@withbuddi/buddi 0.1.0-pre.16 → 0.1.0-pre.18

package/node_modules/@buddi/gateway/dist/web/onboarding.js

@@ -135,7 +135,7 @@ export class OnboardingRefusal extends Error {
  * The example the owner's first agent takes the place of.
  *
  * The catalog's rule is that a private agent with the same id as an example
- * replaces it wholesale (docs/ARCHITECTURE.md, "Drop-in tools and skills"), so
+ * replaces it wholesale (docs/architecture.md, "Drop-in tools and skills"), so
  * writing the first agent under this id *is* the rename: there is one
  * assistant afterwards, the owner's, and Concierge is no longer listed beside
  * it pretending to be a colleague. The handle, name, face and description are

package/node_modules/@buddi/gateway/dist/web/pages.js

@@ -1,7 +1,7 @@
 /**
  * The three routes a plugin's screens are made of.
  *
- * `docs/specs/plugin-pages.md` §3. The dashboard reads the descriptors once,
+ * `docs/plugin-pages.md` §3. The dashboard reads the descriptors once,
  * draws them with its own generic components, and then:
  *
  *   - `GET  /api/pages`                     — every descriptor, session-gated;

package/node_modules/@buddi/gateway/dist/web/read.js

@@ -1,9 +1,9 @@
 /**
  * The dashboard's reads — the event log and everything hanging off it.
  *
- * ARCHITECTURE.md, "Secrets and operations": *«Observability is the event log:
- * run/step/action ids, queue age, ingest lag, retry counts, approval age,
- * provider usage.»* So this file adds no state of its own and computes nothing
+ * docs/architecture.md, "Secrets and operations": *«Observability is the event
+ * log: run, step and action ids, queue age, ingest lag, retry counts, approval
+ * age, provider usage.»* So this file adds no state of its own and computes nothing
  * the system does not already record: every number below is a row somewhere,
  * read back with a `select`.
  *

package/node_modules/@buddi/gateway/dist/web/secrets.d.ts

@@ -1,5 +1,5 @@
 /**
- * The dashboard's Keys and secrets routes (docs/specs/owner-secrets.md §6).
+ * The dashboard's Keys and secrets routes (docs/owner-secrets.md §6).
  *
  * The reads are core's own page queries (`secrets.list`, `secrets.uses`); the
  * writes are the ownerOnly tools of the same manifest — `secrets.put`,

package/node_modules/@buddi/gateway/dist/web/server.d.ts

@@ -52,7 +52,7 @@ export interface WebServerDeps {
     /**
      * Post a pending approval to the owner's Telegram chat — the same hook an
      * unattended run uses. An MCP write raises its card on both surfaces
-     * (docs/specs/mcp.md §2); without it the card is on the dashboard only.
+     * (docs/mcp.md §2); without it the card is on the dashboard only.
      */
     askApproval?: ((action: ActionRecord) => Promise<void>) | undefined;
     /** Where the built UI lives. Defaults to `packages/web/dist`. */

package/node_modules/@buddi/gateway/dist/web/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgBtF,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,eAAe,CAAC;AAUvB,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAY,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAA4G,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1J,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAuB7D,OAAO,EAKL,OAAO,EAKP,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAuC,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAUL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAoC3E,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAcvB,OAAO,EAYL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AA+BtB,qFAAqF;AACrF,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,eAAe,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpE,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;IAC/F;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KAC7E,GAAG,SAAS,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,oHAAoH;AACpH,eAAO,MAAM,aAAa,oBAAoB,CAAC;AA4D/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAE7D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEnE;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA+2ExD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,SAAS,CAAC,CA4DpB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgBtF,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,eAAe,CAAC;AAUvB,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAY,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAA4G,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1J,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAuB7D,OAAO,EAKL,OAAO,EAKP,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAuC,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAUL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAoC3E,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAcvB,OAAO,EAYL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AA+BtB,qFAAqF;AACrF,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,eAAe,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpE,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;IAC/F;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KAC7E,GAAG,SAAS,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,oHAAoH;AACpH,eAAO,MAAM,aAAa,oBAAoB,CAAC;AA4D/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAE7D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEnE;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAy3ExD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,SAAS,CAAC,CA4DpB"}

