@withbuddi/buddi 0.1.0-pre.28 → 0.1.0-pre.29

package/packages/gateway/dist/web/server.js

@@ -41,6 +41,7 @@
  * No `Access-Control-*` header is ever emitted, and `OPTIONS` is refused: a
  * page on another origin gets no preflight and no permission.
  */
+import { runningAgentRuns } from '@buddi/runtime';
 import { agentMuteRoute, focusRoute, listNotificationsRoute, markSeenRoute, notificationSettingsRoute, presenceRoute, testChannelRoute } from './notifications.js';
 import { catalogSkillLookup, discardProposalFromWeb, keepAllProposalsFromWeb, keepProposalFromWeb, readProposals, registryChangeLookup } from './proposals.js';
 import { latestDigest, readDigestSchedule, setDigestSchedule } from '../agents/learning-digest.js';
@@ -69,9 +70,10 @@ import { connectionsOf } from '@buddi/tool-mcp';
 import { CONNECTIONS_CALLBACK_PATH, connectionsRoute } from './connections.js';
 import { browserHost } from '../browser-host.js';
 import { hostService } from '@buddi/tool-host';
-import { listToolPermissions, revokeToolPermission, getArtifact, readArtifactBytes, artifactBytesExist, discardUnreferencedUpload, listLibrary, getLibraryEntry, decodeCursor, filterKey, textPreviewable, readArtifactPrefix, FILE_FAMILIES, LIBRARY_PAGE_MAX, getOwnerProfile, setOwnerProfile, isKnownTimezone, listGroups, getGroup, createGroup, updateGroup, archiveGroup, GroupRefusal, createGroupConversation, listGroupConversations, latestGroupConversation, openGroupRequest, conversationGroup } from '@buddi/core';
+import { listToolPermissions, revokeToolPermission, getArtifact, readArtifactBytes, artifactBytesExist, discardUnreferencedUpload, listLibrary, getLibraryEntry, decodeCursor, filterKey, textPreviewable, readArtifactPrefix, FILE_FAMILIES, LIBRARY_PAGE_MAX, getOwnerProfile, saveOwnerProfile, isKnownTimezone, listGroups, getGroup, createGroup, updateGroup, archiveGroup, deleteGroup, restoreGroup, clearGroupHistory, groupHistorySize, GROUP_UNDO_MS, GroupRefusal, createGroupConversation, listGroupConversations, latestGroupConversation, openGroupRequest, conversationGroup } from '@buddi/core';
 import { beginOnboarding, completeOnboarding, markStepDone, setOnboardingDetails, skipOnboarding, readWebSetting, writeWebSetting } from '@buddi/core';
 import { listMemory, setPreference, forgetPreference, updateNote, forgetNote } from '@buddi/tool-memory';
+import { purgeGroups, stopGroupWork } from './group-lifecycle.js';
 import { engineChangeFromBody, readAgentEngines, readDefaultAgent, readEngineOptions, setAgentEngineFromWeb, setDefaultAgentFromWeb, } from './agents.js';
 import { writeDefaultAgentRecord } from '../agents/default-agent.js';
 import { ownerEditableInput, updateAgentFromOwner, PlatformRefusal } from '../agents/platform.js';
@@ -86,7 +88,7 @@ import { ATTACHMENTS_UNAVAILABLE, CHAT_CONVERSATIONS_LIMIT, CHAT_UNAVAILABLE, WE
 import { readAgentAttention, streamAttention } from './attention.js';
 import { PreviewApp, PreviewTickets, parsePreviewApiPath } from './preview.js';
 import { allowedOrigins, isLoopback, webAssetsDir, webUrl } from './config.js';
-import { TAILSCALE_SETTING_KEY, daemonWhois, isLoginRefusal, plausibleLogin, proxiedThroughTailscale, sameLogin, tailscaleIdentity, tailscaleRefusalReason, tailscaleSelf, toTailscaleSetting, } from './tailscale.js';
+import { TAILSCALE_SETTING_KEY, daemonWhois, isLoginRefusal, isUnansweredRefusal, plausibleLogin, proxiedThroughTailscale, sameLogin, tailscaleIdentity, tailscaleRefusalReason, tailscaleSelf, toTailscaleSetting, } from './tailscale.js';
 import { retryHref, sendSignedOut, wantsSignedOutPage } from './signed-out.js';
 import { extensionEndpoint } from './extension.js';
 import { REMOTE_HAND_SOCKET_PATH, RemoteHandEndpoint } from './remote-hand.js';
@@ -99,6 +101,10 @@ import { acceptAgentRoute, approveRoute, listPlugins, pluginJobRoute, receivePlu
 import { marketAssetRoute, marketRoute } from './market.js';
 import { pluginFoldersRoute } from './folders.js';
 import { tipsRoute } from '../tips/route.js';
+import { createWidgets, widgetsRoute } from './widgets.js';
+import { createRequirements } from '../plugins/requires.js';
+import { placesList, placesRoute } from './places.js';
+import { OWNER_DATE_FORMATS, OWNER_TIME_FORMATS } from '@buddi/core';
 import { readFacts, webSettingsStore } from '../tips/facts.js';
 import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers, readTeammates } from './agent-offers.js';
 import { currentVersion, upgradeJobRoute, upgradeRoute, versionCheckRoute, versionRoute, } from './version.js';
@@ -108,6 +114,10 @@ import { BUILD_MISSING, serveAsset, serveShellAtRoot } from './static.js';
 import { StreamBudget, resumeCursor, streamConversation } from './stream.js';
 import { ensureWebToken, verifyTicket } from './token.js';
 import { MAX_UPLOAD_BYTES, readUpload } from './upload.js';
+import { LOCKED_BODY, LockUnavailable, allowedWhileLocked, clientOf, createLock } from './lock.js';
+import { matchApiRoute, TOKEN_REFUSALS } from './api-routes.js';
+import { apiTokensRoute, bearerOf, verifyApiToken } from './api-tokens.js';
+import { LockImageRefusal, MAX_LOCK_IMAGE_BYTES, normaliseLockImage } from './lock-image.js';
 import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, setMissionEnabledFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
 /** How often approvals past their expiry are swept, and waiting delegations told. */
 export const EXPIRY_SWEEP_MS = 60_000;
@@ -232,9 +242,16 @@ export function createWebApp(deps) {
             const session = await sessions.resolve(parseCookies(req.headers.cookie)[sessionCookieName(cookiePort(req))], scope, now);
             if (!session)
                 return null;
+            // A locked dashboard drives nothing (docs/dashboard.md, "Lock screen").
