@songsid/agend 2.3.0-beta.21 → 2.3.0-beta.23

package/dist/web-api.js

@@ -1,3 +1,5 @@
+import { canvasWorkerEnabled, CANVAS_WORKER_EXPERIMENTAL_MESSAGE } from "./web-experimental.js";
+import { isCanvasWorkerHttpPath } from "./web-experimental-http.js";
 import { webHumanOrigin } from "./human-delivery-receipts.js";
 import { classifyWebPeer, confirmAfterBody, noAuthority } from "./authority/web-authority.js";
 import { guestChatRefusal, guestCommandText, guestDeliveries, guestFrameData, guestHistory, guestMessages, guestPollBody, guestPrefs, guestRequestOf, guestSeesMessage, guestStatus } from "./web-guest-access.js";
@@ -5,6 +7,8 @@ import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { binaryProbe } from "./binary-probe.js";
 import { settingsRequestExecution, settingsWrite, isSettingsReplay } from "./settings-request-capability.js";
 import { readBoundedWebBody } from "./web-body.js";
+import { APP_ICON_MAX_BYTES } from "./web-app-icon.js";
+import { withAppIconLinks } from "./web-icons.js";
 import { MOD_MAX_BYTES } from "./web-mod-bundle.js";
 import { buildModBundle } from "./web-mod-export.js";
 import { AGENT_WIDGET_SLOTS, checkWidgetData, checkWidgetSpec } from "./web-widget.js";
@@ -36,7 +40,7 @@ import { readStatuslineModel, resolveInstanceContext } from "./topic-commands.js
 import { z } from "zod";
 import { evaluateWebRequest, isPassiveWebRead, isSecureRequest, isWebRequestAuthorized, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
 import { dashboardOriginFor } from "./web-preview.js";
-import { newWebMessageId, parseLastEventId, webChatReplyRef, webChatReplyText } from "./web-chat-history.js";
+import { WEB_CHAT_CARDS_OVERFLOW, newWebMessageId, parseLastEventId, webChatReplyRef, webChatReplyText } from "./web-chat-history.js";
 import { attachmentDelivery, createPartFile, displayName, fileTooLargeText, INLINE_MIME, isFileId, MEDIA_RANGE_MAX, publicAttachment, UPLOAD_LIMITS, UPLOAD_MAX_MS, UPLOAD_STALL_MS, UploadSniffer, uploadLimits, wellFormed } from "./web-upload.js";
 import { getAgendHome } from "./paths.js";
 import { OPERATOR, isOwnerEffectKey } from "./web-prefs.js";
@@ -121,11 +125,20 @@ const CardMoveSchema = z.object({
     version: z.number().int().optional(),
 }).strict();
 const CardReorderSchema = z.object({ after: CardRef.nullable().optional(), before: CardRef.nullable().optional() }).strict();
-const ProjectCreateSchema = z.object({ name: z.string().max(256), description: z.string().max(BOARD_TEXT).optional() }).strict();
+const ProjectCreateSchema = z.object({ name: z.string().max(256), description: z.string().max(BOARD_TEXT).optional(), leadInstance: z.string().max(256).nullable().optional() }).strict();
+/** #2352: a project's lead must be one of the fleet's instances now (the board keeps any name, as for an assignee). */
+function checkLeadIsInstance(ctx, lead) {
+    const name = lead?.trim();
+    if (name && !(ctx.fleetConfig?.instances && Object.hasOwn(ctx.fleetConfig.instances, name))) {
+        throw new TaskBoardError("invalid", `"${name.slice(0, 64)}" is not one of the fleet's instances`, "lead_not_instance");
+    }
+}
 const ProjectPatchSchema = z.object({
     name: z.string().max(256).optional(),
     description: z.string().max(BOARD_TEXT).optional(),
     archived: z.boolean().optional(),
+    /** #2352: the instance whose channel lists the project's waiting cards (null or "": General). */
+    leadInstance: z.string().max(256).nullable().optional(),
 }).strict();
 const TeamCreateSchema = z.object({
     name: z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/),
@@ -167,6 +180,68 @@ const safeInstanceSegment = (name) => /^[^\\/\x00]+$/.test(name) && name !== "."
