@vantran-se/openchamber-web 2.1.1 → 2.2.0

package/server/lib/source-control/change-request-worktree.js

@@ -0,0 +1,90 @@
+import { hostOf } from './binding-service.js';
+
+/**
+ * The change-request source for a worktree made from a pull or merge request
+ * given by number, built on the server the way the New worktree dialog builds
+ * it on the client (`prWorktreeConfig.ts`, `getBoundSourceControlReadContexts`):
+ *
+ * - The read context is the repository's: a ready bound provider first, else a
+ *   remote on GitHub or a known GitLab instance read with that host's current
+ *   account. GitHub wins over GitLab, as the dialog's picker does.
+ * - The project, head and head revision are the provider's current answer for
+ *   that number on the context's primary remote.
+ *
+ * Nothing from the caller beyond the directory and the number reaches the
+ * result; the contributor pipeline then resolves and checks the source again.
+ */
+
+const sourceControlError = (message, status, code) => Object.assign(new Error(message), { status, code });
+
+// The client names the fork remote this way; the contributor pipeline renames
+// it after the provider's own head owner anyway.
+const requestedRemoteName = (owner) => `pr-${String(owner || '').trim().toLowerCase()
+  .replace(/[^a-z0-9._-]+/g, '-').replace(/-+/g, '-').replace(/^-+|-+$/g, '') || 'head'}`;
+
+export const createChangeRequestWorktreeSource = ({
+  readBinding,
+  listGitLabInstances,
+  readCurrentAccountId,
+  readChangeRequestHead,
+}) => {
+  const identityForHost = (host, gitlabInstances) => {
+    if (!host) return null;
+    if (host === 'github.com') return { provider: 'github', instance: 'github.com' };
+    const instance = gitlabInstances.find((candidate) => hostOf(candidate) === host);
+    return instance ? { provider: 'gitlab', instance } : null;
+  };
+  const identityKey = (identity) => `${identity.provider}:${hostOf(identity.instance)}`;
+
+  const readContexts = async (directory) => {
+    const read = await readBinding(directory);
+    const contextFor = (identity, accountId, primaryRemote) => ({
+      directory,
+      repositoryId: read.repository.repositoryId,
+      provider: identity.provider,
+      instance: identity.instance,
+      accountId,
+      bindingRevision: read.revision,
+      primaryRemote,
+    });
+    const providers = read.binding?.providers ?? [];
+    const contexts = providers
+      .filter((provider) => provider.readiness === 'ready'
+        && provider.endpoint?.fingerprint === read.repository.remotes.find((remote) => remote.name === provider.primaryRemote)?.fetch.fingerprint)
+      .map((provider) => contextFor(provider, provider.accountId, provider.primaryRemote));
+    // A repository nobody bound to a host, or bound to an account that is
+    // gone, is read with that host's current account, as the client does.
+    const covered = new Set(providers.filter((provider) => provider.readiness !== 'account-unavailable').map(identityKey));
+    const gitlabInstances = ['https://gitlab.com', ...await listGitLabInstances()];
+    const remotes = [...read.repository.remotes].sort((a, b) => (a.name === 'origin' ? -1 : b.name === 'origin' ? 1 : 0));
+    for (const remote of remotes) {
+      const identity = identityForHost(hostOf(remote.push.displayUrl) ?? hostOf(remote.fetch.displayUrl), gitlabInstances);
+      if (!identity || covered.has(identityKey(identity))) continue;
+      const accountId = await readCurrentAccountId(identity);
+      if (!accountId) continue;
+      covered.add(identityKey(identity));
+      contexts.push(contextFor(identity, accountId, remote.name));
+    }
+    return contexts;
+  };
+
+  return async ({ directory, number }) => {
+    const contexts = await readContexts(directory);
+    const context = contexts.find((candidate) => candidate.provider === 'github')
+      ?? contexts.find((candidate) => candidate.provider === 'gitlab');
+    if (!context) {
+      throw sourceControlError('No connected GitHub or GitLab account can read this project', 409, 'AUTHENTICATION_REQUIRED');
+    }
+    const head = await readChangeRequestHead({ context, number });
+    return {
+      headBranch: head.headBranch,
+      sourceRequest: {
+        context,
+        project: head.project,
+        number,
+        expectedHeadSha: head.headSha,
+        requestedRemoteName: requestedRemoteName(head.headOwner),
+      },
+    };
+  };
+};

