = binary ? 32768 : kind === "placements" ? 256 * 1024 : WIRE; pending.add(op);
+    let release, reader = null, body = null, cancellation = null, timer = null, wasAborted = false;
+    // Cache the actual cancellation, but not a pre-response no-op: a late response still owns its body.
+    const cancelBody = () => {
+      if (!reader && !body) return Promise.resolve();
+      if (!cancellation) { try { cancellation = Promise.resolve(reader ? reader.cancel() : body.cancel()).catch(() => {}); } catch { cancellation = Promise.resolve(); } }
+      return cancellation;
+    };
+    const cancelled = new Promise(resolve => { release = resolve; });
+    const abort = () => { wasAborted = true; controller.abort(); void cancelBody(); release(null); };
+    op.abort = abort;
+    const valid = () => { if (!alive() || controller.signal.aborted) { abort(); return false; } const t = now(); if (t === null || t < began || t - began >= 10000) { abort(); return false; } return true; };
+    const work = Promise.resolve().then(async () => {
+      if (!valid()) return null;
+      const response = await host.fetch(path, { credentials: "same-origin", cache: "no-store", redirect: "error", signal: controller.signal });
+      body = response.body;
+      if (!valid()) return null;
+      if ([401, 403, 409].includes(response.status)) { revoke("authorization_rejected"); return null; }
+      if (!response.ok || response.redirected || !((binary ? /^image\/png(?:\s*;|$)/i : /^application\/json(?:\s*;|$)/i).test(response.headers.get("content-type") || ""))) return null;
+      const length = response.headers.get("content-length");
+      if (length !== null && (!/^(0|[1-9][0-9]*)$/.test(length) || !integer(Number(length), 0, limit))) return null;
+      if (!body || typeof body.getReader !== "function") return null;
+      reader = body.getReader(); const chunks = []; let size = 0;
+      for (;;) {
+        const part = await reader.read(); if (!valid()) return null;
+        if (part.done) break;
+        if (!(part.value instanceof Uint8Array) || (size += part.value.length) > limit) { abort(); return null; }
+        chunks.push(part.value.slice());
+      }
+      const bytes = new Uint8Array(size); let offset = 0; for (const part of chunks) { bytes.set(part, offset); offset += part.length; }
+      let value = bytes; if (!binary) { try { value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)); } catch { return null; } }
+      if (!valid()) return null;
+      const answer = project(value); return valid() ? answer : null;
+    }).catch(() => null).finally(async () => { controller.abort(); await cancelBody(); pending.delete(op); releaseWindow(); host.clearTimeout(timer); signal?.removeEventListener("abort", abort); }).then(value => {
+      // Cleanup aborts the controller even on success; only an actual abort or stale completion revokes the result.
+      if (!alive() || wasAborted || signal?.aborted) return null;
+      const t = now(); return t !== null && t >= began && t - began < 10000 ? value : null;
+    });
+    timer = host.setTimeout(abort, 10000); signal?.addEventListener("abort", abort, { once: true });
+    return settled ? work : Promise.race([work, cancelled]);
+  }
+  const placementRead = (instance, signal, settled = false) => instanceOK(instance) ? run("placements", `/ui/effects/placements?instance=${encodeURIComponent(instance)}&ownerEpoch=${ownerEpoch}`, checkEffectPlacements, signal, settled) : Promise.resolve(null);
+  function resourceRead(input, signal, settled = false) {
+    const spec = data(input);
+    if (!subset(spec, ["id", "instance", "slot"]) || typeof spec.id !== "string" || !ID.test(spec.id) || (spec.instance !== undefined) === (spec.slot !== undefined) || spec.instance !== undefined && !instanceOK(spec.instance) || spec.slot !== undefined && !SLOTS.includes(spec.slot)) return Promise.resolve(null);
+    const id = spec.id, scope = spec.instance !== undefined ? `instance=${encodeURIComponent(spec.instance)}` : `slot=${encodeURIComponent(spec.slot)}`;
+    return run("resource", `/ui/effects/resource/${id}?${scope}&ownerEpoch=${ownerEpoch}`, value => checkEffectResource(value, id), signal, settled);
+  }
+  function trialResourceRead(input, signal) {
+    const spec = data(input);
+    if (!exact(spec, ["trial", "id", "instance"]) || typeof spec.trial !== "string" || !ID.test(spec.trial)
+      || typeof spec.id !== "string" || !ID.test(spec.id) || !instanceOK(spec.instance)) return Promise.resolve(null);
+    const id = spec.id;
+    return run("resource", `/ui/effect-trials/${spec.trial}/resource?instance=${encodeURIComponent(spec.instance)}&ownerEpoch=${ownerEpoch}`, value => checkEffectResource(value, id), signal, true);
+  }
+  const ownerRead = (signal, settled = false) => run("placements", `/ui/effects/owner?ownerEpoch=${ownerEpoch}`, checkEffectOwnerSlots, signal, settled);
+  return { ok: true,
+    owner(signal) { return ownerRead(signal); },
+    placements(instance, signal) { return placementRead(instance, signal); },
+    resource(input, signal) { return resourceRead(input, signal); },
+    // Host scheduler seams: logical abort is prompt; these promises retain ownership until physical cleanup.