  */
 /** #1920 phase 1b: the open streams that are a guest's, and whose — each event is projected for them (guestFrameData). */
 const streamGuests = new WeakMap();
+/**
+ * The task board's rule over the public link: an instance kept out of sight (cross_instance_visibility: hidden) is not
+ * shown, nor a card that names one as its assignee, creator or dispatcher. Off the link nothing is hidden. Read when
+ * asked: the fleet's config as it is now.
+ */
+function boardHiding(ctx, gateway) {
+    const fleet = ctx.fleetConfig;
+    const hiddenName = (n) => gateway && typeof n === "string" && !!n && !!ctx.fleetConfig?.instances?.[n] && crossInstanceVisibility(fleet, n) === "hidden";
+    const hidden = (c) => [c.assignee, c.createdBy, c.dispatcher?.name].some(hiddenName);
+    return { hiddenName, hidden };
+}
+/**
+ * Chat history as the public link may see it (#2341 review): a status line that names board cards (the daily summary)
+ * is withheld while one of them is hidden there now — or no longer on the board — read when asked, so a card hidden
+ * after the line was written is withheld too. Off the link, as is. The cards are read in one query per answer.
+ */
+function visibleMessages(ctx, gateway, messages) {
+    if (!gateway)
+        return messages;
+    // #2341 review r2: a line that named too many cards to keep them all is withheld whole.
+    messages = messages.filter((m) => !(m.cards ?? []).includes(WEB_CHAT_CARDS_OVERFLOW));
+    const named = [...new Set(messages.flatMap((m) => m.cards ?? []))];
+    if (!named.length)
+        return messages;
+    const board = ctx.scheduler?.db.board;
+    const { hidden } = boardHiding(ctx, true);
+    let found;
+    try {
+        found = new Map((board ? board.cardsByCode(named) : []).map((c) => [c.code, c]));
+    }
+    catch {
+        found = new Map();
+    }
+    const withheld = new Set(named.filter((code) => { const c = found.get(code); return !c || hidden(c); }));
+    return messages.filter((m) => !(m.cards ?? []).some((code) => withheld.has(code)));
+}
+/**
+ * Needs you as the public link may see it (#2306 review): a task item whose card the board hides there — or a card
+ * the board no longer has — is left out, with its title and question; everything else as listed. Off the link, as is.
+ * The link reads Needs you by /ui/poll only: its page has no stream (/ui/events answers it 404).
+ */
+function visibleNeeds(ctx, gateway, items) {
+    if (!gateway)
+        return items;
+    const board = ctx.scheduler?.db.board;
+    const { hidden } = boardHiding(ctx, true);
+    return items.filter((i) => {
+        const item = i;
+        if (item.type !== "task")
+            return true;
+        const code = item.card?.code;
+        if (!board || typeof code !== "string")
+            return false;
+        try {
+            const card = board.findCard(code);
+            return !!card && !hidden(card);
+        }
+        catch {
+            return false;
+        }
+    });
+}
 /**
  * #1920 §5.2: one event for the guests' streams only, each as projected for it — a message that has just become what
  * its channel saw (an admin's page already has it, unchanged).
@@ -252,6 +327,8 @@ function jsonText(res, status, body) {
  * board (the newest revision replaces the previous), so it holds one board's JSON at most.
  */
 const boardBodies = new WeakMap();
+/** #2316 review: the same for who works on what (GET /ui/tasks/work), per (revision, names asked for). */
+const workBodies = new WeakMap();
 /**
  * #1630 (#1635 review): an answer that waited on something (a list, a download) is sent only if the request is still
  * allowed — the session not revoked meanwhile, a public link's exposure still current. Otherwise 401, and nothing.
@@ -264,6 +341,104 @@ function stillAuthorized(req, res, url, ctx) {
     json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
     return false;
 }
+/**
+ * #2308: the app icon. GET: its state, for the settings card (a signed-in person's session). PUT (one PNG, at most
+ * 5 MiB) and DELETE (back to the bundled icon): a signed-in admin's session only — never the CLI's token, a read-only
+ * session, a guest or the public link; checked again once the body has arrived.