package/server/lib/source-control/change-request-worktree.test.js

@@ -0,0 +1,121 @@
+import { describe, expect, it, vi } from 'vitest';
+import { createChangeRequestWorktreeSource } from './change-request-worktree.js';
+
+const remote = (name, url) => ({
+  name,
+  fetch: { displayUrl: url, fingerprint: `fp-${name}` },
+  push: { displayUrl: url, fingerprint: `fp-${name}` },
+});
+const read = ({ remotes, providers = null, revision = 4 }) => ({
+  revision,
+  repository: { repositoryId: 'repo_one', remotes },
+  binding: providers ? { providers, remotes: [] } : null,
+});
+const head = {
+  project: { id: 'acme/app', owner: 'acme', name: 'app' },
+  headSha: 'b'.repeat(40),
+  headBranch: 'feature/fix',
+  headOwner: 'Alice',
+};
+
+const setup = ({ binding, accounts = {}, gitlabInstances = [] }) => {
+  const readChangeRequestHead = vi.fn(async () => head);
+  const readCurrentAccountId = vi.fn(async ({ provider, instance }) => accounts[`${provider}:${instance}`] ?? null);
+  const resolve = createChangeRequestWorktreeSource({
+    readBinding: vi.fn(async () => binding),
+    listGitLabInstances: vi.fn(async () => gitlabInstances),
+    readCurrentAccountId,
+    readChangeRequestHead,
+  });
+  return { resolve, readChangeRequestHead, readCurrentAccountId };
+};
+
+describe('change request source for a worktree made by number', () => {
+  it('reads an unbound GitHub project with the current account and its primary remote', async () => {
+    const { resolve, readChangeRequestHead } = setup({
+      binding: read({ remotes: [remote('upstream', 'https://example.com/x.git'), remote('origin', 'git@github.com:acme/app.git')], revision: 0 }),
+      accounts: { 'github:github.com': 'github.com#7' },
+    });
+
+    const result = await resolve({ directory: '/repo', number: 42 });
+
+    const context = {
+      directory: '/repo', repositoryId: 'repo_one', provider: 'github', instance: 'github.com',
+      accountId: 'github.com#7', bindingRevision: 0, primaryRemote: 'origin',
+    };
+    expect(readChangeRequestHead).toHaveBeenCalledExactlyOnceWith({ context, number: 42 });
+    expect(result).toEqual({
+      headBranch: 'feature/fix',
+      sourceRequest: {
+        context, project: head.project, number: 42,
+        expectedHeadSha: 'b'.repeat(40), requestedRemoteName: 'pr-alice',
+      },
+    });
+  });
+
+  it('uses a ready bound provider and does not ask for that host\'s current account', async () => {
+    const { resolve, readChangeRequestHead, readCurrentAccountId } = setup({
+      binding: read({
+        remotes: [remote('origin', 'https://github.com/acme/app.git')],
+        providers: [{
+          provider: 'github', instance: 'github.com', accountId: 'github.com#9', primaryRemote: 'origin',
+          readiness: 'ready', endpoint: { fingerprint: 'fp-origin' },
+        }],
+      }),
+      accounts: { 'github:github.com': 'github.com#7' },
+    });
+
+    await resolve({ directory: '/repo', number: 42 });
+
+    expect(readCurrentAccountId).not.toHaveBeenCalled();
+    expect(readChangeRequestHead.mock.calls[0][0].context).toMatchObject({ accountId: 'github.com#9', bindingRevision: 4 });
+  });
+
+  it('prefers GitHub over GitLab, as the dialog does', async () => {
+    const { resolve, readChangeRequestHead } = setup({
+      binding: read({ remotes: [remote('origin', 'https://gitlab.com/acme/app.git'), remote('mirror', 'https://github.com/acme/app.git')] }),
+      accounts: { 'gitlab:https://gitlab.com': 'gitlab#1', 'github:github.com': 'github.com#7' },
+    });
+
+    await resolve({ directory: '/repo', number: 42 });
+
+    expect(readChangeRequestHead.mock.calls[0][0].context).toMatchObject({ provider: 'github', primaryRemote: 'mirror' });
+  });
+
+  it('reads a merge request on a connected self-hosted GitLab', async () => {
+    const { resolve, readChangeRequestHead } = setup({
+      binding: read({ remotes: [remote('origin', 'git@gitlab.example.com:team/app.git')] }),
+      accounts: { 'gitlab:https://gitlab.example.com': 'https://gitlab.example.com#3' },
+      gitlabInstances: ['https://gitlab.example.com'],
+    });
+
+    await resolve({ directory: '/repo', number: 7 });
+
+    expect(readChangeRequestHead.mock.calls[0][0]).toMatchObject({
+      number: 7,
+      context: { provider: 'gitlab', instance: 'https://gitlab.example.com', accountId: 'https://gitlab.example.com#3' },
+    });
+  });
+
+  it('refuses a project no connected account can read, before asking any provider', async () => {
+    const { resolve, readChangeRequestHead } = setup({
+      binding: read({ remotes: [remote('origin', 'https://github.com/acme/app.git')] }),
+    });
+
+    await expect(resolve({ directory: '/repo', number: 42 })).rejects.toMatchObject({
+      status: 409, code: 'AUTHENTICATION_REQUIRED', message: 'No connected GitHub or GitLab account can read this project',
+    });
+    expect(readChangeRequestHead).not.toHaveBeenCalled();
+  });
+
+  it('passes a provider refusal through unchanged', async () => {
+    const gone = Object.assign(new Error('Pull request #42 has no branch to check out: its fork was deleted'), { status: 409 });
+    const { resolve, readChangeRequestHead } = setup({
+      binding: read({ remotes: [remote('origin', 'https://github.com/acme/app.git')] }),
+      accounts: { 'github:github.com': 'github.com#7' },
+    });
+    readChangeRequestHead.mockRejectedValueOnce(gone);
+
+    await expect(resolve({ directory: '/repo', number: 42 })).rejects.toBe(gone);
+  });
+});

package/server/lib/source-control/mutation-executor.js

@@ -129,7 +129,7 @@ export function createMutationExecutor({ store, auditStore, runtimeIdentity }) {
     }
     const existing = await auditStore.read(auditId(record));
     const target = {
-      kind: 'change-request',
+      kind: record.kind.startsWith('issue-') ? 'issue' : 'change-request',
       operation: record.kind,
       projectId: record.target.project.id,
     };

package/server/lib/source-control/mutation-storage.js

@@ -1,3 +1,4 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
@@ -11,17 +12,21 @@ const KINDS = [
   'change-request-update',
   'change-request-merge',
   'change-request-ready',
+  'change-request-comment',
+  'change-request-review',
+  'issue-comment',
+  'change-request-state',
+  'issue-state',
+  'change-request-labels',
+  'issue-labels',
+  'change-request-reviewers',
 ];
 const STATES = ['running', 'succeeded', 'failed', 'outcome-unknown'];
 const TERMINAL_STATES = ['succeeded', 'failed'];
 const TARGET_OPTIONAL_KEYS = ['number', 'head', 'base', 'headSha'];
-const RESULT_KEYS = [...TARGET_OPTIONAL_KEYS, 'state', 'merged', 'ready', 'failureStatus', 'failureCode'];
+const RESULT_KEYS = [...TARGET_OPTIONAL_KEYS, 'state', 'merged', 'ready', 'commented', 'failureStatus', 'failureCode'];
 
 const emptyState = () => ({ version: VERSION, records: {} });
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 const isBoolean = (value) => Object.prototype.toString.call(value) === '[object Boolean]';
 const isFunction = (value) => Object.prototype.toString.call(value) === '[object Function]';
 const isNonEmptyString = (value) => isString(value) && value.length > 0;
@@ -83,6 +88,7 @@ const isTerminalResult = (value) => isPlainObject(value)
   && (value.headSha === undefined || isNonEmptyString(value.headSha))
   && (value.state === undefined || isNonEmptyString(value.state))
   && (value.merged === undefined || isBoolean(value.merged))
+  && (value.commented === undefined || isBoolean(value.commented))
   && (value.ready === undefined || isBoolean(value.ready))
   && (value.failureStatus === undefined || isFailureStatus(value.failureStatus))
   && (value.failureCode === undefined || isNonEmptyString(value.failureCode));

package/server/lib/source-control/provider-instance.js

@@ -1,7 +1,6 @@
+import { isString } from '../shared/guards.js';
 import { normalizeGitLabInstance } from '../gitlab/instance.js';
 
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
-
 export function normalizeSourceControlProviderInstance(provider, instance) {
   const value = isString(instance) ? instance.trim() : '';
   if (!value) throw new Error('Source control provider instance is required');

package/server/lib/source-control/repository-identity.js

@@ -66,7 +66,7 @@ const resolveIdentity = async (directory, {
   return identity;
 };
 
