@songsid/agend 2.3.3-beta.7 → 2.3.3-beta.8

package/dist/ui/shared/app.css

@@ -916,15 +916,19 @@ img.amb-p { object-fit: contain; }
 /* A guest's note and the public link's sentence are kept whole: on a narrow screen they wrap rather than lose words. */
 .composer-row .guest-note, .composer-row .webauth-row[data-state="public"] { margin: 0; text-align: left; white-space: normal; flex-shrink: 1; }
 .webauth-row { display: inline-flex; align-items: center; gap: var(--s-1); }
-.webauth-row .webauth-ok, .webauth-row .webauth-ask { font: inherit; padding: 0 2px; border: 0; background: none; cursor: pointer; border-radius: var(--r-sm); }
+.webauth-row .webauth-ok, .webauth-row .webauth-ask, .webauth-row .webauth-why { font: inherit; padding: 0 2px; border: 0; background: none; cursor: pointer; border-radius: var(--r-sm); }
 .webauth-row .webauth-ok { color: var(--ok); }
 .webauth-row .webauth-ask { color: var(--accent); text-decoration: underline; text-underline-offset: 2px; }
-.webauth-row .webauth-ok:focus-visible, .webauth-row .webauth-ask:focus-visible { outline: 2px solid var(--focus); outline-offset: 1px; }
+/* #2889: "Not verified" where it can't be authorized: the row's grey words, a dotted underline saying a tap tells why. */
+.webauth-row .webauth-why { color: inherit; text-decoration: underline dotted; text-underline-offset: 2px; }
+.webauth-row .webauth-ok:focus-visible, .webauth-row .webauth-ask:focus-visible, .webauth-row .webauth-why:focus-visible { outline: 2px solid var(--focus); outline-offset: 1px; }
 /* What pressing Authorize answered is said in the row, in the hint's place: nothing is laid over the composer. */
 .webauth-row .webauth-notice { white-space: normal; color: var(--text-2); }
 .webauth-row .webauth-notice::before { content: "·"; margin-right: var(--s-2); color: var(--text-3); }
 .composer-row:has(.webauth-notice) > .hint { display: none; }
-/* When "✓ Verified" ends, on a tap (touch has no hover): a bubble above the row while it has focus. */
+/* When "✓ Verified" ends, or why it can't be authorized (#2889), on a tap (touch has no hover): a bubble above the
+   composer (web-authorize.js lifts it by the composer's height: never over Attach or the text, #2216) until the next tap,
+   a tap or key elsewhere, or Escape. */
 .webauth-tip { position: absolute; left: 0; bottom: calc(100% + 4px); z-index: 5; max-width: min(420px, calc(100vw - 32px)); white-space: normal;
   padding: var(--s-1) var(--s-2); border: 1px solid var(--border); border-radius: var(--r-sm); background: var(--surface); color: var(--text);
   box-shadow: var(--shadow-2); }

package/dist/ui/shared/web-authorize.js

@@ -1,7 +1,7 @@
 // #1939 S2b (design §0.1): "Authorize this browser". The app shows this browser's state — verified (until when), a
 // Confirm card waiting in the account's Discord or Telegram DM (with its countdown), or why it can't be authorized here —
 // and asks for the card. The card itself is the gate: nothing here can authorize anything.
-import { html, useEffect, useRef, useState } from "./app-html.js";
+import { html, useEffect, useLayoutEffect, useRef, useState } from "./app-html.js";
 import { register, t } from "./app-i18n.js";
 import { guestPage } from "./app-store.js";
 