+ */
+function handleAppIcon(req, res, url, ctx, method) {
+    const store = ctx.appIcon;
+    if (!store) {
+        json(res, 404, { error: "The app icon is not kept on this fleet" });
+        return true;
+    }
+    const reading = method === "GET" || method === "HEAD";
+    if (!reading && method !== "PUT" && method !== "DELETE") {
+        res.setHeader("Allow", "GET, PUT, DELETE");
+        json(res, 405, { error: "method not allowed" });
+        return true;
+    }
+    if (gatewayRequestContext(req)) {
+        json(res, reading ? 404 : 403, { error: "app_icon_not_over_public_link" });
+        return true;
+    }
+    const who = () => {
+        const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+        if (verdict.kind !== "allow")
+            return { status: 401, error: WEB_TOKEN_INVALID_MESSAGE };
+        if (verdict.via !== "session" || !verdict.session || verdict.session.tier === "guest")
+            return { status: 403, error: "app_icon_needs_a_signed_in_person" };
+        if (!reading && verdict.session.tier !== "admin")
+            return { status: 403, error: "app_icon_admin_only" };
+        return { person: webPersonKey(verdict.session.owner) };
+    };
+    const first = who();
+    if ("status" in first) {
+        json(res, first.status, { error: first.error });
+        return true;
+    }
+    const state = () => { const s = store.current(); return s ? { custom: true, version: s.version, updatedAt: s.updatedAt } : { custom: false, version: "default", updatedAt: null }; };
+    if (reading) {
+        json(res, 200, state());
+        return true;
+    }
+    if (method === "DELETE") {
+        const reset = store.reset();
+        if (!reset.ok) {
+            json(res, reset.status, { error: reset.error, ...(reset.detail ? { detail: reset.detail } : {}) });
+            return true;
+        }
+        json(res, 200, state());
+        return true;
+    }
+    // Still allowed, still answering, the store still open: asked after each await (the body; the conversion).
+    const again = () => {
+        if (!permitWebContinuation(req, res, ctx))
+            return null;
+        if (res.destroyed)
+            return null;
+        const now = who();
+        if ("status" in now) {
+            json(res, now.status, { error: now.error });
+            return null;
+        }
+        return now.person;
+    };
+    (async () => {
+        let bytes;
+        try {
+            bytes = await readBoundedWebBody(req, APP_ICON_MAX_BYTES);
+        }
+        catch {
+            json(res, 413, { error: "app_icon_too_large", detail: "at most 5 MiB" });
+            return;
+        }
+        if (!again())
+            return;
+        // #2308 review: decoding and making the sizes is seconds of CPU at worst — a worker thread's, not the fleet loop's.
+        const prepared = await store.prepare(bytes);
+        if (!prepared.ok) {
+            json(res, prepared.status, { error: prepared.error, ...(prepared.detail ? { detail: prepared.detail } : {}) });
+            return;
+        }
+        const person = again();
+        if (!person)
+            return;
+        const saved = store.commit(prepared.prepared, person);
+        if (!saved.ok) {
+            json(res, saved.status, { error: saved.error, ...(saved.detail ? { detail: saved.detail } : {}) });
+            return;
+        }
+        json(res, 200, state());
+    })().catch((err) => {
+        ctx.logger.error({ err: err.message }, "App icon request failed");
+        try {
+            json(res, 500, { error: "App icon request failed" });
+        }
+        catch { /* already answered */ }
+    });
+    return true;
+}
 /**
  * #1629 r4 §3: the owner-CSS routes (see their call site). `who()`, asked first and again after any body: the person a
  * signed-in human session is, or the status to answer.
@@ -561,6 +736,10 @@ function handleEffectTrials(req, res, url, ctx, path, method) {
             json(res, now.status, { error: now.error });
             return;
         }
+        if (!canvasWorkerEnabled(ctx.fleetConfig?.web)) {
+            json(res, 403, { error: "canvas_worker_experimental", message: CANVAS_WORKER_EXPERIMENTAL_MESSAGE });
+            return;
+        }
         if (now.record !== first.record || now.sessions !== first.sessions || now.actor.sessionHash !== first.actor.sessionHash
             || now.actor.person !== first.actor.person || now.actor.epoch !== first.actor.epoch) {
             json(res, 409, { error: "trials_person_changed" });
@@ -796,6 +975,10 @@ function handleEffects(req, res, url, ctx, path, method) {
             json(res, now.status, { error: now.error });
             return;
         }
+        if (!canvasWorkerEnabled(ctx.fleetConfig?.web)) {
+            json(res, 403, { error: "canvas_worker_experimental", message: CANVAS_WORKER_EXPERIMENTAL_MESSAGE });
+            return;
+        }
         if (now.person !== first.person || now.epoch !== first.epoch) {
             json(res, 409, { error: "effects_person_changed" });
             return;
@@ -917,6 +1100,10 @@ function handleMods(req, res, url, ctx, path, method) {
         // So the export ACL judges what the file carries, not what was installed: it downloads only when this person may
         // read every effect in it (their own claim on that content, or a shared one). A file without effects is any admin's.