+            if (await lock.locked(session))
+                return null;
             if (session.via === 'tailscale') {
-                const confirmed = await identityOf(req, now);
+                let refusal;
+                const confirmed = await identityOf(req, now, (reason) => { refusal = reason; });
                 if (!confirmed || !sameLogin(confirmed.login, session.tailscaleLogin)) {
+                    // "Could not ask" is not an answer: no socket now, but the session stays.
+                    if (!confirmed && isUnansweredRefusal(refusal))
+                        return null;
                     await sessions.destroy(session.id).catch(() => { });
                     return null;
                 }
@@ -273,6 +290,64 @@ export function createWebApp(deps) {
             return [own, preview].filter((port) => typeof port === 'number');
         },
     });
+    // Plugin readiness and requirements: serve's, or this server's own.
+    const requirements = deps.requirements ??
+        createRequirements({ registry: deps.registry, ctx: deps.ctx, env: deps.env ?? process.env, pool: deps.pool, now: deps.now, log });
+    // Home's widgets: one cache per server (web/widgets.ts).
+    const widgets = createWidgets({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now });
+    /*
+     * The lock screen (web/lock.ts): which sessions are locked, the PIN, the
+     * gate below. A session that locks has its streams closed and its remote
+     * hand let go on the spot, and every half minute the sessions holding a
+     * stream are asked again, so one left idle past the delay is locked and cut
+     * off even if its page never says a word.
+     */
+    const lock = createLock({ pool: deps.pool, sessions, now: deps.now, get timezone() { return deps.timezone; }, widgets, log });
+    const openStreams = new Map();
+    /*
+     * The session a live API token acts through: minted on its first request,
+     * kept in memory only, one per token (and scope), so a stream budget or a
+     * sign-in in progress keyed by session id holds across its requests.
+     */
+    const tokenSessions = new Map();
+    const tokenSession = (holder, scope, now) => {
+        const key = `${holder.id}:${scope}`;
+        const held = tokenSessions.get(key);
+        if (held && held.expiresAt.getTime() > now.getTime()) {
+            held.expiresAt = new Date(now.getTime() + held.ttlMs);
+            return held;
+        }
+        for (const [k, s] of tokenSessions)
+            if (s.expiresAt.getTime() <= now.getTime())
+                tokenSessions.delete(k);
+        const session = sessions.create(scope, now, { via: 'token', client: 'api' }, { persist: false });
+        tokenSessions.set(key, session);
+        return session;
+    };
+    const holdStream = (session, res) => {
+        let entry = openStreams.get(session.id);
+        if (!entry)
+            openStreams.set(session.id, (entry = { session, responses: new Set() }));
+        entry.responses.add(res);
+        return () => {
+            const held = openStreams.get(session.id);
+            if (!held)
+                return;
+            held.responses.delete(res);
+            if (held.responses.size === 0)
+                openStreams.delete(session.id);
+        };
+    };
+    lock.onLocked((session) => {
+        hand.revoke((lease) => lease === session.id);
+        for (const res of openStreams.get(session.id)?.responses ?? [])
+            res.end();
+    });
+    const idleSweep = setInterval(() => {
+        for (const { session } of openStreams.values())
+            void lock.locked(session).catch(() => { });
+    }, 30_000);
+    idleSweep.unref();
     const writeDeps = {
         pool: deps.pool,
         registry: deps.registry,
@@ -297,7 +372,7 @@ export function createWebApp(deps) {
             registry: deps.registry,
             ctx: deps.ctx,
             now: deps.now,
-            timezone: deps.timezone,
+            get timezone() { return deps.timezone; },
             log,
             ...deps.chat,
         })
@@ -389,7 +464,6 @@ export function createWebApp(deps) {
     const identityOf = (req, now, onRefusal) => tailscaleIdentity(req, {
         setting: readTailscaleSetting,
         whois,
-        mayAskDaemon: () => !limiter.blocked(remoteKey(req), now),
         log,
         now: () => now,
         onRefusal,
@@ -406,6 +480,51 @@ export function createWebApp(deps) {
             cookieHeader(csrfCookieName(cookiePort(req)), session.csrf, { httpOnly: false, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
         ];
     };
+    /**
+     * The same pair, expired: what a response carries when the browser presented
+     * a session that is gone, so it stops presenting it. A forgotten tab or a
+     * polling page then sends no credential at all, which counts as nothing.