@@ -31,6 +31,7 @@ register("webauth", {
     verifiedShort: "Verified",
     authorizeShort: "Authorize",
     authorizeWhy: "Not verified: authorize this browser to speak as you",
+    notVerifiedWhy: "Not verified: {0}",
     waitingShort: "Waiting for your Confirm ({0})",
   },
   "zh-TW": {
@@ -58,6 +59,7 @@ register("webauth", {
     verifiedShort: "已驗證",
     authorizeShort: "授權",
     authorizeWhy: "未驗證：授權這個瀏覽器以你的身分發言",
+    notVerifiedWhy: "未驗證：{0}",
     waitingShort: "等待確認（{0}）",
   },
 });
@@ -155,26 +157,46 @@ export function AuthorizeChip() {
  * The composer's row (#2215, the user's request, 2026-10-19): the same states as AuthorizeChip, each kept to a few words so
  * they share one row with the key hint. What a state would have said at length is in its tooltip and its accessible
  * name: when "Verified" ends, why it can't be authorized, the countdown's ask. A tap on "✓ Verified" shows when it
- * ends (touch has no hover) in a bubble above the row, until the next tap, a tap elsewhere or Escape. What pressing
- * Authorize answered (sent, refused) is said in the row itself, in the hint's place (#2216 review: a bubble left over the
- * composer covered Attach and what was being typed, with nothing to close it).
+ * ends, and a tap on "Not verified" why it can't be authorized here (#2889; touch has no hover), in a bubble above the
+ * composer, until the next tap, a tap or key elsewhere, or Escape. What pressing Authorize answered (sent, refused) is
+ * said in the row itself, in the hint's place (#2216 review: a bubble left over the composer covered Attach and what was
+ * being typed, with nothing to close it).
  */
 export function ComposerAuth() {
   const a = useWebAuthorization();
   const [open, setOpen] = useState(false);
-  const tip = useRef("wa-tip-" + Math.random().toString(36).slice(2, 8));
+  const tip = useRef("wa-tip-" + Math.random().toString(36).slice(2, 8)), opener = useRef(null);
   useEffect(() => { setOpen(false); }, [a.st && a.st.state]);              // a new state closes the bubble
+  // #2889: a tap, focus or key (Escape too) anywhere else closes it, even where a tapped button never takes focus (Safari);
+  // on the button itself, its own handlers decide.
+  useEffect(() => {
+    if (!open) return undefined;
+    const doc = globalThis.document, kinds = ["pointerdown", "focusin", "keydown"];
+    const away = (e) => { if (!opener.current || !opener.current.contains(e.target)) setOpen(false); };
+    for (const k of kinds) doc.addEventListener(k, away, true);
+    return () => { for (const k of kinds) doc.removeEventListener(k, away, true); };
+  }, [open]);
+  // Above the whole composer, not over it (#2216): lifted by the composer's height, measured when it opens.
+  const bubble = useRef(null);
+  useLayoutEffect(() => {
+    const el = bubble.current, row = el && el.parentElement && el.parentElement.closest(".composer-row");
+    const composer = row && row.parentElement ? row.parentElement.querySelector(".composer") : null;
+    if (!el || !open || !composer) { if (el) el.style.removeProperty("bottom"); return; }
+    const lift = Math.max(0, Math.round(row.getBoundingClientRect().top - composer.getBoundingClientRect().top));
+    el.style.setProperty("bottom", `calc(100% + ${lift + 4}px)`);
+  }, [open]);
   if (guestPage()) return null;
   if (!a.st) return null;
   const st = a.st, id = tip.current;
   const said = a.notice ? html`<span class="webauth-notice" role="status">${a.notice}</span>` : null;
+  // The words in the row, a button whose tap shows `text` in the bubble; `title` keeps the hover on a desk.
+  const tipped = (cls, label, name, text) => html`<button type="button" class=${cls} ref=${opener} title=${text} aria-label=${name}
+      aria-expanded=${open ? "true" : "false"} aria-controls=${id} onClick=${() => setOpen((v) => !v)} onBlur=${() => setOpen(false)}
+      onKeyDown=${(e) => { if (e.key === "Escape" && open) { e.stopPropagation(); setOpen(false); } }}>${label}</button><span
+      id=${id} ref=${bubble} class="webauth-tip" role="tooltip" hidden=${!open}>${text}</span>`;
   if (st.state === "verified") {
     const until = tn("verified", clock(st.until));
-    return html`<span class="webauth-row" data-state="verified">
-      <button type="button" class="webauth-ok" title=${until} aria-label=${`✓ ${until}`} aria-expanded=${open ? "true" : "false"}
-        aria-controls=${id} onClick=${() => setOpen((v) => !v)} onBlur=${() => setOpen(false)}
-        onKeyDown=${(e) => { if (e.key === "Escape" && open) { e.stopPropagation(); setOpen(false); } }}>✓ ${tn("verifiedShort")}</button><span
-        id=${id} class="webauth-tip" role="tooltip" hidden=${!open}>${until}</span>${said}</span>`;
+    return html`<span class="webauth-row" data-state="verified">${tipped("webauth-ok", `✓ ${tn("verifiedShort")}`, `✓ ${until}`, until)}${said}</span>`;
   }
   if (st.state === "pending") {
     const asks = tn("waiting", mmss(a.left));
@@ -185,7 +207,7 @@ export function ComposerAuth() {
       title=${tn("authorizeWhy")} aria-label=${tn("authorizeWhy")} onClick=${a.ask}>${tn("authorizeShort")}</button>${said}</span>`;
   }
   const why = REASONS.includes(st.reason) ? tn(`reason_${st.reason}`) : tn("reason_other");
-  return html`<span class="webauth-row" data-state="none"><span class="note" title=${why}>${tn("notVerified")}<span class="sr-only">: ${why}</span></span>${fixable(st.reason)
+  return html`<span class="webauth-row" data-state="none">${tipped("webauth-why", tn("notVerified"), tn("notVerifiedWhy", why), why)}${fixable(st.reason)
     ? html` · <a href="/settings/access" title=${why}>${tn("settings")}</a>` : null}</span>`;
 }
 