+    ownerSettled(signal) { return ownerRead(signal, true); },
+    placementsSettled(instance, signal) { return placementRead(instance, signal, true); },
+    resourceSettled(input, signal) { return resourceRead(input, signal, true); },
+    trialResourceSettled(input, signal) { return trialResourceRead(input, signal); },
+    // One binary physical lane in the same loader: no response-derived URL, code, metadata or ACL fallback.
+    cursorImageSettled(id, signal) {
+      return typeof id === "string" && ID.test(id)
+        ? run("cursor", `/ui/effects/image/${id}/cursor.png?slot=fx.cursor&ownerEpoch=${ownerEpoch}`, checkStaticEffectCursor, signal, true, true)
+        : Promise.resolve(null);
+    },
+    dispose() { if (dead) return; dead = true; for (const p of pending) p.abort(); releaseWindow(); },
+  };
+}

package/dist/ui/shared/effect-safety.js

@@ -0,0 +1,153 @@
+/** #1629: synchronous browser probation/history participant. No product startup or frame creation. */
+import { newEffectPauseHistory, recordEffectPause } from "./effect-profiler.js";
+
+const PREFIX = "agend_effect_safety_v1:", MAX_KEYS = 4096, MAX_RECORDS = 2048, MAX_BYTES = 512 * 1024;
+const plain = o => !!o && (Object.getPrototypeOf(o) === Object.prototype || Object.getPrototypeOf(o) === null);
+const idOK = x => typeof x === "string" && /^[a-f0-9]{32}$/.test(x);
+const deviceOK = x => x === "standard" || x === "constrained";
+const wallOK = x => typeof x === "number" && Number.isSafeInteger(x) && x >= 0;
+const fields = (o, expected) => plain(o) && Object.keys(o).sort().join(",") === expected.split(",").sort().join(",");
+const keyFor = r => `${PREFIX}${r.kind}:${r.id}:${r.device}:${r.token}`;
+function valid(r) {
+  if (!plain(r) || r.v !== 1 || !idOK(r.id) || !deviceOK(r.device) || !idOK(r.token)) return false;
+  if (r.kind === "probation") return fields(r, "v,kind,id,device,token,owner,at") && idOK(r.owner) && wallOK(r.at);
+  if (r.kind === "pause") return fields(r, "v,kind,id,device,token,at") && wallOK(r.at);
+  return r.kind === "resume" && fields(r, "v,kind,id,device,token");
+}
+
+/**
+ * Storage is local to this browser/origin. Append-only pause receipts avoid read/modify/write lost updates
+ * between tabs. Explicit human Resume acknowledges exact pause ids; it never deletes history or sticky off.
+ * Any unreadable/unknown receipt, quota failure or incomplete cleanup latches this participant closed.