-export function createRepositoryIdentityResolver({
+function createRepositoryIdentityResolver({
   fsImpl = fs,
   resolveGitPaths = resolveRepositoryGitPaths,
   getRepositoryRemotes = getRepositoryRemoteUrls,

package/server/lib/source-control/routes.js

@@ -4,8 +4,9 @@ import { registerGitHubRoutes } from '../github/routes.js';
 import { registerGitLabRoutes } from '../gitlab/routes.js';
 import { createBindingService } from './binding-service.js';
 import { createBindingStore } from './binding-storage.js';
+import { createChangeRequestWorktreeSource } from './change-request-worktree.js';
 import { createGitIdentityProvisioning } from '../git/identity-provisioning.js';
-import * as gitIdentityStore from '../git/identity-storage.js';
+import { createProfile, getProfiles, updateProfile } from '../git/identity-storage.js';
 import { resolveRepositoryIdentity } from './repository-identity.js';
 import { redactSensitiveText } from './url-redaction.js';
 import { createOAuthFlowRegistry } from './oauth-flow-registry.js';
@@ -73,7 +74,7 @@ export function registerSourceControlRoutes(app, dependencies = {}) {
   // Connecting an account is the moment every part of an identity is known, so
   // the identity is made there instead of being asked for again later.
   const identityProvisioning = dependencies.identityProvisioning ?? createGitIdentityProvisioning({
-    store: gitIdentityStore,
+    store: { createProfile, getProfiles, updateProfile },
   });
   const listGitHubAccounts = dependencies.listGitHubAccounts ?? getGitHubAuthAccounts;
   const oauthFlowRegistry = dependencies.oauthFlowRegistry ?? createOAuthFlowRegistry();
@@ -291,5 +292,16 @@ export function registerSourceControlRoutes(app, dependencies = {}) {
         code: 'INVALID_SOURCE_CONTROL_READ_CONTEXT', status: 400,
       });
     },
+    // A worktree from a pull or merge request given by number (session.create).
+    resolveChangeRequestWorktreeSource: createChangeRequestWorktreeSource({
+      readBinding: bindingService.get,
+      listGitLabInstances: gitlab.listInstances,
+      readCurrentAccountId: ({ provider, instance }) => (provider === 'github'
+        ? github.readCurrentAccountId()
+        : gitlab.readCurrentAccountId(instance)),
+      readChangeRequestHead: (input) => (input.context.provider === 'github'
+        ? github.readChangeRequestHead(input)
+        : gitlab.readChangeRequestHead(input)),
+    }),
   });
 }

package/server/lib/spaces/DOCUMENTATION.md

@@ -64,7 +64,7 @@ Stage 3a added three more and changed none. The argv from `execArgv` runs a comm
 
 A new place is done when `runPlaceContractSuite` and `runEscapeSuite` pass against it.
 
-Since 5e-4 the Docker place also has `readDisk()` and `cleanUpDisk()`, for the places page in Settings. They are not in the contract and not in the registry's required list: what a place keeps on disk, and what it can make again, is its own. The journey calls them on its one place; a later place brings its own or the page has nothing to say for it.
+Since 5e-4 the Docker place also has `readDisk()` and `cleanUpDisk()`, for the places page in Settings, and since the image button of 2026-10-09 `pullImage()`, which starts or joins the one download of the image, and `imagePulling()`, whether one runs. They are not in the contract and not in the registry's required list: what a place keeps on disk, and what it can make again, is its own. The journey calls them on its one place; a later place brings its own or the page has nothing to say for it. The memory place answers them with nothing to download.
 
 ## Labels
 
@@ -148,7 +148,7 @@ A space downloads nothing to start. Its programs come from a tools volume: one v
 
 The volume is a plain npm project at `/opt/openchamber-tools`, with `package.json`, `node_modules`, and the binaries in `node_modules/.bin`. It is not a global install. A development build needs the local `@openchamber/sdk` tarball to win over the published package with the same version number. npm `overrides` in a project `package.json` does that. A `-g` install would pull the published sdk as a dependency of `web`.
 
-Contents: `@openchamber/web`, `@opencode/cli`, and `@opencode/plugin` at the version of `@opencode/cli`.
+Contents: `@vantran-se/openchamber-web`, `@opencode/cli`, and `@opencode/plugin` at the version of `@opencode/cli`.
 
 ### Sources and the key
 
@@ -230,7 +230,7 @@ Environment:
 | `PATH` with `/opt/openchamber-tools/node_modules/.bin` last | The server refuses to start without `opencode` on PATH. The image has no `openchamber` and no `opencode`, so both are found there. The image's own directories come first, so a transitive npm package that ships a bin named `node` or `sh` never shadows the image's program. |
 | `HTTPS_PROXY`, `https_proxy`, `HTTP_PROXY`, `http_proxy`, all four `http://gatekeeper:3128` | The corridor. curl 7.88.1, the version in this image, ignores an uppercase `HTTP_PROXY` on purpose, the httpoxy protection, and honours the lowercase one. Without the lowercase spelling, plain-HTTP traffic from curl and from everything that uses libcurl never reaches the corridor. |
 | `NO_PROXY`, `no_proxy`, both `gatekeeper,localhost,127.0.0.1` | Window traffic skips the corridor, and so does the space's own loopback. Measured: with `http_proxy` set, curl sends even a request to 127.0.0.1 to the corridor, and Node with `NODE_USE_ENV_PROXY=1` proxies loopback too. curl reads both spellings. |
-| `NODE_USE_ENV_PROXY=1` | Node 22 ignores proxy variables without it. Measured: `EAI_AGAIN` for every fetch, and with it Node honours the uppercase spelling. |
+| `NODE_USE_ENV_PROXY=1` | Node ignores proxy variables without it, on 22 and still on 24. Measured: `EAI_AGAIN` for every fetch, and with it Node honours the uppercase spelling. |
 | `OPENCODE_DISABLE_MODELS_FETCH=1`, `OPENCODE_DISABLE_AUTOUPDATE=1` | The catalog and the update check would spend corridor attempts on downloads a space does not need. Measured with OpenCode 2.0.15: without `OPENCODE_DISABLE_MODELS_FETCH` the journal shows `models.opencode.ai:443 deny:not-on-allowlist`, and with it the journal stays empty. The 2.0.15 binary does read `OPENCODE_DISABLE_AUTOUPDATE`, `1` or `true`, and then logs that it skipped the update check. What it changes in a space was not seen: `opencode serve` made no update attempt with it or without it. It stays because the binary honours it and it costs nothing. |
 | `OPENCHAMBER_RELAY_HOST=off` | The server inside a space must never host the relay passively. It has a way out now, and paired devices must not land on a space. `server/index.js` reads this variable when it computes `allowPassiveHost`. |
 | `OPENCHAMBER_SPACE_IDLE_STOP_FILE=/home/space/.openchamber-space/idle-stop.json` | Since 5d-3: where the server inside reads the idle stop's setting. Only a space has it, so the idle timer runs nowhere else. See "Idle stop" under "The journey". |
@@ -528,8 +528,9 @@ All under `/api/openchamber/spaces`, a namespace of the host's beside `/api/open
 | `POST /<id>/restart-opencode` | Since 5d-2: asks the server inside a running space to restart its OpenCode, and answers the listed entry once it is ready again. See "Repair". |
 | `POST /<id>/restart` | Since 5d-2: restarts the container of a running space with a fresh token, then says the network and the grants again as a start does. Answers as start does. See "Repair". |
 | `DELETE /<id>` | Saves the space's chats to the archive, then removes the containers, networks and volumes, the service refs in the user's repository and the record; forgets a failed creation. `{ id, removed, refsRemoved, failures, chats }`. 409 `chats_not_saved` when the chats cannot all be saved, and `?unsavedChats=delete` deletes anyway. See "Chat archive". |
-| `GET /places/<place>/disk` | Since 5e-4: `{ imageBytes, toolsBytes, spacesBytes, freeBytes, freesImage }`, the disk the place's spaces take and what a clean-up would free now. See "Places page". |
-| `POST /places/<place>/clean-up` | Since 5e-4: removes what OpenChamber can make again; `{ freedBytes, kept: [{ kind, reason }], disk }`. 409 `space_preparing` while a space is being made. See "Places page". |
+| `GET /places/<place>/disk` | Since 5e-4: `{ imageBytes, imagePulling, imageFailure, toolsBytes, spacesBytes, freeBytes, freesImage }`, the disk the place's spaces take, whether the image is being downloaded and why the last download failed, and what a clean-up would free now. See "Places page". |
+| `POST /places/<place>/clean-up` | Since 5e-4: removes what OpenChamber can make again; `{ freedBytes, kept: [{ kind, reason }], disk }`. 409 `space_preparing` while a space is being made, 409 `image_pulling` while the image is being downloaded. See "Places page". |
+| `POST /places/<place>/image` | Downloads the image ahead of the first space (journey step 0); answers 202 with the disk, `imagePulling` set, while the download goes on. See "Places page". |
 | `GET /archives` | Since 5e-2: `{ archives: [{ spaceId, name, projectDirectory, directory, archivedAt }] }`, which directory holds which deleted space's chats. Reachable with the switch off too, see "Chat archive". |
 | `POST /<id>/setup` | Since 5d-4: `{ commands }`. Runs the project's setup commands again in a running space; answers the listed entry once the run began. See "Setup commands". |
 | `GET /<id>/setup` | Since 5d-4: `{ setup, output }`, the setup as the list carries it and the end of the failed command's output, or null. |
@@ -589,11 +590,13 @@ DESIGN.md, journey step 9 and decision 12; built in 5e-3, UI only on top of `GET
 