         const fx = mods.bundleEffects(fileMatch[1]);
+        if (!canvasWorkerEnabled(ctx.fleetConfig?.web) && (fx === "unknown" || (fx?.length ?? 0) > 0)) {
+            json(res, 403, { error: "canvas_worker_experimental", message: CANVAS_WORKER_EXPERIMENTAL_MESSAGE });
+            return true;
+        }
         if (fx === "unknown" || (fx ?? []).some(id => !ctx.modPlacedEffect?.(first.person, id))) {
             json(res, 403, { error: "mod_effects_not_yours", detail: "this mod's file carries effects that are not yours to share: export your own look instead" });
             return true;
@@ -1047,7 +1234,7 @@ export function exportMod(ctx, person, body) {
             // The effects the theme places travel with it, as the library keeps them (a person may export what is placed).
             // Only effects this person may carry away travel (Sol's ACL); the rest are counted, never packaged.
             // #2017: an older placement of an effect that doesn't play in chat stays out (a mod can't place it): counted.
-            const effects = rec.placements.effects.flatMap(p => { const e = ctx.modPlacedEffect?.(person, p.id); if (!e || !filesPlayInChat(e.files)) {
+            const effects = (canvasWorkerEnabled(ctx.fleetConfig?.web) ? rec.placements.effects : []).flatMap(p => { const e = ctx.modPlacedEffect?.(person, p.id); if (!e || !filesPlayInChat(e.files)) {
                 omitted++;
                 return [];
             } return [{ name: e.name, files: e.files, params: p.params ?? {} }]; });
@@ -1298,6 +1485,10 @@ function statusTick(ctx, t) {
 export function handleWebRequest(req, res, url, ctx) {
     const path = url.pathname;
     const method = req.method ?? "GET";
+    if (!canvasWorkerEnabled(ctx.fleetConfig?.web) && isCanvasWorkerHttpPath(path)) {
+        json(res, 403, { error: "canvas_worker_experimental", message: CANVAS_WORKER_EXPERIMENTAL_MESSAGE });
+        return true;
+    }
     // Auth check for all /ui routes. Defence in depth behind the fleet-manager
     // gate: the same session cookie or header token, and an unset token closes
     // the panel instead of comparing null against a missing credential.
@@ -1445,16 +1636,20 @@ export function handleWebRequest(req, res, url, ctx) {
         }
         json(res, 200, {
             status: ctx.getUiStatus(),
-            messages: history ? (fresh ? history.after(0) : history.replayFor(parseLastEventId(after))) : [],
+            // #2341 review: over the public link, without a summary line that names a card hidden there.
+            messages: history ? visibleMessages(ctx, !!gatewayRequestContext(req), fresh ? history.after(0) : history.replayFor(parseLastEventId(after))) : [],
             // The ticks too, so polling never has to re-read a chat's history — that read would count as the person's
             // activity; this poll does not (isPassiveWebRead).
             deliveries: history ? history.deliveries() : [],
             // #1266: a reply's buttons that ended after the page saw the reply (the message itself is not sent again).
             reply_buttons: history ? history.buttonStates() : [],
+            // #2305: the instance's reactions, likewise (a reaction is no new message).
+            reactions: history ? history.reactionStates() : [],
             // And the fleet prompts open on the dashboard (C4): prompt events are stream-only too.
             prompts: ctx.listWebPrompts?.() ?? [],
-            // #1386: "Needs you" rides the passive channels only — no endpoint of its own to poll.
-            needs: ctx.needsYouItems?.() ?? [],
+            // #1386: "Needs you" rides the passive channels only — no endpoint of its own to poll. Over the public link,
+            // without the task board's hidden cards (#2306 review).