+ */
+export function createEffectSafety({ storage, crypto, wall = () => Date.now() } = {}) {
+  let fault = false, owner = null;
+  const owned = new Map();
+  const fail = () => { fault = true; return null; };
+  const nonce = () => {
+    try {
+      const bytes = new Uint8Array(16); if (crypto.getRandomValues(bytes) !== bytes) return fail();
+      return [...bytes].map(x => x.toString(16).padStart(2, "0")).join("");
+    } catch { return fail(); }
+  };
+  try {
+    if (!storage || ["key", "getItem", "setItem", "removeItem"].some(k => typeof storage[k] !== "function") || typeof crypto?.getRandomValues !== "function" || typeof wall !== "function") fault = true;
+    else owner = nonce();
+  } catch { fault = true; }
+  function read() {
+    if (fault) return null;
+    try {
+      const length = storage.length;
+      if (!Number.isSafeInteger(length) || length < 0 || length > MAX_KEYS) return fail();
+      const rows = new Map(), seen = new Set(); let bytes = 0;
+      for (let i = 0; i < length; i++) {
+        const key = storage.key(i);
+        if (typeof key !== "string" || seen.has(key)) return fail();
+        seen.add(key);
+        if (!key.startsWith(PREFIX)) continue;
+        const text = storage.getItem(key);
+        if (typeof text !== "string" || text.length > 1024) return fail();
+        bytes += (key.length + text.length) * 2;
+        if (bytes > MAX_BYTES || rows.size >= MAX_RECORDS) return fail();
+        const value = JSON.parse(text);
+        if (!valid(value) || keyFor(value) !== key) return fail();
+        rows.set(key, { value, text });
+      }
+      if (storage.length !== length) return fail();
+      // A still-owned probation receipt cannot disappear or change beneath a live page. Another tab's
+      // explicit Resume may remove it; that page must stop rather than silently treating the loss as healthy.
+      for (const item of owned.values()) if (rows.get(item.key)?.text !== item.text) return fail();
+      for (const { value: r } of rows.values()) if (r.kind === "resume" && !rows.has(keyFor({ ...r, kind: "pause" }))) return fail();
+      return rows;
+    } catch { return fail(); }
+  }
+  function inspect(rows, id, device) {
+    const relevant = [...rows.values()].map(x => x.value).filter(r => r.id === id && r.device === device);
+    const pauses = relevant.filter(r => r.kind === "pause").sort((a, b) => a.at - b.at || a.token.localeCompare(b.token));
+    let history = newEffectPauseHistory(id, device, 0);
+    for (const r of pauses) { const next = recordEffectPause(history, r.at); if (!next.ok) return fail(); history = next.history; }
+    const interrupted = relevant.some(r => r.kind === "probation" && r.owner !== owner);
+    const paused = pauses.some(r => !rows.has(keyFor({ ...r, kind: "resume" })));
+    return { state: history.off ? "off" : interrupted ? "interrupted" : paused ? "paused" : "ok", history };
+  }
+  function put(record, rows) {
+    try {
+      const key = keyFor(record), text = JSON.stringify(record), previous = storage.getItem(key);
+      if (previous !== null) { if (previous === text) return true; return !!fail(); }
+      if (rows.size >= MAX_RECORDS || [...rows].reduce((n, [k, r]) => n + (k.length + r.text.length) * 2, (key.length + text.length) * 2) > MAX_BYTES) return !!fail();
+      storage.setItem(key, text);
+      if (storage.getItem(key) !== text) return !!fail();
+      return true;
+    } catch { return !!fail(); }
+  }
+  function remove(key, text) {
+    try {
+      if (storage.getItem(key) !== text) return !!fail();
+      storage.removeItem(key);
+      if (storage.getItem(key) !== null) return !!fail();
+      return true;
+    } catch { return !!fail(); }
+  }
+  function stamp(rows, id, device) {
+    try {
+      const now = wall(); if (!wallOK(now)) return fail();
+      return Math.max(now, ...[...rows.values()].map(x => x.value).filter(r => r.id === id && r.device === device && "at" in r).map(r => r.at));
+    } catch { return fail(); }
+  }
+  const status = (id, device) => {
+    if (!idOK(id) || !deviceOK(device)) return { state: "unknown" };
+    const rows = read(), result = rows && inspect(rows, id, device);
+    return result ? { state: result.state, history: { ...result.history, pauses: [...result.history.pauses] } } : { state: "unknown" };
+  };
+  return {
+    status,
+    allowed(id, device) { return status(id, device).state === "ok"; },
+    begin(spec) {
+      if (!plain(spec) || !idOK(spec.id) || !deviceOK(spec.device) || typeof spec.key !== "string" || spec.key.length < 1 || spec.key.length > 256) return null;
+      const rows = read(), state = rows && inspect(rows, spec.id, spec.device);
+      if (!state || state.state !== "ok") return null;
+      const token = nonce(), at = stamp(rows, spec.id, spec.device);
+      if (token === null || at === null) return null;
+      const record = { v: 1, kind: "probation", id: spec.id, device: spec.device, token, owner, at };
+      // Never overwrite a colliding marker, even one this page already owns.