 DESIGN.md, journey step 9 and decision 12; built in 5e-4, `places/docker-disk.js` behind the two routes above. The maintainer's calls of 2026-09-30: Settings has a page of its own, "Isolated spaces" in the Workspace group, which holds the switch, the idle stop, the places and the spaces without a project, and the phone lists it among its Settings pages; a place shows its Docker version, how many spaces run and stand stopped, the disk, the spaces whose container is gone with their "Delete", and "Clean up…" with one confirmation that says what it frees and, when the image goes, that it downloads again; a place that cannot be reached says what to do and lists the spaces this window last saw, never a count of zero, and nothing polls.
 
-- **What it measures.** `docker system df --verbose` for the volumes, read by name for this owner's tools volumes and space volumes, which are found by label and checked again on the inspect result; `docker image inspect` for the pinned image. Docker prints volume sizes rounded to three digits in decimal units, so the page's numbers are Docker's, as `docker system df` shows them. `freeBytes` counts the old tools volumes no container mounts and the image when no container at all, anyone's, was made from it.
-- **What a clean-up removes.** This owner's tools volumes other than the current one, this owner's tools one-shot containers, and the space image by its pinned reference. Each goes without force, one by one. Docker refuses a volume a container mounts, a stopped one included, an image any container was made from, and a running container; that refusal is the guard, and whatever it keeps is reported as `in_use`. Nothing here keeps its own account of what is in use. The current tools volume, anything without this owner's labels, the spaces' own volumes and a space whose container is gone are never asked to go: a space's volumes may hold work that was never applied, so they go only with that space's own "Delete".
+- **What it measures.** `docker system df --verbose` for the volumes, read by name for this owner's tools volumes and space volumes, which are found by label and checked again on the inspect result; `docker image inspect` for the pinned image. Docker prints volume sizes rounded to three digits in decimal units, so the page's numbers are Docker's, as `docker system df` shows them. `freeBytes` counts the old tools volumes no container mounts, the image when no container at all, anyone's, was made from it, and each retired image the clean-up would remove that no container was made from. A retired image has no number of its own on the page, by the maintainer's call of 2026-10-08. Each image counts what it alone takes, so layers the current and a retired image share are counted for neither while both are there: a clean-up that removes both frees more than the page said.
+- **What a clean-up removes.** This owner's tools volumes other than the current one, this owner's tools one-shot containers, the space image by its pinned reference, and the retired images below. Each goes without force, one by one. Docker refuses a volume a container mounts, a stopped one included, an image any container was made from, and a running container; that refusal is the guard, and whatever it keeps is reported as `in_use`. Nothing here keeps its own account of what is in use. The current tools volume, anything without this owner's labels, the spaces' own volumes and a space whose container is gone are never asked to go: a space's volumes may hold work that was never applied, so they go only with that space's own "Delete".
 - **The image is the exception to the labels.** It is a public image, pulled and never labelled, and the only resource a clean-up removes without our labels. It is named by the pinned digest and removed without force, so any container made from it keeps it. Measured on Docker 29.2.1 with the containerd image store: removing an image by its digest reference removes it whole, a tag the user gave the same image included. A user who pulled the same `node` image for their own use pulls it again.
+- **Retired images.** `RETIRED_SPACE_BASE_IMAGES` in `places/docker.js` lists the digests the pinned image replaced, so a bump does not leave the old image on the disk for good. A clean-up treats each like the current image, with one more guard, by the maintainer's call of 2026-10-08: it skips a retired image whose `RepoTags` hold anything besides its own digest reference. A space pulls by digest, so another tag means someone pulled or tagged the same image for their own use, and the removal by digest would take that tag with it. Measured on Docker 29.5.2 with the containerd image store: an image pulled by digest has only its digest reference in `RepoTags`, and the same image pulled by tag has the tag as well. Not measured on the classic image store, where an image pulled by digest is expected to have no `RepoTags` at all, which the guard also lets through. A retired image any container was made from stays, reported as `in_use`. That includes the gatekeeper of every space created before the bump: a start moves a space container to the current image along with its tools, but leaves the gatekeeper on the image it was made from, by the maintainer's call of 2026-10-08. The retired image therefore goes at the first clean-up after the last such space is removed.
 - **Colima.** Space freed inside the Colima machine does not return to the Mac until the machine trims its disk. After a clean-up that removed anything, when `docker info` names the machine `colima` or `colima-<profile>`, the place runs `colima ssh --profile <profile> -- sudo -n fstrim --all`, found with the host's augmented PATH beside `docker`, within two minutes. Any failure, a missing CLI, a stopped machine or a `sudo` that wants a password among them, is logged and never fails the clean-up. Measured: about a second on a 40 GiB machine. Docker Desktop, Linux and Windows run nothing.
-- A clean-up is refused while a space is being made, because the creation pulls the image and fills the tools before any container holds them. A start of a stopped space needs no such refusal: its containers hold the image and its tools.
+- A clean-up is refused while a space is being made, because the creation pulls the image and fills the tools before any container holds them, and while the image is being downloaded. A start of a stopped space needs no such refusal: its containers hold the image and its tools.
+- **The image ahead of the first space.** DESIGN.md, journey step 0; the maintainer's call of 2026-10-09. While the image is absent the place's block shows "Download image" beside "Clean up…"; pressed, it asks `POST /places/<place>/image`, which starts the pull and answers the disk at once. The place runs one `docker pull` at a time: a creation that needs the image while one runs waits on the same pull, and a second press is the same pull. The disk read carries `imagePulling`, and `imageFailure`, the code and message of the last download that failed, while the image is absent and no download runs; the page reads the disk again every three seconds while `imagePulling` is set, the one thing on this page that polls, and shows the failure under the buttons. `docker pull` prints no byte counts without a terminal, so the button says "Downloading…" with a spinner and no percentage; when the pull ends the disk line shows the image's size and the button goes. A pull that fails is logged by its code and not thrown to the page: the next disk read says it.
 