+     */
+    const expiredCookies = (req) => {
+        const secure = requestScope(req) === 'remote' && !!deps.config.publicOrigin;
+        return [
+            cookieHeader(sessionCookieName(cookiePort(req)), '', { httpOnly: true, maxAgeSeconds: 0, secure }),
+            cookieHeader(csrfCookieName(cookiePort(req)), '', { httpOnly: false, maxAgeSeconds: 0, secure }),
+        ];
+    };
+    /**
+     * What the signed-out page should offer this request: how it arrived,
+     * whether Tailscale can sign it in, and whether a lockout is running.
+     */
+    const signedOutFor = async (req, pathname, search, now, refusal) => {
+        const proxied = proxiedThroughTailscale(req);
+        let publicHost;
+        try {
+            publicHost = deps.config.publicOrigin ? new URL(deps.config.publicOrigin).hostname : undefined;
+        }
+        catch {
+            publicHost = undefined;
+        }
+        let host;
+        try {
+            host = req.headers.host ? new URL(`http://${req.headers.host}`).hostname : undefined;
+        }
+        catch {
+            host = undefined;
+        }
+        const scope = requestScope(req);
+        const arrived = proxied || (publicHost !== undefined && host === publicHost) ? 'tailnet' : scope === 'local' ? 'local' : 'remote';
+        const setting = arrived === 'tailnet' ? await readTailscaleSetting() : null;
+        const lockedForMs = limiter.retryAfterMs(remoteKey(req), now);
+        return {
+            retry: retryHref(pathname, search),
+            arrived,
+            tailscaleSignIn: !!setting?.enabled && !isLoginRefusal(refusal),
+            ...(isLoginRefusal(refusal) ? { tailscaleRefusal: tailscaleRefusalReason(refusal) } : {}),
+            ...(isUnansweredRefusal(refusal) ? { tailscaleUnanswered: true } : {}),
+            ...(lockedForMs > 0 ? { lockedForMs } : {}),
+        };
+    };
     /**
      * The port this request's cookies are named after (http.ts says why they
      * carry one): the port the browser sees, from the request's Host, so the
@@ -434,6 +553,13 @@ export function createWebApp(deps) {
     // have to unpack.
     const server = createServer((req, res) => {
         handle(req, res).catch((err) => {
+            // The lock could not say whether this request may pass: refused, never let in (web/lock.ts).
+            if (err instanceof LockUnavailable) {
+                log('web: the lock screen\'s state could not be read; refusing until it can');
+                if (!res.headersSent)
+                    return sendEmpty(res, 503, { 'Retry-After': '5' });
+                return res.end();
+            }
             // A defect is a 500 with nothing in it. The sentence goes to the log,
             // where only the owner can read it.
             log(`web: ${req.method} ${req.url} failed: ${err instanceof Error ? err.stack : String(err)}`);
@@ -450,7 +576,7 @@ export function createWebApp(deps) {
     // rather than in `startWebServer` so every caller, tests included, has it.
     extension.attach(server);
     extension.attachPath(REMOTE_HAND_SOCKET_PATH, (req, socket, head) => hand.upgrade(req, socket, head));
-    server.once('close', () => { extension.shutdown(); hand.shutdown(); });
+    server.once('close', () => { extension.shutdown(); hand.shutdown(); clearInterval(idleSweep); });
     return server;
     async function handle(req, res) {
         const now = deps.now();
@@ -462,7 +588,9 @@ export function createWebApp(deps) {
             return sendEmpty(res, 405);
         // A port answering 401 is not evidence that this installation is ready.
         // Domain-separated challenge proof never sends the install secret to that port.
-        if (method === 'GET' && url.pathname === '/_buddi/ready' && deps.env?.BUDDI_WEB_REQUIRE_AUTH === '1') {
+        // Answered on every binding: `buddi mcp` asks it before it presents a
+        // ticket, so a port held by some other buddi never sees one.
+        if (method === 'GET' && url.pathname === '/_buddi/ready') {
             const challenge = url.searchParams.get('challenge') ?? '';
             if (!/^[a-f0-9]{64}$/.test(challenge))
                 return sendEmpty(res, 400);
@@ -505,7 +633,9 @@ export function createWebApp(deps) {
                 return sendText(res, 401, 'This sign-in link is no longer valid: a link lasts five minutes.\nRun `buddi` again for a fresh one.\n');
             }
             limiter.reset(key);
-            const session = sessions.create(scope, now);
+            // A ticket takes the installation's token, so it is the one way in that
+            // opens a session unlocked: what `buddi dashboard --unlock` hands out.