+      if (rows.has(keyFor(record))) return fail();
+      if (!put(record, rows)) return null;
+      const fresh = read(), verified = fresh && inspect(fresh, spec.id, spec.device);
+      if (!verified || verified.state !== "ok" || fresh.get(keyFor(record))?.text !== JSON.stringify(record)) { if (!fault) remove(keyFor(record), JSON.stringify(record)); return null; }
+      owned.set(token, { key: keyFor(record), text: JSON.stringify(record) });
+      return token;
+    },
+    finish(token, reason) {
+      if (fault || !idOK(token) || typeof reason !== "string" || reason.length < 1 || reason.length > 128) return false;
+      const item = owned.get(token); if (!item) return false;
+      if (!remove(item.key, item.text)) return false;
+      owned.delete(token); return true;
+    },
+    pause(record) {
+      if (!plain(record) || !idOK(record.id) || !deviceOK(record.device) || record.reason !== "host_budget") return false;
+      const rows = read(); if (!rows) return false;
+      const token = nonce(), at = stamp(rows, record.id, record.device);
+      if (token === null || at === null) return false;
+      const value = { v: 1, kind: "pause", id: record.id, device: record.device, token, at };
+      if (rows.has(keyFor(value))) return !!fail();
+      return put(value, rows);
+    },
+    /** Human action only: acknowledges the observed pauses, leaving every immutable history receipt intact. */
+    resume(id, device) {
+      if (!idOK(id) || !deviceOK(device)) return false;
+      const rows = read(), state = rows && inspect(rows, id, device);
+      if (!state || state.state === "off") return false;
+      for (const [key, { value: r, text }] of rows) {
+        if (r.id !== id || r.device !== device) continue;
+        if (r.kind === "probation" && r.owner !== owner && !remove(key, text)) return false;
+        if (r.kind === "pause" && !rows.has(keyFor({ ...r, kind: "resume" }))) {
+          const ack = { v: 1, kind: "resume", id, device, token: r.token };
+          if (!put(ack, rows)) return false;
+          rows.set(keyFor(ack), { value: ack, text: JSON.stringify(ack) });
+        }
+      }
+      const fresh = read(), verified = fresh && inspect(fresh, id, device);
+      return verified?.state === "ok";
+    },
+  };
+}

package/dist/ui/shared/effect-stock-snapshot.js

@@ -0,0 +1,34 @@
+/** #1629: a bounded copy of host stock paint evidence. Never reads an accessor or a DOMRect. */
+const snapshots = new WeakSet();
+const plain = value => !!value && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+const finite = value => typeof value === "number" && Number.isFinite(value) && Math.abs(value) <= 1e7;
+function fields(value, required, optional = []) {
+  if (!plain(value)) return null;
+  const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
+  if (keys.some(key => typeof key !== "string" || !required.includes(key) && !optional.includes(key) || !Object.hasOwn(descriptors[key], "value")) || required.some(key => !Object.hasOwn(descriptors, key))) return null;
+  return Object.fromEntries(keys.map(key => [key, descriptors[key].value]));
+}
+export function effectStockSnapshot(value) {
+  try {
+    if (snapshots.has(value)) return value;
+    const data = fields(value, ["ok", "front", "agentFront", "rects"], ["reason", "agentReason", "settingsHref"]);
+    if (!data || data.ok !== true || typeof data.front !== "boolean" || typeof data.agentFront !== "boolean" || data.agentFront && !data.front || !Array.isArray(data.rects) || data.rects.length > 128) return null;
+    // Optional host display metadata is not copied into the paint evidence.