+            needs: visibleNeeds(ctx, !!gatewayRequestContext(req), ctx.needsYouItems?.() ?? []),
             // #1577: the newest message this answer accounts for — after a restart, the last restored one until this process
             // records its own (`<boot>-0` would be after(0): the whole restored history again on every poll).
             cursor: history ? history.pollCursor() : null,
@@ -1570,7 +1765,8 @@ export function handleWebRequest(req, res, url, ctx) {
         }
         // #1920 §5.2: a guest gets what the channel showed of it, and its own messages (the gate checked the scope).
         const guest = guestRequestOf(req);
-        const messages = !ctx.webChatHistory ? [] : guest ? guestHistory(ctx.webChatHistory, instance, limit, guest, guest.scope()) : ctx.webChatHistory.list(instance, limit);
+        const messages = !ctx.webChatHistory ? [] : guest ? guestHistory(ctx.webChatHistory, instance, limit, guest, guest.scope())
+            : visibleMessages(ctx, !!gatewayRequestContext(req), ctx.webChatHistory.list(instance, limit));
         json(res, 200, { messages, boot: ctx.webChatHistory?.boot ?? null, lastId: ctx.webChatHistory?.lastId ?? 0 });
         return true;
     }
@@ -2064,6 +2260,10 @@ export function handleWebRequest(req, res, url, ctx) {
                 return;
             }
             const personal = [...parsed.patch.keys()].some(isOwnerEffectKey);
+            if (personal && !canvasWorkerEnabled(ctx.fleetConfig?.web)) {
+                json(res, 403, { error: "canvas_worker_experimental", message: CANVAS_WORKER_EXPERIMENTAL_MESSAGE });
+                return;
+            }
             if (personal && now.person === null) {
                 json(res, 403, { error: "prefs_need_a_signed_in_person" });
                 return;
@@ -2103,6 +2303,9 @@ export function handleWebRequest(req, res, url, ctx) {
     if (path === "/ui/owner-css.css" || path === "/ui/owner-css" || path.startsWith("/ui/owner-css/")) {
         return handleOwnerCss(req, res, url, ctx, path, method);
     }
+    // #2308: the app icon (handleAppIcon: its state for a signed-in person; changing it, an admin's session only).
+    if (path === "/ui/app-icon")
+        return handleAppIcon(req, res, url, ctx, method);
     // #1629 r4-5: mods — a person's import, uninstall and export (handleMods: sessions only, never the public link).
     if (path === "/ui/mods" || path.startsWith("/ui/mods/"))
         return handleMods(req, res, url, ctx, path, method);
@@ -2537,7 +2740,7 @@ export function handleWebRequest(req, res, url, ctx) {
     }
     // ── Task board (scheduler/task-board.ts) ──────────────
     // Reads are the session's; every write is the signed-in person's, through the same rules an instance's tools use.
-    if (path === "/ui/tasks/board" || path === "/ui/tasks/search" || path.startsWith("/ui/tasks/cards") || path.startsWith("/ui/tasks/projects")) {
+    if (path === "/ui/tasks/board" || path === "/ui/tasks/search" || path === "/ui/tasks/work" || path.startsWith("/ui/tasks/cards") || path.startsWith("/ui/tasks/projects")) {
         const board = ctx.scheduler?.db.board;
         if (!board) {
             json(res, 503, { error: "The task board is not available" });
@@ -2551,9 +2754,7 @@ export function handleWebRequest(req, res, url, ctx) {
             return true;
         }
         // …nor shows the cards of instances kept out of sight (cross_instance_visibility: hidden).
-        const fleet = ctx.fleetConfig;
-        const hiddenName = (n) => !!gateway && typeof n === "string" && !!n && !!ctx.fleetConfig?.instances?.[n] && crossInstanceVisibility(fleet, n) === "hidden";
-        const hidden = (c) => [c.assignee, c.createdBy, c.dispatcher?.name].some(hiddenName);
+        const { hiddenName, hidden } = boardHiding(ctx, !!gateway);
         // #2303 review: what a visible card shows of the cards around it follows the same rule — its children, its main
         // task (a search hit's too) — and so do the words and the history a hidden instance left on it.
         // …and a hidden instance's words on a visible card are not counted, named or found there (#2304 review).
@@ -2590,12 +2791,53 @@ export function handleWebRequest(req, res, url, ctx) {
                     return true;
                 }
                 const cards = board.boardCards(undefined, allDone).filter((c) => !hidden(c));
-                const body = JSON.stringify({ rev, cards: board.views(cards, scope), projects: board.listProjects(true), stats: board.projectStats() });
+                // #2352: over the public link a hidden lead is not named (the project reads as having none).