package/node_modules/@buddi/gateway/dist/web/server.js

@@ -1,9 +1,9 @@
 /**
  * The dashboard's HTTP server — bound to loopback, CSRF-checked, and CORS-free.
  *
- * ARCHITECTURE.md, "Owner and surface authentication": *«Web UI: session auth,
- * CSRF protection, Origin checks, bound to localhost by default (remote access
- * = explicit authenticated transport).»* The binding is the credential. Each
+ * docs/architecture.md, "Owner and surface authentication": the dashboard
+ * binds to `127.0.0.1` by default, CSRF and `Origin` checks gate every write,
+ * and remote access is an explicit, authenticated transport. The binding is the credential. Each
  * rule runs here before any handler sees a request:
  *
  *   1. **Rate limit.** Failed authentications are counted per address; over
@@ -41,6 +41,7 @@
  * No `Access-Control-*` header is ever emitted, and `OPTIONS` is refused: a
  * page on another origin gets no preflight and no permission.
  */
+import { listNotificationsRoute, markSeenRoute, notificationSettingsRoute, presenceRoute, testChannelRoute } from './notifications.js';
 import { catalogSkillLookup, discardProposalFromWeb, keepProposalFromWeb, readProposals, registryChangeLookup } from './proposals.js';
 import { latestDigest, readDigestSchedule, setDigestSchedule } from '../agents/learning-digest.js';
 import { readAgentSkills, removeLearnedSkillFromWeb } from '../agents/learned-skills.js';
@@ -81,7 +82,7 @@ import { allowedOrigins, isLoopback, webAssetsDir, webUrl } from './config.js';
 import { TAILSCALE_SETTING_KEY, daemonWhois, plausibleLogin, proxiedThroughTailscale, sameLogin, tailscaleIdentity, tailscaleSelf, toTailscaleSetting, } from './tailscale.js';
 import { extensionEndpoint } from './extension.js';
 import { REMOTE_HAND_SOCKET_PATH, RemoteHandEndpoint } from './remote-hand.js';
-import { csrfCookieName, CSRF_HEADER, sessionCookieName, portOf, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, remoteKey, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
+import { csrfCookieName, CSRF_HEADER, sessionCookieName, requestPort, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, remoteKey, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
 import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readMissions, readOverview, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
 import { RateLimiter, SessionStore, } from './sessions.js';
 import { supervisorCall } from './service.js';
@@ -211,7 +212,7 @@ export function createWebApp(deps) {
             if (origin === undefined || !allowed().has(origin))
                 return null;
             const scope = requestScope(req);
-            const session = sessions.get(parseCookies(req.headers.cookie)[sessionCookieName(cookiePort())], scope, now);
+            const session = sessions.get(parseCookies(req.headers.cookie)[sessionCookieName(cookiePort(req))], scope, now);
             if (!session)
                 return null;
             if (session.via === 'tailscale') {
@@ -290,7 +291,7 @@ export function createWebApp(deps) {
     writeDeps.resumeInteractive = (action, outcome) => chat?.resumeHost(action, outcome);
     /*
      * What an approved MCP write reaches: the functions the dashboard's own
-     * routes below call, and nothing else (docs/specs/mcp.md §2).
+     * routes below call, and nothing else (docs/mcp.md §2).
      */
     const unwrap = async (result) => {
         const settled = await result;
@@ -372,22 +373,20 @@ export function createWebApp(deps) {
      * the page has to echo back in a header. Both carry the same `Max-Age`, which
      * is the lifetime this session's scope earned it.
      */
-    const sessionCookies = (session) => {
+    const sessionCookies = (req, session) => {
         const maxAgeSeconds = SessionStore.maxAgeSeconds(session);
         return [
-            cookieHeader(sessionCookieName(cookiePort()), session.id, { httpOnly: true, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
-            cookieHeader(csrfCookieName(cookiePort()), session.csrf, { httpOnly: false, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
+            cookieHeader(sessionCookieName(cookiePort(req)), session.id, { httpOnly: true, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
+            cookieHeader(csrfCookieName(cookiePort(req)), session.csrf, { httpOnly: false, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
         ];
     };
     /**
-     * The port the cookies are named after (http.ts says why they carry one):
-     * the public origin's when there is one, else the port actually bound.
+     * The port this request's cookies are named after (http.ts says why they
+     * carry one): the port the browser sees, from the request's Host, so the
+     * loopback page and the tailnet page each keep their own pair. Set, read and
+     * checked through this one function.
      */
-    const cookiePort = () => {
-        if (deps.config.publicOrigin)
-            return portOf(new URL(deps.config.publicOrigin));
-        return server.address()?.port ?? deps.config.port;
-    };
+    const cookiePort = (req) => requestPort(req, server.address()?.port ?? deps.config.port, deps.config.publicOrigin);
     /**
      * The origins a write may claim, resolved against the port actually bound.
      *
@@ -469,11 +468,11 @@ export function createWebApp(deps) {
             clean.searchParams.delete(TICKET_PARAM);
             return sendEmpty(res, 302, {
                 Location: `${clean.pathname}${clean.search}`,
-                'Set-Cookie': sessionCookies(session),
+                'Set-Cookie': sessionCookies(req, session),
             });
         }
         const cookies = parseCookies(req.headers.cookie);