+    for (const key of ["reason", "agentReason", "settingsHref"]) if (Object.hasOwn(data, key) && data[key] !== null && (typeof data[key] !== "string" || data[key].length > 256)) return null;
+    const entries = Object.getOwnPropertyDescriptors(data.rects), keys = Reflect.ownKeys(entries);
+    if (keys.length !== data.rects.length + 1 || keys.some(key => key !== "length" && (typeof key !== "string" || !/^(0|[1-9]\d*)$/.test(key) || Number(key) >= data.rects.length || !Object.hasOwn(entries[key], "value")))) return null;
+    const rects = [];
+    for (let i = 0; i < data.rects.length; i++) {
+      const r = fields(entries[i].value, ["x", "y", "width", "height"]);
+      if (!r || ![r.x, r.y, r.width, r.height].every(finite) || r.width < 0 || r.height < 0) return null;
+      rects.push(Object.freeze(r));
+    }
+    const result = Object.freeze({ ok: true, front: data.front, agentFront: data.agentFront, rects: Object.freeze(rects) });
+    snapshots.add(result); return result;
+  } catch { return null; }
+}
+/** Missing provenance receives the agent rule. Behind still requires proven stock ordering. */
+export function effectStockAllows(snapshot, { layer, by } = {}) {
+  const proof = effectStockSnapshot(snapshot);
+  return !!proof && (layer === "behind" || layer === "front" && proof.front && (by === "human" || proof.agentFront));
+}

package/dist/ui/shared/effect-stock-trust.js

@@ -0,0 +1,165 @@
+/** #1629: stock shell inventory/paint prerequisite. No frame creation, effect code, content or network reads. */
+const SPECS = [
+  ["composer", ".shell .p-chat .chat-main > .dock"],
+  ["reply", ".shell .thread .rb-row, .shell .thread .poll-voters"],
+  ["navigation", ".shell .side-head, .shell .side-nav, .shell .side-section, .shell .side-foot, .shell .tabs, .shell .skip, .shell .side-resize"],
+  ["header", ".shell .panel-head"], ["status", ".shell .main > .conn"], ["usage", ".shell > .u-rail"],
+  ["widget", ".shell .aw, .shell .side-widget"], ["card", ".shell .p-chat > .chat-card"], ["permission", ".shell .n-item, .shell .dock .prompts"],
+  ["menu", ".shell .menu-list[role=menu]"], ["session", ".shell .side-foot .pop[role=dialog]"],
+  ["popover", ".shell .prefs-pop > .pop"], ["dialog", ".shell dialog.dlg"], ["lightbox", ".shell dialog.lb"],
+  ["tour", "body > #tour.tour[role=dialog]"], ["keep", ".shell > .oc-keep"], ["toast", ".shell > .toasts"],
+  ["confirmation", ".shell > .pending-stack, .shell .p-settings > .panel-body > .col > .pending-stack.inline"], ["preview", ".shell .chat-split > .pv-panel, .shell .chat-split > .pv-divider"],
+  ["preview-menu", ".shell .thread details.pv-menu"], ["palette", ".shell .dock .cmd-palette"],
+  ["drop", ".shell .p-chat > .drop-overlay"],
+  ["thread-control", ".shell .p-chat .jump-latest, .shell .thread .msg-tools, .shell .thread .st-more, .shell .thread .cb-head, .shell .thread .cb-more, .shell .thread .tc-head, .shell .thread .tc-more, .shell .thread .pv-head, .shell .thread .pv-note, .shell .thread .pv-banner, .shell .thread .effect-trial-offer, .shell .thread .click-chip"],
+  ["link", ".shell .thread .md a, .shell .thread .st-text > a.st-link, .shell .dock .prompts .txt > a.st-link"], ["attachment", ".shell .thread .atts"], ["media", ".shell .thread .att-media"],
+  ["panel-navigation", ".shell .p-fleet > .seg, .shell .p-settings > .seg"],
+  ["panel-content", ".shell .p-fleet > .panel-body, .shell .p-needs > .panel-body, .shell .p-settings > .panel-body, .shell .p-log > .panel-body, .shell .p-details > .panel-body, .shell .p-view > .panel-body, .shell .p-view > .v-term, .shell .p-view > .v-id, .shell .p-view > .v-card"],
+  ["panel-controls", ".shell .p-log > .log-bar, .shell .p-settings > .s-pending"],
+  ["session-ended", "body > .agend-session-ended[role=alert]"],
+];
+export const STOCK_TRUST_INVENTORY = Object.freeze(SPECS.map(([kind, selector]) => Object.freeze({ kind, selector })));
+const STRUCTURAL = ["html", "body", "#app", "#app > .shell", ".shell > .main", ".main > .p-chat", ".p-chat > .chat-split", ".chat-split > .chat-main"];
+const CONTENT = [".main > .conn", ".p-chat > .panel-head", ".p-chat > .chat-card", ".p-chat > .aw-chat_header", ".chat-main > .scroller", ".chat-main > .dock", ".sidebar > .side-head", ".sidebar > .side-nav", ".sidebar > .side-section", ".sidebar > .side-widget", ".sidebar > .side-foot", ".u-rail > .u-rail-head", ".u-rail > .u-rail-body"];
+// Closed producer/topology inventory. Bare Outlet loading/error panels never become an effect surface.