+                const projects = board.listProjects(true).map((p) => (p.leadInstance && hiddenName(p.leadInstance) ? { ...p, leadInstance: null } : p));
+                // #2355 review: the names a project's lead may be — the fleet's instances (a Classic-only room is not one); over the
+                // public link, not a hidden one.
+                const leads = Object.keys(ctx.fleetConfig?.instances ?? {}).filter((n) => !hiddenName(n)).sort();
+                const body = JSON.stringify({ rev, cards: board.views(cards, scope), projects, leads, stats: board.projectStats() });
                 if (key)
                     boardBodies.set(board, { key, body });
                 jsonText(res, 200, body);
                 return true;
             }
+            if (method === "GET" && path === "/ui/tasks/work") {
+                // #2246 step 3: each instance's work on the board — what its `task mine` reads (myWork) — for the board's
+                // Instance list and an instance's Details page (`?instance=`): the fleet's instances and anyone else a live
+                // card is assigned to. Over the public link, not those kept out of sight, nor a card that names one. Every
+                // name's work is one workOf() read and the cards one views() read, whatever the number of instances (#2316
+                // review); on the dashboard the answer is built once per board revision and the names asked for, and shared
+                // by every open drawer (the public link's is filtered per request, as the board's).
+                const only = url.searchParams.get("instance");
+                const names = (only ? [only] : [...new Set([...Object.keys(ctx.fleetConfig?.instances ?? {}), ...board.liveAssignees()])]).filter((n) => !hiddenName(n));
+                const key = gateway ? null : `${board.revision()}:${only === null ? "*" : `=${only}`}:${names.join("\u0000")}`;
+                const kept = key ? workBodies.get(board) : undefined;
+                if (kept && kept.key === key) {
+                    jsonText(res, 200, kept.body);
+                    return true;
+                }
+                const byName = board.workOf(names);
+                const works = names.map((name) => ({ name, w: byName.get(name) }));
+                const all = new Map();
+                for (const { w } of works)
+                    for (const c of [...w.doing, ...w.blocked, ...w.review, ...w.ready, ...w.waiting.map((x) => x.card), ...w.mains.map((x) => x.card)])
+                        if (!hidden(c))
+                            all.set(c.uuid, c);
+                const viewOf = new Map(board.views([...all.values()], scope).map((v) => [v.uuid, v]));
+                const drawn = (cards) => cards.flatMap((c) => (viewOf.has(c.uuid) ? [viewOf.get(c.uuid)] : []));
+                const codes = (cards) => cards.filter((x) => all.has(x.card.uuid)).map((x) => x.card.code);
+                const body = JSON.stringify({ instances: works.map(({ name, w }) => ({
+                        name,
+                        doing: drawn(w.doing), blocked: drawn(w.blocked), review: drawn(w.review), ready: drawn(w.ready),
+                        waiting: drawn(w.waiting.map((x) => x.card)), mains: drawn(w.mains.map((x) => x.card)),
+                        sentBack: codes(w.sentBack), newComments: codes(w.newComments),
+                    })) });
+                if (key)
+                    workBodies.set(board, { key, body });
+                jsonText(res, 200, body);
+                return true;
+            }
             if (method === "GET" && path === "/ui/tasks/search") {
                 const names = new Map(board.listProjects(true).map((p) => [p.id, p.name]));
                 const hits = board.search(url.searchParams.get("q") ?? "", Number(url.searchParams.get("limit")) || 20, scope).filter((h) => !hidden(h.card));
@@ -2644,11 +2886,11 @@ export function handleWebRequest(req, res, url, ctx) {
                 return true;
             }
             if (method === "POST" && path === "/ui/tasks/projects") {
-                boardWrite(req, res, url, ctx, board, ProjectCreateSchema, (input, person) => ({ project: board.createProject(person, input) }));
+                boardWrite(req, res, url, ctx, board, ProjectCreateSchema, (input, person) => { checkLeadIsInstance(ctx, input.leadInstance); return { project: board.createProject(person, input) }; });
                 return true;
             }
             if (method === "POST" && project) {
-                boardWrite(req, res, url, ctx, board, ProjectPatchSchema, (patch, person) => ({ project: board.updateProject(person, Number(project[1]), patch) }));
+                boardWrite(req, res, url, ctx, board, ProjectPatchSchema, (patch, person) => { checkLeadIsInstance(ctx, patch.leadInstance); return { project: board.updateProject(person, Number(project[1]), patch) }; });
                 return true;
             }
         }
@@ -3296,9 +3538,10 @@ function handleSendMessage(req, res, ctx) {
             // the fleet-wide switch is off for a room that is unset) resolved at send time inside sendClassicWebEcho.