+            const session = sessions.create(scope, now, { via: scope === 'local' ? 'local' : 'ticket', client: clientOf(req.headers['x-buddi-client']) });
             const clean = new URL(url.toString());
             clean.searchParams.delete(TICKET_PARAM);
             return sendEmpty(res, 302, {
@@ -513,6 +643,43 @@ export function createWebApp(deps) {
                 'Set-Cookie': sessionCookies(req, session),
             });
         }
+        /*
+         * An owner API token (docs/api.md, "Authentication"): `Authorization:
+         * Bearer buddi_…` on an /api request, from a script or another program.
+         *
+         * It is a credential presented, so a wrong or revoked one counts as a
+         * failed sign-in for this address exactly as a stale cookie does. A live
+         * one is the owner with no cookie and therefore no CSRF to check, and is
+         * answered only on a route the table lets a token call: never one that
+         * decides an approval, changes a grant, installs code, opens access or
+         * touches a secret. The lock screen does not cover it.
+         */
+        const bearer = url.pathname === '/api' || url.pathname.startsWith('/api/') ? bearerOf(req.headers.authorization) : undefined;
+        if (bearer !== undefined) {
+            if (limiter.blocked(key, now)) {
+                return sendEmpty(res, 429, { 'Retry-After': String(Math.max(1, Math.ceil(limiter.retryAfterMs(key, now) / 1000))) });
+            }
+            let holder;
+            try {
+                holder = await verifyApiToken(deps.pool, bearer, now);
+            }
+            catch (err) {
+                log(`web: checking an API token failed: ${err instanceof Error ? err.message : String(err)}`);
+                return sendEmpty(res, 503, { 'Retry-After': '5' });
+            }
+            if (!holder) {
+                limiter.failCredential(key, bearer, now);
+                return sendEmpty(res, 401, { 'WWW-Authenticate': 'Bearer realm="buddi"' });
+            }
+            const path = url.pathname.replace(/\/+$/, '') || '/api';
+            const route = matchApiRoute(method, path);
+            if (!route)
+                return method === 'GET' || method === 'HEAD' ? sendJson(res, 404, { error: 'no such endpoint' }) : sendEmpty(res, 405);
+            if (route.token) {
+                return sendJson(res, 403, { error: `An API token cannot call ${route.method} ${route.path}. ${TOKEN_REFUSALS[route.token]} Do it on the dashboard.` });
+            }
+            return api(req, res, url, method, now, tokenSession(holder, scope, now));
+        }
         const cookies = parseCookies(req.headers.cookie);
         const presentedSession = cookies[sessionCookieName(cookiePort(req))];
         let session = await sessions.resolve(presentedSession, scope, now);
@@ -523,18 +690,29 @@ export function createWebApp(deps) {
          */
         let refusal;
         const noteRefusal = (reason) => { refusal = reason; };
+        /*
+         * Set when the browser presented a session that is gone: the refusal then
+         * expires its cookies, so it stops presenting them (and stops counting).
+         */
+        let forgetCookies = false;
         /*
          * The answer to a refused request: the signed-out page for a person
-         * opening a page, the empty 401 for everything else (docs/web.md).
+         * opening a page, the empty status for everything else (docs/web.md).
+         * 401 is "signed out", 429 "too many tries from here", 503 "Tailscale
+         * could not be asked; the session is still good, try again".
          */
-        const refuse = () => {
+        const refuse = async (status = 401) => {
+            const headers = forgetCookies ? { 'Set-Cookie': expiredCookies(req) } : {};
+            if (status === 429)
+                headers['Retry-After'] = String(Math.max(1, Math.ceil(limiter.retryAfterMs(key, now) / 1000)));
+            if (status === 503)
+                headers['Retry-After'] = '5';
             if (!wantsSignedOutPage(req, method, url.pathname))
-                return sendEmpty(res, 401);
-            return sendSignedOut(res, {
-                retry: retryHref(url.pathname, url.search),
-                ...(isLoginRefusal(refusal) ? { tailscaleRefusal: tailscaleRefusalReason(refusal) } : {}),
-            });
+                return sendEmpty(res, status, headers);
+            return sendSignedOut(res, await signedOutFor(req, url.pathname, url.search, now, refusal), headers, status);
         };
+        /* A Tailscale session this request ended: not a guess, so never a failed sign-in. */
+        let revoked = false;
         /*
          * A Tailscale session is re-confirmed on every single request.
          *
@@ -550,14 +728,23 @@ export function createWebApp(deps) {
         if (session?.via === 'tailscale') {
             const confirmed = await identityOf(req, now, noteRefusal);
             if (!confirmed || !sameLogin(confirmed.login, session.tailscaleLogin)) {
-                const revoked = session.id;
+                /*
+                 * The daemon could not be asked (busy, starting, timed out). That is
+                 * not an answer about anyone, so the session is not ended for it —
+                 * a restart's first burst of requests used to end every tailnet
+                 * session this way — and nothing is counted. This request waits.