+const PANELS = Object.freeze({
+  fleet: { required: [".panel-head", ".seg", ".panel-body"], optional: [] },
+  needs: { required: [".panel-head", ".panel-body"], optional: [] },
+  settings: { required: [".panel-head", ".seg", ".panel-body"], optional: [".s-pending"] },
+  log: { required: [".panel-head", ".panel-body"], optional: [".log-bar"] },
+  details: { required: [".panel-head", ".panel-body"], optional: [] },
+  view: { required: [".panel-head"], optional: [".panel-body", ".v-term", ".v-id", ".v-card"] },
+});
+function panelSurface(doc, chat) {
+  if (chat) return { panel: chat, structural: STRUCTURAL, content: CONTENT, kind: "chat" };
+  const panel = doc.querySelector(".main > .panel"), kind = panel?.getAttribute("data-effect-panel"), spec = Object.hasOwn(PANELS, kind) ? PANELS[kind] : null;
+  if (!spec || panel.className !== `panel p-${kind}` || [...panel.childNodes].some(node => node.nodeType === 3 && node.textContent.trim())) return null;
+  const children = [...panel.children], count = selector => children.filter(el => el.matches(selector)).length;
+  if (spec.required.some(selector => count(selector) !== 1) || spec.optional.some(selector => count(selector) > 1)
+    || children.some(el => !el.matches([...spec.required, ...spec.optional, "dialog.dlg", "dialog.lb"].join(",")))) return null;
+  if (kind === "view" && !(count(".panel-body") === 1 && !count(".v-term") && !count(".v-id") && !count(".v-card")
+    || !count(".panel-body") && count(".v-term") === 1 && count(".v-card") === 1)) return null;
+  const prefix = `.p-${kind} > `;
+  return { panel, kind, structural: [...STRUCTURAL.slice(0, 5), `.main > .p-${kind}`],
+    content: [...CONTENT.filter(selector => !selector.startsWith(".p-chat") && !selector.startsWith(".chat-main")),
+      ...[...spec.required, ...spec.optional].map(selector => prefix + selector)] };
+}
+const BARRIERS = '[role=menu],[role=dialog],[role=alertdialog],[role=listbox],dialog[open],details[open],.toast,.pending-stack:not(.inline),.oc-keep,.shell.sb-open,.p-chat.dragging,.agend-session-ended,audio[controls],video[controls],.effect-trial-panel';
+/** Shared closed overlay list; a trial may exclude only its own positively identified panel. */
+export const STOCK_EFFECT_BARRIERS = BARRIERS;
+const finite = n => typeof n === "number" && Number.isFinite(n) && Math.abs(n) <= 1e7;
+const none = x => x === "" || x === undefined || x === "none";
+// The stock narrow header fades its own pixels inside its already bounded content context.
+// This exception is never applied to an ancestor or another content surface.
+function stockWidgetMask(host, selector, style) {
+  return selector === ".p-chat > .aw-chat_header" && host.innerWidth < 900
+    && typeof style.maskImage === "string"
+    && /^linear-gradient\(to right, (?:rgb\(0, 0, 0\)|rgb\(0 0 0\)) calc\(100% - 32px\), (?:rgba\(0, 0, 0, 0\)|rgb\(0 0 0 \/ 0\))\)$/.test(style.maskImage);
+}
+function neutral(style, allowStockMask = false) {
+  return !!style && ["transform", "perspective", "filter", "backdropFilter", "rotate", "scale", "translate", "offsetPath", "clipPath"].every(k => none(style[k])) && (none(style.maskImage) || allowStockMask)
+    && style.opacity === "1" && style.isolation === "auto" && style.mixBlendMode === "normal" && style.contain === "none" && style.willChange === "auto"
+    && (style.contentVisibility === undefined || ["", "visible"].includes(style.contentVisibility)) && (style.zoom === undefined || ["", "1", "normal"].includes(style.zoom));
+}
+function rect(el) {
+  const r = el.getBoundingClientRect();
+  return [r.x, r.y, r.width, r.height].every(finite) && r.width >= 0 && r.height >= 0 ? { x: r.x, y: r.y, width: r.width, height: r.height } : null;
+}
+function visible(host, el) {
+  if (!el || el.isConnected !== true) return false;
+  // A descendant of a closed details/dialog may have a styled box but no painted client rect.