             const canClassicEcho = ctx.isClassicInstance?.(instance) === true && !!ctx.sendClassicWebEcho;
             const settleClassicEcho = canClassicEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
-                const posted = await ctx.sendClassicWebEcho(instance, formatWebChannelEcho(person.name, preview, t("web.echo_full_text"), { guest: !!guest }), person.name);
+                const copies = [];
+                const posted = await ctx.sendClassicWebEcho(instance, formatWebChannelEcho(person.name, preview, t("web.echo_full_text"), { guest: !!guest }), person.name, copies);
                 if (posted > 0)
-                    ctx.webMessageInChannel?.(instance, messageId); // #1920 §5.2: the room saw it
+                    ctx.webMessageInChannel?.(instance, messageId, copies); // #1920 §5.2: the room saw it (#2305: its copies)
             }) : undefined;
             const settleEcho = canEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
                 // A replacement adapter or edited binding is not the route we reserved.
@@ -3307,7 +3550,11 @@ function handleSendMessage(req, res, ctx) {
                     || ctx.fleetConfig?.instances[instance]?.topic_id !== topicId)
                     return;
                 const sent = await syncAdapter.sendText(String(groupId), formatWebChannelEcho(person.name, preview, t("web.echo_full_text"), { guest: !!guest }), { threadId: String(topicId), format: "text", allowedMentions: { parse: [] } });
-                ctx.webMessageInChannel?.(instance, messageId); // #1920 §5.2: the topic saw it
+                const copyId = sent && typeof sent === "object" && typeof sent.messageId === "string" ? sent.messageId : "";
+                // #1920 §5.2: the topic saw it. #2305: and where it is, for a reaction to the web message.
+                const reacting = syncAdapter;
+                ctx.webMessageInChannel?.(instance, messageId, copyId && typeof reacting.react === "function"
+                    ? [{ adapter: reacting, chatId: String(groupId), threadId: String(topicId), messageId: copyId }] : []);
                 return sent;
             }) : undefined;
             let delivered;
@@ -3655,6 +3902,7 @@ function shellBodyTag(req, ctx, mode, viewer) {
         + ` data-usage-panel="${ctx.fleetConfig?.web?.usage_panel === false || viewer?.guest ? "0" : "1"}"`
         // #1218: whether the Log tab is on (web.log_tab; off by default): the tab says so and offers to turn it on.
         + ` data-log-tab="${ctx.fleetConfig?.web?.log_tab === true ? "1" : "0"}"`
+        + ` data-canvas-worker="${canvasWorkerEnabled(ctx.fleetConfig?.web) ? "1" : "0"}"`
         // #1937: the upload limits in force for this page (the config's; the public link's own cap on it) — what the chat
         // checks before sending a file, and the numbers its words say. The server checks again on every upload.
         + ` data-upload-limits="${attr(JSON.stringify(uploadLimits(ctx.fleetConfig?.web, { publicLink: gatewayRequestContext(req) !== undefined })))}"`
@@ -3686,7 +3934,7 @@ export function serveAppShell(req, res, ctx, mode) {
         const effectOrigin = gatewayRequestContext(req)?.expectedOrigin ?? dashboardOriginFor(typeof req.headers.host === "string" ? req.headers.host : undefined, isSecureRequest(req));
         const effectFrame = shellEffect(req, ctx, mode) && effectOrigin ? `${effectOrigin}/effect-bootstrap` : null;
         const frameSrc = [previewFrames, effectFrame].filter(Boolean).join(" ");
-        sendPanelHtml(res, html.replace('<html lang="en">', shellHtmlTag(ctx, mode, viewer)).replace("<body>", shellBodyTag(req, ctx, mode, viewer)), 200, {}, { ...(frameSrc ? { frameSrc } : {}), mediaSrc });
+        sendPanelHtml(res, withAppIconLinks(html).replace('<html lang="en">', shellHtmlTag(ctx, mode, viewer)).replace("<body>", shellBodyTag(req, ctx, mode, viewer)), 200, {}, { ...(frameSrc ? { frameSrc } : {}), mediaSrc });
     }
     catch {
         json(res, 500, { error: "app.html not found" });