+                 */
+                if (!confirmed && isUnansweredRefusal(refusal))
+                    return refuse(503);
+                const ended = session.id;
                 // A hand this session was holding does not outlive the session.
-                hand.revoke((lease) => lease === revoked);
-                await sessions.destroy(revoked);
-                if (limiter.blocked(key, now))
-                    return sendEmpty(res, 429);
-                limiter.failCredential(key, presentedSession ?? '', now);
-                return refuse();
+                hand.revoke((lease) => lease === ended);
+                await sessions.destroy(ended);
+                session = undefined;
+                revoked = true;
+                forgetCookies = true;
+                // The identity on this very request may still earn a new session below.
+                refusal = undefined;
             }
         }
         /*
@@ -571,7 +758,14 @@ export function createWebApp(deps) {
         if (!session && openAccess && scope === 'local') {
             // Not stored: the next request mints another for free, so there is
             // nothing to keep across a restart and no row per cookie-less poll.
-            session = sessions.create(scope, now, undefined, { persist: false });
+            // While a PIN is set a browser's new session starts locked: clearing the
+            // cookie or opening a private window is not a way past the lock screen.
+            //
+            // Always a browser's session: `x-buddi-client` is a header anybody can
+            // send, so here it earns nothing. Only a ticket from the installation
+            // token (the exchange above) names a client the lock does not cover.
+            const locked = await lock.startLocked('browser');
+            session = sessions.create(scope, now, { via: 'local', client: 'browser' }, { persist: false, ...(locked ? { locked } : {}) });
             res.setHeader('Set-Cookie', sessionCookies(req, session));
         }
         /*
@@ -589,12 +783,13 @@ export function createWebApp(deps) {
             const identity = await identityOf(req, now, noteRefusal);
             if (identity) {
                 limiter.reset(key);
+                const locked = await lock.startLocked('browser');
                 session = sessions.create('remote', now, {
                     via: 'tailscale',
                     tailscaleLogin: identity.login,
                     tailscaleAddress: identity.address,
                     tailscaleName: identity.name,
-                });
+                }, locked ? { locked } : {});
                 res.setHeader('Set-Cookie', sessionCookies(req, session));
             }
         }
@@ -610,8 +805,11 @@ export function createWebApp(deps) {
             // able to lock the owner out of every way in.
             if (!presentedSession)
                 return refuse();
+            forgetCookies = true;
+            if (revoked)
+                return refuse();
             if (limiter.blocked(key, now))
-                return sendEmpty(res, 429);
+                return refuse(429);
             limiter.failCredential(key, presentedSession, now);
             return refuse();
         }
@@ -641,6 +839,14 @@ export function createWebApp(deps) {
                 return sendEmpty(res, 403);
         }
         if (url.pathname === '/api' || url.pathname.startsWith('/api/')) {
+            /*
+             * The lock screen's gate, after the session and its CSRF: a locked
+             * session gets 423 for everything but what the lock screen itself
+             * draws and the two ways off it (web/lock.ts).
+             */
+            const path = url.pathname.replace(/\/+$/, '') || '/api';
+            if (!allowedWhileLocked(method, path) && (await lock.locked(session)))
+                return sendJson(res, 423, LOCKED_BODY);
             return api(req, res, url, method, now, session);
         }
         if (mutating)
@@ -690,6 +896,7 @@ export function createWebApp(deps) {
             log,
             pool: deps.pool,
             registry: deps.registry,
+            requirements,
             ...(deps.plugins ? { engine: deps.plugins } : {}),
         });
         /** Is a mailbox connected? The email plugin's own read, the one Home's offer asks. */
@@ -764,6 +971,24 @@ export function createWebApp(deps) {
                     now: deps.now,
                     agents: () => deps.catalog.list(),
                     plugins: () => deps.registry.manifests().map((m) => m.name),
+                    needsSetup: async () => {
+                        const out = [];
+                        for (const manifest of deps.registry.manifests()) {
+                            if (manifest.setup === undefined)
+                                continue;
+                            const ready = await requirements.readiness.of(manifest.name);
+                            if (!ready || ready.ready)
+                                continue;
+                            const page = ready.page === undefined ? undefined : deps.registry.pages().find((p) => p.plugin === manifest.name && p.id === ready.page);
+                            const route = page === undefined
+                                ? undefined
+                                : page.place === 'settings'
+                                    ? `#/settings/p.${manifest.name}${page.id === manifest.name ? '' : `.${page.id}`}`
+                                    : `#/p/${encodeURIComponent(manifest.name)}/${encodeURIComponent(page.id)}`;
+                            out.push({ plugin: manifest.name, ...(ready.note ? { note: ready.note } : {}), ...(route ? { route } : {}) });
+                        }
+                        return out;
+                    },
                     mailboxSet: async () => {
                         const answer = await runPageQuery(pagesDeps(), 'email', 'triage_offer', new URLSearchParams()).catch(() => null);
                         return answer?.status === 200 && answer.body?.data?.wanted === true;
@@ -772,6 +997,74 @@ export function createWebApp(deps) {
             }, { method, path, body, preview: url.searchParams.get('preview') });
             return sendJson(res, answer.status, answer.body);
         }
+        // The lock screen: its state and data, Lock now, Unlock, the PIN, its settings and picture (web/lock.ts).