+  const s = host.getComputedStyle(el);
+  return s.display !== "none" && s.visibility === "visible" && s.opacity !== "0" && el.getClientRects().length > 0;
+}
+/** Conservatively include stock outer shadows and focus outlines, not only the border box. Unknown paint refuses. */
+function outset(style) {
+  let pad = 0;
+  if (!none(style.textShadow)) return null;
+  if (style.outlineStyle !== "none") {
+    const width = parseFloat(style.outlineWidth), offset = parseFloat(style.outlineOffset);
+    if (![width, offset].every(Number.isFinite)) return null;
+    pad = Math.max(pad, width + Math.max(0, offset));
+  }
+  if (!none(style.boxShadow)) {
+    // Computed colors may contain commas; remove closed color functions before splitting the shadow list.
+    const shadow = style.boxShadow.replace(/(?:rgba?|color|color-mix)\([^()]*\)/g, "color");
+    for (const part of shadow.split(",")) {
+      if (/\binset\b/.test(part)) continue;
+      const lengths = [...part.matchAll(/(-?\d+(?:\.\d+)?)px\b/g)].map(m => Number(m[1]));
+      if (lengths.length < 2 || lengths.length > 4 || !lengths.every(Number.isFinite)) return null;
+      const [x, y, blur = 0, spread = 0] = lengths;
+      if (blur < 0) return null;
+      // Stock blur support is bounded generously; no arbitrary constant padding is the security argument.
+      pad = Math.max(pad, Math.abs(x) + 3 * blur + Math.max(0, spread), Math.abs(y) + 3 * blur + Math.max(0, spread));
+    }
+  }
+  return pad <= 256 ? Math.ceil(pad) : null;
+}
+function protectedPaint(host, root, budget) {
+  const nodes = [root, ...root.querySelectorAll("*")]; budget.n += nodes.length;
+  if (budget.n > 4096) return null;
+  let union = null;
+  for (const el of nodes) {
+    if (!visible(host, el)) continue;
+    const style = host.getComputedStyle(el), r = rect(el), pad = outset(style);
+    if (!r || pad === null || !none(style.filter) || !none(style.backdropFilter)) return null;
+    const a = { x: r.x - pad, y: r.y - pad, width: r.width + pad * 2, height: r.height + pad * 2 };
+    if (!union) union = a;
+    else { const x = Math.min(union.x, a.x), y = Math.min(union.y, a.y); union = { x, y, width: Math.max(union.x + union.width, a.x + a.width) - x, height: Math.max(union.y + union.height, a.y + a.height) - y }; }
+  }
+  return union || { x: 0, y: 0, width: 0, height: 0 };
+}
+/** Snapshot immediately before reveal; callers must hide first on mutations/scroll/resize. No observer is installed here. */
+export function stockEffectTrust(host, { frameRoot = null, ownerCss = "unknown" } = {}) {
+  const fail = reason => ({ ok: false, reason, rects: [], front: false });
+  try {
+    const doc = host.document, app = doc.getElementById("app"), shell = doc.querySelector("#app > .shell"), chat = doc.querySelector(".main > .p-chat");
+    if (!app || app.parentElement !== doc.body || !shell || doc.querySelectorAll("#app > .shell").length !== 1 || doc.querySelectorAll(".main > .panel").length !== 1) return fail("stock_route_unknown");
+    const surface = panelSurface(doc, chat);
+    if (!surface) return fail("stock_route_unknown");
+    if (frameRoot && (frameRoot.ownerDocument !== doc || frameRoot.parentElement !== doc.body || !frameRoot.classList.contains("agend-effect-layer") || !neutral(host.getComputedStyle(frameRoot)) || !["static", "relative"].includes(host.getComputedStyle(frameRoot).position) || host.getComputedStyle(frameRoot).zIndex !== "auto")) return fail("stock_frame_root_unknown");
+    for (const selector of surface.structural) {
+      const el = doc.querySelector(selector), s = el && host.getComputedStyle(el);
+      if (!el || el.isConnected !== true || !neutral(s) || s.zIndex !== "auto" || !["static", "relative"].includes(s.position)) return fail("stock_order_unknown");
+    }
+    for (const selector of surface.content) for (const el of doc.querySelectorAll(selector)) {
+      if (!visible(host, el)) { const children = [...el.querySelectorAll("*")]; if (children.length > 4096 || children.some(child => visible(host, child))) return fail("stock_order_unknown"); continue; }
+      const s = host.getComputedStyle(el);
+      if (s.position !== (selector === ".p-settings > .s-pending" ? "sticky" : "relative") || s.zIndex !== (selector.endsWith(" > .panel-head") ? "2" : "1") || !neutral(s, stockWidgetMask(host, selector, s))) return fail("stock_order_unknown");
+    }
+    // The resize separator has no bounded content parent; prove its own level and neutral sidebar/usage ancestors.