 ### Idle stop
 
@@ -604,7 +607,7 @@ DESIGN.md, decision 11 and the last line of "Dispatcher, sessions, events"; buil
 - **What the host sees.** The place's list carries `stoppedIdle`, an exited space whose exit code is 75, and `gatekeeperRunning`. A server stopped by `docker stop` exits 143. The journey's list passes `stoppedIdle` on, and the group says the space stopped after sitting idle, with Start.
 - **The gatekeeper.** Nothing inside can stop it, so an idle stop leaves it running. The journey's list stops a gatekeeper it finds running beside an exited space, and leaves it when another action holds the space; a start that comes meanwhile waits for that stop instead of being refused as busy. Turning the switch off stops it too. A key typed into it goes with it, as after a stop by hand. The maintainer's call of 2026-09-28: a self-stopping gatekeeper is more machinery than 24 MiB for a while is worth.
 - **Not a boundary.** The agent can change the file, keep a session busy, or exit with 75 itself. That keeps its space running or changes a line of text; it restricts nothing.
-- In the UI, a space stream that drops while the list says the space runs makes the client read the list again, at the host's reconnect pace, so an idle stop shows as stopped and not as "not answering".
+- In the UI, a space stream that drops while the list says the space runs makes the client read the list again, at the host's reconnect pace, so an idle stop shows as stopped and not as "not answering". While the list says a space is stopped the client sends it nothing: the sync watchdog and the browser panel's dev-server look skip its directories, and a message sent to it stays in the composer with "Start", instead of the dispatcher's 503 as a toast. A stream that comes back on such a space makes the client read the list again, so a start from another window reaches every window.
 
 ### Setup commands
 
@@ -625,13 +628,13 @@ DESIGN.md, "Words" and "Gatekeeper", and decisions 4, 5 and 13. Stage 5b takes t
 - An opened domain gets a random id, `open-<12 hex>`, and its window URL, `http://gatekeeper:8080/model/<id>`, which the answer carries so a screen can show it. Nothing inside is configured for it in this stage.
 - The key goes to the gatekeeper first, then the grant without its value goes to the record, and for a model grant OpenCode inside is told: `space-opencode.js` writes the whole global configuration, `$HOME/.config/opencode/opencode.json`, from the record's model grants, each provider with `options.baseURL` at its window URL and a placeholder `apiKey`, so OpenCode's own auth plugins stay out of the way and the window throws the placeholder away. That file cooperates and enforces nothing: the agent can change it, and the gatekeeper is what keeps the key out. The catalog a space offers is the host's, so the model chosen in the composer works inside unchanged; that was the second decision of 2026-09-26. A grant the gatekeeper refused is not remembered. A grant goes to a running space only, `space_not_running` otherwise, and to one whose record can be read, `space_record_unreadable` otherwise, because a grant that cannot be remembered would be gone at the next start without a word. The configuration is the whole file, so anything the agent wrote into its global `opencode.json` is gone at the next model grant or start; a project's own `opencode.json` is not touched.
 - The providers a model grant takes are the ones whose header this module knows: `anthropic` and `google` with their own headers, and `openai`, `openrouter`, `groq`, `mistral`, `deepseek` and `xai` with a bearer token. Any other is refused with `provider_not_supported` rather than accepted and failing every turn with a 401 upstream; Azure, Bedrock and Vertex read their key another way or sign requests. The grant dialog decides how the list grows.
-- After every start the journey says the record's grants again, after the network: an environment key is read again and delivered, an opened domain is delivered, and a typed key cannot be, because it was never kept. The provider configuration inside is written again from the record too, so a write that failed at the grant is repaired by the next start; a write that fails at the start is logged and the start goes on. A grant the host cannot read in the record, from a later version, is dropped with a warning and the rest of the record stays readable. The start answers `grantsRestored` and `needsAccess` with the ids. A gatekeeper that refuses one at the start leaves the space running and that grant in `needsAccess`, logged; the alternative, a start that fails with the space up and the network said, would be worse.
+- After every start the journey says the record's grants again, after the network: an environment key is read again and delivered, an opened domain is delivered, and a typed key cannot be, because it was never kept. The provider configuration inside is written again from the record too, so a write that failed at the grant is repaired by the next start; a write that fails at the start is logged and the start goes on. A grant the host cannot read in the record, from a later version, is dropped with a warning and the rest of the record stays readable. The start answers `grantsRestored` and `needsAccess` with the ids. A gatekeeper that refuses one at the start leaves the space running and that grant in `needsAccess`, logged; the alternative, a start that fails with the space up and the network said, would be worse. When the host starts, `restoreLostGrants` asks the gatekeeper of every running space what it holds and says the record's environment keys and opened domains it lacks, for a start a previous host did not live to finish; a typed key still waits for the user, a space with an action under way and a gatekeeper that does not answer are left alone, logged.
 - The list, with `access`, asks each running space that has grants what its gatekeeper holds, `GET /policy`, one request per such space and none for a space without grants or one that is stopped, and says `access: 'granted'`, `'needs_access'` with the missing ids in `needsAccess`, or `'unknown'` when the gatekeeper could not be asked, never "granted" on a failed read. While an action holds the space, a start saying its grants again among them, `access` is null rather than a "needs access" that is about to be untrue. `GET /` asks with `access`; the other routes answer the list without it, `access: null`. This is the "needs access" of DESIGN.md after a machine restart, read from the gatekeeper rather than from what this process remembers, so a host that restarted shows the truth.
 
 - An opened domain of the grant dialog is a name added to the allowlist, the corridor's, and not the window grant above: since 5d `POST /<id>/network/domains` tells the gatekeeper the list with the name first and the record after, so a record that cannot be written leaves the name open only until the next start, which closes it. It is the same action as "Open" on a blocked attempt of the journal, whose name the agent wrote: the user reading it and pressing the button is the decision, and the allowlist's name rule, applied here as in the corridor, refuses anything that is not a name. A space whose network is open refuses it with `network_is_open`, and the list holds at most 200 names, `too_many_domains` past that. A window grant for a domain has no screen yet, because nothing inside a space uses it before npm and git go through the window.
 