+        if (path === '/api/lock' || path.startsWith('/api/lock/')) {
+            let body = {};
+            const upload = method === 'POST' && path === '/api/lock/background';
+            if ((method === 'POST' || method === 'PUT') && !upload) {
+                try {
+                    body = await readJsonBody(req);
+                }
+                catch {
+                    return sendJson(res, 400, { error: 'request body must be JSON' });
+                }
+            }
+            const answer = await lock.route({
+                method,
+                path,
+                body,
+                session,
+                query: url.searchParams,
+                ...(upload ? {
+                    upload: async () => {
+                        const file = await readUpload(req, MAX_LOCK_IMAGE_BYTES);
+                        if (!file.ok)
+                            return { ok: false, status: file.status, error: file.status === 413 ? 'A picture can be at most 10 MB.' : file.error };
+                        try {
+                            return { ok: true, image: normaliseLockImage(file.file.bytes, file.file.mime) };
+                        }
+                        catch (err) {
+                            if (err instanceof LockImageRefusal)
+                                return { ok: false, status: err.status, error: err.message };
+                            throw err;
+                        }
+                    },
+                } : {}),
+            });
+            if (answer === null)
+                return sendJson(res, 404, { error: 'no such endpoint' });
+            if ('image' in answer) {
+                const etag = `"${answer.image.sha256}"`;
+                res.setHeader('ETag', etag);
+                res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+                if (req.headers['if-none-match'] === etag)
+                    return sendEmpty(res, 304);
+                res.setHeader('Content-Type', 'image/jpeg');
+                res.setHeader('Content-Length', String(answer.image.jpeg.length));
+                res.statusCode = 200;
+                res.end(method === 'HEAD' ? undefined : answer.image.jpeg);
+                return;
+            }
+            if (answer.status === 204)
+                return sendEmpty(res, 204);
+            return sendJson(res, answer.status, answer.body);
+        }
+        // Home's widgets: the gallery, the owner's layout, each placed one's body (web/widgets.ts).
+        if (path === '/api/widgets' || path.startsWith('/api/widgets/')) {
+            let body = {};
+            if (method === 'PUT' || (method === 'POST' && path === '/api/widgets/preview')) {
+                try {
+                    body = await readJsonBody(req);
+                }
+                catch {
+                    return sendJson(res, 400, { error: 'request body must be JSON' });
+                }
+            }
+            const answer = await widgetsRoute(widgets, { method, path, body, query: url.searchParams });
+            return sendJson(res, answer.status, answer.body);
+        }
         // Settings → Connections: every method, one module (web/connections.ts).
         if (path === '/api/connections' || path.startsWith('/api/connections/')) {
             let body = {};
@@ -952,10 +1245,14 @@ export function createWebApp(deps) {
                     res.end(method === 'HEAD' ? undefined : bytes);
                     return;
                 }
-                case '/api/session':
+                case '/api/session': {
+                    // How the owner reads times and dates: every page formats with it.
+                    const formats = await getOwnerProfile(deps.pool).catch(() => null);
                     return sendJson(res, 200, {
                         csrf: session.csrf,
                         timezone: deps.timezone,
+                        timeFormat: formats?.timeFormat ?? null,
+                        dateFormat: formats?.dateFormat ?? null,
                         host: deps.config.host,
                         port: deps.config.port,
                         // Where buddi runs: a page opened from another machine is still
@@ -979,6 +1276,7 @@ export function createWebApp(deps) {
                         // the old one" without a second route.
                         version: await currentVersion(deps.env ?? process.env),
                     });
+                }
                 /*
                  * The Tailscale panel's whole payload: what is stored, whether a
                  * daemon is here to ask, who this machine is signed in as (so the
@@ -1010,7 +1308,9 @@ export function createWebApp(deps) {
                             timezone: deps.timezone,
                             now,
                         })),
-                        running: chat?.runningCount ?? 0,
+                        // Every surface's runs (Telegram, the queue, the terminal), not only
+                        // this dashboard's; a chat send still being set up counts too.
+                        running: Math.max(runningAgentRuns(), chat?.runningCount ?? 0),
                     });
                 case '/api/events':
                     return sendJson(res, 200, await readEvents(deps.pool, {
@@ -1113,6 +1413,8 @@ export function createWebApp(deps) {
                         default: readDefaultAgent(deps.catalog),
                     });
                 case '/api/groups':
+                    // The list is read every few seconds, so it is also where a delete whose minute has passed is made final.