-        let session = sessions.get(cookies[sessionCookieName(cookiePort())], scope, now);
+        let session = sessions.get(cookies[sessionCookieName(cookiePort(req))], scope, now);
         /*
          * A Tailscale session is re-confirmed on every single request.
          *
@@ -508,7 +507,7 @@ export function createWebApp(deps) {
          */
         if (!session && openAccess && scope === 'local') {
             session = sessions.create(scope, now);
-            res.setHeader('Set-Cookie', sessionCookies(session));
+            res.setHeader('Set-Cookie', sessionCookies(req, session));
         }
         /*
          * Signed in through Tailscale.
@@ -531,7 +530,7 @@ export function createWebApp(deps) {
                     tailscaleAddress: identity.address,
                     tailscaleName: identity.name,
                 });
-                res.setHeader('Set-Cookie', sessionCookies(session));
+                res.setHeader('Set-Cookie', sessionCookies(req, session));
             }
         }
         if (!session) {
@@ -555,7 +554,7 @@ export function createWebApp(deps) {
          * instead of one per request.
          */
         if (sessions.renewCookie(session, now))
-            res.setHeader('Set-Cookie', sessionCookies(session));
+            res.setHeader('Set-Cookie', sessionCookies(req, session));
         const mutating = method !== 'GET' && method !== 'HEAD';
         if (mutating) {
             const origin = requestOrigin(req);
@@ -565,7 +564,7 @@ export function createWebApp(deps) {
             const header = Array.isArray(presented) ? presented[0] : presented;
             if (!SessionStore.csrfMatches(session, header))
                 return sendEmpty(res, 403);
-            if (cookies[csrfCookieName(cookiePort())] !== session.csrf)
+            if (cookies[csrfCookieName(cookiePort(req))] !== session.csrf)
                 return sendEmpty(res, 403);
         }
         if (url.pathname === '/api' || url.pathname.startsWith('/api/')) {
@@ -605,7 +604,7 @@ export function createWebApp(deps) {
             pool: deps.pool,
             agentIds: () => deps.catalog.list().map((a) => a.id),
         });
-        /** The Keys and secrets page (docs/specs/owner-secrets.md §6): core's own queries and ownerOnly tools. */
+        /** The Keys and secrets page (docs/owner-secrets.md §6): core's own queries and ownerOnly tools. */
         const secretsDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now });
         /** The same, for the version and upgrade routes. */
         const versionDeps = () => ({ env: deps.env ?? process.env, log });
@@ -906,6 +905,10 @@ export function createWebApp(deps) {
                             schedule: await readDigestSchedule(deps.pool, now, deps.timezone),
                         },
                     });
+                case '/api/notifications':
+                    return reply(res, await listNotificationsRoute(deps.pool, q.get('limit')));
+                case '/api/notifications/settings':
+                    return reply(res, await notificationSettingsRoute(deps.pool, 'GET'));
                 case '/api/reminders':
                     return sendJson(res, 200, {
                         reminders: await readReminders(deps.pool, boundedLimit(q.get('limit'))),
@@ -921,7 +924,7 @@ export function createWebApp(deps) {
                 /*
                  * The screens the installed plugins contribute, and nothing else: a
                  * rail entry, a settings tab, and the tree of generic components each
-                 * is made of (docs/specs/plugin-pages.md). Descriptors are data, like
+                 * is made of (docs/plugin-pages.md). Descriptors are data, like
                  * views — no plugin code ever runs in the page.
                  */
                 case '/api/pages':
@@ -1377,7 +1380,7 @@ export function createWebApp(deps) {
          * everything else.
          */
         if (method === 'PUT') {
-            const puttable = ['/api/backups/schedule', '/api/backups/passphrase', '/api/version/check', '/api/tailscale'];
+            const puttable = ['/api/backups/schedule', '/api/backups/passphrase', '/api/version/check', '/api/tailscale', '/api/notifications/settings'];
             if (!puttable.includes(path))
                 return sendEmpty(res, 405);
             let put;
@@ -1441,6 +1444,8 @@ export function createWebApp(deps) {
             }
             if (path === '/api/version/check')
                 return reply(res, await versionCheckRoute(versionDeps(), 'PUT', put));
+            if (path === '/api/notifications/settings')
+                return reply(res, await notificationSettingsRoute(deps.pool, 'PUT', put));
             return reply(res, path === '/api/backups/schedule'
                 ? await scheduleRoute(backupDeps(), 'PUT', put)
                 : await passphraseRoute(backupDeps(), 'PUT', put));
@@ -1665,6 +1670,13 @@ export function createWebApp(deps) {
                 return sendJson(res, 413, { error: err.message });
             return sendJson(res, 400, { error: 'request body must be JSON' });
         }
+        if (path === '/api/presence')
+            return reply(res, await presenceRoute(deps.pool, body, deps.now()));
+        if (path === '/api/notifications/test')
+            return reply(res, await testChannelRoute(body, deps.now()));
+        const seen = /^\/api\/notifications\/([^/]+)\/seen$/.exec(path);
+        if (seen)
+            return reply(res, await markSeenRoute(deps.pool, decodeURIComponent(seen[1]), deps.now()));
         const approval = /^\/api\/approvals\/([^/]+)\/(approve|reject)$/.exec(path);
         if (approval) {
             const scope = body.permissionScope ?? 'once';