 - The list route runs one `docker ps` and one record read per space on every call; there is no cache, because the user is looking and the answer must be the state now.
-- A creation is one process's memory: a host that restarts in the middle of one leaves the space where the step got to, listed from the labels with whatever the record holds; a space whose code never arrived has an empty `spacePath` in its record and its apply fails on the project path. Removing such a space is the way out.
+- A creation is one process's memory: a host that restarts in the middle of one leaves the space where the step got to, listed from the labels with whatever the record holds. A space whose code never arrived has an empty `spacePath` in its record, and the list says so since the stage 5 leftovers: `state: 'failed'` with the failure `space_code_never_arrived`, as for a creation that failed in this process, so the group offers Remove and nothing else. Before that it was listed as running, and the user could send the agent into an empty folder; the packaged desktop quit check of stage 3a found it. The containers are not removed on the host's behalf: Remove is the user's action, as for every failed creation. A host that quit between making the containers and writing the record leaves a space with no record at all, which is still listed as running with `network: null`; that window is a few hundred milliseconds and is not closed here.
 - The history transfer is not retried on its own; a start of the space retries it while the record says `pending` or `failed`.
 - The lock on a space is one process's memory, like code out's turns: two OpenChamber processes on one Docker daemon are not coordinated.
 - The chat archive keeps what the export holds: a turn still running when the space is deleted is not in it, and a chat created in the space after its list was read goes with the space.
@@ -642,6 +645,28 @@ DESIGN.md, "Words" and "Gatekeeper", and decisions 4, 5 and 13. Stage 5b takes t
 - Whether OpenCode inside takes a provider granted after the instance of the space's project started, without a restart, is what the live file of 5b measures; see the pull request of 5b for the outcome. The restart action of the repair stage is the lever if it does not.
 - A grant for a provider the host's catalog does not know is written inside all the same; OpenCode inside then has no `npm` package for it and the turn fails with a provider error. The grant dialog offers the host's catalog, so this is a request nothing in the app makes.
 
+### Preview
+
+DESIGN.md, journey step 5 and decision 14; built in stage 6. The maintainer's calls of 2026-10-08: a space's dev servers are opened from the same place as the host's, the list on the empty "Browser" tab beside the chat, which for a chat of a space shows the servers listening inside that space; no port is granted, because the traffic goes into the space; the page opens on the desktop only, and in a browser tab or on the phone the list shows with its rows greyed and a computer icon that says the desktop app is needed; the agent inside a space cannot open or drive the panel; and a page from a space reaches nothing but the space, the internet included.
+
+Nothing of it is new on the server: `/api/spaces/<id>/dev-servers` is forwarded like any route, and the server inside answers with the ports listening inside the container, read from `/proc/net/tcp`, its own port and OpenCode's left out; `/api/spaces/<id>/dev-tunnel` is one of the four forwarded sockets since 4b, and the server inside dials the port on its own loopback after checking it against its own discovery, so the tunnel reaches a port the user could see and no other. The UI addresses both by the directory of the tab, which the prefix rule turns into the space's prefix, so a space's tab lists and opens the space's ports whether the instance is local or remote.
+
+The desktop opens the page through its dev-server tunnel, the one it already uses for a dev server of a remote instance, so the page loads from a local port of its own, `openchamber-preview.localhost:<port>`, under an origin that is not the app's. Three things are the space's alone:
+
+- **Its tunnel.** The desktop's tunnel client takes the space id and dials the space's prefix; a space's tunnel is keyed apart from the host's on the same remote port, so the two never share a local port. Over the private relay the same id travels with each connection, and the renderer dials the prefixed socket.
+- **Its session.** The page's view runs in a partition of the space's own, `openchamber-space-preview:<id>`, in memory, so it holds no cookie of the app's or of any page the user previewed, and the shell's hardening of the panel session, user agent, permissions and device pickers, applies to it. The shell refuses a view attached under any other partition than the panel's or a space's, and takes the preload and node integration off every view it attaches.
+- **Its reach.** The local API of the desktop runs without a password, and a page shown on this machine could call it, as it could the user's own dev servers and anything on the local network, which no gatekeeper stands in front of. So the space's session is routed through a proxy that answers nothing, a listener of the shell's that drops every connection, and bypasses it only for that space's tunnel ports; Chromium's implicit loopback bypass is taken away with `<-loopback>`. The rules are `space-preview.mjs` in `packages/electron`, applied before a tunnel's port is handed to the renderer and again, with no port, the moment a view with a space partition is attached. The page reaches the space and nothing else: a font from a CDN does not load in it, and neither does a request to the host's API, to a port on this machine, or to a name that resolves to one.
+
+The panel's views are keyed by their directory as well as their tab since this stage: before, a tab of the next directory with the same id kept the previous directory's view, and a space's page loaded in the host's session, which the live run showed before the fix. A PAC script was tried first for the rules and dropped: Chromium keeps its implicit bypass for loopback and `*.localhost` under a PAC script, and a page from the space reached a port on this machine; only `<-loopback>` in manual bypass rules takes that bypass away.
+
+Three more rules came out of the review of the stage. The icon a page reports is fetched by the shell only for a view in the user's own panel session; a space's view has a session of its own, so its page, whose icon URL the agent chose, gets no tab icon at all. Measured before that rule: the shell fetched the icon from the local service the page named, in the space's session too, since `net.fetch` does not go through the session's proxy. A space's view is attached only after the renderer asked the shell to put the proxy on the space's session, so a saved public address does not load direct in the moment before the attach-time apply. And every closed tunnel of a space, a window closing among the reasons, takes its port out of the space's session, so the list never holds a port another listener could later take.
+
+What the user sees of all this: in the list, a space's server carries the container icon, with the space's name and place behind it on hover, "preview · On this computer (Docker)"; a page from a space shows the same icon before its address; in a browser tab and on the phone the row is greyed with a computer icon, "Opens in the desktop app" on hover, and no sentence under the list. The maintainer's call of 2026-10-08: show, do not write.
+
+The "Open in browser" action of the toolbar is off for a space's tab: the system browser has no such proxy. The host's status probe, `/api/system/probe-url`, is host-only and is not asked for a space's page; a page that loaded counts as served. A loopback address a space's page navigates to is tunnelled into the same space, as a remote instance's pages keep their other ports on the host.
+
+Known limits: the proof that Chromium reads the proxy rules as written is the live run, since the rules are text; a port the user hides from the list is hidden by number for the host and every space alike; and the tunnel's local port accepts any local connection, so a page opened by hand in another browser at that address has that browser's reach and not the panel's, which is why the panel does not offer it.
+
 ## Code in
 
 The project's code travels into a space as git objects over the place's exec channel: `git push` over `ext::`, with `docker exec` as the transport. No network, no ports, no archives, no shared folders. The host drives every step. The command sequences are the ones in `docs/isolated-spaces/stage-0/e4-git-over-exec.md`, with the changes below. Nothing calls this yet, and getting code out, quarantine and apply are stage 3b.
@@ -1008,7 +1033,7 @@ Not built: moving a space when the agent finishes its turn. That needs session a
 
 The name check sits outside the rollback on purpose. If the id is taken, the resources belong to an existing space and must survive the failed call.
 