+                    await purgeGroups(deps.pool, deps.now(), log);
                     return sendJson(res, 200, { groups: (await listGroups(deps.pool)).map(groupView) });
                 /*
                  * The supervisor, when there is one. A developer checkout has no
@@ -1237,7 +1539,7 @@ export function createWebApp(deps) {
                     return sendJson(res, 200, await telegramDevices(telegramDeps()));
                 case '/api/owner': {
                     const profile = await getOwnerProfile(deps.pool);
-                    return sendJson(res, 200, { ...profile, detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
+                    return sendJson(res, 200, { ...profile, places: await placesList(deps.pool), detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
                 }
                 case '/api/memory': {
                     try {
@@ -1249,6 +1551,9 @@ export function createWebApp(deps) {
                         return sendJson(res, 503, { error: `Memory is unavailable: ${err instanceof Error ? err.message : String(err)}` });
                     }
                 }
+                // Settings → API tokens. A token is refused these by the table: it cannot list or make its kind.
+                case '/api/api-tokens':
+                    return reply(res, await apiTokensRoute(deps.pool, { method, path, body: null, now }));
                 case '/api/provider-accounts':
                     if (!deps.providerAccounts)
                         return sendJson(res, 503, { error: 'Provider accounts are unavailable in this process.' });
@@ -1420,7 +1725,13 @@ export function createWebApp(deps) {
                     return sendJson(res, 404, { error: 'no such group' });
                 const latest = await latestGroupConversation(deps.pool, group.id);
                 const open = latest ? await openGroupRequest(deps.pool, latest) : null;
-                return sendJson(res, 200, { ...groupView(group), latestConversationId: latest, openRequest: open ? { id: open.id, state: open.state, awaitingAgentId: open.awaitingAgentId, budgetReserved: open.budgetReserved, budgetTotal: open.budgetTotal } : null });
+                return sendJson(res, 200, {
+                    ...groupView(group),
+                    latestConversationId: latest,
+                    openRequest: open ? { id: open.id, state: open.state, awaitingAgentId: open.awaitingAgentId, budgetReserved: open.budgetReserved, budgetTotal: open.budgetTotal } : null,
+                    // What Clear history and Delete would take, for the sentence that asks first.
+                    history: await groupHistorySize(deps.pool, group.id),
+                });
             }
             const chatConversations = /^\/api\/chat\/([^/]+)\/conversations$/.exec(path);
             if (chatConversations) {
@@ -1449,6 +1760,7 @@ export function createWebApp(deps) {
                 const release = streams.take(session.id);
                 if (release === null)
                     return sendEmpty(res, 429);
+                const let_go = holdStream(session, res);
                 try {
                     await streamAttention(req, res, {
                         pool: deps.pool,
@@ -1457,6 +1769,7 @@ export function createWebApp(deps) {
                     });
                 }
                 finally {
+                    let_go();
                     release();
                 }
                 return;
@@ -1472,6 +1785,7 @@ export function createWebApp(deps) {
                 const release = streams.take(session.id);
                 if (release === null)
                     return sendEmpty(res, 429);
+                const let_go = holdStream(session, res);
                 try {
                     await streamConversation(req, res, {
                         pool: deps.pool,
@@ -1482,6 +1796,7 @@ export function createWebApp(deps) {
                     });
                 }
                 finally {
+                    let_go();
                     release();
                 }
                 return;
@@ -1545,6 +1860,12 @@ export function createWebApp(deps) {
                 const forgotten = await extension.unpair();
                 return sendJson(res, forgotten.status, forgotten.body);
             }
+            // Revoke an API token: the next request carrying it is a 401.
+            const tokenGone = /^\/api\/api-tokens\/([0-9a-f-]{36})$/i.exec(path);
+            if (tokenGone) {
+                const revoked = await apiTokensRoute(deps.pool, { method, path, body: null, now });
+                return revoked.status === 204 ? sendEmpty(res, 204) : sendJson(res, revoked.status, revoked.body);
+            }
             // A phone the owner no longer wants talking to their agents. Same as
             // `buddi telegram unpair <id>`, and as immediate.
             const phoneGone = /^\/api\/telegram\/devices\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(path);
@@ -1560,14 +1881,21 @@ export function createWebApp(deps) {
                 }
             }
             /*
-             * A group the owner is done with leaves the rail and takes no new
-             * requests — and keeps everything that was said in it. Archived, never
-             * deleted: the transcript is the record of work that was done, and no
-             * amount of tidying the roster is worth destroying it.
+             * Delete a group: it leaves every list now, with whatever it was doing
+             * stopped, and is removed for good — its history and what the room
+             * remembered, never its agents — once GROUP_UNDO_MS has passed without
+             * a restore. The answer says until when Undo works.