+    for (const el of doc.querySelectorAll(".shell > .sidebar, .shell > .u-rail")) {
+      if (!visible(host, el)) { const children = [...el.querySelectorAll("*")]; if (children.length > 4096 || children.some(child => visible(host, child))) return fail("stock_order_unknown"); continue; }
+      const s = host.getComputedStyle(el);
+      if (!neutral(s) || s.zIndex !== "auto" || !["static", "relative"].includes(s.position)) return fail("stock_order_unknown");
+    }
+    for (const el of doc.querySelectorAll(".shell .side-resize")) if (visible(host, el)) {
+      const s = host.getComputedStyle(el);
+      if (!neutral(s) || s.position !== "absolute" || s.zIndex !== "5") return fail("stock_order_unknown");
+    }
+    // Desktop split preview is a stock level1 content owner too. Narrow preview is a modal sheet, handled below.
+    if (host.innerWidth >= 900) for (const el of doc.querySelectorAll(".chat-split > .pv-panel, .chat-split > .pv-divider")) {
+      if (!visible(host, el)) { const children = [...el.querySelectorAll("*")]; if (children.length > 4096 || children.some(child => visible(host, child))) return fail("stock_order_unknown"); continue; }
+      const s = host.getComputedStyle(el);
+      if (s.position !== "relative" || s.zIndex !== "1" || !neutral(s)) return fail("stock_order_unknown");
+    }
+    const marked = [...doc.querySelectorAll("[data-trust]")], expected = new Set(), rects = [], budget = { n: 0 };
+    if (marked.length > 128) return fail("stock_trust_unknown");
+    for (const { kind, selector } of STOCK_TRUST_INVENTORY) for (const el of doc.querySelectorAll(selector)) {
+      if (el.ownerDocument !== doc || el.isConnected !== true || el.getAttribute("data-trust") !== kind) return fail("stock_trust_unknown");
+      expected.add(el);
+    }
+    if (marked.some(el => !expected.has(el)) || surface.kind === "chat" && !chat.querySelector('.dock[data-trust="composer"]') || !surface.panel.querySelector('.panel-head[data-trust="header"]')) return fail("stock_trust_unknown");
+    for (const el of marked) {
+      const bounds = protectedPaint(host, el, budget); if (!bounds) return fail("stock_paint_unknown");
+      if (bounds.width && bounds.height) rects.push(bounds);
+    }
+    if (doc.querySelector(".agend-session-ended")) return fail("session_ended");
+    let barrier = [...doc.querySelectorAll(BARRIERS)].some(el => visible(host, el));
+    if (host.innerWidth < 900 && [...doc.querySelectorAll(".pv-panel")].some(el => visible(host, el))) barrier = true;
+    const active = doc.activeElement;
+    if (doc.fullscreenElement || doc.pictureInPictureElement) barrier = true;
+    if (active && active !== doc.body && active !== doc.documentElement && (active.matches("input,select,textarea,[contenteditable]") || active.isContentEditable)) barrier = true;
+    return { ok: true, rects, front: !barrier, reason: barrier ? "stock_overlay" : "stock", agentFront: !barrier && ownerCss === "off", agentReason: barrier ? "stock_overlay" : ownerCss === "off" ? "stock" : "owner_css", settingsHref: "/settings/appearance" };
+  } catch { return fail("stock_trust_unknown"); }
+}