-After an interrupted step (`command_timeout`, `command_killed`, or `command_output_too_large`) the daemon may still finish the step whose CLI died. `create` then sweeps, waits two seconds, and sweeps again. The second sweep also inspects the seven names directly and removes the ones that exist, labelled or not. This covers a late `docker run` or `docker create`: it makes a missing `src=` volume again, and that volume has no labels. This by-name removal, the two for a tools volume described in "Fill rollback", and the space image a clean-up of the places page asks Docker to remove without force (see "Places page"), are the only places in the module where a resource without our labels can be deleted. It is safe because the same call confirmed all seven names absent moments earlier, and the names hold a random 48-bit id, so nobody else makes them in between. The error carries `details.uncertain: true`, so the caller can tell the user to look at the spaces list.
+After an interrupted step (`command_timeout`, `command_killed`, or `command_output_too_large`) the daemon may still finish the step whose CLI died. `create` then sweeps, waits two seconds, and sweeps again. The second sweep also inspects the seven names directly and removes the ones that exist, labelled or not. This covers a late `docker run` or `docker create`: it makes a missing `src=` volume again, and that volume has no labels. This by-name removal, the two for a tools volume described in "Fill rollback", and the space image and retired images a clean-up of the places page asks Docker to remove without force (see "Places page"), are the only places in the module where a resource without our labels can be deleted. It is safe because the same call confirmed all seven names absent moments earlier, and the names hold a random 48-bit id, so nobody else makes them in between. The error carries `details.uncertain: true`, so the caller can tell the user to look at the spaces list.
 
 The manager verifies again after `create` and removes a space that reports violations or cannot be inspected. For the Docker place this repeats a check that already passed. It stays because the guarantee must hold for every place, including a place whose `create` forgets to verify.
 
@@ -1155,15 +1180,15 @@ Not verified with OpenCode 2.0.15: the rewritten credential test and the rewritt
 
 ## Base image
 
-`SPACE_BASE_IMAGE` in `places/docker.js` is `node:22-bookworm` pinned as `node@sha256:dd5847a04b0deee391fa145f1f4c6d214196668b6bcc7988ebed67249f226844`.
+`SPACE_BASE_IMAGE` in `places/docker.js` is `node:24-bookworm` pinned as `node@sha256:3d27e5c11e5786e309ec3e03f93ae536eb36e6e5eb3714d5eb3300a36157add0`.
 
-It must be the multi-arch index digest, or spaces break on the other CPU architecture. Verified on 2026-09-19:
+It must be the multi-arch index digest, or spaces break on the other CPU architecture. Verified on 2026-10-08:
 
 ```
-docker manifest inspect node@sha256:dd5847a04b0deee391fa145f1f4c6d214196668b6bcc7988ebed67249f226844
+docker manifest inspect node@sha256:3d27e5c11e5786e309ec3e03f93ae536eb36e6e5eb3714d5eb3300a36157add0
 ```
 
-The answer has `mediaType: application/vnd.oci.image.index.v1+json` and lists manifests for `linux/amd64`, `linux/arm`, `linux/arm64`, and `linux/ppc64le`. An arch-specific digest answers with `application/vnd.oci.image.manifest.v1+json` and no platform list. `docker images --digests node` showed the same digest for the `22-bookworm` tag. Repeat both commands when you bump the digest. `docker buildx imagetools inspect` gives the same facts where buildx is installed.
+The answer has `mediaType: application/vnd.oci.image.index.v1+json` and lists manifests for `linux/amd64`, `linux/arm64`, and `linux/ppc64le`, plus attestation entries with platform `unknown/unknown`. Node 24 dropped 32-bit `linux/arm`. An arch-specific digest answers with `application/vnd.oci.image.manifest.v1+json` and no platform list. `docker images --digests node` showed the same digest for the `24-bookworm` tag. Repeat both commands when you bump the digest. `docker buildx imagetools inspect` gives the same facts where buildx is installed. A bump also reads the image's own variables again for `hardening.js`, and adds the digest it replaces to `RETIRED_SPACE_BASE_IMAGES`, see "Retired images" under "Places page". The bump of 2026-10-08 from `node:22-bookworm` is the first.
 
 ## Tests
 
@@ -1179,7 +1204,7 @@ Each live file uses an owner id of its own, removes its spaces, helper container
 
 `places/contract-suite.js` is a fixed contract. It passes unchanged against the memory place, the fake Docker, and live Docker.
 
-`places/fake-docker.js` answers like the docker CLI for the subcommands the place uses. It knows tools volumes and their fill marker, the three one-shots, container ids, `rename`, `network connect`, a container name that is in use, a volume that is in use, a CLI that cannot reach the daemon and exits with 1, the server inside a space, which answers `/health` once its token is there, and a gatekeeper, whose control channel answers once its program has been written and whose tmpfs is empty again after a stop. Its `wait` moves its own clock, so no test sleeps. `docker.test.js` uses it for tools reuse, fill, fill failure, interrupted fill, a stranger's volume, two creates that share one fill, the readiness timeout, the token that never shows in an argument, a marker check that Docker could not run, a marker for other content, a tools volume that came back without labels, and the move to new tools with its rollbacks, including the old container that got its name back before the create landed.
+`places/fake-docker.js` answers like the docker CLI for the subcommands the place uses. It knows tools volumes and their fill marker, retired images with their tags, the three one-shots, container ids, `rename`, `network connect`, a container name that is in use, a volume that is in use, a CLI that cannot reach the daemon and exits with 1, the server inside a space, which answers `/health` once its token is there, and a gatekeeper, whose control channel answers once its program has been written and whose tmpfs is empty again after a stop. Its `wait` moves its own clock, so no test sleeps. `docker.test.js` uses it for tools reuse, fill, fill failure, interrupted fill, a stranger's volume, two creates that share one fill, the readiness timeout, the token that never shows in an argument, a marker check that Docker could not run, a marker for other content, a tools volume that came back without labels, and the move to new tools with its rollbacks, including the old container that got its name back before the create landed.
 