              */
             const groupGone = /^\/api\/groups\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(path);
             if (groupGone) {
-                return (await archiveGroup(deps.pool, groupGone[1], deps.now())) ? sendEmpty(res, 204) : sendEmpty(res, 404);
+                const at = deps.now();
+                if (!(await getGroup(deps.pool, groupGone[1])))
+                    return sendJson(res, 404, { error: 'no such group' });
+                await stopGroupWork(deps.pool, chat, groupGone[1], at, deps.ctx.ownerId);
+                if (!(await deleteGroup(deps.pool, groupGone[1], at)))
+                    return sendJson(res, 404, { error: 'no such group' });
+                await purgeGroups(deps.pool, at, log);
+                return sendJson(res, 200, { undoUntil: new Date(at.getTime() + GROUP_UNDO_MS).toISOString() });
             }
             /*
              * The owner read the note a rollover carried into this conversation and
@@ -1900,6 +2228,8 @@ export function createWebApp(deps) {
         }
         if (path === '/api/presence')
             return reply(res, await presenceRoute(deps.pool, body, deps.now()));
+        if (path === '/api/api-tokens')
+            return reply(res, await apiTokensRoute(deps.pool, { method, path, body, now }));
         if (path === '/api/notifications/test')
             return reply(res, await testChannelRoute(body, deps.now()));
         if (path === '/api/notifications/agent-mute')
@@ -2301,6 +2631,21 @@ export function createWebApp(deps) {
         if (groupArchive) {
             return (await archiveGroup(deps.pool, groupArchive[1], deps.now())) ? sendEmpty(res, 204) : sendEmpty(res, 404);
         }
+        // Undo a delete, while the minute lasts. Too late: 410, and the page says so.
+        const groupRestore = /^\/api\/groups\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/restore$/i.exec(path);
+        if (groupRestore) {
+            const back = await restoreGroup(deps.pool, groupRestore[1], deps.now());
+            return back ? sendJson(res, 200, groupView(back)) : sendJson(res, 410, { error: 'Too late to undo: that group is gone for good.' });
+        }
+        // Clear the history, keep the group: its conversations go, its members and memory stay.
+        const groupClear = /^\/api\/groups\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/clear$/i.exec(path);
+        if (groupClear) {
+            const group = await getGroup(deps.pool, groupClear[1]);
+            if (!group)
+                return sendJson(res, 404, { error: 'no such group' });
+            await stopGroupWork(deps.pool, chat, group.id, deps.now(), deps.ctx.ownerId);
+            return sendJson(res, 200, { conversations: await clearGroupHistory(deps.pool, group.id) });
+        }
         /*
          * First run, from the dashboard.
          *
@@ -2532,14 +2877,37 @@ export function createWebApp(deps) {
                     return sendJson(res, 400, { error: `\`${key}\` must be a string or null` });
                 patch[key] = given;
             }
+            // How times and dates read: a known word, or null for Auto.
+            if (body.timeFormat !== undefined) {
+                if (body.timeFormat !== null && !OWNER_TIME_FORMATS.includes(body.timeFormat))
+                    return sendJson(res, 400, { error: '`timeFormat` is 12h, 24h or null (Auto).' });
+                patch.timeFormat = body.timeFormat;
+            }
+            if (body.dateFormat !== undefined) {
+                if (body.dateFormat !== null && !OWNER_DATE_FORMATS.includes(body.dateFormat))
+                    return sendJson(res, 400, { error: '`dateFormat` is short, long, iso or null (Auto).' });
+                patch.dateFormat = body.dateFormat;
+            }
             if (patch.timezone && !isKnownTimezone(patch.timezone))
                 return sendJson(res, 400, { error: `"${patch.timezone}" is not a timezone this host knows.` });
             if (patch.preferredName && patch.preferredName.length > 80)
                 return sendJson(res, 400, { error: 'The name is too long (80 characters at most).' });
             if (patch.about && patch.about.length > 1000)
                 return sendJson(res, 400, { error: 'Keep the line about you under 1,000 characters.' });
-            const profile = await setOwnerProfile(deps.pool, patch);
-            return sendJson(res, 200, { ...profile, detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
+            // The zone applies at once; schedules kept in the old one move with it.
+            const { profile, zoneChange } = await saveOwnerProfile(deps.pool, patch, deps.env ?? process.env);
+            if (zoneChange)
+                log(`owner: timezone ${zoneChange.from} → ${zoneChange.to}${zoneChange.missions.length > 0 ? `; moved ${zoneChange.missions.join(', ')}` : ''}`);
+            return sendJson(res, 200, { ...profile, places: await placesList(deps.pool), detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
+        }
+        /* The owner's places beside the timezone: find one, save one, remove one (web/places.ts). */
+        if (path.startsWith('/api/owner/places')) {
+            const answered = await placesRoute({ pool: deps.pool, log, ...(deps.placesHttp ? { http: deps.placesHttp } : {}) }, path, body);
+            if (answered) {
+                // Plugins that read the places answer their setup again now.
+                requirements.readiness.forget();
+                return sendJson(res, answered.status, answered.body);
+            }
         }
         /* Memory, the owner's side: correct a preference, retire one, edit or forget a note. */
         if (path === '/api/memory/preferences') {
@@ -2863,7 +3231,8 @@ export function createWebApp(deps) {
  */
 export async function startWebServer(deps) {
     const token = deps.token ?? (await ensureWebToken()).token;
-    const server = createWebApp({ ...deps, token });
+    // The zone stays a getter through the spread: Settings → Profile can change it.
+    const server = createWebApp({ ...deps, token, get timezone() { return deps.timezone; } });
     await new Promise((resolve, reject) => {
         server.once('error', reject);
         server.listen(deps.config.port, deps.config.host, () => {