package/launcher/fleet-service-owner.cjs

@@ -47,11 +47,20 @@ function fields(text) {
   text.split("\n").forEach(function (line) { var at = line.indexOf("="); if (at > 0) out[line.slice(0, at)] = line.slice(at + 1); });
   return out;
 }
+// The process's systemd cgroup. Pure cgroup v2 lists one `0::` row; a hybrid host (WSL, older distros) lists both the
+// unified `0::` row and the v1 `N:name=systemd:` row, with the same path — the 0:: one is what systemd reports as the
+// unit's ControlGroup there too. A pure-v1 host has only the name=systemd row, or a bare `0::/` beside it (cgroup2
+// mounted but unused). Two rows of the same kind, or no usable path, stay unknown.
 function cgroup(text) {
-  var rows = text.trim().split("\n").filter(function (r) { return /^(?:0::|\d+:name=systemd:)/.test(r); });
-  if (rows.length !== 1) throw Error("unknown cgroup");
-  var p = rows[0].slice(rows[0].indexOf(":", rows[0].indexOf(":") + 1) + 1);
-  if (p[0] !== "/") throw Error("unknown cgroup");
+  var unified = null, named = null;
+  text.trim().split("\n").forEach(function (r) {
+    var m = /^(\d+):([^:]*):(.*)$/.exec(r);
+    if (!m) return;
+    if (m[1] === "0" && m[2] === "") { if (unified !== null) throw Error("unknown cgroup"); unified = m[3]; }
+    else if (m[2].split(",").indexOf("name=systemd") >= 0) { if (named !== null) throw Error("unknown cgroup"); named = m[3]; }
+  });
+  var p = unified !== null && unified !== "/" ? unified : named !== null ? named : unified;
+  if (!p || p[0] !== "/") throw Error("unknown cgroup");
   return p;
 }
 function inside(p, group) { return !!group && group !== "/" && (p === group || p.indexOf(group + "/") === 0); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@songsid/agend",
-  "version": "2.3.3-beta.7",
+  "version": "2.3.3-beta.8",
   "description": "Multi-agent fleet daemon — run coding CLIs (Claude, Muse, Codex, OpenCode) from Discord or Telegram",
   "type": "module",
   "bin": {