 `dispatcher.test.js` runs the dispatcher in front of a stand-in for the server inside: an Express app behind the host's own `createUiAuth`, so the login, the cookie name with the port in it and the refusal of a wrong token are the real ones, reached over a plain socket. It covers the prefix and the credentials coming off and the session going on, one login and one connection pool for many requests, a three-megabyte body streamed in, a form-encoded body kept whole by the parser predicate, an event stream read event by event with the request inside ended when the client leaves, a four-megabyte event stream whole, both guards in every spelling they take with their controls, the host-only and refused routes with their neighbours forwarded, an unknown id and one that appears, the cookie stripped and the page and raw-file content types, a redirect and `Clear-Site-Data` and `Refresh` never leaving the dispatcher for any method, an answer without a content type served as text, a stopped space answered with its code while a three-megabyte body is still on its way in, the renewed session and the repeated request after a 401, the body request that is not repeated, the renewal before expiry, the codes for a stopped space and an unreachable server, and the token absent from every answer and log line when the login fails. Each guard's test was run once with its guard removed and went red; so did the parser predicate's test, where the request hangs without it. `command-stream.test.js` runs `openCommandStream` and the bridge on the host's Node: bytes both ways, the error with the command's stderr, the kill on destroy, the idle timeout, the spawn failure, HTTP over a keep-alive agent with one process for many requests, the four-megabyte full-duplex exchange compared by sha256, `ECONNREFUSED` reported, and the command gone when the host lets go and when the server closes. `host.test.js` covers the owner file and the wiring over the memory place, with no process started, and since 4b, over a stand-in place whose spaces are Express apps behind the real UI auth, the merged list with its drops and the stale mark of a stopped space, the event connections into the real hub with the host's ids learned from it, and a socket forwarded through the mounted upgrade handler. `websocket.test.js` runs the forwarder against such a stand-in with an echo socket: the handshake built without the user's credentials and with the loopback origin, a header with a line break refused, the answer parsed with the bytes after it, the close frame's bytes, the terminal socket forwarded with the query token gone and the space session on, a 4 MiB frame both ways, every refusal before the upgrade with its code, the place's and the space's own refusals, the host's auth and origin rules per socket, the session renewed once after a 401, the close frame when the stream inside dies and the stream killed when the client leaves, and every socket ended at close. `space-sessions.test.js` is the table of what a space may claim: each directory spelling kept or dropped, a host id never taken, an id another space listed dropped, the field allowlist, each event rule, the merge order and marks, and the index's stale, partial, unknown and forgotten states. `space-events.test.js` runs the connection against a stand-in stream and the real hub: the announcement, the status seed, an event entered with the space's id and directory, the three drops with the directory absent from the log, the backoff after the stream ends with the gap announced, the connection dropped for a space that is gone, and a refused connection retried quietly. `places/sessions.docker.live.test.js` is the live file of 4b, see "Verified and not verified".
 

package/server/lib/spaces/command-stream.test.js

@@ -96,6 +96,21 @@ describe('openCommandStream', () => {
     expect(stream.timeout).toBe(150);
   });
 
+  it('takes a timeout listener off again when the timeout is cancelled with it, as a socket does', async () => {
+    // The http client sets and cancels a timeout with its listener on every request a pooled
+    // stream carries; left on, the listeners pile up across the stream's life.
+    const stream = open(node, ['-e', ECHO]);
+    stream.resume();
+    const listener = () => {};
+    for (let round = 0; round < 12; round += 1) {
+      stream.setTimeout(1_000, listener);
+      stream.setTimeout(0, listener);
+    }
+    expect(stream.listenerCount('timeout')).toBe(0);
+    stream.setTimeout(1_000, listener);
+    expect(stream.listenerCount('timeout')).toBe(1);
+  });
+
   it('answers a command that cannot start with an error, not an exception', async () => {
     const stream = open('/nonexistent/program/of-ours', []);
     stream.resume();

package/server/lib/spaces/dispatcher.js

@@ -521,6 +521,13 @@ export function createSpaceDispatcher({ transport, now = Date.now, logger = cons
     res.on('close', onClientGone);
 
     upstreamRequest.on('response', (upstream) => {
+      // The client left between the request and the answer, a list poll aborted by its panel
+      // among them: nothing to write to, and `pipeline` into a destroyed response throws.
+      if (res.destroyed) {
+        upstream.destroy();
+        finish('done');
+        return;
+      }
       if (upstream.statusCode === 401 && onUnauthorized === 'report') {
         upstream.resume();
         upstream.on('end', () => finish('unauthorized'));

package/server/lib/spaces/dispatcher.test.js

@@ -86,6 +86,9 @@ const startInside = async ({ password = TOKEN } = {}) => {
     res.setHeader('content-type', String(req.query.type));
     res.end('file');
   });
+  app.get('/api/slow', (_req, res) => {
+    setTimeout(() => res.json({ late: true }), 300);
+  });
   app.get('/api/page', (_req, res) => {
     res.setHeader('content-type', 'text/html; charset=utf-8');
     res.send('<script>alert(1)</script>');
@@ -422,6 +425,20 @@ describe('space dispatcher', () => {
     expect(await page.text()).toBe('<script>alert(1)</script>');
   });
 
+  it('survives a client that leaves between the request and the answer', async () => {
+    // The browser panel polls a space's dev servers and aborts the poll when it closes; the
+    // answer inside still arrives, and piping it into a response that is gone must not throw.
+    await start();
+    const controller = new AbortController();
+    const aborted = fetch(host.url(`/api/spaces/${ID}/slow`), { signal: controller.signal }).catch((error) => error);
+    await new Promise((resolve) => { setTimeout(resolve, 80); });
+    controller.abort();
+    expect((await aborted).name).toBe('AbortError');
+    await new Promise((resolve) => { setTimeout(resolve, 500); });
+    const next = await fetch(host.url(`/api/spaces/${ID}/echo`));
+    expect(next.status).toBe(200);
+  });
+
   it('passes a 304 through: a browser revalidating its own copy is not a redirect', async () => {
     await start();
     const first = await fetch(host.url(`/api/spaces/${ID}/unchanged`));

package/server/lib/spaces/hardening.js

@@ -51,9 +51,9 @@ const FILLER_TMPFS_OPTIONS = 'rw,exec,nosuid,size=1g';
 // named on its own as well, so its message stays specific.
 const FORBIDDEN_ENVIRONMENT = ['OPENCHAMBER_UI_PASSWORD'];
 // The variables the pinned base image sets itself. Docker copies them into every container made
-// from it. Read on 2026-09-24 with
+// from it. Read on 2026-10-08 with
 // `docker image inspect <SPACE_BASE_IMAGE> --format '{{json .Config.Env}}'`, which answered
-// PATH, NODE_VERSION=22.23.2 and YARN_VERSION=1.22.22. Read them again when the digest changes.
+// PATH, NODE_VERSION=24.21.0 and YARN_VERSION=1.22.22. Read them again when the digest changes.
 const BASE_IMAGE_ENVIRONMENT_NAMES = ['PATH', 'NODE_VERSION', 'YARN_VERSION'];
 const SPACE_ENVIRONMENT_NAMES = new Set([...Object.keys(SPACE_ENVIRONMENT), ...BASE_IMAGE_ENVIRONMENT_NAMES]);
 const GATEKEEPER_ENVIRONMENT_NAMES = new Set([...Object.keys(GATEKEEPER_ENVIRONMENT), ...BASE_IMAGE_ENVIRONMENT_NAMES]);

package/server/lib/spaces/hardening.test.js

@@ -150,7 +150,7 @@ describe('findHardeningViolations', () => {
   it('accepts exactly the variables a space gets and the base image sets', () => {
     const full = withEnv([
       ...Object.entries(SPACE_ENVIRONMENT).map(([name, value]) => `${name}=${value}`),
-      'NODE_VERSION=22.23.2',
+      'NODE_VERSION=24.21.0',
       'YARN_VERSION=1.22.22',
     ]);
     expect(checksFor({ container: full })).toEqual([]);